For each slave, record a value of -autoPath instead of discarding it and relying on the value of ::auto_path in the slave. Clarify the distinction between the two, both in library/safe.tcl and in doc/safe.n. Amend four tests to expect the correct value. Add code to tests to examine both values where appropriate. Add three more tests for cases in which the distinction is important. Renumber and re-title tests in safe-stock86.test to correspond to those in safe.test, and add code to safe-stock86.test to set the Sync Mode.

4 files changed, 331 insertions, 52 deletions

diff --git a/doc/safe.n b/doc/safe.n
index 5777f74..8aa8686 100644
--- a/doc/safe.n
+++ b/doc/safe.n
@@ -401,14 +401,18 @@ to call \fB::safe::interpCreate\fR or \fB::safe::interpInit\fR without the
 option set to the
 empty list), which will give the safe interpreter the same access as the
 master interpreter to packages, modules, and autoloader files.  With
-"Sync Mode" off, the ::auto_path will be set to a tokenized form of the master's
-::auto_path.
+"Sync Mode" off, the Safe Base will set the value of \fB\-autoPath\fR to the
+master's ::auto_path, and will set the slave's ::auto_path to a tokenized form
+of the master's ::auto_path.
 .PP
 With "Sync Mode" off, if a value is specified for \fB\-autoPath\fR, even the empty
 list, in a call to \fB::safe::interpCreate\fR, \fB::safe::interpInit\fR, or
 \fB::safe::interpConfigure\fR, it will be tokenized and used as the safe
 interpreter's ::auto_path.  Any directories that do not also belong to the
-access path cannot be tokenized and will be silently ignored.
+access path cannot be tokenized and will be silently ignored.  However, the
+value of \fB\-autoPath\fR will remain as specified, and will be used to
+re-tokenize the slave's ::auto_path if \fB::safe::interpConfigure\fR is called
+to change the value of \fB\-accessPath\fR.
 .PP
 With "Sync Mode" off, if the access path is reset to the values in the
 master interpreter by calling \fB::safe::interpConfigure\fR with arguments
diff --git a/library/safe.tcl b/library/safe.tcl
index 88f59fc..5a5ddb5 100644
--- a/library/safe.tcl
+++ b/library/safe.tcl
@@ -147,8 +147,7 @@ proc ::safe::interpConfigure {args} {
 	        [list -deleteHook $state(cleanupHook)] \
 	    ]
 	    if {!$AutoPathSync} {
-	        set SLAP [DetokPath $slave [$slave eval set ::auto_path]]
-	        lappend TMP [list -autoPath $SLAP]
+	        lappend TMP [list -autoPath $state(auto_path)]
 	    }
 	    return [join $TMP]
 	}
@@ -179,8 +178,7 @@ proc ::safe::interpConfigure {args} {
 		    if {$AutoPathSync} {
 		        return -code error "unknown flag $name (bug)"
 		    } else {
-		        set SLAP [DetokPath $slave [$slave eval set ::auto_path]]
-		        return [list -autoPath $SLAP]
+		        return [list -autoPath $state(auto_path)]
 		    }
 		}
 		-statics    {
@@ -227,8 +225,7 @@ proc ::safe::interpConfigure {args} {
 		set doreset 1
 	    }
 	    if {(!$AutoPathSync) && (![::tcl::OptProcArgGiven -autoPath])} {
-		set SLAP [DetokPath $slave [$slave eval set ::auto_path]]
-		set autoPath $SLAP
+		set autoPath $state(auto_path)
 	    } elseif {$AutoPathSync} {
 		set autoPath {}
 	    } else {
@@ -487,6 +484,10 @@ proc ::safe::InterpSetConfig {slave access_path staticsok nestedok deletehook au
     set state(nestedok)          $nestedok
     set state(cleanupHook)       $deletehook
 
+    if {!$AutoPathSync} {
+        set state(auto_path)     $raw_auto_path
+    }
+
     SyncAccessPath $slave
     return
 }
@@ -1441,13 +1442,20 @@ namespace eval ::safe {
     # access_path,slave : Ditto, as the path tokens as seen by the slave.
     # access_path,map   : dict ( token -> path )
     # access_path,remap : dict ( path -> token )
+    # auto_path         : List of paths requested by the caller as slave's ::auto_path.
     # tm_path_slave     : List of TM root directories, as tokens seen by the slave.
     # staticsok         : Value of option -statics
     # nestedok          : Value of option -nested
     # cleanupHook       : Value of option -deleteHook
     #
-    # Because the slave can change its value of ::auto_path, the value of
-    # option -autoPath is not stored in the array but must be obtained from
+    # In principle, the slave can change its value of ::auto_path -
+    # - a package might add a path (that is already in the access path) for
+    #   access to tclIndex files;
+    # - the script might remove some elements of the auto_path.
+    # However, this is really the business of the master, and the auto_path will
+    # be reset whenever the token mapping changes (i.e. when option -accessPath is
+    # used to change the access path).
+    # -autoPath is now stored in the array and is no longer obtained from
     # the slave.
 }
 
diff --git a/tests/safe-stock86.test b/tests/safe-stock86.test
index a3f6bb5..e13d37e 100644
--- a/tests/safe-stock86.test
+++ b/tests/safe-stock86.test
@@ -52,8 +52,17 @@ catch {safe::interpConfigure}
 testConstraint TcltestPackage [expr {![catch {package require Tcltest}]}]
 testConstraint AutoSyncDefined 1
 
-# high level general test
-test safe-stock86-7.1 {tests that everything works at high level, uses http 2} -body {
+###  7. Test the use of ::auto_path for loading commands (via tclIndex files)
+###     and non-module packages (via pkgIndex.tcl files).
+###     Corresponding tests with Sync Mode off are 17.*
+
+test safe-stock86-7.1 {positive non-module package require, uses http 2, Sync Mode on} -setup {
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 1
+    }
+} -body {
     set i [safe::interpCreate]
     # no error shall occur:
     # (because the default access_path shall include 1st level sub dirs so
@@ -63,8 +72,19 @@ test safe-stock86-7.1 {tests that everything works at high level, uses http 2} -
     interp eval $i {http::config}
     safe::interpDelete $i
     set v
+} -cleanup {
+    catch {safe::interpDelete $i}
+    if {$SyncExists} {
+        safe::setAutoPathSync $SyncVal_TMP
+    }
 } -match glob -result 2.*
-test safe-stock86-7.2 {tests specific path and interpFind/AddToAccessPath, uses http1.0} -body {
+test safe-stock86-7.2 {negative non-module package require with specific path and interpAddToAccessPath, uses http1.0, Sync Mode on} -setup {
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 1
+    }
+} -body {
     set i [safe::interpCreate -nostat -nested 1 -accessPath [list [info library]]]
     # should not add anything (p0)
     set token1 [safe::interpAddToAccessPath $i [info library]]
@@ -77,9 +97,20 @@ test safe-stock86-7.2 {tests specific path and interpFind/AddToAccessPath, uses
     list $token1 $token2 -- \
 	    [catch {interp eval $i {package require http 1}} msg] $msg -- \
 	    $mappA -- [safe::interpDelete $i]
+} -cleanup {
+    catch {safe::interpDelete $i}
+    if {$SyncExists} {
+        safe::setAutoPathSync $SyncVal_TMP
+    }
 } -match glob -result {{$p(:0:)} {$p(:*:)} -- 1 {can't find package http 1} --\
         {TCLLIB */dummy/unixlike/test/path} -- {}}
-test safe-stock86-7.4 {tests specific path and positive search, uses http1.0} -body {
+test safe-stock86-7.4 {positive non-module package require with specific path and interpAddToAccessPath, uses http1.0, Sync Mode on} -setup {
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 1
+    }
+} -body {
     set i [safe::interpCreate -nostat -nested 1 -accessPath [list [info library]]]
     # should not add anything (p0)
     set token1 [safe::interpAddToAccessPath $i [info library]]
@@ -91,8 +122,13 @@ test safe-stock86-7.4 {tests specific path and positive search, uses http1.0} -b
     list $token1 $token2 -- \
 	    [catch {interp eval $i {package require http 1}} msg] $msg -- \
 	    $mappA -- [safe::interpDelete $i]
+} -cleanup {
+    catch {safe::interpDelete $i}
+    if {$SyncExists} {
+        safe::setAutoPathSync $SyncVal_TMP
+    }
 } -match glob -result {{$p(:0:)} {$p(:*:)} -- 0 1.0 -- {TCLLIB *TCLLIB/http1.0} -- {}}
-test safe-stock86-7.5 {tests positive and negative module loading with conventional AutoPathSync} -setup {
+test safe-stock86-7.5 {positive and negative module package require, including ancestor directory issue, uses platform::shell, Sync Mode on} -setup {
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
     if {$SyncExists} {
         set SyncVal_TMP [safe::setAutoPathSync]
@@ -120,27 +156,35 @@ test safe-stock86-7.5 {tests positive and negative module loading with conventio
 
 # The following test checks whether the definition of tcl_endOfWord can be
 # obtained from auto_loading.  It was previously test "safe-5.1".
-test safe-stock86-9.8 {test auto-loading in safe interpreters, was test 5.1} -setup {
+test safe-stock86-9.8 {autoloading commands indexed in tclIndex files, was test 5.1, Sync Mode on} -setup {
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 1
+    }
     catch {safe::interpDelete a}
     safe::interpCreate a
 } -body {
     interp eval a {tcl_endOfWord "" 0}
 } -cleanup {
     safe::interpDelete a
+    if {$SyncExists} {
+        safe::setAutoPathSync $SyncVal_TMP
+    }
 } -result -1
 
-### 18. Tests for AutoSyncDefined without conventional AutoPathSync, i.e. with AutoPathSync off.
-test safe-stock86-18.1 {cf. safe-stock86-7.1 - tests that everything works at high level without conventional AutoPathSync} -constraints AutoSyncDefined -setup {
-    # All ::safe commands are loaded at start of file.
-    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+### 17. Test the use of ::auto_path for loading commands (via tclIndex files)
+###     and non-module packages (via pkgIndex.tcl files).
+###     Corresponding tests with Sync Mode on are 7.*
 
+test safe-stock86-17.1 {cf. safe-7.1 - positive non-module package require, Sync Mode off} -constraints AutoSyncDefined -setup {
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
     if {$SyncExists} {
         set SyncVal_TMP [safe::setAutoPathSync]
         safe::setAutoPathSync 0
     } else {
         error {This test is meaningful only if the command ::safe::setAutoPathSync is defined}
     }
-
     # Without AutoPathSync, we need a more complete auto_path,
     # because the slave will use the same value.
     set lib1        [info library]
@@ -164,10 +208,8 @@ test safe-stock86-18.1 {cf. safe-stock86-7.1 - tests that everything works at hi
         safe::setAutoPathSync $SyncVal_TMP
     }
 } -result 1.0
-test safe-stock86-18.2 {cf. safe-stock86-7.2 - tests specific path and interpFind/AddToAccessPath without conventional AutoPathSync} -constraints AutoSyncDefined -setup {
-    # All ::safe commands are loaded at start of file.
+test safe-stock86-17.2 {cf. safe-7.2 - negative non-module package require with specific path and interpAddToAccessPath, Sync Mode off} -constraints AutoSyncDefined -setup {
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
-
     if {$SyncExists} {
         set SyncVal_TMP [safe::setAutoPathSync]
         safe::setAutoPathSync 0
@@ -189,14 +231,13 @@ test safe-stock86-18.2 {cf. safe-stock86-7.2 - tests specific path and interpFin
 	    [safe::interpConfigure $i]\
 	    [safe::interpDelete $i]
 } -cleanup {
+    catch {safe::interpDelete $i}
     if {$SyncExists} {
         safe::setAutoPathSync $SyncVal_TMP
     }
-} -match glob -result "{} {\$p(:0:)} {\$p(:*:)} 1 {can't find package http 1} {-accessPath {[list $tcl_library */dummy/unixlike/test/path]} -statics 0 -nested 1 -deleteHook {} -autoPath [list $tcl_library]} {}"
-test safe-stock86-18.4 {cf. safe-stock86-7.4 - tests specific path and positive search and auto_path without conventional AutoPathSync} -constraints AutoSyncDefined -setup {
-    # All ::safe commands are loaded at start of file.
+} -match glob -result "{} {\$p(:0:)} {\$p(:*:)} 1 {can't find package http 1} {-accessPath {[list $tcl_library */dummy/unixlike/test/path]} -statics 0 -nested 1 -deleteHook {} -autoPath {}} {}"
+test safe-stock86-17.4 {cf. safe-7.4 - positive non-module package require with specific path and interpAddToAccessPath, Sync Mode off} -constraints AutoSyncDefined -setup {
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
-
     if {$SyncExists} {
         set SyncVal_TMP [safe::setAutoPathSync]
         safe::setAutoPathSync 0
@@ -220,17 +261,18 @@ test safe-stock86-18.4 {cf. safe-stock86-7.4 - tests specific path and positive
     # should not have been changed by Safe Base:
     set auto2 [interp eval $i {set ::auto_path}]
 
-    # This time, unlike test safe-stock86-18.2 and the try above, http 1.0 should be found:
+    # This time, unlike test safe-stock86-17.2 and the try above, http 1.0 should be found:
     list $auto1 $auto2 $token1 $token2 \
 	    [catch {interp eval $i {package require http 1}} msg] $msg \
 	    [safe::interpConfigure $i]\
 	    [safe::interpDelete $i]
 } -cleanup {
+    catch {safe::interpDelete $i}
     if {$SyncExists} {
 	safe::setAutoPathSync $SyncVal_TMP
     }
-} -match glob -result "{} {{\$p(:0:)}} {\$p(:0:)} {\$p(:*:)} 0 1.0 {-accessPath {[list $tcl_library *$tcl_library/http1.0]} -statics 0 -nested 1 -deleteHook {} -autoPath [list $tcl_library]} {}"
-test safe-stock86-18.5 {cf. safe-stock86-7.5 - tests positive and negative module loading without conventional AutoPathSync} -setup {
+} -match glob -result "{} {{\$p(:0:)}} {\$p(:0:)} {\$p(:*:)} 0 1.0 {-accessPath {[list $tcl_library *$tcl_library/http1.0]} -statics 0 -nested 1 -deleteHook {} -autoPath {}} {}"
+test safe-stock86-17.5 {cf. safe-7.5 - positive and negative module package require, including ancestor directory issue, Sync Mode off} -setup {
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
     if {$SyncExists} {
         set SyncVal_TMP [safe::setAutoPathSync]
diff --git a/tests/safe.test b/tests/safe.test
index f24c4d3..19daabc 100644
--- a/tests/safe.test
+++ b/tests/safe.test
@@ -1917,14 +1917,15 @@ test safe-14.2.1 {Check that first element of slave auto_path (and access path)
     set token [lindex [$i eval set ::auto_path] 0]
     set auto0 [dict get [set ::safe::S${i}(access_path,map)] $token]
     set accessList [lindex [safe::interpConfigure $i -accessPath] 1]
-    return [list [lindex $accessList 0] $auto0]
+    set autoList   [lindex [safe::interpConfigure $i -autoPath] 1]
+    return [list [lindex $accessList 0] [lindex $autoList 0] $auto0]
 } -cleanup {
     set ::auto_path $::auto_TMP
     safe::interpDelete $i
     if {$SyncExists} {
         safe::setAutoPathSync $SyncVal_TMP
     }
-} -result [list [info library] [info library]]
+} -result [list [info library] [info library] [info library]]
 test safe-14.3 {Check that first element of slave auto_path (and access path) is Tcl Library, even if not true for master, Sync Mode on} -setup {
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
     if {$SyncExists} {
@@ -1974,15 +1975,16 @@ test safe-14.3.1 {Check that first element of slave auto_path (and access path)
     set token [lindex [$i eval set ::auto_path] 0]
     set auto0 [dict get [set ::safe::S${i}(access_path,map)] $token]
     set accessList [lindex [safe::interpConfigure $i -accessPath] 1]
+    set autoList   [lindex [safe::interpConfigure $i -autoPath] 1]
 
-    return [list [lindex $accessList 0] $auto0]
+    return [list [lindex $accessList 0] [lindex $autoList 0] $auto0]
 } -cleanup {
     set ::auto_path $::auto_TMP
     safe::interpDelete $i
     if {$SyncExists} {
         safe::setAutoPathSync $SyncVal_TMP
     }
-} -result [list [info library] [info library]]
+} -result [list [info library] [info library] [info library]]
 
 ### 17. Test the use of ::auto_path for loading commands (via tclIndex files)
 ###     and non-module packages (via pkgIndex.tcl files).
@@ -2029,7 +2031,9 @@ test safe-17.2 {cf. safe-7.2 - negative non-module package require with specific
     }
 } -body {
     set i [safe::interpCreate -nostat -nested 1 -accessPath [list [info library]]]
+    # should not have been set by Safe Base:
     set auto1 [interp eval $i {set ::auto_path}]
+    # This does not change the value of option -autoPath:
     interp eval $i {set ::auto_path [list {$p(:0:)}]}
     # should not add anything (p0)
     set token1 [safe::interpAddToAccessPath $i [info library]]
@@ -2051,7 +2055,7 @@ test safe-17.2 {cf. safe-7.2 - negative non-module package require with specific
         {-accessPath {[list $tcl_library \
                             */dummy/unixlike/test/path \
                             $TestsDir/auto0]}\
-        -statics 0 -nested 1 -deleteHook {} -autoPath [list $tcl_library]} {}"
+        -statics 0 -nested 1 -deleteHook {} -autoPath {}} {}"
 # (not a counterpart of safe-7.3)
 test safe-17.3 {Check that default auto_path is the same as in the master interpreter, Sync Mode off} -constraints AutoSyncDefined -setup {
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
@@ -2069,13 +2073,13 @@ test safe-17.3 {Check that default auto_path is the same as in the master interp
     foreach token [$i eval set ::auto_path] {
         lappend ap [dict get [set ::safe::S${i}(access_path,map)] $token]
     }
-    return $ap
+    return [list $ap [lindex [::safe::interpConfigure $i -autoPath] 1]]
 } -cleanup {
     safe::interpDelete $i
     if {$SyncExists} {
 	safe::setAutoPathSync $SyncVal_TMP
     }
-} -result $::auto_path
+} -result [list $::auto_path $::auto_path]
 test safe-17.4 {cf. safe-7.4 - positive non-module package require with specific path and interpAddToAccessPath, Sync Mode off} -constraints AutoSyncDefined -setup {
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
     if {$SyncExists} {
@@ -2090,6 +2094,7 @@ test safe-17.4 {cf. safe-7.4 - positive non-module package require with specific
     # should not have been set by Safe Base:
     set auto1 [interp eval $i {set ::auto_path}]
 
+    # This does not change the value of option -autoPath.
     interp eval $i {set ::auto_path [list {$p(:0:)}]}
 
     # should not add anything (p0)
@@ -2118,7 +2123,7 @@ test safe-17.4 {cf. safe-7.4 - positive non-module package require with specific
 } -match glob -result "{} {{\$p(:0:)}} {\$p(:0:)} {\$p(:*:)} {\$p(:*:)} 0 1.2.3\
         {-accessPath {[list $tcl_library *$TestsDir/auto0 $TestsDir/auto0/auto1]}\
         -statics 0 -nested 1 -deleteHook {}\
-        -autoPath {[list $tcl_library $TestsDir/auto0]}} {}"
+        -autoPath {}} {}"
 test safe-17.5 {cf. safe-7.5 - positive and negative module package require, including ancestor directory issue, Sync Mode off} -setup {
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
     if {$SyncExists} {
@@ -2171,19 +2176,23 @@ test safe-19.8 {autoloading commands indexed in tclIndex files, Sync Mode off} -
     set mappA [mapList $PathMapp [dict get $confA -accessPath]]
     set path1 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
     set path2 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+    set mappC [mapList $PathMapp [dict get $confA -autoPath]]
+    set toksC [interp eval $i set ::auto_path]
 
     # Load and run the commands.
     set code1 [catch {interp eval $i {report1}} msg1]
     set code2 [catch {interp eval $i {report2}} msg2]
 
-    list $path1 $path2 -- $code1 $msg1 $code2 $msg2 -- $mappA
+    list $path1 $path2 -- $code1 $msg1 $code2 $msg2 -- $mappA -- $mappC -- $toksC
 } -cleanup {
     safe::interpDelete $i
     if {$SyncExists} {
         safe::setAutoPathSync $SyncVal_TMP
     }
 } -match glob -result {{$p(:1:)} {$p(:2:)} -- 0 ok1 0 ok2 --\
-        {TCLLIB TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2*}}
+        {TCLLIB TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2*} --\
+        {TCLLIB TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2*} --\
+        {{$p(:0:)} {$p(:1:)} {$p(:2:)}}}
 test safe-19.9 {interpConfigure change the access path; tclIndex commands unaffected by token rearrangement (dummy test of doreset), Sync Mode off} -constraints AutoSyncDefined -setup {
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
     if {$SyncExists} {
@@ -2204,6 +2213,8 @@ test safe-19.9 {interpConfigure change the access path; tclIndex commands unaffe
     set mappA [mapList $PathMapp [dict get $confA -accessPath]]
     set path1 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
     set path2 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+    set mappC [mapList $PathMapp [dict get $confA -autoPath]]
+    set toksC [interp eval $i set ::auto_path]
 
     # Load auto_load data.
     interp eval $i {catch nonExistentCommand}
@@ -2225,12 +2236,15 @@ test safe-19.9 {interpConfigure change the access path; tclIndex commands unaffe
     set mappB [mapList $PathMapp [dict get $confB -accessPath]]
     set path3 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
     set path4 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+    set mappD [mapList $PathMapp [dict get $confB -autoPath]]
+    set toksD [interp eval $i set ::auto_path]
 
     # Run the commands.
     set code3 [catch {interp eval $i {report1}} msg3]
     set code4 [catch {interp eval $i {report2}} msg4]
 
-    list $path1 $path2 -- $path3 $path4 -- $code3 $msg3 $code4 $msg4 -- $mappA -- $mappB
+    list $path1 $path2 -- $path3 $path4 -- $code3 $msg3 $code4 $msg4 -- \
+            $mappA -- $mappB -- $mappC -- $mappD -- $toksC -- $toksD
 } -cleanup {
     safe::interpDelete $i
     if {$SyncExists} {
@@ -2238,7 +2252,10 @@ test safe-19.9 {interpConfigure change the access path; tclIndex commands unaffe
     }
 } -match glob -result {{$p(:1:)} {$p(:2:)} -- {$p(:2:)} {$p(:1:)} -- 0 ok1 0 ok2 --\
         {TCLLIB TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2*} --\
-        {TCLLIB TESTSDIR/auto0/auto2 TESTSDIR/auto0/auto1*}}
+        {TCLLIB TESTSDIR/auto0/auto2 TESTSDIR/auto0/auto1*} --\
+        {TCLLIB TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2*} --\
+        {TCLLIB TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2*} --\
+        {{$p(:0:)} {$p(:1:)} {$p(:2:)}} -- {{$p(:0:)} {$p(:2:)} {$p(:1:)}}}
 test safe-19.10 {interpConfigure change the access path; tclIndex commands unaffected by token rearrangement (actual test of doreset), Sync Mode off} -constraints {AutoSyncDefined} -setup {
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
     if {$SyncExists} {
@@ -2259,6 +2276,8 @@ test safe-19.10 {interpConfigure change the access path; tclIndex commands unaff
     set mappA [mapList $PathMapp [dict get $confA -accessPath]]
     set path1 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
     set path2 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+    set mappC [mapList $PathMapp [dict get $confA -autoPath]]
+    set toksC [interp eval $i set ::auto_path]
 
     # Load auto_load data.
     interp eval $i {catch nonExistentCommand}
@@ -2278,12 +2297,15 @@ test safe-19.10 {interpConfigure change the access path; tclIndex commands unaff
     set mappB [mapList $PathMapp [dict get $confB -accessPath]]
     set path3 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
     set path4 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+    set mappD [mapList $PathMapp [dict get $confB -autoPath]]
+    set toksD [interp eval $i set ::auto_path]
 
     # Load and run the commands.
     set code3 [catch {interp eval $i {report1}} msg3]
     set code4 [catch {interp eval $i {report2}} msg4]
 
-    list $path1 $path2 -- $path3 $path4 -- $code3 $msg3 $code4 $msg4 -- $mappA -- $mappB
+    list $path1 $path2 -- $path3 $path4 -- $code3 $msg3 $code4 $msg4 -- \
+            $mappA -- $mappB -- $mappC -- $mappD -- $toksC -- $toksD
 } -cleanup {
     safe::interpDelete $i
     if {$SyncExists} {
@@ -2292,8 +2314,11 @@ test safe-19.10 {interpConfigure change the access path; tclIndex commands unaff
 } -match glob -result {{$p(:1:)} {$p(:2:)} -- {$p(:2:)} {$p(:1:)} --\
         0 ok1 0 ok2 --\
         {TCLLIB TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2*} --\
-        {TCLLIB TESTSDIR/auto0/auto2 TESTSDIR/auto0/auto1*}}
-test safe-19.11 {interpConfigure change the access path; pkgIndex.tcl packages unaffected by token rearrangement, Sync Mode off} -constraints AutoSyncDefined -setup {
+        {TCLLIB TESTSDIR/auto0/auto2 TESTSDIR/auto0/auto1*} --\
+        {TCLLIB TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2} --\
+        {TCLLIB TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2} --\
+        {{$p(:0:)} {$p(:1:)} {$p(:2:)}} -- {{$p(:0:)} {$p(:2:)} {$p(:1:)}}}
+test safe-19.11 {interpConfigure change the access path; pkgIndex.tcl packages unaffected by token rearrangement (1), Sync Mode off} -constraints AutoSyncDefined -setup {
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
     if {$SyncExists} {
         set SyncVal_TMP [safe::setAutoPathSync]
@@ -2302,7 +2327,6 @@ test safe-19.11 {interpConfigure change the access path; pkgIndex.tcl packages u
         error {This test is meaningful only if the command ::safe::setAutoPathSync is defined}
     }
 } -body {
-    # For complete correspondence to safe-stock87-9.11, include auto0 in access path.
     set i [safe::interpCreate -accessPath [list $tcl_library \
                                             [file join $TestsDir auto0] \
                                             [file join $TestsDir auto0 auto1] \
@@ -2315,6 +2339,8 @@ test safe-19.11 {interpConfigure change the access path; pkgIndex.tcl packages u
     set path0 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0]]
     set path1 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
     set path2 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+    set mappC [mapList $PathMapp [dict get $confA -autoPath]]
+    set toksC [interp eval $i set ::auto_path]
 
     # Load pkgIndex.tcl data.
     catch {interp eval $i {package require NOEXIST}}
@@ -2333,6 +2359,8 @@ test safe-19.11 {interpConfigure change the access path; pkgIndex.tcl packages u
     set mappB [mapList $PathMapp [dict get $confB -accessPath]]
     set path3 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
     set path4 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+    set mappD [mapList $PathMapp [dict get $confB -autoPath]]
+    set toksD [interp eval $i set ::auto_path]
 
     # Try to load the packages and run a command from each one.
     set code3 [catch {interp eval $i {package require SafeTestPackage1}} msg3 opts3]
@@ -2341,7 +2369,8 @@ test safe-19.11 {interpConfigure change the access path; pkgIndex.tcl packages u
     set code6 [catch {interp eval $i {HeresPackage2}} msg6 opts6]
 
     list $path1 $path2 -- $path3 $path4 -- $code3 $msg3 $code4 $msg4 -- \
-         $mappA -- $mappB -- $code5 $msg5 $code6 $msg6
+         $mappA -- $mappB -- $mappC -- $mappD -- $toksC -- $toksD -- \
+         $code5 $msg5 $code6 $msg6
 } -cleanup {
     safe::interpDelete $i
     if {$SyncExists} {
@@ -2350,6 +2379,8 @@ test safe-19.11 {interpConfigure change the access path; pkgIndex.tcl packages u
 } -match glob -result {{$p(:2:)} {$p(:3:)} -- {$p(:3:)} {$p(:2:)} -- 0 1.2.3 0 2.3.4 --\
         {TCLLIB TESTSDIR/auto0 TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2*} --\
         {TCLLIB TESTSDIR/auto0 TESTSDIR/auto0/auto2 TESTSDIR/auto0/auto1*} --\
+        {TCLLIB TESTSDIR/auto0} -- {TCLLIB TESTSDIR/auto0} --\
+        {{$p(:0:)} {$p(:1:)}} -- {{$p(:0:)} {$p(:1:)}} --\
         0 OK1 0 OK2}
 test safe-19.12 {interpConfigure change the access path; pkgIndex.tcl packages unaffected by token rearrangement, safe-19.11 without path auto0, Sync Mode off} -constraints {AutoSyncDefined} -setup {
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
@@ -2373,6 +2404,8 @@ test safe-19.12 {interpConfigure change the access path; pkgIndex.tcl packages u
     set mappA [mapList $PathMapp [dict get $confA -accessPath]]
     set path1 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
     set path2 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+    set mappC [mapList $PathMapp [dict get $confA -autoPath]]
+    set toksC [interp eval $i set ::auto_path]
 
     # Load pkgIndex.tcl data.
     catch {interp eval $i {package require NOEXIST}}
@@ -2389,6 +2422,8 @@ test safe-19.12 {interpConfigure change the access path; pkgIndex.tcl packages u
     set mappB [mapList $PathMapp [dict get $confB -accessPath]]
     set path3 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
     set path4 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+    set mappD [mapList $PathMapp [dict get $confB -autoPath]]
+    set toksD [interp eval $i set ::auto_path]
 
     # Try to load the packages and run a command from each one.
     set code3 [catch {interp eval $i {package require SafeTestPackage1}} msg3 opts3]
@@ -2397,7 +2432,7 @@ test safe-19.12 {interpConfigure change the access path; pkgIndex.tcl packages u
     set code6 [catch {interp eval $i {HeresPackage2}} msg6 opts6]
 
     list $path1 $path2 -- $path3 $path4 -- $code3 $msg3 $code4 $msg4 -- \
-            $mappA -- $mappB -- \
+            $mappA -- $mappB -- $mappC -- $mappD -- $toksC -- $toksD -- \
             $code5 $msg5 $code6 $msg6
 } -cleanup {
     safe::interpDelete $i
@@ -2408,6 +2443,9 @@ test safe-19.12 {interpConfigure change the access path; pkgIndex.tcl packages u
         0 1.2.3 0 2.3.4 --\
         {TCLLIB TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2*} --\
         {TCLLIB TESTSDIR/auto0/auto2 TESTSDIR/auto0/auto1*} --\
+        {TCLLIB TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2} --\
+        {TCLLIB TESTSDIR/auto0/auto2 TESTSDIR/auto0/auto1} --\
+        {{$p(:0:)} {$p(:1:)} {$p(:2:)}} -- {{$p(:0:)} {$p(:1:)} {$p(:2:)}} --\
         0 OK1 0 OK2}
 test safe-19.13 {interpConfigure change the access path; pkgIndex.tcl packages fail if directory de-listed, Sync Mode off} -constraints {AutoSyncDefined} -setup {
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
@@ -2430,6 +2468,8 @@ test safe-19.13 {interpConfigure change the access path; pkgIndex.tcl packages f
     set mappA [mapList $PathMapp [dict get $confA -accessPath]]
     set path1 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
     set path2 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+    set mappC [mapList $PathMapp [dict get $confA -autoPath]]
+    set toksC [interp eval $i set ::auto_path]
 
     # Load pkgIndex.tcl data.
     catch {interp eval $i {package require NOEXIST}}
@@ -2442,13 +2482,15 @@ test safe-19.13 {interpConfigure change the access path; pkgIndex.tcl packages f
     set mappB [mapList $PathMapp [dict get $confB -accessPath]]
     set code4 [catch {::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]} path4]
     set code5 [catch {::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]} path5]
+    set mappD [mapList $PathMapp [dict get $confB -autoPath]]
+    set toksD [interp eval $i set ::auto_path]
 
     # Try to load the packages.
     set code3 [catch {interp eval $i {package require SafeTestPackage1}} msg3]
     set code6 [catch {interp eval $i {package require SafeTestPackage2}} msg6]
 
     list $path1 $path2 -- $code4 $path4 -- $code5 $path5 -- $code3 $code6 -- \
-            $mappA -- $mappB
+            $mappA -- $mappB -- $mappC -- $mappD -- $toksC -- $toksD
 } -cleanup {
     safe::interpDelete $i
     if {$SyncExists} {
@@ -2456,7 +2498,190 @@ test safe-19.13 {interpConfigure change the access path; pkgIndex.tcl packages f
     }
 } -match glob -result {{$p(:2:)} {$p(:3:)} -- 1 {* not found in access path} --\
         1 {* not found in access path} -- 1 1 --\
-        {TCLLIB TESTSDIR/auto0 TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2*} -- {TCLLIB*}}
+        {TCLLIB TESTSDIR/auto0 TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2*} --\
+        {TCLLIB*} -- {TCLLIB TESTSDIR/auto0} -- {TCLLIB TESTSDIR/auto0} --\
+        {{$p(:0:)} {$p(:1:)}} -- {{$p(:0:)}}}
+# (no counterpart safe-9.14)
+test safe-19.14 {when interpConfigure changes the access path, ::auto_path uses -autoPath value and new tokens, Sync Mode off} -constraints AutoSyncDefined -setup {
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 0
+    } else {
+        error {This test is meaningful only if the command ::safe::setAutoPathSync is defined}
+    }
+} -body {
+    # Test that although -autoPath is unchanged, the slave's ::auto_path changes to
+    # reflect the changes in token mappings.
+    set i [safe::interpCreate -accessPath [list $tcl_library \
+                                            [file join $TestsDir auto0] \
+                                            [file join $TestsDir auto0 auto1] \
+                                            [file join $TestsDir auto0 auto2]] \
+                              -autoPath [list $tcl_library \
+                                            [file join $TestsDir auto0]]]
+    # Inspect.
+    set confA [safe::interpConfigure $i]
+    set mappA [mapList $PathMapp [dict get $confA -accessPath]]
+    set path0 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0]]
+    set path1 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
+    set path2 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+    set mappC [mapList $PathMapp [dict get $confA -autoPath]]
+    set toksC [interp eval $i set ::auto_path]
+
+    # Load pkgIndex.tcl data.
+    catch {interp eval $i {package require NOEXIST}}
+
+    # Rearrange access path.  Swap tokens {$p(:1:)} and {$p(:3:)}.
+    safe::interpConfigure $i -accessPath [list $tcl_library \
+                                           [file join $TestsDir auto0 auto2] \
+                                           [file join $TestsDir auto0 auto1] \
+                                           [file join $TestsDir auto0]]
+    # Inspect.
+    set confB [safe::interpConfigure $i]
+    set mappB [mapList $PathMapp [dict get $confB -accessPath]]
+    set path5 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0]]
+    set path3 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
+    set path4 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+    set mappD [mapList $PathMapp [dict get $confA -autoPath]]
+    set toksD [interp eval $i set ::auto_path]
+
+    # Try to load the packages and run a command from each one.
+    set code3 [catch {interp eval $i {package require SafeTestPackage1}} msg3 opts3]
+    set code4 [catch {interp eval $i {package require SafeTestPackage2}} msg4 opts4]
+    set code5 [catch {interp eval $i {HeresPackage1}} msg5 opts5]
+    set code6 [catch {interp eval $i {HeresPackage2}} msg6 opts6]
+
+    list $path0 $path1 $path2 -- $path5 $path3 $path4 -- $toksC -- $toksD -- \
+         $code3 $msg3 $code4 $msg4 -- \
+         $mappA -- $mappB -- $mappC -- $mappD -- $code5 $msg5 $code6 $msg6
+} -cleanup {
+    safe::interpDelete $i
+    if {$SyncExists} {
+        safe::setAutoPathSync $SyncVal_TMP
+    }
+} -match glob -result {{$p(:1:)} {$p(:2:)} {$p(:3:)} -- {$p(:3:)} {$p(:2:)} {$p(:1:)} -- {{$p(:0:)} {$p(:1:)}} -- {{$p(:0:)} {$p(:3:)}} -- 0 1.2.3 0 2.3.4 --\
+        {TCLLIB TESTSDIR/auto0 TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2*} --\
+        {TCLLIB TESTSDIR/auto0/auto2 TESTSDIR/auto0/auto1 TESTSDIR/auto0*} --\
+        {TCLLIB TESTSDIR/auto0} --\
+        {TCLLIB TESTSDIR/auto0} --\
+        0 OK1 0 OK2}
+# (no counterpart safe-9.15)
+test safe-19.15 {when interpConfigure changes the access path, ::auto_path uses -autoPath value and new tokens, Sync Mode off} -constraints AutoSyncDefined -setup {
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 0
+    } else {
+        error {This test is meaningful only if the command ::safe::setAutoPathSync is defined}
+    }
+} -body {
+    # Test that although -autoPath is unchanged, the slave's ::auto_path changes to
+    # reflect the changes in token mappings; and that it is based on the -autoPath
+    # value, not the previously restricted slave ::auto_path.
+    set i [safe::interpCreate -accessPath [list $tcl_library \
+                                            [file join $TestsDir auto0]] \
+                              -autoPath [list $tcl_library \
+                                            [file join $TestsDir auto0 auto1] \
+                                            [file join $TestsDir auto0 auto2]]]
+    # Inspect.
+    set confA [safe::interpConfigure $i]
+    set mappA [mapList $PathMapp [dict get $confA -accessPath]]
+    set path0 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0]]
+    set mappC [mapList $PathMapp [dict get $confA -autoPath]]
+    set toksC [interp eval $i set ::auto_path]
+
+    # Load pkgIndex.tcl data.
+    catch {interp eval $i {package require NOEXIST}}
+
+    # Rearrange access path.  Add more directories.
+    safe::interpConfigure $i -accessPath [list $tcl_library \
+                                            [file join $TestsDir auto0] \
+                                            [file join $TestsDir auto0 auto1] \
+                                            [file join $TestsDir auto0 auto2]]
+    # Inspect.
+    set confB [safe::interpConfigure $i]
+    set mappB [mapList $PathMapp [dict get $confB -accessPath]]
+    set path5 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0]]
+    set path3 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
+    set path4 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto2]]
+    set mappD [mapList $PathMapp [dict get $confA -autoPath]]
+    set toksD [interp eval $i set ::auto_path]
+
+    # Try to load the packages and run a command from each one.
+    set code3 [catch {interp eval $i {package require SafeTestPackage1}} msg3 opts3]
+    set code4 [catch {interp eval $i {package require SafeTestPackage2}} msg4 opts4]
+    set code5 [catch {interp eval $i {HeresPackage1}} msg5 opts5]
+    set code6 [catch {interp eval $i {HeresPackage2}} msg6 opts6]
+
+    list $path0 -- $path5 $path3 $path4 -- $toksC -- $toksD -- \
+         $code3 $msg3 $code4 $msg4 -- \
+         $mappA -- $mappB -- $mappC -- $mappD -- $code5 $msg5 $code6 $msg6
+} -cleanup {
+    safe::interpDelete $i
+    if {$SyncExists} {
+        safe::setAutoPathSync $SyncVal_TMP
+    }
+} -match glob -result {{$p(:1:)} -- {$p(:1:)} {$p(:2:)} {$p(:3:)} -- {{$p(:0:)}} -- {{$p(:0:)} {$p(:2:)} {$p(:3:)}} -- 0 1.2.3 0 2.3.4 --\
+        {TCLLIB TESTSDIR/auto0*} --\
+        {TCLLIB TESTSDIR/auto0 TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2*} --\
+        {TCLLIB TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2} --\
+        {TCLLIB TESTSDIR/auto0/auto1 TESTSDIR/auto0/auto2} --\
+        0 OK1 0 OK2}
+# (no counterpart safe-9.16)
+test safe-19.16 {default value for -accessPath and -autoPath on creation; -autoPath preserved when -accessPath changes, ::auto_path using changed tokens, Sync Mode off} -constraints AutoSyncDefined -setup {
+    set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
+    if {$SyncExists} {
+        set SyncVal_TMP [safe::setAutoPathSync]
+        safe::setAutoPathSync 0
+    } else {
+        error {This test is meaningful only if the command ::safe::setAutoPathSync is defined}
+    }
+    set tmpAutoPath $::auto_path
+    set ::auto_path [list $tcl_library [file join $TestsDir auto0]]
+    set i [safe::interpCreate]
+    set ::auto_path $tmpAutoPath
+} -body {
+    # Test that the -autoPath acquires and keeps the master's value unless otherwise specified.
+
+    # Inspect.
+    set confA [safe::interpConfigure $i]
+    set mappC [mapList $PathMapp [dict get $confA -autoPath]]
+    set toksC [interp eval $i set ::auto_path]
+
+    # Load pkgIndex.tcl data.
+    catch {interp eval $i {package require NOEXIST}}
+
+    # Rearrange access path.  Remove a directory.
+    safe::interpConfigure $i -accessPath [list $tcl_library \
+                                            [file join $TestsDir auto0] \
+                                            [file join $TestsDir auto0 auto1]]
+    # Inspect.
+    set confB [safe::interpConfigure $i]
+    set mappB [mapList $PathMapp [dict get $confB -accessPath]]
+    set path5 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0]]
+    set path3 [::safe::interpFindInAccessPath $i [file join $TestsDir auto0 auto1]]
+    set mappD [mapList $PathMapp [dict get $confA -autoPath]]
+    set toksD [interp eval $i set ::auto_path]
+
+    # Try to load the packages and run a command from each one.
+    set code3 [catch {interp eval $i {package require SafeTestPackage1}} msg3]
+    set code4 [catch {interp eval $i {package require SafeTestPackage2}} msg4]
+    set code5 [catch {interp eval $i {HeresPackage1}} msg5 opts5]
+    set code6 [catch {interp eval $i {HeresPackage2}} msg6 opts6]
+
+    list $path5 $path3 -- [lindex $toksC 0] [llength $toksC] -- \
+            $toksD -- $code3 $msg3 $code4 $msg4 -- \
+            $mappB -- $mappC -- $mappD -- $code5 $msg5 $code6 $msg6
+} -cleanup {
+    safe::interpDelete $i
+    if {$SyncExists} {
+        safe::setAutoPathSync $SyncVal_TMP
+    }
+} -match glob -result {{$p(:1:)} {$p(:2:)} -- {$p(:0:)} 2 --\
+        {{$p(:0:)} {$p(:1:)}} -- 0 1.2.3 1 {can't find package SafeTestPackage2} --\
+        {TCLLIB TESTSDIR/auto0 TESTSDIR/auto0/auto1*} --\
+        {TCLLIB TESTSDIR/auto0} -- {TCLLIB TESTSDIR/auto0} --\
+        0 OK1 1 {invalid command name "HeresPackage2"}}
 test safe-19.20 {check module loading, Sync Mode off} -constraints AutoSyncDefined -setup {
     set SyncExists [expr {[info commands ::safe::setAutoPathSync] ne {}}]
     if {$SyncExists} {