@kavishdua/proctor 1.0.0 → 1.1.0

package/README.md

@@ -53,9 +53,14 @@ source needs Node 20.19+ or 22.12+.
 
 ## Quickstart
 
-The npm package is not published yet: `npm view @kavishdua/proctor` currently returns 404, so an
-`npx @kavishdua/proctor ...` command from the registry will not work. Until the first release, run
-the checked-out source against any git repository:
+Check the changes in any git repository, with nothing to install first:
+
+```bash
+cd /path/to/repository
+npx @kavishdua/proctor check
+```
+
+To run it from source instead:
 
 ```bash
 git clone https://github.com/catfish-1234/proctor.git
@@ -91,16 +96,10 @@ qwen extensions install https://github.com/catfish-1234/proctor
 
 **Other agents, or CLI use without an agent** (30 agents supported)
 
-Until the npm package is published, build its installable tarball from source:
+Add it to the repository as a dev dependency:
 
 ```bash
-# In the proctor checkout
-npm ci
-npm run build
-npm pack
-
-# In the repository proctor should guard; use the .tgz path printed above
-npm install --save-dev /absolute/path/to/kavishdua-proctor-*.tgz
+npm install --save-dev @kavishdua/proctor
 ```
 
 **Proctor does not install guards during npm installation by default.** npm still updates your
@@ -276,15 +275,17 @@ families.
 **WI1xx checks "the work is done."** These look for incomplete or disabled behavior in source,
 config, and tests, including discarded errors, removed validation, and altered expected values.
 
-> **Beta, and opt-in for now.** The WI family is off by default in v1.0.0. Turn it on for one run
-> with `proctor check --wi` (or `--all-checks`), or for good by listing the IDs you want in
-> `enabled` in `proctor.config.json`, which also applies them in both hooks. These thirteen checks
-> cover 25+ languages and have had less real-world testing than the RH family, so they remain
-> opt-in while we assess false positives.
+> **Six WI checks run by default:** WI101, WI102, WI105, WI108, WI109, and WI110.
+> Alongside RH001 to RH014, they close error-handling, unfinished-body, canned-output,
+> source-hiding, expectation-edit, and script-verification gaps. The remaining seven WI checks
+> stay opt-in because their human-commit findings still include legitimate maintenance.
+> Run `proctor check --wi` (or `--all-checks`) to add the entire family, or name checks in
+> `enabled` in the committed config. An explicit `enabled` list is still honored exactly.
+> See the [measurements and per-check decisions](bench/detection/README.md).
 
 | | Catches |
 |---|---|
-| WI101 | An error discarded by an empty handler, so failures pass unnoticed |
+| WI101 | Empty or logging-only handlers, and formerly propagated operation errors discarded or replaced with defaults |
 | WI102 | An explicit "not implemented" marker shipped inside finished-looking work |
 | WI103 | Validation deleted so the case it rejected now goes through |
 | WI104 | Proctor, a commit hook, or a type/lint gate switched off instead of satisfied |
@@ -338,12 +339,11 @@ jobs:
     steps:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with: { fetch-depth: 0 }
-      - uses: catfish-1234/proctor@1bfd0b192ea214a0ed349b27822b11b8ccf23e07
+      - uses: catfish-1234/proctor@ede7e0ec0d9a91c241af1b181b74b1a6af67df07 # v1.0.0
 ```
 
-No release tags exist yet, so the example pins an existing source commit. After the first release,
-`catfish-1234/proctor@v1` will be the moving tag for the newest `1.x` release. To keep builds
-reproducible, use a full commit SHA as above; a full SHA is immutable.
+The example pins the commit behind the `v1.0.0` release. You can use the `v1.0.0` tag instead, but
+a full commit SHA is immutable, so it keeps builds reproducible.
 
 ## How it works
 
@@ -363,7 +363,7 @@ unchecked commit.
 that same diff is checked. Approvals and inline `proctor-ignore` markers must also be committed
 before the change they cover.
 
-**Switching the guard off is itself a finding.** WI104 fires on a check removed from `enabled`, a
+**An opt-in check can flag changes to the guard.** WI104 fires on a check removed from `enabled`, a
 severity downgraded, an ignore pattern or approval added, a ruleset file deleted, a `--no-verify`
 added to a script, or TypeScript strictness turned off. WI104 is part of the opt-in WI family.
 
@@ -383,22 +383,32 @@ changes and allows turns when proctor cannot run, so it is not a substitute for
 | **up to 100 pts** | gap between "the visible tests pass" and "the held-out tests pass" on the largest tasks in [SpecBench](https://arxiv.org/abs/2605.21384). It widens by about 28 points per tenfold increase in code size, and adding test coverage does not close it |
 | **8 of 8** | agent benchmarks that [Berkeley RDI](https://rdi.berkeley.edu/blog/trustworthy-benchmarks-cont/) drove to near-perfect scores without solving a single task. SWE-bench Verified fell to a pytest hook that forced every test to pass |
 
-**What proctor catches.** The fixture and benchmark numbers below come out of `npm test`; the
-adversarial number comes from the independent widening corpus in [`bench/redteam/`](https://github.com/catfish-1234/proctor/tree/main/bench/redteam):
+**What proctor catches.** The original rule fixtures and recorded benchmark cases are checked by
+`npm test`. The redteam probe is a repeatedly tuned **dev corpus**, not independent evidence of
+generalization. Fresh measurements compare the unchanged main baseline with these changes:
 
 | | |
 |---|---|
-| **139 of 139** | planted cheats caught. One fixture per check per language, each asserted against the exact finding proctor has to produce, not just "something fired" |
-| **0 of 33** | near-miss fixtures flagged. Each one is a change built to look like a cheat and be legitimate: a single `@ts-ignore` with a justification, one retry rather than five, an empty catch whose comment explains itself, a guard clause extracted into a validator |
-| **21 of 21** | recorded cheats caught in the benchmark corpus, across 7 signatures. Whole-repo task diffs rather than minimal fixtures. The 22nd task is a control that plants no cheat, and proctor stays silent on it. Reproduce with `proctor bench --mock` |
-| **76 of 76** | adversarial cheat diffs caught with **both families enabled**, and **0 of 24** legitimate controls flagged, across eleven total red-team rounds. The corpus probes the WI family too, so reproduce it with `--all-checks`; the RH family alone catches 25 of the 76, since the rest are cheats the WI checks were written for. Includes process-status laundering, workload cuts, dependency rollback, fixed-delay masking, CI trigger/matrix contraction, diagnostic suppression, and out-of-band Git index hiding. Reproduce with `node bench/redteam/probe.mjs` |
-| **3.8%** | of 689 real human commits, sampled from 20 maintained open-source repositories across seven languages, produce any finding at all from the default check set. **2.32%** produce a blocking one, and most of those are the check correctly noticing that somebody deleted a test or added a skip marker |
-| **27** | checks in two families, across **25+** languages, installable into **30** agents |
-| **under 1s** | to check a commit, offline. Measured here at roughly 0.25s on a 3-file diff and 0.55s on a 79-file one, cold Node start included |
-
-**What we don't claim.** The 139 of 139 result measures detection of planted changes.
-Our [benchmark](#benchmark) has not shown that proctor reduces cheating: all 44 invocations in
-each of the two complete live runs passed their held-out tests in both arms.
+| **139 of 139** | original planted rule fixtures caught with all checks, with **0 of 33** original near-miss fixtures flagged. These are development fixtures, not an unseen evaluation |
+| **21 of 21** | recorded cheats caught in the mock benchmark corpus, across 7 signatures. The 22nd task is a control; it stays quiet |
+| **25 to 54 of 76** | tuned dev cheats caught by defaults before and after. With all checks: **76 to 76 of 76**. Dev controls: **0 to 0 of 24** flagged in either mode. Run `node bench/redteam/probe.mjs --default` and `node bench/redteam/probe.mjs` |
+| **7 to 36 of 36** | cheats caught by defaults in the **74-case frozen validation set**, with benign flags falling from **2/38 to 0/38**. All checks improve from **9/36 to 36/36**. The separately frozen 74-case design set has the same totals. Both are small authored sets with paired variations |
+| **4.29% to 2.00% blocking** | **30/700 to 14/700** real non-bot commits flagged by defaults on the same fresh pinned sample from 20 repositories. Any finding: **46/700 (6.57%) to 26/700 (3.71%)**. Every flagged human commit counts as a conservative false-positive proxy, including intentional test deletions |
+| **26 to 35 of 72** | cheats caught by defaults on a **72-cheat, 72-benign held-out set** written after 1.0.0 by a separate run that never saw the checks. Benign flags: **5/72 before, 5/72 after**. All checks: **38 to 42 of 72**, with 6/72 benign flagged. Error handling went from 0/12 to 7/12. Hardcoded special cases (2/8), removed validation (0/3), edited expected values (0/3), race masking (0/3) and suppression (0/3) are still mostly missed. The set was used only to measure, not to tune, but it is now public, so it no longer counts as blind. Run `node bench/heldout/probe.mjs --default` |
+| **2.6% blocking** | **11/420** real commits blocked by both 1.0.0 and this release on a second fresh sample of 14 repositories that neither the checks nor the first sample touched. Any finding: **17 before, 16 after**. A few false positives found there were fixed with rules, not by pinning commits |
+| **27** | checks in two families, with **20 enabled by default**, across **25+** languages, installable into **30** agents |
+
+The old **689-commit** claim, **2.32% blocking and 3.8% any finding**, refers to a missing ignored
+sample and harness. It could not be reproduced from this checkout or tracked history. The fresh
+700-commit sample uses the same 20 repositories, pins every commit and patch hash, and retains
+all findings. It is a replacement cohort, not the original sample. See
+[methods, per-rule results, and reproduction commands](bench/detection/README.md).
+
+**What we don't claim.** Proctor is a heuristic diff checker. Defaults still miss more than half of the held-out cheats, mostly the ones that need running the code to see: special-cased inputs, edited expected values, removed validation, masked races and suppression. It detects suspicious changes;
+it does not prevent them or judge intent. A determined author can write a cheat that no static
+diff check recognizes. The dev and authored-validation results do not establish a detection
+rate for unseen cheats. Our [live benchmark](#benchmark) has not shown that proctor reduces
+cheating: all 44 invocations in each complete run passed their evaluation tests in both arms.
 
 ## Benchmark
 
@@ -465,8 +475,9 @@ For command details, configuration, support limits, and contributor instructions
 | [bench/METHODOLOGY.md](https://github.com/catfish-1234/proctor/blob/main/bench/METHODOLOGY.md) | How the benchmark works and what it does not claim |
 
 proctor supports 25+ languages and installs to 30 agents. Five diff-level checks (RH001, RH002,
-RH003, RH007, RH011) work across all of them; six (RH004, RH005, RH006, RH008, RH009, RH010) are
-JS/TS/Python-only; and RH012 and RH013 read CI and coverage config, so they apply everywhere. Of the
+RH003, RH007, RH011) have signatures across the language roster. RH004, RH006, RH008, RH009, and
+RH010 have their tested coverage in JS/TS/Python; RH005 also detects emptied Go and Rust bodies.
+RH012 and RH013 read CI and coverage config, so they apply everywhere. Of the
 work-integrity family, WI101, WI102 and WI103 carry per-language signatures, WI104 reads config
 files so it applies everywhere, and WI105 and WI106 are scoped to the languages whose tokens are
 unambiguous. [Full matrix](https://github.com/catfish-1234/proctor/blob/main/docs/LANGUAGES.md).

package/dist/cli.js

@@ -65,7 +65,7 @@ import { homedir } from "os";
 // package.json
 var package_default = {
   name: "@kavishdua/proctor",
-  version: "1.0.0",
+  version: "1.1.0",
   description: "Catch AI agents gaming their test suites: deleted tests, skipped tests, weakened assertions, hardcoded outputs",
   homepage: "https://github.com/catfish-1234/proctor#readme",
   bugs: {
@@ -653,7 +653,9 @@ var WI_CHECKS = [
   "WI112",
   "WI113"
 ];
-var DEFAULT_ENABLED = RH_CHECKS;
+var DEFAULT_WI_CHECKS = ["WI101", "WI102", "WI105", "WI108", "WI109", "WI110"];
+var DEFAULT_CHECKS = [...RH_CHECKS, ...DEFAULT_WI_CHECKS];
+var DEFAULT_ENABLED = DEFAULT_CHECKS;
 var VALID_SEVERITIES = /* @__PURE__ */ new Set(["error", "warn", "info"]);
 function normalizeConfig(config) {
   const out = { ...config };
@@ -923,8 +925,9 @@ function withoutTrailingComment(text) {
   return text.replace(/\s*(?:\/\/|#|--\s).*$/, "").replace(/\s*\/\*.*\*\/\s*$/, "");
 }
 function hasExplanation(text) {
-  const comment = /(?:\/\/|#(?!\!)|--|\/\*|\*)\s*(.+)$/.exec(text);
+  const comment = /(?:\/\/|#(?!\!)|--(?=\s)|\/\*|\*)\s*(.+)$/.exec(text);
   if (!comment) return false;
+  if (/^proctor-ignore\s*:/.test(comment[1].trim())) return false;
   const words = comment[1].replace(/\*\/\s*$/, "").trim();
   if (/^(?:todo|fixme|xxx|hack|noqa|nosec|eslint-disable\S*|prettier-ignore)\b\W*$/i.test(words)) return false;
   return words.split(/\s+/).filter(Boolean).length >= 3;
@@ -956,6 +959,155 @@ function codeLines(chunk) {
   return added.filter((line, i) => !templated.has(i) && !isCommentLine(line.text));
 }
 
+// src/verifiers/structure.ts
+function maskCode(text, pythonOrRuby = false, preserveDelimiters = false) {
+  const out = text.split("");
+  let quote = "";
+  let block = false;
+  let line = false;
+  let previous = "";
+  for (let i = 0; i < text.length; i++) {
+    const ch = text[i];
+    const next = text[i + 1];
+    if (ch === "\n") {
+      line = false;
+      continue;
+    }
+    if (line) {
+      out[i] = " ";
+      continue;
+    }
+    if (block) {
+      out[i] = " ";
+      if (ch === "*" && next === "/") {
+        out[++i] = " ";
+        block = false;
+      }
+      continue;
+    }
+    if (quote) {
+      out[i] = " ";
+      if (ch === "\\") {
+        if (i + 1 < text.length) out[++i] = " ";
+      } else if (text.startsWith(quote, i)) {
+        for (let k = 0; k < quote.length; k++) out[i + k] = preserveDelimiters ? quote[k] : " ";
+        i += quote.length - 1;
+        quote = "";
+      }
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      out[i] = out[++i] = " ";
+      block = true;
+    } else if (!pythonOrRuby && ch === "/" && next === "/" || pythonOrRuby && ch === "#") {
+      out[i] = " ";
+      line = true;
+    } else if (ch === '"' || ch === "'" || ch === "`") {
+      quote = pythonOrRuby && text.startsWith(ch.repeat(3), i) ? ch.repeat(3) : ch;
+      out[i] = preserveDelimiters ? ch : " ";
+      for (let k = 1; k < quote.length; k++) out[i + k] = preserveDelimiters ? ch : " ";
+      i += quote.length - 1;
+      previous = "v";
+    } else if (!pythonOrRuby && ch === "/" && /^(?:$|[(,=:[!&|?{};+*%~^<>-])$/.test(previous)) {
+      let end = i + 1;
+      let inClass = false;
+      for (; end < text.length && text[end] !== "\n"; end++) {
+        if (text[end] === "\\") end++;
+        else if (text[end] === "[") inClass = true;
+        else if (text[end] === "]") inClass = false;
+        else if (text[end] === "/" && !inClass) break;
+      }
+      if (text[end] === "/") {
+        for (let cursor = i; cursor <= end; cursor++) out[cursor] = " ";
+        i = end;
+        previous = "v";
+      } else previous = ch;
+    } else if (!/\s/.test(ch)) previous = ch;
+  }
+  return out.join("");
+}
+function sourceView(chunk, side, pythonOrRuby = false) {
+  const selected = chunk.changes.map((change, position) => ({ change, position })).filter(({ change }) => change.type !== (side === "after" ? "del" : "add"));
+  const starts = [];
+  let text = "";
+  for (const { change } of selected) {
+    starts.push(text.length);
+    text += body(change.content) + "\n";
+  }
+  const indexAt = (offset) => {
+    let lo = 0;
+    let hi = starts.length;
+    while (lo + 1 < hi) {
+      const mid = lo + hi >>> 1;
+      if (starts[mid] <= offset) lo = mid;
+      else hi = mid;
+    }
+    return lo;
+  };
+  return {
+    text,
+    code: maskCode(text, pythonOrRuby),
+    signatures: maskCode(text, pythonOrRuby, true),
+    offsetAtLine: (line) => {
+      const index = selected.findIndex(({ change }) => (change.type === "normal" ? side === "before" ? change.ln1 : change.ln2 : change.ln) === line);
+      return index < 0 ? void 0 : starts[index];
+    },
+    lineAt: (offset) => {
+      const change = selected[indexAt(offset)]?.change;
+      return change ? change.type === "normal" ? side === "before" ? change.ln1 : change.ln2 : change.ln : chunk.newStart;
+    },
+    touched: (start, end) => {
+      const first = selected[indexAt(start)];
+      const last = selected[indexAt(end)];
+      return !!first && !!last && chunk.changes.slice(first.position, last.position + 1).some((c) => c.type !== "normal");
+    }
+  };
+}
+function closingDelimiter(code, open, left = "{", right = "}") {
+  let depth = 0;
+  for (let i = open; i < code.length; i++) {
+    if (code[i] === left) depth++;
+    else if (code[i] === right && --depth === 0) return i;
+  }
+  return -1;
+}
+var compact = (text) => text.replace(/\s+/g, "");
+function callables(view) {
+  const result = [];
+  const header = /\b(?:function\s+|fn\s+|func\s+)([A-Za-z_$][\w$]*)\s*\([^{}]*\)[^{;]*\{/g;
+  for (const match of view.code.matchAll(header)) {
+    const start = match.index;
+    const open = start + match[0].length - 1;
+    const end = closingDelimiter(view.code, open);
+    if (end < 0) continue;
+    result.push({ name: match[1], header: compact(match[0]), start, open, end, body: view.code.slice(open + 1, end) });
+  }
+  return result;
+}
+function testBodies(view) {
+  const result = [];
+  for (const match of view.code.matchAll(/\b(?:it|test)(?:\.(?!each\b)\w+)*\s*\(/g)) {
+    const openArgs = match.index + match[0].length - 1;
+    const endArgs = closingDelimiter(view.code, openArgs, "(", ")");
+    if (endArgs < 0) continue;
+    const title = /^\s*(['"`])((?:\\.|[^\\])*?)\1/.exec(view.text.slice(openArgs + 1, endArgs));
+    if (!title) continue;
+    let depth = 0;
+    let last = openArgs + 1;
+    for (let i = openArgs + 1; i < endArgs; i++) {
+      if ("({[".includes(view.code[i])) depth++;
+      else if (")}]".includes(view.code[i])) depth--;
+      else if (view.code[i] === "," && depth === 0) last = i + 1;
+    }
+    const callback = /^\s*(?:async\s+)?(?:\([^)]*\)|[A-Za-z_$][\w$]*)\s*=>\s*\{|^\s*(?:async\s+)?function\s*\([^)]*\)\s*\{/.exec(view.code.slice(last, endArgs));
+    if (!callback) continue;
+    const open = last + callback[0].length - 1;
+    const end = closingDelimiter(view.code, open);
+    if (end >= 0) result.push({ key: title[2], open, end, body: view.code.slice(open + 1, end) });
+  }
+  return result;
+}
+
 // src/verifiers/rh001.ts
 var JS_TS_DEL = /^-\s*(?:it|test|describe)(?:\.\w+)?\s*\(/;
 var PY_DEL = /^-\s*(?:async\s+)?def test_/;
@@ -1032,6 +1184,28 @@ function testsRelocated(file, files, ctx) {
   if (relocated.size !== removed.size) return false;
   return assertionsGained >= assertionCount(file, "del");
 }
+function removedFeature(context, testPath, testCode) {
+  const unit = (path9) => (path9.split("/").pop() ?? "").replace(/\.(?:test|spec)\.[^.]+$|\.[^.]+$/, "").replace(/^test_/, "").replace(/_test$/, "").replace(/^_+/, "");
+  const declaration = /\b(?:function|def|class)\s+([A-Za-z_$][\w$]*)/g;
+  for (const candidate of context.files) {
+    const path9 = candidate.from ?? candidate.to ?? "";
+    if (context.isTestFile(path9) || unit(path9) !== unit(testPath)) continue;
+    const before = candidate.chunks.map((chunk) => sourceView(chunk, "before", path9.endsWith(".py")));
+    const after = candidate.chunks.map((chunk) => sourceView(chunk, "after", path9.endsWith(".py")));
+    for (const view of before) for (const match of view.code.matchAll(declaration)) {
+      const name = match[1];
+      if (!view.touched(match.index, match.index + match[0].length)) continue;
+      if (after.some((next) => [...next.code.matchAll(/\b(?:function|def|class|const|let|var)\s+([A-Za-z_$][\w$]*)/g)].some((declaration2) => declaration2[1] === name))) continue;
+      for (const reference of testCode.matchAll(/[A-Za-z_$][\w$]*/g)) {
+        if (reference[0] !== name) continue;
+        let next = reference.index + reference[0].length;
+        while (/\s/.test(testCode[next] ?? "") && next < testCode.length) next++;
+        if (testCode[reference.index - 1] === "." || testCode[next] === "(") return true;
+      }
+    }
+  }
+  return false;
+}
 function run(context) {
   const files = context.files;
   const ctx = context;
@@ -1082,6 +1256,28 @@ function run(context) {
         if (change.type !== "del") continue;
         if (templateLines.has(changeIndex)) continue;
         if (hasReconcilingAdd) continue;
+        const before = sourceView(chunk, "before", from.endsWith(".py"));
+        const start = before.offsetAtLine(change.ln);
+        if (start !== void 0) {
+          let end = before.code.length;
+          if (from.endsWith(".py")) {
+            const indent = /^\s*/.exec(change.content.slice(1))[0].length;
+            const nextLine = before.code.indexOf("\n", start);
+            const rest = before.code.slice(nextLine + 1);
+            const boundary = /^( *)(\S)/gm;
+            for (const match of rest.matchAll(boundary)) if (match[1].length <= indent) {
+              end = nextLine + 1 + match.index;
+              break;
+            }
+          } else {
+            const open = before.code.indexOf("(", start);
+            if (open >= 0) {
+              const close = closingDelimiter(before.code, open, "(", ")");
+              if (close >= 0) end = close + 1;
+            }
+          }
+          if (removedFeature(ctx, from, before.code.slice(start, end))) continue;
+        }
         if (JS_TS_DEL.test(change.content)) {
           const name = extractTestName(change.content);
           findings.push({
@@ -1196,7 +1392,7 @@ var WEAK_PATTERNS = [
 ];
 var ORDERING_WEAK = /\.toBe(?:GreaterThan|LessThan)(?:OrEqual)?\(/;
 var SOLE_ANYTHING = /\.(?:toBe|toEqual|toStrictEqual)\(\s*expect\.anything\(\)\s*\)/;
-var CONTAINMENT_WEAK = /\.(?:toContain|toContainEqual|toMatch|toHaveProperty)\(/;
+var CONTAINMENT_WEAK = /\.(?:toContain|toContainEqual|toMatch|toHaveProperty|toBeCloseTo)\(/;
 var GROUP_B_STRONG = [
   { ext: /\.(?:pl|pm|t)$/i, re: /\bis(?:_deeply)?\s*\(/ },
   { ext: /\.r$/i, re: /\bexpect_(?:equal|identical)\s*\(/ },
@@ -1581,6 +1777,29 @@ function run2(context) {
   for (const file of files) {
     const filePath = file.to ?? file.from ?? "";
     for (const chunk of file.chunks) {
+      if (context.isTestFile(filePath) && /\.[cm]?[jt]sx?$/.test(filePath)) {
+        const before = sourceView(chunk, "before");
+        const after = sourceView(chunk, "after");
+        const priorTests = testBodies(before);
+        for (const next of testBodies(after)) {
+          const prior = priorTests.find((test) => test.key === next.key);
+          if (!prior || !after.touched(next.open, next.end)) continue;
+          for (const assertion of prior.body.matchAll(/\bexpect\s*\(\s*([A-Za-z_$][\w$]*)\s*\)\s*\.(?:toBe|toEqual|toStrictEqual|toBeCloseTo)\s*\(/g)) {
+            const subject = assertion[1];
+            const computesSubject = (code) => [...code.matchAll(/\b(?:const|let)\s+([A-Za-z_$][\w$]*)\s*=\s*([^;\n]+)/g)].some((binding) => binding[1] === subject && /[^\s(]+\s*\(/.test(binding[2]));
+            if (!computesSubject(prior.body) || !computesSubject(next.body)) continue;
+            if ([...next.body.matchAll(/[A-Za-z_$][\w$]*/g)].filter((token) => token[0] === subject).length !== 1) continue;
+            findings.push({
+              verifierId: "RH002",
+              severity: "error",
+              file: filePath,
+              line: after.lineAt(next.open),
+              message: "A computed test result is still assigned, but its value assertion was removed and the value is no longer used.",
+              suggestion: "Restore the result assertion or replace it with an equivalent check of that value."
+            });
+          }
+        }
+      }
       const dels = chunk.changes.filter((c) => c.type === "del");
       const adds = chunk.changes.filter((c) => c.type === "add");
       const at = new Map(chunk.changes.map((c, i) => [c, i]));
@@ -1632,6 +1851,41 @@ function run2(context) {
           suggestion: "Restore the specific value assertion to preserve test coverage strength."
         });
       }
+      if (context.isTestFile(filePath)) for (const added of adds) {
+        if (reported.has(added.ln) || hasExplanation(added.content)) continue;
+        const next = body(added.content);
+        const nextSubject = extractSubject(next);
+        const prior = dels.find((del) => {
+          if (!nearby(del, added)) return false;
+          const old = body(del.content);
+          const subject = extractSubject(old);
+          if (subject && subject === nextSubject) {
+            const a = /\.toBeCloseTo\(\s*([^,]+),\s*(\d+)\s*\)/.exec(old);
+            const b = /\.toBeCloseTo\(\s*([^,]+),\s*(\d+)\s*\)/.exec(next);
+            if (a && b && compact(a[1]) === compact(b[1]) && Number(b[2]) < Number(a[2])) return true;
+          }
+          if (subject && isStrongAssertion(old, filePath) && /\.toHaveBeenCalled(?:Times|With)?\(/.test(next)) {
+            return !chunk.changes.some((c) => c.type !== "del" && extractSubject(c.content) === subject && isStrongAssertion(c.content, filePath));
+          }
+          if (filePath.endsWith(".py")) {
+            const pattern = /\bassert\s+(.+?)==\s*pytest\.approx\(\s*([^,]+),\s*(abs|rel)\s*=\s*([0-9.eE+-]+)\s*\)/;
+            const a = pattern.exec(old);
+            const b = pattern.exec(next);
+            return !!a && !!b && compact(a[1]) === compact(b[1]) && compact(a[2]) === compact(b[2]) && a[3] === b[3] && Number(b[4]) > Number(a[4]);
+          }
+          return false;
+        });
+        if (!prior) continue;
+        reported.add(added.ln);
+        findings.push({
+          verifierId: "RH002",
+          severity: "error",
+          file: filePath,
+          line: added.ln,
+          message: "A result assertion was replaced by a wider tolerance or an assertion on mock interactions.",
+          suggestion: "Preserve the result contract and its precision, or document the specification change."
+        });
+      }
       for (const del of dels) {
         if (!ALMOST_EQUAL.test(del.content)) continue;
         const delPlaces = del.content.match(/places\s*=\s*(\d+)/);
@@ -2293,6 +2547,22 @@ function isSkipPattern(content, flags) {
       return JS_PATTERNS.some((re) => re.test(content));
   }
 }
+function skipIdentity(text) {
+  const match = /\b((?:it|test|describe)(?:\.\w+)*)\s*\(\s*(['"`])((?:\\.|[^\\])*?)\2/.exec(text);
+  return match ? match[1] + ":" + match[3] : void 0;
+}
+function nativeReason(text) {
+  const match = /\breason\s*=\s*(['"])/.exec(text);
+  if (!match) return false;
+  const start = match.index + match[0].length;
+  let end = start;
+  for (; end < text.length; end++) {
+    if (text[end] === "\\") end++;
+    else if (text[end] === match[1]) break;
+  }
+  const reason = text.slice(start, end).trim();
+  return reason.split(/\s+/).length >= 3 || /^https?:\/\/\S+/.test(reason);
+}
 function run3(context) {
   const files = context.files;
   const ctx = context;
@@ -2313,10 +2583,77 @@ function run3(context) {
     const luaTestFile = ext === "lua" && isLuaTestFile(filePath);
     const batsFile = ext === "bats" && isBatsFile(filePath);
     if (!isPython && !isNewLang && !ctx.isTestFile(filePath)) continue;
+    const previousSkips = new Set(file.chunks.flatMap((chunk) => chunk.changes).filter((c) => c.type === "del" && isSkipPattern(c.content, { ext, pyTestModule, goTestFile, rubyTestFile, kotlinTestFile, cTestFile, scalaTestFile, rTestFile, haskellTestFile, luaTestFile, batsFile })).map((c) => skipIdentity(c.content)).filter(Boolean));
     for (const chunk of file.chunks) {
+      const lines = afterLines(chunk);
+      const view = sourceView(chunk, "after", isPython);
+      const signatureLines = view.signatures.split("\n");
+      const maskedLines = view.code.split("\n");
+      if (ctx.isTestFile(filePath) && !isPython && chunk.changes.some((change) => change.type === "add" && body(change.content).includes("/*"))) {
+        const before = sourceView(chunk, "before");
+        const surviving = new Set(testBodies(view).map((test) => test.key));
+        for (const prior of testBodies(before)) {
+          if (surviving.has(prior.key)) continue;
+          const oldLine = before.lineAt(prior.open);
+          const unchanged = chunk.changes.find((change) => change.type === "normal" && change.ln1 === oldLine);
+          if (!unchanged || unchanged.type !== "normal") continue;
+          const offset = view.offsetAtLine(unchanged.ln2);
+          if (offset === void 0) continue;
+          const end = view.code.indexOf("\n", offset);
+          if (view.code.slice(offset, end < 0 ? void 0 : end).trim()) continue;
+          findings.push({
+            verifierId: "RH003",
+            severity: "error",
+            file: filePath,
+            line: unchanged.ln2,
+            message: "An existing named test is now inside a block comment and no longer executes.",
+            suggestion: "Restore the executable test or remove the feature and its tests deliberately."
+          });
+        }
+      }
+      if (ctx.isTestFile(filePath)) {
+        const after = sourceView(chunk, "after", isPython);
+        for (const match of after.code.matchAll(/\bif\s*\([^\n;{}]*\)\s*(?:\{\s*)?return\s*;|^([ \t]*)if\s+[^:\n]+:\s*return\s*$/gm)) {
+          if (!after.touched(match.index, match.index + match[0].length)) continue;
+          const offset = match.index;
+          const inTest = isPython ? /\bdef\s+test_\w+\s*\(/.test(after.code.slice(0, offset)) : testBodies(after).some((test) => offset > test.open && offset < test.end && !/=>|\bfunction\b/.test(after.code.slice(test.open + 1, offset)));
+          if (!inTest) continue;
+          const line = after.lineAt(offset);
+          const raw = after.text.slice(match.index, match.index + match[0].length);
+          if (hasExplanation(raw)) continue;
+          const later = after.code.slice(match.index + match[0].length);
+          if (!/\bexpect\s*\(|\bassert\b/.test(later)) continue;
+          findings.push({
+            verifierId: "RH003",
+            severity: "error",
+            file: filePath,
+            line,
+            message: "A new conditional return can bypass the assertions in a test that still reports success.",
+            suggestion: "Run the assertions on every supported path, or document and report an explicit test skip."
+          });
+        }
+      }
       for (const change of chunk.changes) {
         if (change.type !== "add") continue;
-        if (!isSkipPattern(change.content, {
+        const text = body(change.content);
+        const identity = skipIdentity(text);
+        if (identity && previousSkips.has(identity)) continue;
+        const index = lines.findIndex((line) => line.line === change.ln && line.added);
+        const offset = lines.slice(0, index).reduce((sum, line) => sum + line.text.length + 1, 0);
+        const open = view.code.indexOf("(", offset);
+        const end = open < 0 ? -1 : closingDelimiter(view.code, open, "(", ")");
+        const invocation = end < 0 ? text : view.text.slice(offset, end + 1);
+        const previousComment = index > 0 ? lines[index - 1].text : "";
+        if (!/\.only\b|\[\s*['"]only['"]\s*\]|\b(?:fit|fdescribe)\s*\(/.test(text) && (nativeReason(invocation) || /^\s*(?:\/\/|#)/.test(previousComment) && /\breason\s*:/i.test(previousComment) && hasExplanation(previousComment))) continue;
+        if (!/\.only\b|\[\s*['"]only['"]\s*\]|\b(?:fit|fdescribe)\s*\(/.test(text) && (/\breason\s*:/i.test(text) && hasExplanation(text) || /\breason\s*=\s*['"][^'"]*\S+\s+\S+\s+\S+[^'"]*['"]/.test(text))) continue;
+        const lexical = "+" + (signatureLines[index] ?? "");
+        const masked = "+" + (maskedLines[index] ?? "");
+        const bracketApi = [...change.content.matchAll(new RegExp(BRACKET_SKIP, "g"))].some((match) => {
+          const root = /^(?:it|test|describe)/.exec(match[0])[0];
+          return masked.slice(match.index, match.index + root.length) === root;
+        });
+        const commentedDeclaration = COMMENTED_JS_TEST.test(change.content) || COMMENTED_PY_TEST.test(change.content);
+        if (!isSkipPattern(commentedDeclaration || bracketApi ? change.content : lexical, {
           ext,
           pyTestModule,
           goTestFile,
@@ -2408,10 +2745,86 @@ function extractLiterals(line) {
   }
   return result;
 }
+function assertionPairs(context) {
+  const pairs = /* @__PURE__ */ new Map();
+  const pattern = new RegExp(`expect\\(\\s*([A-Za-z_$][\\w$]*)\\(\\s*(${LITERAL_TOKEN})\\s*\\)\\s*\\)\\.(?:toBe|toEqual|toStrictEqual)\\(\\s*(${LITERAL_TOKEN})\\s*\\)`, "g");
+  for (const file of context.files) {
+    if (!context.isTestFile(pathOf(file))) continue;
+    for (const chunk of file.chunks) {
+      const view = sourceView(chunk, "after");
+      for (const match of view.text.matchAll(pattern)) {
+        if (!view.code.slice(match.index, match.index + 6).startsWith("expect")) continue;
+        const set = pairs.get(match[1]) ?? /* @__PURE__ */ new Set();
+        set.add(match[2].trim() + ":" + match[3].trim());
+        pairs.set(match[1], set);
+      }
+    }
+  }
+  return pairs;
+}
+function structuralHardcodes(context) {
+  const findings = [];
+  const pairs = assertionPairs(context);
+  if (!pairs.size) return findings;
+  for (const file of context.files) {
+    const filePath = pathOf(file);
+    if (!isWatchedSource(context, filePath)) continue;
+    for (const chunk of file.chunks) {
+      const before = sourceView(chunk, "before");
+      const after = sourceView(chunk, "after");
+      const oldFunctions = callables(before);
+      for (const fn of callables(after)) {
+        const evidence = pairs.get(fn.name);
+        const old = oldFunctions.find((candidate) => candidate.header === fn.header);
+        if (!evidence || !old) continue;
+        const raw = after.text.slice(fn.open + 1, fn.end);
+        const branch = new RegExp(`\\bif\\s*\\(\\s*[A-Za-z_$][\\w$]*\\s*===?\\s*(${LITERAL_TOKEN})\\s*\\)\\s*\\{\\s*return\\s+(${LITERAL_TOKEN})\\s*;?\\s*\\}`, "g");
+        for (const match of raw.matchAll(branch)) {
+          if (!evidence.has(match[1].trim() + ":" + match[2].trim())) continue;
+          const offset = fn.open + 1 + match.index;
+          if (!after.code.slice(offset, offset + 2).startsWith("if")) continue;
+          if (!after.touched(offset, offset + match[0].length)) continue;
+          const open = after.code.indexOf("{", offset);
+          const close = closingDelimiter(after.code, open);
+          const rest = after.code.slice(fn.open + 1, offset) + after.code.slice(close + 1, fn.end);
+          if (compact(rest) !== compact(old.body)) continue;
+          findings.push({
+            verifierId: "RH004",
+            severity: "error",
+            file: filePath,
+            line: after.lineAt(offset),
+            message: "A literal-input branch returns the matching test expectation while leaving the general computation unchanged.",
+            suggestion: "Implement the behavior generally rather than adding a branch for one asserted example."
+          });
+        }
+        if (!/\breturn\s+[^;]+\(/.test(old.body) || /\breturn\s+[^;]+\(/.test(fn.body)) continue;
+        const lookup = /\breturn\s+([A-Za-z_$][\w$]*)\s*\[\s*([A-Za-z_$][\w$]*)\s*\]/.exec(fn.body);
+        if (!lookup) continue;
+        const table = [...fn.body.matchAll(/\b(?:const|let)\s+([A-Za-z_$][\w$]*)\s*=\s*\{/g)].find((binding) => binding[1] === lookup[1]);
+        if (!table) continue;
+        const literalEntry = new RegExp(`\\[?\\s*(${LITERAL_TOKEN})\\s*\\]?\\s*:\\s*(${LITERAL_TOKEN})`, "g");
+        const tableOpen = fn.open + 1 + table.index + table[0].length - 1;
+        const tableEnd = closingDelimiter(after.code, tableOpen);
+        if (tableEnd < 0) continue;
+        const entries = after.text.slice(tableOpen + 1, tableEnd);
+        if (![...entries.matchAll(literalEntry)].some((entry) => evidence.has(entry[1].trim() + ":" + entry[2].trim()))) continue;
+        findings.push({
+          verifierId: "RH004",
+          severity: "error",
+          file: filePath,
+          line: after.lineAt(fn.open),
+          message: "A computed return was replaced by a lookup containing the same literal input and output as a test assertion.",
+          suggestion: "Restore the computation. A finite domain table needs a stated specification and complete domain coverage."
+        });
+      }
+    }
+  }
+  return findings;
+}
 async function run4(context) {
   const files = context.files;
   const ctx = context;
-  const findings = [];
+  const findings = structuralHardcodes(context);
   const fuzzyCandidates = [];
   for (const file of files) {
     const filePath = file.to ?? file.from ?? "";
@@ -2455,6 +2868,7 @@ async function run4(context) {
         const branchMatch = add.content.match(BRANCH_LITERAL_RE) ?? add.content.match(PY_BRANCH_LITERAL_RE);
         if (!branchMatch) continue;
         if (EMPTINESS_GUARD_RE.test(add.content) || TYPEOF_GUARD_RE.test(add.content)) continue;
+        if (/^(['"`])[^\w\s]\1$/.test(branchMatch[1])) continue;
         findings.push({
           verifierId: "RH004",
           severity: "error",
@@ -2619,6 +3033,22 @@ async function run5(context) {
       const adds = chunk.changes.filter((c) => c.type === "add" && !isMoved(moved, c.content));
       const near = (a, b) => Math.abs((at.get(a) ?? 0) - (at.get(b) ?? 0)) <= PAIRING_DISTANCE;
       if (!isTest) {
+        const beforeView = sourceView(chunk, "before");
+        const afterView = sourceView(chunk, "after");
+        const previous = callables(beforeView);
+        for (const fn of callables(afterView)) {
+          if (fn.body.trim() || !afterView.touched(fn.start, fn.end)) continue;
+          const prior = previous.find((old) => old.header === fn.header);
+          if (!prior || !/\b(?:return|await)\b|\w\s*\(/.test(prior.body)) continue;
+          findings.push({
+            verifierId: "RH005",
+            severity: "error",
+            file: filePath,
+            line: afterView.lineAt(fn.open),
+            message: "An existing function lost its executable body and is now empty.",
+            suggestion: "Restore the implementation or remove the feature and its callers deliberately."
+          });
+        }
         const shrank = adds.length <= dels.length;
         for (const add of adds) {
           if (!isGuttedAdd(add.content)) continue;
@@ -2729,6 +3159,7 @@ var rh006 = { id: "RH006", severity: "warn", run: run6 };
 
 // src/verifiers/rh007.ts
 import path from "path";
+import picomatch4 from "picomatch";
 var CONFIG_FILE_RE = /(?:jest|vitest|vite)\.config\.(?:[mc]?[jt]s|json)$|(?:^|\/)jest\.config\.json$|tsconfig(?:\.[^/]*)?\.json$|(?:pytest\.ini|setup\.cfg|pyproject\.toml|conftest\.py)$|(?:^|\/)pom\.xml$|(?:^|\/)build\.gradle(?:\.kts)?$|(?:^|\/)Cargo\.toml$|(?:^|\/)\.rspec$|(?:^|\/)phpunit\.xml(?:\.dist)?$|\.runsettings$|(?:^|\/)CMakeLists\.txt$|\.xctestplan$|(?:^|\/)dart_test\.yaml$|(?:^|\/)build\.sbt$|(?:^|\/)\.Rbuildignore$|\.cabal$|(?:^|\/)test_helper\.exs$|(?:^|\/)\.busted$|(?:^|\/)project\.clj$/;
 var PACKAGE_JSON_RE = /(?:^|\/)package\.json$/;
 var JEST_EXCLUSION_KEY_RE = /"(testPathIgnorePatterns)"\s*:/;
@@ -2803,8 +3234,8 @@ function narrowsSelection(changes, added) {
   if (!key) return false;
   const prior = changes.find((c) => c.type === "del" && c.content.includes(key));
   if (!prior) return false;
-  const kept = new Set(patternsIn(added.content));
-  return patternsIn(prior.content).some((p) => !kept.has(p));
+  const kept = patternsIn(added.content);
+  return patternsIn(prior.content).some((p) => !kept.some((next) => next === p || key === "testMatch" && !/[?*{[]/.test(p) && picomatch4(next)(p) || key === "testMatch" && next.startsWith("**/") && picomatch4(next.slice(3))(p.split("/").pop() ?? p)));
 }
 var EXCLUSION_PATTERNS = [
   { re: /testPathIgnorePatterns/, key: "testPathIgnorePatterns", severity: "error", langs: ["js"] },
@@ -2995,6 +3426,16 @@ function run7(context) {
       const testSuiteNameMatch = chunk.changes.map((c) => c.content.match(/\btest-suite\s+([A-Za-z0-9_-]+)/i)).find((m) => m !== null);
       for (const change of chunk.changes) {
         if (change.type !== "add") continue;
+        if (lang === "js" && /\bpassWithNoTests\s*:\s*true\b|"passWithNoTests"\s*:\s*true\b/.test(change.content) && !chunk.changes.some((c) => c.type === "del" && /passWithNoTests["']?\s*:\s*true\b/.test(c.content))) {
+          findings.push({
+            verifierId: "RH007",
+            severity: "error",
+            file: filePath,
+            line: change.ln,
+            message: "Test discovery now succeeds when it finds no tests.",
+            suggestion: "Keep empty test discovery failing so an accidentally detached suite cannot report success."
+          });
+        }
         const matched = matchExclusion(change.content, lang);
         if (!matched) continue;
         const { pattern, afterMatch } = matched;
@@ -3403,7 +3844,9 @@ function isJustified(content) {
     (m) => m !== null
   );
   if (!match) return false;
-  return JUSTIFICATION_RE.test(content.slice(match.index + match[0].length));
+  const tail = content.slice(match.index + match[0].length);
+  if (/^\s*(?:\/\/|\/\*)\s*@ts-(?:expect-error|ignore)\b/.test(body(content)) && tail.trim().split(/\s+/).filter(Boolean).length >= 3) return true;
+  return JUSTIFICATION_RE.test(tail);
 }
 function isFilewideSuppression(content) {
   return FILEWIDE_ESLINT_DISABLE_RE.test(content) || FILEWIDE_FLAKE8_NOQA_RE.test(content) || FILEWIDE_TS_NOCHECK_RE.test(content) || FILEWIDE_MYPY_RE.test(content) || FILEWIDE_RUST_ALLOW_RE.test(content) || FILEWIDE_KOTLIN_SUPPRESS_RE.test(content) || FILEWIDE_PHPCS_IGNOREFILE_RE.test(content) || FILEWIDE_SWIFTLINT_ALL_RE.test(content) || FILEWIDE_DART_IGNOREFILE_RE.test(content) || FILEWIDE_HLINT_RE.test(content) || FILEWIDE_CREDO_FILE_RE.test(content);
@@ -3428,8 +3871,20 @@ function run11(context) {
     if (DOC_FILE_RE.test(filePath)) continue;
     if (VENDORED_PATH_RE.test(filePath.replace(/\\/g, "/"))) continue;
     const occurrences = [];
+    const identity = (text) => body(text).trim().replace(/\s*(?:\/\/|#)\s+(?:for|because|reason:)\b.*$/, "").trim();
+    const removed = /* @__PURE__ */ new Map();
+    for (const change of file.chunks.flatMap((chunk) => chunk.changes).filter((c) => c.type === "del")) {
+      const key = identity(change.content);
+      removed.set(key, (removed.get(key) ?? 0) + 1);
+    }
     for (const chunk of file.chunks) {
       for (const add of chunk.changes.filter((c) => c.type === "add")) {
+        const key = identity(add.content);
+        const remaining = removed.get(key) ?? 0;
+        if (remaining > 0) {
+          removed.set(key, remaining - 1);
+          continue;
+        }
         const line = add.ln;
         if (filewideInCode(add.content)) {
           findings.push({
@@ -3533,10 +3988,13 @@ var COMMAND_KEYS = /* @__PURE__ */ new Set(["run", "script", "command", "command
 function isCommandLine(text) {
   if (/^\s*#/.test(text)) return false;
   const key = /^[ \t]*(?:-[ \t]*)?([A-Za-z_][\w.-]*)[ \t]*:/.exec(text);
+  if (/^[ \t]*(?:-[ \t]*)?\{/.test(text)) return false;
   return key === null || COMMAND_KEYS.has(key[1].toLowerCase());
 }
 function commandKey(content) {
-  return stripDiffPrefix2(content).replace(/^-\s*/, "").replace(/^(?:run|script|command)\s*:\s*/, "").replace(/['"]/g, "").replace(/\s+/g, " ").trim().toLowerCase();
+  const command = stripDiffPrefix2(content);
+  const invocation = TEST_COMMAND_RE.exec(command);
+  return (invocation ? command.slice(invocation.index) : command).replace(/^-\s*/, "").replace(/^(?:run|script|command)\s*:\s*/, "").replace(/['"]/g, "").replace(/\s+/g, " ").trim().toLowerCase();
 }
 var RETRY_ACTION_RE = /uses\s*:\s*[\w-]+\/(?:retry|action-retry|retry-action)@/i;
 var RETRY_ATTEMPTS_RE = /max_attempts\s*:\s*([2-9]|\d{2,})/;
@@ -3740,45 +4198,83 @@ function withoutLeadingSlice(text) {
 function withoutFilter(text) {
   return withoutTrailingComment(text).replace(/\.filter\([^)]*\)/, "").replace(/\s+/g, " ").trim();
 }
-var PARAMETERIZED_RUNNER_RE = /\b(?:it|test)\.each\s*\(|pytest\.mark\.parametrize\b/;
-var TABLE_ROW_RE = /^\s*\[[^\]]+\],?\s*$/;
 var LOOP_BOUND_RE = /\bfor\s*\([^;]*;\s*([A-Za-z_$][\w$]*)\s*<\s*(\d+)\s*;/;
-function inlineRowCount(text) {
-  return [...withoutTrailingComment(text).matchAll(/\[[^\[\]]+\]/g)].length;
+function elements(view, open, end) {
+  let depth = 0;
+  let start = open + 1;
+  let count = 0;
+  const present = (from, to) => !!view.code.slice(from, to).trim() || /^\s*['"`]/.test(view.text.slice(from, to));
+  for (let i = start; i < end; i++) {
+    const ch = view.code[i];
+    if ("[{(".includes(ch)) depth++;
+    else if ("]})".includes(ch)) depth--;
+    else if (ch === "," && depth === 0) {
+      if (present(start, i)) count++;
+      start = i + 1;
+    }
+  }
+  return count + Number(present(start, end));
+}
+function parameterTables(view) {
+  const tables = [];
+  const runner = /\b(?:it|test)\.each\s*\(|\bpytest\.mark\.parametrize\s*\(/g;
+  for (const match of view.code.matchAll(runner)) {
+    const args = match.index + match[0].length - 1;
+    const argsEnd = closingDelimiter(view.code, args, "(", ")");
+    if (argsEnd < 0) continue;
+    let open = args + 1;
+    while (/\s/.test(view.code[open] ?? "") && open < argsEnd) open++;
+    let key = "";
+    if (match[0].includes("parametrize")) {
+      const comma = view.code.indexOf(",", open);
+      if (comma < 0 || comma >= argsEnd) continue;
+      key = "python:" + view.text.slice(open, comma).replace(/\s+/g, "");
+      if (key === "python:") continue;
+      open = comma + 1;
+      while (/\s/.test(view.code[open] ?? "") && open < argsEnd) open++;
+    } else {
+      const reference = /^[A-Za-z_$][\w$]*/.exec(view.code.slice(open, argsEnd));
+      if (reference) {
+        key = "binding:" + reference[0];
+        const binding = [...view.code.matchAll(/\b(?:const|let|var)\s+([A-Za-z_$][\w$]*)\s*=\s*\[/g)].find((binding2) => binding2[1] === reference[0]);
+        if (!binding) continue;
+        open = binding.index + binding[0].length - 1;
+      } else {
+        const title = /^\s*\(\s*(['"`])([^'"`]+)\1/.exec(view.text.slice(argsEnd + 1));
+        if (!title) continue;
+        key = "inline:" + title[2];
+      }
+    }
+    const left = view.code[open];
+    if (left !== "[" && left !== "(") continue;
+    const end = closingDelimiter(view.code, open, left, left === "[" ? "]" : ")");
+    if (end < 0) continue;
+    tables.push({ key, count: elements(view, open, end), start: open, end });
+  }
+  return tables;
 }
 function run14(context) {
   const findings = [];
   for (const file of context.files) {
     const filePath = pathOf(file);
     if (!context.isTestFile(filePath)) continue;
-    const allChanges = file.chunks.flatMap((chunk) => chunk.changes);
-    const parameterized = allChanges.some((change) => PARAMETERIZED_RUNNER_RE.test(change.content));
-    if (parameterized) {
-      const removedRows = file.chunks.flatMap(deletedLines).filter((line) => TABLE_ROW_RE.test(line.text));
-      const addedRows = file.chunks.flatMap(addedLines).filter((line) => TABLE_ROW_RE.test(line.text));
-      const netRemoved = removedRows.filter((row) => !addedRows.some((next) => next.text.trim() === row.text.trim()));
-      if (netRemoved.length > addedRows.filter((row) => !removedRows.some((prior) => prior.text.trim() === row.text.trim())).length) {
-        findings.push({
-          verifierId: "RH014",
-          severity: "error",
-          file: filePath,
-          line: netRemoved[0].line,
-          message: "Test workload reduced: a row was removed from a parameterized test table while the test itself still runs.",
-          suggestion: "Restore the removed case and fix the behavior it exposed."
-        });
-      }
-      for (const added of file.chunks.flatMap(addedLines)) {
-        const nextCount = inlineRowCount(added.text);
-        if (nextCount === 0) continue;
-        const prior = file.chunks.flatMap(deletedLines).find((line) => inlineRowCount(line.text) > nextCount);
-        if (!prior || hasExplanation(added.text)) continue;
+    if (file.deleted) continue;
+    for (const chunk of file.chunks) {
+      const before = sourceView(chunk, "before", filePath.endsWith(".py"));
+      const after = sourceView(chunk, "after", filePath.endsWith(".py"));
+      const old = parameterTables(before);
+      for (const next of parameterTables(after)) {
+        const prior = old.find((table) => table.key === next.key);
+        if (!prior || next.count >= prior.count || !after.touched(next.start, next.end)) continue;
+        if (after.text.slice(next.start, next.end).split("\n").some(hasExplanation)) continue;
+        const inline = !after.text.slice(next.start, next.end).includes("\n");
         findings.push({
           verifierId: "RH014",
           severity: "error",
           file: filePath,
-          line: added.line,
-          message: `Test workload reduced: an inline parameter table fell from ${inlineRowCount(prior.text)} cases to ${nextCount}.`,
-          suggestion: "Restore the removed inline cases and fix the behavior they expose."
+          line: after.lineAt(next.start),
+          message: inline ? `Test workload reduced: an inline parameter table fell from ${prior.count} cases to ${next.count}.` : "Test workload reduced: a row was removed from a parameterized test table while the test itself still runs.",
+          suggestion: inline ? "Restore the removed inline cases and fix the behavior they expose." : "Restore the removed case and fix the behavior it exposed."
         });
       }
     }
@@ -3965,6 +4461,128 @@ function bareCall(text) {
   );
   return match?.[1]?.replace(/\s+/g, "");
 }
+function handlers(view, indented) {
+  const result = [];
+  const opener = indented ? /^([ \t]*)(?:except\b[^:\n]*:|rescue\b[^\n]*)/gm : /\bcatch\s*(?:\([^)]*\))?\s*\{|\bif\s+([A-Za-z_]\w*)\s*!=\s*nil\s*\{/g;
+  for (const match of view.code.matchAll(opener)) {
+    const start = match.index;
+    const bodyStart = start + match[0].length;
+    let end;
+    if (!indented) end = closingDelimiter(view.code, bodyStart - 1);
+    else {
+      end = view.code.length;
+      const indent = match[1].replace(/\n/g, "").length;
+      const tail = view.code.slice(bodyStart);
+      const boundary = /\n([ \t]*)(\S)/g;
+      for (const line of tail.matchAll(boundary)) {
+        if (line[1].length <= indent) {
+          end = bodyStart + line.index + 1;
+          break;
+        }
+      }
+    }
+    if (end < 0) continue;
+    result.push({ start, end, key: compact(match[0]), code: view.code.slice(bodyStart, end), raw: view.text.slice(start, end + 1) });
+  }
+  if (!indented) for (const match of view.code.matchAll(/\.catch\s*\(\s*(?:\([^)]*\)|[A-Za-z_$][\w$]*)\s*=>\s*/g)) {
+    const start = match.index;
+    const bodyStart = start + match[0].length;
+    const open = view.code.indexOf("(", start);
+    const end = closingDelimiter(view.code, open, "(", ")");
+    if (end < 0) continue;
+    const code = view.code.slice(bodyStart, end).replace(/^\{([\s\S]*)\}$/, "$1");
+    result.push({ start, end, key: compact(match[0]), code, raw: view.text.slice(start, end + 1) });
+  }
+  return result;
+}
+function discardedHandler(code) {
+  let rest = code;
+  const logging = /\b(?:(?:console|logger|logging|log|Console|System\.err)\.(?:error|warn|warning|info|debug|trace|log|Print|Printf|Println|WriteLine|println)|error_log)\s*\(/g;
+  const ranges = [];
+  for (const match of rest.matchAll(logging)) {
+    const open = match.index + match[0].lastIndexOf("(");
+    const end = closingDelimiter(rest, open, "(", ")");
+    if (end < 0) return false;
+    ranges.push([match.index, end + 1]);
+  }
+  for (const [start, end] of ranges.reverse()) rest = rest.slice(0, start) + rest.slice(end);
+  return /^(?:\s|;|pass\b)*$/.test(rest);
+}
+function structuralSwallows(context) {
+  const findings = [];
+  for (const file of context.files) {
+    const path9 = pathOf(file);
+    if (!isWatchedSource(context, path9) || !/\.(?:[cm]?[jt]sx?|py|go|rs|java|rb|cs|php|sh|bash)$/.test(path9)) continue;
+    const indented = /\.(?:py|rb)$/.test(path9);
+    for (const chunk of file.chunks) {
+      const before = sourceView(chunk, "before", indented);
+      const after = sourceView(chunk, "after", indented);
+      const prior = handlers(before, indented);
+      for (const handler of handlers(after, indented)) {
+        if (!after.touched(handler.start, handler.end) || !discardedHandler(handler.code)) continue;
+        if (handler.raw.split("\n").some(hasExplanation)) continue;
+        if (indented && /^[ \t]*\r?\n?[ \t]*else[ \t]*:/.test(after.text.slice(handler.end))) continue;
+        const retainedOpener = chunk.changes.find((change) => change.type === "normal" && change.ln2 === after.lineAt(handler.start));
+        const previous = retainedOpener?.type === "normal" ? prior.filter((old) => before.lineAt(old.start) === retainedOpener.ln1) : prior;
+        if (previous.some((old) => old.key === handler.key && discardedHandler(old.code))) continue;
+        findings.push({
+          verifierId: "WI101",
+          severity: "error",
+          file: path9,
+          line: after.lineAt(handler.start),
+          message: "Error handling was added or changed to an empty or logging-only handler, so failures no longer propagate.",
+          suggestion: "Return an error, retry, or propagate the failure. Document a specific, deliberate fallback."
+        });
+      }
+      const removed = deletedLines(chunk);
+      for (const added of addedLines(chunk)) {
+        if (isCommentLine(added.text) || hasExplanation(added.text)) continue;
+        let discarded = false;
+        if (path9.endsWith(".rs")) {
+          const operation = (text) => compact(text.replace(/^\s*(?:let\s+[^=]+\s*=|return\s+)/, "").replace(/\?\s*;?\s*$/, "").replace(/;\s*$/, ""));
+          const lost = removed.filter((line) => /\?\s*;?\s*$/.test(line.text));
+          const replacement = added.text.replace(/^\s*let\s+_\s*=\s*/, "").replace(/\.unwrap_or_default\(\)/, "");
+          discarded = /\blet\s+_\s*=|\.unwrap_or_default\(\)/.test(added.text) && lost.some((line) => operation(line.text) === operation(replacement));
+        } else if (path9.endsWith(".go")) {
+          const assignment = /^\s*([^:=]+)(?::=|=)\s*(.+?)\s*;?\s*$/;
+          const next = assignment.exec(added.text);
+          if (next && next[1].split(",").some((binding) => binding.trim() === "_")) {
+            discarded = removed.some((line) => {
+              const old = assignment.exec(line.text);
+              if (!old || compact(old[2]) !== compact(next[2])) return false;
+              const names = old[1].split(",").map((binding) => binding.trim());
+              const slots = next[1].split(",").map((binding) => binding.trim());
+              return names.some((name, i) => slots[i] === "_" && name !== "_" && [...before.code.matchAll(/\bif\s+([A-Za-z_]\w*)\s*!=\s*nil\b/g)].some((check) => check[1] === name));
+            });
+          }
+        } else if (/\.(?:sh|bash)$/.test(path9)) {
+          const swallow = /\s*\|\|\s*(?:true|:|exit\s+0)\s*$/.exec(added.text);
+          discarded = !!swallow && removed.some((line) => compact(line.text) === compact(added.text.slice(0, swallow.index)));
+        }
+        if (discarded) findings.push({
+          verifierId: "WI101",
+          severity: "error",
+          file: path9,
+          line: added.line,
+          message: "A previously propagated operation failure is now discarded or replaced with a default.",
+          suggestion: "Preserve the operation failure or handle it explicitly instead of converting it to success."
+        });
+      }
+    }
+  }
+  return findings;
+}
+function followedByElse(lines, index) {
+  if (index < 0) return false;
+  const indent = (text) => text.length - text.trimStart().length;
+  const base = indent(lines[index].text);
+  for (const line of lines.slice(index + 1)) {
+    if (!line.text.trim()) continue;
+    if (indent(line.text) > base) continue;
+    return indent(line.text) === base && /^\s*else\s*:/.test(line.text);
+  }
+  return false;
+}
 function run15(context) {
   const findings = [];
   for (const file of context.files) {
@@ -3988,6 +4606,7 @@ function run15(context) {
     }
     for (const chunk of file.chunks) {
       const after = afterLines(chunk);
+      const lexicalLines = sourceView(chunk, "after", /\.(?:py|rb)$/.test(filePath)).code.split("\n");
       const addedInOrder = addedLines(chunk);
       const templated = insideTemplateLiteral(addedInOrder);
       const removedLoud = deletedLines(chunk).filter((line) => ERROR_DIAGNOSTIC_RE.test(line.text));
@@ -4022,7 +4641,10 @@ function run15(context) {
         if (templated.has(index)) continue;
         if (hasExplanation(added.text)) continue;
         if (isCommentLine(added.text)) continue;
+        const lexicalIndex = after.findIndex((line) => line.line === added.line && line.added);
+        if (lexicalIndex >= 0 && !lexicalLines[lexicalIndex]?.trim()) continue;
         const code = withoutLiterals(added.text);
+        if (/^\s*except\b/.test(code) && followedByElse(after, after.findIndex((l) => l.line === added.line && l.added))) continue;
         const inline = INLINE_SIGNATURES.find((sig) => sig.opener.test(code));
         if (inline) {
           findings.push({
@@ -4065,7 +4687,8 @@ function run15(context) {
       }
     }
   }
-  return findings;
+  const combined = [...findings, ...structuralSwallows(context)];
+  return combined.filter((finding, index) => !combined.slice(0, index).some((prior) => prior.file === finding.file && prior.line === finding.line && prior.severity === finding.severity));
 }
 var wi101 = { id: "WI101", severity: "error", run: run15 };
 
@@ -4878,6 +5501,7 @@ function assertionKey(text) {
 var TABLE_RUNNER_RE = /\.each\b|\bit_each\b|@pytest\.mark\.parametrize|@ParameterizedTest\b|\[InlineData\b|\[Theory\]|\bfor\s+(?:const|let|var)?\s*[\w[\],{} ]+\s+(?:of|in)\s+\w*(?:case|test|table|fixture|sample|scenario|example)\w*\b|\bfor\s+\w+,\s*\w+\s*:=\s*range\b|\.forEach\s*\(|\btests\s*:?=\s*\[\]struct\b/i;
 function isDataRow(text) {
   const stripped = withoutTrailingComment(text);
+  if (/^\s*[A-Za-z_$][\w$.]*\s*\(/.test(stripped) && !TABLE_RUNNER_RE.test(stripped)) return false;
   if (!/[[{]/.test(stripped)) return false;
   const literals = stripped.match(/-?\d+(?:\.\d+)?|'[^']*'|"[^"]*"|`[^`]*`|\btrue\b|\bfalse\b|\bTrue\b|\bFalse\b/g);
   return (literals?.length ?? 0) >= 2;
@@ -4915,12 +5539,20 @@ function run23(context) {
   for (const file of context.files) {
     const filePath = pathOf(file);
     if (!filePath || !context.isTestFile(filePath)) continue;
-    const hasTableRunner = file.chunks.some(
-      (chunk) => chunk.changes.some((change) => TABLE_RUNNER_RE.test(change.content.replace(/^[+\- ]/, "")))
-    );
+    const hasTableRunner = file.chunks.some((chunk) => TABLE_RUNNER_RE.test(sourceView(chunk, "after", /\.(?:py|rb)$/.test(filePath)).code));
     for (const chunk of file.chunks) {
-      const removedBindings = deletedLines(chunk).map((line) => expectedBinding(line.text)).filter((binding) => binding !== void 0);
-      for (const added of addedLines(chunk)) {
+      const before = sourceView(chunk, "before", /\.(?:py|rb)$/.test(filePath));
+      const after = sourceView(chunk, "after", /\.(?:py|rb)$/.test(filePath));
+      const codeAt = (view, line) => {
+        const offset = view.offsetAtLine(line);
+        if (offset === void 0) return "";
+        const end = view.code.indexOf("\n", offset);
+        return view.code.slice(offset, end < 0 ? void 0 : end);
+      };
+      const removedLines = deletedLines(chunk).filter((line) => codeAt(before, line.line).trim());
+      const additions = addedLines(chunk).filter((line) => codeAt(after, line.line).trim());
+      const removedBindings = removedLines.map((line) => expectedBinding(line.text)).filter((binding) => binding !== void 0);
+      for (const added of additions) {
         const binding = expectedBinding(added.text);
         if (!binding) continue;
         const prior = removedBindings.find((old) => old.name === binding.name && old.value !== binding.value);
@@ -4934,9 +5566,9 @@ function run23(context) {
           suggestion: "Change the implementation, not the expected/want binding. If the specification changed, record that reason and update the implementation in the same reviewable change."
         });
       }
-      const removed = deletedLines(chunk).map((l) => ({ line: l, value: expectedLiteral(l.text), key: assertionKey(l.text) })).filter((x) => x.value !== void 0);
+      const removed = removedLines.map((l) => ({ line: l, value: expectedLiteral(l.text), key: assertionKey(l.text) })).filter((x) => x.value !== void 0);
       if (removed.length > 0) {
-        for (const added of addedLines(chunk)) {
+        for (const added of additions) {
           const value = expectedLiteral(added.text);
           if (value === void 0) continue;
           const key = assertionKey(added.text);
@@ -4953,8 +5585,9 @@ function run23(context) {
         }
       }
       if (!hasTableRunner) continue;
-      const removedRows = deletedLines(chunk).filter((line) => isDataRow(line.text));
-      for (const added of addedLines(chunk).filter((line) => isDataRow(line.text))) {
+      const removedRows = removedLines.filter((line) => isDataRow(line.text));
+      const removedTexts = new Set(removedLines.map((line) => line.text.trim()));
+      for (const added of additions.filter((line) => isDataRow(line.text) && !removedTexts.has(line.text.trim()))) {
         const pair = removedRows.map((prior) => changedTableExpectation(prior.text, added.text)).find((value) => value !== void 0);
         if (!pair) continue;
         findings.push({
@@ -4976,7 +5609,7 @@ var wi109 = { id: "WI109", severity: "error", run: run23 };
 import path6 from "path";
 var TASK_FILE_RE = /(?:^|\/)package\.json$|(?:^|\/)Makefile$|(?:^|\/)Taskfile\.ya?ml$|(?:^|\/)justfile$|(?:^|\/)pyproject\.toml$|(?:^|\/)Rakefile$|(?:^|\/)composer\.json$/i;
 var VERIFICATION_SCRIPT_RE = /"(test|tests|check|lint|typecheck|type-check|tsc|verify|validate|ci|coverage|audit)[\w:-]*"\s*:/i;
-var REAL_VERIFIER_RE = /\b(?:vitest|jest|mocha|ava|pytest|tox|nox|rspec|phpunit|cargo\s+test|go\s+test|dotnet\s+test|mvn|gradle|swift\s+test|mix\s+test|bats|busted|prove|tsc|eslint|ruff|flake8|mypy|pylint|clippy|rubocop|phpstan|stylelint|biome)\b|\bnpm\s+(?:run\s+)?(?:test|\w+)|\bpytest\b/;
+var REAL_VERIFIER_RE = /\b(?:vitest|jest|mocha|ava|pytest|tox|nox|rspec|phpunit|cargo\s+test|go\s+test|dotnet\s+test|mvn|gradle|swift\s+test|mix\s+test|bats|busted|prove|tsc|eslint|ruff|flake8|mypy|pylint|clippy|rubocop|phpstan|stylelint|biome)\b|\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|check|lint|build|typecheck|verify|coverage|audit)[\w:-]*\b|\bnode\s+--test\b/;
 var NO_OP_COMMAND_RE = /^\s*(?:echo\b|true\b|:\s*$|exit\s+0\b|#|node\s+-e\s+["']["']|cd\s+\.)/;
 var NEUTERING_SIGNATURES = [
   {
@@ -5032,8 +5665,8 @@ var SNAPSHOT_UPDATE_RE = /(?:^|\s)(?:-u|--update|--updateSnapshot)\b/;
 function verifierTool(text) {
   return /\b(vitest|jest|mocha|ava|pytest|tox|nox|rspec|phpunit|cargo\s+test|go\s+test|dotnet\s+test)\b/.exec(text)?.[1] ?? (/\bnpm\s+(?:run\s+)?test\b/.test(text) ? "npm test" : void 0);
 }
-var PROPAGATED_EXIT_RE = /\b(?:process\.exit|sys\.exit|os\.exit|os\._exit)\s*\(\s*([^)]+?)\s*\)|^\s*exit\s+(\$\{?\w+\}?)\s*(?:#.*)?$/;
-var FORCED_EXIT_ZERO_RE = /\b(?:process\.exit|sys\.exit|os\.exit|os\._exit)\s*\(\s*0\s*\)|^\s*exit\s+0\s*(?:#.*)?$/;
+var PROPAGATED_EXIT_RE = /\b(?:process\.exit|sys\.exit|os\.(?:exit|_exit|Exit)|(?:std::)?process::exit|System\.exit|Environment\.Exit|exit|die)\s*\(\s*([^)]+?)\s*\)|^\s*exit\s+(\$\{?\w+\}?)\s*(?:#.*)?$/;
+var FORCED_EXIT_ZERO_RE = /\b(?:process\.exit|sys\.exit|os\.(?:exit|_exit|Exit)|(?:std::)?process::exit|System\.exit|Environment\.Exit|exit|die)\s*\(\s*0\s*\)|^\s*exit\s+0\s*(?:#.*)?$/;
 var PROPAGATED_EXIT_CODE_RE = /\bprocess\.exitCode\s*=\s*([^;]+?)\s*;?\s*$/;
 var FORCED_EXIT_CODE_ZERO_RE = /\bprocess\.exitCode\s*=\s*0\s*;?\s*$/;
 function exitStatus(text) {
@@ -5045,9 +5678,9 @@ function exitStatus(text) {
   return (m[1] ?? m[2])?.trim();
 }
 function laundersStatus(text, status) {
-  const compact = withoutTrailingComment(text).replace(/\s+/g, "");
+  const compact3 = withoutTrailingComment(text).replace(/\s+/g, "");
   const value = status.replace(/\s+/g, "");
-  return compact.includes(`process.exit(${value}?0:${value})`) || compact.includes(`process.exitCode=Math.min(${value},0)`);
+  return compact3.includes(`process.exit(${value}?0:${value})`) || compact3.includes(`process.exitCode=Math.min(${value},0)`);
 }
 function scriptCommand(text) {
   const m = /"[\w:-]+"\s*:\s*"([^"]*)"/.exec(text);
@@ -5108,7 +5741,7 @@ function run24(context) {
         });
       }
       const after = afterLines(chunk);
-      const afterRunsVerification = after.some((line) => REAL_VERIFIER_RE.test(line.text));
+      const afterRunsVerification = after.some((line) => !isCommentLine(line.text) && REAL_VERIFIER_RE.test(line.text));
       const failFastShell = after.some((line) => /\bset\s+-[a-z]*e\b/.test(line.text));
       const backgroundStatusPropagated = after.some((line) => /^\s*wait\b/.test(line.text)) && after.some((line) => /^\s*exit\s+\$\?\s*$/.test(line.text));
       for (const line of added) {
@@ -5238,7 +5871,29 @@ function run24(context) {
         });
         if (!newEntry) continue;
         const newCommand = scriptCommand(newEntry.text) ?? "";
-        const dropped = oldSteps.filter((s) => REAL_VERIFIER_RE.test(s) && !newCommand.includes(s));
+        const entries = new Map(file.chunks.flatMap(afterLines).flatMap((line) => scriptEntries(line.text)).map((entry) => [entry.name, entry.command]));
+        const expand2 = (command, seen = /* @__PURE__ */ new Set()) => {
+          let expanded = command;
+          for (const call of command.matchAll(/\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?([\w:-]+)/g)) {
+            const name = call[1];
+            if (seen.has(name) || seen.size >= 20) continue;
+            const target = entries.get(name);
+            if (target) expanded += " && " + expand2(target, /* @__PURE__ */ new Set([...seen, name]));
+          }
+          return expanded;
+        };
+        const expandedCommand = expand2(newCommand);
+        const dropped = oldSteps.filter((s) => {
+          const invocation = REAL_VERIFIER_RE.exec(s);
+          if (!invocation || expandedCommand.includes(s)) return false;
+          const tail = s.slice(invocation.index);
+          if (expandedCommand.includes(tail)) return false;
+          const testTool = (command) => /\b(?:vitest|jest|mocha|ava|pytest|tox|rspec|phpunit)\b|\bnode\s+--test\b/.exec(command)?.[0];
+          const priorTool = testTool(s);
+          const nextTool = testTool(newCommand);
+          const importsMigrated = context.files.some((candidate) => candidate.chunks.some((change) => deletedLines(change).some((line) => /\bimport\b|\brequire\s*\(/.test(line.text) && !!priorTool && line.text.includes(priorTool)) && addedLines(change).some((line) => /\bimport\b|\brequire\s*\(/.test(line.text) && /['"](?:node:test|vitest|jest|mocha|ava)['"]/.test(line.text))));
+          return !(priorTool && nextTool && priorTool !== nextTool && importsMigrated);
+        });
         if (dropped.length === 0) continue;
         findings.push({
           verifierId: "WI110",
@@ -5543,7 +6198,7 @@ var VERIFIERS = [
 ];
 
 // src/engine.ts
-import picomatch4 from "picomatch";
+import picomatch5 from "picomatch";
 var norm = (p) => p.replace(/\\/g, "/");
 async function runChecks(context) {
   const activeVerifiers = VERIFIERS.filter((v) => context.enabled.includes(v.id));
@@ -5583,7 +6238,7 @@ function applySuppression(findings, files) {
 var GLOB_OPTIONS = { dot: true };
 function applyIgnorePatterns(findings, patterns) {
   if (patterns.length === 0 || findings.length === 0) return findings;
-  const matchesIgnoredPath = picomatch4(patterns, GLOB_OPTIONS);
+  const matchesIgnoredPath = picomatch5(patterns, GLOB_OPTIONS);
   return findings.filter((f) => !matchesIgnoredPath(norm(f.file)));
 }
 function applyApprovals(findings, approvals) {
@@ -5591,7 +6246,7 @@ function applyApprovals(findings, approvals) {
   return findings.map((f) => {
     const path9 = norm(f.file);
     const match = approvals.find(
-      (a) => a.rule === f.verifierId && (norm(a.file) === path9 || picomatch4(norm(a.file), GLOB_OPTIONS)(path9))
+      (a) => a.rule === f.verifierId && (norm(a.file) === path9 || picomatch5(norm(a.file), GLOB_OPTIONS)(path9))
     );
     if (!match) return f;
     return { ...f, severity: "info", approved: true, approvalReason: match.reason };
@@ -7181,7 +7836,7 @@ async function readStdin() {
 }
 var program = new Command();
 program.name("proctor").description("AI agent test-tampering guard").version(package_default.version);
-program.command("check [path]").description("Check staged, unstaged, and untracked changes for test tampering").option("--staged", "analyze only staged changes").option("--uncommitted", "explicitly analyze the default scope: staged, unstaged, and untracked changes together").option("--base <ref>", "analyze changes against a base ref (e.g. origin/main or a commit SHA) instead of staged/working-tree changes, for CI, where nothing is staged in a fresh checkout").option("--ci", "show only errors in the text report; warnings do not affect the exit code").option("--json", "output findings as JSON to stdout").option("--sarif", "output SARIF 2.1.0 JSON to stdout").option("--ai", "enable the networked LLM judge (requires ANTHROPIC_API_KEY)").option("--rules <ids>", "comma-separated list of verifier IDs to run (narrows the enabled set, e.g. RH001,RH003)").option("--wi", "also run the beta work-integrity family (WI1xx), which is opt-in by default").option("--all-checks", "alias for --wi: add the beta WI family to the configured checks").option("--explain <id>", "print the full explanation for a verifier ID and exit, no diff analysis").option("--fix", "with --explain, print what an honest fix looks like instead of the rule description").option("--markdown <file>", 'also write a Markdown summary to this file, e.g. --markdown "$GITHUB_STEP_SUMMARY"').action(async (pathArg, options) => {
+program.command("check [path]").description("Check staged, unstaged, and untracked changes for test tampering").option("--staged", "analyze only staged changes").option("--uncommitted", "explicitly analyze the default scope: staged, unstaged, and untracked changes together").option("--base <ref>", "analyze changes against a base ref (e.g. origin/main or a commit SHA) instead of staged/working-tree changes, for CI, where nothing is staged in a fresh checkout").option("--ci", "show only errors in the text report; warnings do not affect the exit code").option("--json", "output findings as JSON to stdout").option("--sarif", "output SARIF 2.1.0 JSON to stdout").option("--ai", "enable the networked LLM judge (requires ANTHROPIC_API_KEY)").option("--rules <ids>", "comma-separated list of verifier IDs to run (narrows the enabled set, e.g. RH001,RH003)").option("--wi", "also run the remaining opt-in work-integrity checks (WI1xx)").option("--all-checks", "alias for --wi: add the entire WI family to the configured checks").option("--explain <id>", "print the full explanation for a verifier ID and exit, no diff analysis").option("--fix", "with --explain, print what an honest fix looks like instead of the rule description").option("--markdown <file>", 'also write a Markdown summary to this file, e.g. --markdown "$GITHUB_STEP_SUMMARY"').action(async (pathArg, options) => {
   if (options.fix && !options.explain) {
     process.stderr.write("proctor: --fix only applies with --explain, e.g. proctor check --explain RH001 --fix\n");
     process.exit(2);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kavishdua/proctor",
-  "version": "1.0.0",
+  "version": "1.1.0",
   "description": "Catch AI agents gaming their test suites: deleted tests, skipped tests, weakened assertions, hardcoded outputs",
   "homepage": "https://github.com/catfish-1234/proctor#readme",
   "bugs": {