devrites 6.0.1 → 6.0.3

package/engine/internal/lib/dispatch.go

@@ -6,6 +6,8 @@ import (
 	"io"
 	"os"
 	"path/filepath"
+	"regexp"
+	"slices"
 	"sort"
 	"strings"
 	"time"
@@ -19,24 +21,38 @@ import (
 // fan-out cannot silently degrade to serial (open -> every role started ->
 // seal -> returns -> complete). start/return also auto-record metrics events.
 //
-//	devrites-engine dispatch <slug> <sub> [--phase p] [--wave w] [--role r] [--handle h] [--reason s]
+//	devrites-engine dispatch <slug> <sub> [--phase p] [--wave w] [--role r] [--handle h] [--reason s] [--slice SLICE-###] [--reslice-review <DRIFT-ID>]
 
-const dispatchUsage = `usage: devrites-engine dispatch <slug> <open|start|seal|return|status|abandon> [--phase p] [--wave w] [--role r] [--handle h] [--reason s]
+const dispatchUsage = `usage: devrites-engine dispatch <slug> <open|start|seal|return|status|abandon> [--phase p] [--wave w] [--role r] [--handle h] [--reason s] [--slice SLICE-###] [--reslice-review <DRIFT-ID>]
 
 Wave barrier for parallel agent dispatch: seal fails until every declared
 role has a distinct handle; return fails before seal; status exits nonzero
 while a wave is open, sealed, or abandoned.
+
+A build wave with a wright role must name its slice(s) with --slice; a vet
+wave may (slice-bound recheck). Every 5 rounds of one kind on one slice, the
+next open is blocked until --reslice-review names a drift.md
+"## <DRIFT-ID>" heading for that slice.
 `
 
+// wrightRoundsPerReview is how many build wright rounds (or slice-bound Vet
+// rechecks) one slice may take before (and after each) reslice review.
+// Recovery itself stays unbounded; the cap only forces the split question
+// onto the record.
+const wrightRoundsPerReview = 5
+
 type dispatchFile struct {
 	Waves map[string]*dispatchWave `json:"waves"`
 }
 
 type dispatchWave struct {
-	Phase  string                   `json:"phase"`
-	State  string                   `json:"state"` // open, sealed, abandoned, complete
-	Reason string                   `json:"reason,omitempty"`
-	Roles  map[string]*dispatchRole `json:"roles"`
+	Phase           string                   `json:"phase"`
+	State           string                   `json:"state"` // open, sealed, abandoned, complete
+	Reason          string                   `json:"reason,omitempty"`
+	Roles           map[string]*dispatchRole `json:"roles"`
+	Slices          []string                 `json:"slices,omitempty"`
+	ResliceReview   string                   `json:"reslice_review,omitempty"`
+	ResliceReviewed []string                 `json:"reslice_reviewed,omitempty"`
 }
 
 type dispatchRole struct {
@@ -89,8 +105,8 @@ func nowStamp() string { return time.Now().UTC().Format(time.RFC3339) }
 
 // RunDispatch implements the dispatch wave state machine.
 func RunDispatch(root string, args []string, stdout, stderr io.Writer) int {
-	var slug, sub, phase, wave, role, handle, reason string
-	var roles []string
+	var slug, sub, phase, wave, role, handle, reason, review string
+	var roles, sliceIDs []string
 	var positional []string
 	for i := 0; i < len(args); i++ {
 		value := argAt(args, i+1)
@@ -106,6 +122,10 @@ func RunDispatch(root string, args []string, stdout, stderr io.Writer) int {
 			handle = value
 		case "--reason":
 			reason = value
+		case "--slice":
+			sliceIDs = append(sliceIDs, value)
+		case "--reslice-review":
+			review = value
 		default:
 			if strings.HasPrefix(args[i], "-") {
 				fmt.Fprintf(stderr, "dispatch: unknown flag %q\n", args[i])
@@ -129,7 +149,7 @@ func RunDispatch(root string, args []string, stdout, stderr io.Writer) int {
 	// an update and strand the wave short of complete.
 	code := 0
 	if err := state.WithFeatureLock(root, slug, func() error {
-		code = dispatchLocked(root, slug, sub, phase, wave, role, handle, reason, roles, stdout, stderr)
+		code = dispatchLocked(root, slug, sub, phase, wave, role, handle, reason, roles, sliceIDs, review, stdout, stderr)
 		return nil
 	}); err != nil {
 		fmt.Fprintf(stderr, "dispatch: %v\n", err)
@@ -138,7 +158,7 @@ func RunDispatch(root string, args []string, stdout, stderr io.Writer) int {
 	return code
 }
 
-func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, roles []string, stdout, stderr io.Writer) int {
+func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, roles, sliceIDs []string, review string, stdout, stderr io.Writer) int {
 	f, path, err := loadDispatch(root, slug)
 	if err != nil {
 		fmt.Fprintf(stderr, "dispatch: %v\n", err)
@@ -166,18 +186,25 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 		if w := getWave(); w != nil && w.State != "abandoned" {
 			return fail("wave %q already exists (state %s)", wave, w.State)
 		}
-		w := &dispatchWave{Phase: phase, State: "open", Roles: map[string]*dispatchRole{}}
+		w := &dispatchWave{Phase: phase, State: "open", Roles: map[string]*dispatchRole{}, Slices: sliceIDs}
 		for _, r := range roles {
 			if w.Roles[r] != nil {
 				return fail("duplicate role %q in wave", r)
 			}
 			w.Roles[r] = &dispatchRole{}
 		}
+		rounds, code := admitWrightRounds(root, slug, f, w, review, stderr)
+		if code != 0 {
+			return code
+		}
 		f.Waves[wave] = w
 		if err := saveDispatch(path, f); err != nil {
 			return fail("%v", err)
 		}
 		fmt.Fprintf(stdout, "dispatch: wave %s open, %d roles declared\n", wave, len(roles))
+		for _, line := range rounds {
+			fmt.Fprintln(stdout, line)
+		}
 		return 0
 
 	case "start":
@@ -322,6 +349,114 @@ func dispatchLocked(root, slug, sub, phase, wave, role, handle, reason string, r
 	return 2
 }
 
+// roundKind names the capped loop a wave belongs to: build wright rounds or
+// slice-bound Vet rechecks. Other waves are uncapped.
+func roundKind(w *dispatchWave) string {
+	switch {
+	case isBuildWrightWave(w):
+		return "wright"
+	case strings.EqualFold(w.Phase, "vet") && len(w.Slices) > 0:
+		return "vet"
+	}
+	return ""
+}
+
+func isBuildWrightWave(w *dispatchWave) bool {
+	if w.Phase != "build" {
+		return false
+	}
+	for r := range w.Roles {
+		if strings.Contains(r, "wright") {
+			return true
+		}
+	}
+	return false
+}
+
+// admitWrightRounds enforces the per-slice round cap for a new build wright
+// or slice-bound Vet wave and returns the round lines to print. A slice may
+// take wrightRoundsPerReview rounds of each kind per reslice review (the first
+// window is free); beyond that the open needs --reslice-review naming an
+// unused drift.md heading for every slice over the cap.
+func admitWrightRounds(root, slug string, f *dispatchFile, w *dispatchWave, review string, stderr io.Writer) ([]string, int) {
+	kind := roundKind(w)
+	if kind == "" {
+		if review != "" || (len(w.Slices) > 0 && !strings.EqualFold(w.Phase, "vet")) {
+			fmt.Fprintln(stderr, "dispatch: --slice/--reslice-review apply only to build wright waves and slice-bound vet waves")
+			return nil, 2
+		}
+		return nil, 0
+	}
+	if len(w.Slices) == 0 {
+		fmt.Fprintln(stderr, "dispatch: a build wright wave needs --slice SLICE-### for each slice it builds")
+		return nil, 2
+	}
+	for _, id := range w.Slices {
+		if !state.ValidSliceID(id) {
+			fmt.Fprintf(stderr, "dispatch: %q is not a SLICE-### id\n", id)
+			return nil, 2
+		}
+	}
+	var lines, overCap []string
+	for _, id := range w.Slices {
+		prior, reviews := 0, 0
+		for _, other := range f.Waves {
+			if other.State == "abandoned" || roundKind(other) != kind {
+				continue
+			}
+			if slices.Contains(other.Slices, id) {
+				prior++
+			}
+			if slices.Contains(other.ResliceReviewed, id) {
+				reviews++
+			}
+		}
+		round := prior + 1
+		if round > wrightRoundsPerReview*(1+reviews) {
+			overCap = append(overCap, id)
+		}
+		lines = append(lines, fmt.Sprintf("dispatch: %s %s round %d (reslice review every %d)", id, kind, round, wrightRoundsPerReview))
+	}
+	if len(overCap) == 0 {
+		if review != "" {
+			fmt.Fprintf(stderr, "dispatch: --reslice-review given but no slice has reached its %d-round cap\n", wrightRoundsPerReview)
+			return nil, 2
+		}
+		return lines, 0
+	}
+	if review == "" {
+		fmt.Fprintf(stderr, "dispatch: BLOCKED: %s reached %d %s rounds; run a reslice review (acceptance-preserving split or simpler proof seam, or a drift.md entry recording why neither applies) and reopen with --reslice-review <DRIFT-ID>\n",
+			strings.Join(overCap, ","), wrightRoundsPerReview, kind)
+		return nil, 3
+	}
+	for _, other := range f.Waves {
+		if other.State != "abandoned" && other.ResliceReview == review && roundKind(other) == kind {
+			fmt.Fprintf(stderr, "dispatch: BLOCKED: reslice review %s already admitted another round window\n", review)
+			return nil, 3
+		}
+	}
+	drift, err := readWorkspaceArtifact(root, slug, "drift.md")
+	if err != nil {
+		fmt.Fprintf(stderr, "dispatch: BLOCKED: reslice review %s: %v\n", review, err)
+		return nil, 3
+	}
+	heading := driftHeading(string(drift), review)
+	for _, id := range overCap {
+		if !regexp.MustCompile(`\b` + regexp.QuoteMeta(id) + `\b`).MatchString(heading) {
+			fmt.Fprintf(stderr, "dispatch: BLOCKED: drift.md has no \"## %s\" heading naming %s\n", review, id)
+			return nil, 3
+		}
+	}
+	w.ResliceReview, w.ResliceReviewed = review, overCap
+	return lines, 0
+}
+
+// driftHeading returns the drift.md level-2 heading line for id, or "".
+func driftHeading(drift, id string) string {
+	re := regexp.MustCompile(`(?m)^## ` + regexp.QuoteMeta(id) + `\b.*$`)
+	return re.FindString(drift)
+}
+
 func waveState(w *dispatchWave) string {
 	if w == nil {
 		return "absent"

package/engine/internal/lib/drift.go

@@ -48,7 +48,7 @@ type driftBaseline struct {
 // driftDiff is one input whose state differs from the baseline.
 type driftDiff struct {
 	Path string `json:"path"`
-	Kind string `json:"kind"` // changed | missing | added
+	Kind string `json:"kind"` // changed | missing | added | reviewed-identity-only
 }
 
 // RunCheckDrift implements `devrites-engine check drift`.
@@ -130,6 +130,10 @@ func compareDrift(workspace, baselinePath string, digests []gate.ReadinessInputD
 	if baseline.Binding != binding && len(diffs) == 0 {
 		fmt.Fprintln(stdout, "DRIFT: aggregate binding changed without a recorded input diff; re-record the baseline")
 	}
+	if len(diffs) == 1 && diffs[0].Kind == "reviewed-identity-only" {
+		fmt.Fprintln(stdout, "check drift: reviewed-identity-only — only the Workflow Artifact reviewed identity moved; /rite-vet may use its bytes-only recheck")
+		return 0
+	}
 	fmt.Fprintf(stdout, "check drift: %d input(s) differ — a change is legal only as a dated delta through the owning rite; otherwise restore the input or rerun /rite-vet and --record\n", len(diffs))
 	return 0
 }
@@ -189,7 +193,11 @@ func diffInputs(base, current []gate.ReadinessInputDigest) []driftDiff {
 			}
 			diffs = append(diffs, driftDiff{Path: b.Path, Kind: kind})
 		case b.Present && b.SHA256 != c.SHA256:
-			diffs = append(diffs, driftDiff{Path: b.Path, Kind: "changed"})
+			kind := "changed"
+			if b.Normalized != "" && b.Normalized == c.Normalized {
+				kind = "reviewed-identity-only"
+			}
+			diffs = append(diffs, driftDiff{Path: b.Path, Kind: kind})
 		}
 	}
 	sort.Slice(diffs, func(i, j int) bool { return diffs[i].Path < diffs[j].Path })

package/engine/internal/lib/drift_test.go

@@ -104,3 +104,32 @@ func TestDriftCorruptBaselineBlocks(t *testing.T) {
 		t.Fatalf("code=%d out=%s", code, out)
 	}
 }
+
+func TestDriftClassifiesReviewedIdentityOnlyChange(t *testing.T) {
+	root, featureDir := driftWorkspace(t)
+	if code, out := checkDrift(t, root, "feat", "--record"); code != 0 {
+		t.Fatalf("record code=%d out=%s", code, out)
+	}
+	plan := filepath.Join(featureDir, "test-plan.md")
+	line := "Workflow Artifact reviewed identity: " + strings.Repeat("ab", 32) + "\n"
+	writeFile(t, plan, "# test-plan.md\n\ncontent\n"+line)
+	code, out := checkDrift(t, root, "feat")
+	if code != 0 || !strings.Contains(out, "test-plan.md reviewed-identity-only") || !strings.Contains(out, "bytes-only recheck") {
+		t.Fatalf("identity-only change not classified: code=%d\n%s", code, out)
+	}
+	// Any other edit, including a malformed identity line, is ordinary drift.
+	for _, body := range []string{
+		"# test-plan.md\n\nchanged\n" + line,
+		"# test-plan.md\n\ncontent\nWorkflow Artifact reviewed identity: not-a-digest\n",
+	} {
+		writeFile(t, plan, body)
+		if _, out := checkDrift(t, root, "feat"); !strings.Contains(out, "test-plan.md changed") || strings.Contains(out, "bytes-only") {
+			t.Fatalf("non-identity edit hidden:\n%s", out)
+		}
+	}
+	writeFile(t, plan, "# test-plan.md\n\ncontent\n"+line)
+	writeFile(t, filepath.Join(featureDir, "plan.md"), "# plan.md\n\nrewritten\n")
+	if _, out := checkDrift(t, root, "feat"); strings.Contains(out, "bytes-only") {
+		t.Fatalf("a second changed input must void the bytes-only route:\n%s", out)
+	}
+}

package/engine/internal/lib/slicecheck.go

@@ -29,6 +29,22 @@ var (
 	windowsDrivePath = regexp.MustCompile(`^[A-Za-z]:[\\/]`)
 )
 
+// sliceFileAdvisory is the Writer allowlist size at which a slice is flagged
+// for an acceptance-preserving split. Advisory only: it never changes an exit
+// code. Measured on real plans, slices at or above it averaged ~10 wright
+// rounds versus ~3.5 below it.
+const sliceFileAdvisory = 12
+
+// sliceSizeAdvisory returns the Writer allowlist size and whether the slice is
+// oversized without a recorded `Size rationale:`.
+func sliceSizeAdvisory(block string) (int, bool) {
+	fields := sliceFields(block)
+	raw, _ := fieldValue(fields, "writer allowlist")
+	n := len(parsePathList(raw))
+	rationale, _ := fieldValue(fields, "size rationale")
+	return n, n >= sliceFileAdvisory && rationale == ""
+}
+
 // sliceFields extracts the single-line `Field: value` pairs of a slice block.
 func sliceFields(block string) map[string]string {
 	fields := map[string]string{}
@@ -169,6 +185,9 @@ func RunCheckSlice(root string, args []string, stdout, stderr io.Writer) int {
 		problems = append(problems, "Tests/proof field missing or empty — no evidence plan for the slice")
 	}
 
+	if n, over := sliceSizeAdvisory(block); over {
+		fmt.Fprintf(stdout, "check slice: ADVISORY size: %s has %d Writer allowlist files (>= %d); consider an acceptance-preserving split\n", sliceID, n, sliceFileAdvisory)
+	}
 	if len(problems) > 0 {
 		fmt.Fprintf(stdout, "check slice: %s BLOCKED\n", sliceID)
 		for _, p := range problems {

package/engine/internal/lib/slicecheck_test.go

@@ -127,3 +127,44 @@ func TestCheckSliceTouchedComparesNormalizedPaths(t *testing.T) {
 		t.Fatalf("code=%d want 0\n%s%s", code, stdout, stderr)
 	}
 }
+
+func bigSliceTasks(rationale string) string {
+	var paths []string
+	for i := 1; i <= sliceFileAdvisory; i++ {
+		paths = append(paths, "`src/f"+strings.Repeat("x", i)+".go`")
+	}
+	return "# Tasks\n\n## SLICE-001 Big\nGoal: do it.\nSatisfies: AC-001\ndepends_on: []\nWriter allowlist: " +
+		strings.Join(paths, ", ") + "\nTests/proof: go test ./...\n" + rationale +
+		"\n## SLICE-002 Small\nGoal: tiny.\nSatisfies: AC-001\ndepends_on: [SLICE-001]\nWriter allowlist: `src/a.go`\nTests/proof: go test ./...\n"
+}
+
+func TestSliceSizeAdvisoryNeverBlocks(t *testing.T) {
+	root := sliceWorkspace(t, bigSliceTasks(""), "## Acceptance criteria\n- AC-001 works\n")
+	stdout, stderr := &bytes.Buffer{}, &bytes.Buffer{}
+	if code := RunCheckSlice(root, []string{"feat", "SLICE-001"}, stdout, stderr); code != 0 {
+		t.Fatalf("advisory must not block: code=%d\n%s%s", code, stdout, stderr)
+	}
+	if !strings.Contains(stdout.String(), "ADVISORY size: SLICE-001 has 12 Writer allowlist files") {
+		t.Fatalf("advisory missing:\n%s", stdout)
+	}
+	stdout.Reset()
+	if code := RunTaskGraphCheck(root, "feat", stdout, stderr); code != 0 {
+		t.Fatalf("task-graph code=%d\n%s%s", code, stdout, stderr)
+	}
+	out := stdout.String()
+	if !strings.Contains(out, "task-graph: ADVISORY size: SLICE-001 has 12") || strings.Contains(out, "SLICE-002 has") {
+		t.Fatalf("task-graph advisory wrong:\n%s", out)
+	}
+	stdout.Reset()
+	if code := RunMetrics(root, []string{"summary", "feat"}, stdout, stderr); code != 0 || !strings.Contains(stdout.String(), "size-advisory=1") {
+		t.Fatalf("size-advisory metric not recorded: code=%d\n%s", code, stdout)
+	}
+}
+
+func TestSliceSizeRationaleSilencesAdvisory(t *testing.T) {
+	root := sliceWorkspace(t, bigSliceTasks("Size rationale: one generated golden set moves together\n"), "## Acceptance criteria\n- AC-001 works\n")
+	stdout, stderr := &bytes.Buffer{}, &bytes.Buffer{}
+	if code := RunTaskGraphCheck(root, "feat", stdout, stderr); code != 0 || strings.Contains(stdout.String(), "ADVISORY") {
+		t.Fatalf("rationale must silence advisory: code=%d\n%s", code, stdout)
+	}
+}

package/engine/internal/lib/windows.go

@@ -4,6 +4,7 @@ import (
 	"fmt"
 	"io"
 	"os"
+	"path"
 	"path/filepath"
 	"regexp"
 	"strconv"
@@ -12,17 +13,21 @@ import (
 	"github.com/devrites/devrites/internal/devritespaths"
 )
 
-// windows.go — the broken-windows check. Review prose flags a new TODO, stub, or
-// skipped test as a finding; this gate makes the register countable instead: any
-// deferral marker the change *introduces* must carry a recorded waiver row in the
-// workspace's windows.md, or the check fails. A silent deferral is the bug.
+// windows.go — the broken-windows check. Review prose flags a new TODO, stub,
+// skipped or focused test, checker suppression, swallowed error, deleted test
+// file, or stripped assertion as a finding; this gate makes the register
+// countable instead: any such marker the change *introduces* must carry a
+// recorded waiver row in the workspace's windows.md, or the check fails. A
+// silent deferral or lowered bar is the bug.
 //
 //	devrites-engine check windows <slug> [--worktree|--staged|--base <ref>] [--cwd <dir>]
 //
 //	0  no unwaived markers    2  usage error    3  unwaived markers or blocked
 //
 // Only added lines count: a marker already on the baseline is pre-existing debt,
-// never attributable to this change. Each windows.md row waives exactly one hit —
+// never attributable to this change. Removals count once per file: a deleted
+// test file (`deleted-test`) or a net loss of assertion lines in a test file
+// that remains (`removed-assertion`). Each windows.md row waives exactly one hit —
 // one blanket row cannot cover a file's five new TODOs.
 //
 // windows.md row grammar (one waiver per line):
@@ -34,8 +39,10 @@ import (
 
 const windowsUsage = `usage: devrites-engine check windows <slug> [--worktree|--staged|--base <ref>] [--cwd <dir>]
 
-Reports deferral markers introduced by the change (added lines only) and requires
-each to be waived by a row in .devrites/work/<slug>/windows.md:
+Reports deferral and bar-lowering markers introduced by the change (added lines:
+TODO/stub/skip/focus idioms, checker suppressions, empty-catch; removals:
+deleted-test, removed-assertion) and requires each to be waived by a row in
+.devrites/work/<slug>/windows.md:
   - <path> | <marker> | <reason>
 Each row waives one hit at that path with that marker token.
 Exit 0 clean or fully waived, 3 unwaived markers or blocked.`
@@ -55,8 +62,22 @@ var deferralIdioms = []string{
 	"panic(\"TODO", "panic(\"unimplemented", "panic(\"not implemented",
 	"throw new Error(\"unimplemented", "throw new Error(\"not implemented",
 	"TODO: implement", "not yet implemented",
+	// Focused tests and checker suppressions lower the bar the same way.
+	"it.only(", "describe.only(", "test.only(",
+	"@ts-ignore", "@ts-expect-error", "@ts-nocheck", "eslint-disable",
+	"biome-ignore", "deno-lint-ignore", "istanbul ignore", "c8 ignore",
+	"noqa", "type: ignore", "pylint: disable", "pragma: no cover",
+	"nolint", "#nosec", "nosemgrep", "NOSONAR", "gitleaks:allow",
+	"rubocop:disable", "@SuppressWarnings", "#[allow(", "shellcheck disable",
+	"Stryker disable",
 }
 
+// emptyCatchRe catches a one-line swallowed error: `catch (e) {}`, `except: pass`.
+var emptyCatchRe = regexp.MustCompile(`\bcatch\s*(?:\([^)]*\))?\s*\{\s*\}|\bexcept\b[^:\n]*:\s*pass\b`)
+
+// assertionRe matches a line carrying a test assertion in common frameworks.
+var assertionRe = regexp.MustCompile(`(?i)\bassert|XCTAssert|\bexpect\(|\bt\.(?:error|fatal)|\brequire\.|\.should\b`)
+
 type windowHit struct {
 	Path   string
 	Line   int
@@ -64,6 +85,14 @@ type windowHit struct {
 	Text   string
 }
 
+// location is path:line, or the bare path for a file-level hit (Line 0).
+func (h windowHit) location() string {
+	if h.Line == 0 {
+		return h.Path
+	}
+	return fmt.Sprintf("%s:%d", h.Path, h.Line)
+}
+
 type windowWaiver struct {
 	Path   string
 	Marker string
@@ -92,7 +121,73 @@ func windowsMarkers(line string) []string {
 			out = append(out, m[1])
 		}
 	}
-	return append(out, idioms...)
+	out = append(out, idioms...)
+	if emptyCatchRe.MatchString(line) {
+		out = append(out, "empty-catch")
+	}
+	return out
+}
+
+// isTestPath reports whether a project-relative path names a test source file.
+func isTestPath(p string) bool {
+	base := path.Base(p)
+	for _, suffix := range []string{"_test.go", "_test.py", "_spec.rb", "Test.java", "Tests.java", "Test.kt", "Test.cs", "Tests.cs"} {
+		if strings.HasSuffix(base, suffix) {
+			return true
+		}
+	}
+	return strings.Contains(base, ".test.") || strings.Contains(base, ".spec.") ||
+		strings.HasPrefix(base, "test_") && strings.HasSuffix(base, ".py") ||
+		strings.Contains("/"+p, "/__tests__/") ||
+		strings.Contains("/"+p, "/tests/") && strings.HasSuffix(base, ".rs")
+}
+
+// removedTestHits reports bar-lowering removals in a `git diff -U0` stream: a
+// deleted test file, or a test file that still exists but lost assertion lines
+// on net (moving an assertion within the file is not a loss). Renames are not
+// deletions when git rename detection pairs them.
+func removedTestHits(diff string) []windowHit {
+	var hits []windowHit
+	net := map[string]int{}
+	var order []string
+	var oldPath, file string
+	inHeader, deleted := false, false
+	for _, line := range strings.Split(diff, "\n") {
+		switch {
+		case strings.HasPrefix(line, "diff --git "):
+			inHeader, deleted, file = true, false, ""
+		case inHeader && strings.HasPrefix(line, "--- "):
+			oldPath = strings.TrimPrefix(strings.Trim(strings.TrimSpace(line[4:]), `"`), "a/")
+		case inHeader && strings.HasPrefix(line, "+++ "):
+			newPath := strings.Trim(strings.TrimSpace(line[4:]), `"`)
+			if newPath == "/dev/null" {
+				deleted = true
+				if isTestPath(oldPath) {
+					hits = append(hits, windowHit{Path: oldPath, Marker: "deleted-test", Text: "test file deleted"})
+				}
+				continue
+			}
+			if file = strings.TrimPrefix(newPath, "b/"); !isTestPath(file) {
+				file = ""
+			}
+		case strings.HasPrefix(line, "@@"):
+			inHeader = false
+		case inHeader || deleted || file == "":
+		case strings.HasPrefix(line, "-") && assertionRe.MatchString(line[1:]):
+			if _, seen := net[file]; !seen {
+				order = append(order, file)
+			}
+			net[file]++
+		case strings.HasPrefix(line, "+") && assertionRe.MatchString(line[1:]):
+			net[file]--
+		}
+	}
+	for _, f := range order {
+		if n := net[f]; n > 0 {
+			hits = append(hits, windowHit{Path: f, Marker: "removed-assertion", Text: fmt.Sprintf("net -%d assertion line(s)", n)})
+		}
+	}
+	return hits
 }
 
 // addedLinesFromDiff parses a `git diff -U0` stream into added (path, line,
@@ -180,17 +275,18 @@ func windowsHits(opts diffScopeOpts) ([]windowHit, error) {
 	var diffArgs []string
 	switch opts.mode {
 	case "staged":
-		diffArgs = []string{"diff", "--cached", "-U0", "--"}
+		diffArgs = []string{"diff", "--cached", "-M", "-U0", "--"}
 	case "base":
-		diffArgs = []string{"diff", opts.base, "-U0", "--"}
+		diffArgs = []string{"diff", opts.base, "-M", "-U0", "--"}
 	default:
-		diffArgs = []string{"diff", "HEAD", "-U0", "--"}
+		diffArgs = []string{"diff", "HEAD", "-M", "-U0", "--"}
 	}
 	diff, err := runGitCommand(dir, nil, diffArgs...)
 	var diffPaths map[string]bool
 	switch {
 	case err == nil:
 		hits, diffPaths = addedLinesFromDiff(string(diff))
+		hits = append(hits, removedTestHits(string(diff))...)
 	case opts.mode == "worktree" && isUnbornHEAD(dir):
 		// No commits yet: every changed file is wholly new.
 		diffPaths = map[string]bool{}
@@ -334,11 +430,11 @@ func RunCheckWindows(root string, args []string, stdout, stderr io.Writer) int {
 		if waivers[w] > 0 {
 			waivers[w]--
 			waived++
-			fmt.Fprintf(stdout, "windows: waived: %s:%d %s\n", h.Path, h.Line, h.Marker)
+			fmt.Fprintf(stdout, "windows: waived: %s %s\n", h.location(), h.Marker)
 			continue
 		}
 		unwaived++
-		fmt.Fprintf(stdout, "windows: unwaived: %s:%d %s — %s\n", h.Path, h.Line, h.Marker, h.Text)
+		fmt.Fprintf(stdout, "windows: unwaived: %s %s — %s\n", h.location(), h.Marker, h.Text)
 	}
 	switch {
 	case len(hits) == 0:

package/engine/internal/lib/windows_test.go

@@ -57,6 +57,12 @@ func TestWindowsMarkersTokensAndIdioms(t *testing.T) {
 		{"describe.skip(\"x\", fn)", []string{"describe.skip("}},
 		{"raise NotImplementedError", []string{"NotImplementedError"}},
 		{"panic(\"TODO wire cache\")", []string{"panic(\"TODO"}},
+		{"// @ts-ignore", []string{"@ts-ignore"}},
+		{"x = f()  # noqa: E501", []string{"noqa"}},
+		{"it.only(\"focus\", fn)", []string{"it.only("}},
+		{"try { f() } catch (e) {}", []string{"empty-catch"}},
+		{"except ValueError: pass", []string{"empty-catch"}},
+		{"} catch (e) { log(e) }", nil},
 		{"plain line", nil},
 	}
 	for _, tc := range cases {
@@ -333,3 +339,82 @@ func TestCheckWindowsFailsWhenStatusScanFails(t *testing.T) {
 		t.Fatalf("status failure must be reported on stderr: err=%q", errBuf.String())
 	}
 }
+
+func TestRemovedTestHits(t *testing.T) {
+	diff := "diff --git a/old_test.go b/old_test.go\ndeleted file mode 100644\n--- a/old_test.go\n+++ /dev/null\n@@ -1,2 +0,0 @@\n-package a\n-\tassert(true)\n" +
+		"diff --git a/a_test.go b/a_test.go\n--- a/a_test.go\n+++ b/a_test.go\n@@ -3,2 +3,0 @@\n-\tif got != 1 { t.Fatalf(\"got %d\", got) }\n-\trequire.NoError(t, err)\n" +
+		"diff --git a/moved.test.ts b/moved.test.ts\n--- a/moved.test.ts\n+++ b/moved.test.ts\n@@ -2 +2,0 @@\n-  expect(x).toBe(1)\n@@ -9,0 +9 @@\n+  expect(x).toBe(1)\n" +
+		"diff --git a/lib.go b/lib.go\n--- a/lib.go\n+++ b/lib.go\n@@ -1 +0,0 @@\n-\tassert(ok)\n" +
+		"diff --git a/gone.go b/gone.go\ndeleted file mode 100644\n--- a/gone.go\n+++ /dev/null\n@@ -1 +0,0 @@\n-package a\n"
+	hits := removedTestHits(diff)
+	if len(hits) != 2 {
+		t.Fatalf("hits=%+v", hits)
+	}
+	if hits[0].Path != "old_test.go" || hits[0].Marker != "deleted-test" {
+		t.Fatalf("deleted test hit=%+v", hits[0])
+	}
+	if hits[1].Path != "a_test.go" || hits[1].Marker != "removed-assertion" || !strings.Contains(hits[1].Text, "net -2") {
+		t.Fatalf("removed assertion hit=%+v", hits[1])
+	}
+}
+
+func TestIsTestPath(t *testing.T) {
+	for p, want := range map[string]bool{
+		"pkg/a_test.go": true, "src/a.test.ts": true, "src/a.spec.js": true,
+		"tests/test_api.py": true, "spec/user_spec.rb": true, "src/__tests__/a.js": true,
+		"FooTest.java": true, "tests/integration.rs": true,
+		"pkg/a.go": false, "src/latest.ts": false, "tests/fixture.json": false, "contest.py": false,
+	} {
+		if got := isTestPath(p); got != want {
+			t.Fatalf("isTestPath(%q)=%v want %v", p, got, want)
+		}
+	}
+}
+
+func TestCheckWindowsBlocksLoweredBarUntilWaived(t *testing.T) {
+	project := t.TempDir()
+	initWindowsRepo(t, project)
+	root := windowsWorkspace(t, project, "feat")
+	testutil.WriteFile(t, filepath.Join(project, "a_test.go"), "package a\n\nfunc TestA(t *testing.T) {\n\tif A() != 1 {\n\t\tt.Fatal(\"bad\")\n\t}\n}\n")
+	testutil.WriteFile(t, filepath.Join(project, "b_test.go"), "package a\n")
+	runSecretScanGit(t, project, "add", "--", "a_test.go", "b_test.go")
+	runSecretScanGit(t, project, "commit", "-qm", "baseline")
+	testutil.WriteFile(t, filepath.Join(project, "a_test.go"), "package a\n\nfunc TestA(t *testing.T) {\n\t_ = A()\n}\n")
+	if err := os.Remove(filepath.Join(project, "b_test.go")); err != nil {
+		t.Fatal(err)
+	}
+
+	var out, errBuf bytes.Buffer
+	if code := RunCheckWindows(root, []string{"feat"}, &out, &errBuf); code != 3 {
+		t.Fatalf("code=%d out=%q err=%q", code, out.String(), errBuf.String())
+	}
+	for _, want := range []string{"unwaived: a_test.go removed-assertion", "unwaived: b_test.go deleted-test"} {
+		if !strings.Contains(out.String(), want) {
+			t.Fatalf("missing %q in out=%q", want, out.String())
+		}
+	}
+
+	testutil.WriteFile(t, filepath.Join(root, "work", "feat", "windows.md"),
+		"- a_test.go | removed-assertion | assertion moved to TestB in SLICE-002\n- b_test.go | deleted-test | feature removed per spec AC-3\n")
+	out.Reset()
+	if code := RunCheckWindows(root, []string{"feat"}, &out, &errBuf); code != 0 {
+		t.Fatalf("waived: code=%d out=%q", code, out.String())
+	}
+}
+
+func TestCheckWindowsRenamedTestIsNotDeleted(t *testing.T) {
+	project := t.TempDir()
+	initWindowsRepo(t, project)
+	root := windowsWorkspace(t, project, "feat")
+	runSecretScanGit(t, project, "config", "diff.renames", "false")
+	body := "package a\n\nfunc TestA(t *testing.T) {\n\tif A() != 1 {\n\t\tt.Fatal(\"bad\")\n\t}\n}\n"
+	testutil.WriteFile(t, filepath.Join(project, "a_test.go"), body)
+	runSecretScanGit(t, project, "add", "--", "a_test.go")
+	runSecretScanGit(t, project, "commit", "-qm", "baseline")
+	runSecretScanGit(t, project, "mv", "a_test.go", "b_test.go")
+
+	var out, errBuf bytes.Buffer
+	if code := RunCheckWindows(root, []string{"feat"}, &out, &errBuf); code != 0 {
+		t.Fatalf("rename flagged: code=%d out=%q err=%q", code, out.String(), errBuf.String())
+	}
+}