jules-orchestrator-kit 0.69.0 → 0.71.0

package/src/engine.mjs

@@ -459,7 +459,28 @@ export async function gate(opts = {}) {
       let assertMetrics = {};
 
       if (isAssertion) {
-        const assertRes = runAssertion(stage, root);
+        // The loosening flags have to reach here too.
+        //
+        // `scanDiff` above is given `allowTestChanges` and honours it, while
+        // the `assert:test-integrity` stage received only its own stage object
+        // and re-ran the same guard with none of them. So an override was
+        // accepted by one phase and ignored by the next: `--allow-test-change
+        // deregistration` turned the SECRETS phase green and then failed the
+        // run at the anti-tamper stage, with a flag hint the operator had
+        // already followed. One rule, two places, and the second kept the old
+        // answer — for the eighth time in this project's history, which is why
+        // the regression test asserts the verdict a caller receives rather
+        // than the behaviour of either site.
+        const assertRes = runAssertion(
+          {
+            ...stage,
+            allowTestModifications: opts.allowTestModifications === true,
+            allowTestChanges: opts.allowTestChanges,
+            tamperGuard: trustedVerify.tamperGuard,
+            allowUnreadableTests: opts.allowUnreadableTests === true,
+          },
+          root
+        );
         durationMs = assertRes.metrics?.durationMs ?? (Date.now() - startTime);
         stdoutRedacted = assertRes.stdout || "";
         stderrRedacted = assertRes.stderr || "";
@@ -894,19 +915,49 @@ export async function repair(failure, opts = {}) {
       break;
     }
 
-    attempts.push({ n, session, ok: true });
-    appendTelemetry(root, "ooda_repair_attempt", { attempt: n, ok: true });
-
     // Poll async provider for terminal session state before executing re-verification gates
+    let pollVerdict = null;
     if (provider && session) {
-      await pollSessionState(provider, session, {
+      pollVerdict = await pollSessionState(provider, session, {
         root,
         dryRun: opts.dryRun,
         pollIntervalMs: opts.pollIntervalMs,
         maxPollAttempts: opts.maxPollAttempts,
       });
+
+      // The gate below is the authority on whether the change works, so it runs
+      // either way. But a non-terminal session means it is about to judge a
+      // tree the agent may not have finished writing, and saying nothing here
+      // turns that into a confusing cascade of repair attempts against a
+      // half-applied patch.
+      if (pollVerdict && pollVerdict.terminal !== true) {
+        const why = pollVerdict.blockedOn
+          ? `waiting on an actor (${pollVerdict.blockedOn})`
+          : pollVerdict.unreachable
+            ? "the provider stopped answering"
+            : `still ${pollVerdict.status} when the poll budget ran out`;
+        console.warn(
+          `[SESSION_NOT_TERMINAL] Session ${session.id} is ${why}. Re-verification is running against a tree the agent may not have finished writing.`
+        );
+        appendTelemetry(root, "session_not_terminal", {
+          attempt: n,
+          sessionId: session.id,
+          status: pollVerdict.status,
+          blockedOn: pollVerdict.blockedOn || null,
+          timedOut: Boolean(pollVerdict.timedOut),
+          unreachable: Boolean(pollVerdict.unreachable),
+        });
+      }
     }
 
+    attempts.push({
+      n,
+      session,
+      ok: true,
+      poll: pollVerdict ? { status: pollVerdict.status, terminal: pollVerdict.terminal } : null,
+    });
+    appendTelemetry(root, "ooda_repair_attempt", { attempt: n, ok: true });
+
     // Re-verify after repair attempt
     const gateRes = await gate({ root, config, fix: false, progressBus, progressToken });
     if (gateRes.ok) {
@@ -1000,10 +1051,38 @@ export async function checkTaskPremise(task = {}, opts = {}) {
 }
 
 /**
- * Polls the provider until the session terminates in COMPLETED, FAILED, or reaches timeout.
+ * Session states the API documents as final. The full `SessionState` enum is
+ * transcribed in `docs/jules-quality-plan.md`.
+ */
+export const TERMINAL_SESSION_STATES = new Set(["COMPLETED", "FAILED"]);
+
+/**
+ * Session states that cannot advance without an actor — a human approving a
+ * plan, a human answering a question, or whoever paused it resuming it.
+ *
+ * Polling these is not waiting, it is spending the budget: the state cannot
+ * change on its own no matter how long the loop runs.
+ */
+export const BLOCKING_SESSION_STATES = new Set(["AWAITING_PLAN_APPROVAL", "AWAITING_USER_FEEDBACK", "PAUSED"]);
+
+/**
+ * Polls the provider until the session reaches a terminal state, blocks on an
+ * actor, or the poll budget runs out.
+ *
+ * The verdict is explicit about which of those three happened, because the
+ * caller runs the verification gate on the assumption that the agent has
+ * finished writing. A previous version returned `COMPLETED` for every
+ * non-terminal exit — a session sitting in `AWAITING_USER_FEEDBACK` and one
+ * still `IN_PROGRESS` when the budget expired were both reported as success,
+ * which is the same shape this project exists to refuse.
+ *
+ * @returns {Promise<object>} Always carries `status` and `terminal`. Non-terminal
+ *   exits additionally carry one of `blockedOn`, `timedOut` or `unreachable`.
+ *   `status` is never synthesised: it is the last state the provider reported,
+ *   or `UNKNOWN` when it never answered.
  */
 export async function pollSessionState(provider, session, opts = {}) {
-  if (!session || !session.id) return { status: "COMPLETED" };
+  if (!session || !session.id) return { status: "UNKNOWN", terminal: false, unpolled: true };
   const initialStatus = String(session.status || session.state || "").toUpperCase();
   if (
     initialStatus === "COMPLETED" ||
@@ -1013,13 +1092,20 @@ export async function pollSessionState(provider, session, opts = {}) {
     session.id.startsWith("mock-") ||
     session.id.startsWith("dry-run-")
   ) {
-    return { status: initialStatus || "COMPLETED" };
+    // A dry run has no session to watch, so it reports the outcome a real
+    // dispatch would have had to earn. Flagged as simulated so a caller can
+    // tell the two apart; a terminal state already reported by the provider is
+    // a fact, not a simulation, and is returned as itself.
+    const status = initialStatus || "COMPLETED";
+    return { status, terminal: TERMINAL_SESSION_STATES.has(status), simulated: true, polls: 0 };
   }
 
   const maxAttempts = opts.maxPollAttempts || 30;
   const pollIntervalMs = opts.pollIntervalMs || 1000;
   const timeoutMs = opts.pollTimeoutMs || 300000;
   const startTime = Date.now();
+  let lastStatus = "";
+  let polls = 0;
 
   for (let attempt = 0; attempt < maxAttempts; attempt++) {
     if (Date.now() - startTime > timeoutMs) break;
@@ -1035,30 +1121,59 @@ export async function pollSessionState(provider, session, opts = {}) {
       } catch (_) {}
     }
 
-    if (currentSession) {
-      const status = String(currentSession.status || currentSession.state || "").toUpperCase();
-      if (
-        (status === "AWAITING_PLAN_APPROVAL" || status === "PENDING_APPROVAL") &&
-        (opts.autoApprovePlan || opts.autoApprove || session.autoApprovePlan)
-      ) {
-        if (provider && typeof provider.approvePlan === "function") {
-          try {
-            await provider.approvePlan(session.id, opts);
-          } catch (_) {}
+    if (!currentSession) {
+      return {
+        ...session,
+        status: lastStatus || "UNKNOWN",
+        terminal: false,
+        unreachable: true,
+        polls,
+      };
+    }
+
+    polls += 1;
+    const status = String(currentSession.status || currentSession.state || "").toUpperCase();
+    if (status) lastStatus = status;
+
+    if (TERMINAL_SESSION_STATES.has(status)) {
+      return { ...currentSession, status, terminal: true, polls };
+    }
+
+    if (BLOCKING_SESSION_STATES.has(status)) {
+      // A pending plan approval is the one blocking state this loop is allowed
+      // to resolve itself, and only when the caller said so.
+      const isPlanApproval = status === "AWAITING_PLAN_APPROVAL";
+      const wantsAutoApprove = Boolean(opts.autoApprovePlan || opts.autoApprove || session.autoApprovePlan);
+      if (isPlanApproval && wantsAutoApprove && provider && typeof provider.approvePlan === "function") {
+        try {
+          await provider.approvePlan(session.id, opts);
+          await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
+          continue;
+        } catch (err) {
+          return {
+            ...currentSession,
+            status,
+            terminal: false,
+            blockedOn: status,
+            approvePlanError: err && err.message ? err.message : String(err),
+            polls,
+          };
         }
       }
 
-      if (status === "COMPLETED" || status === "FAILED") {
-        return { ...currentSession, status };
-      }
-    } else {
-      break;
+      return { ...currentSession, status, terminal: false, blockedOn: status, polls };
     }
 
     await new Promise((resolve) => setTimeout(resolve, pollIntervalMs));
   }
 
-  return { ...session, status: String(session.status || "COMPLETED").toUpperCase() };
+  return {
+    ...session,
+    status: lastStatus || "UNKNOWN",
+    terminal: false,
+    timedOut: true,
+    polls,
+  };
 }
 
 function buildRepairPrompt(failure, attempt, _config, extraPromptDirective = null) {

package/src/guard-policy.mjs

@@ -454,6 +454,57 @@ export const SCOPE_CANARIES = [
  * from never showed it.
  */
 export const INNOCENT_EDITS = [
+  // Everything below this comment was a CRITICAL rejection until v0.71.0.
+  //
+  // Not through any rule that examined them: `UNREADABLE` was reached whenever
+  // a test file had changed lines and none of them parsed as an assertion, so
+  // the verdict was the same for a repository speaking an unsupported dialect
+  // and for one where the edit simply was not an assertion. Adding an import
+  // was a CRITICAL block. The finding carried no file, no line and no sample,
+  // because there was nothing to name — and it advised a pytest repository
+  // that its assertion library might be unsupported, from a list naming pytest.
+  //
+  // These are ordinary work. Every one of them has to be silent.
+  {
+    id: "add-import/pytest",
+    file: "testing/test_iniconfig.py",
+    context: "# fixtures",
+    removed: [],
+    added: ["import os"],
+    why: "adding an import to a test file is not an assertion and not tampering",
+  },
+  {
+    id: "rename-test-multiline/pytest",
+    file: "testing/test_iniconfig.py",
+    context: "# parsing",
+    removed: ["def test_parse_strips_inline_comments() -> None:"],
+    added: ["def test_parse_strips_inline_comments_from_continuations() -> None:"],
+    why: "still collected by pytest, so nothing left the run",
+  },
+  {
+    id: "docstring/pytest",
+    file: "testing/test_iniconfig.py",
+    context: "# parsing",
+    removed: ['    """Check comments."""'],
+    added: ['    """Check that inline comments are stripped."""'],
+    why: "prose about the test, not a value it asserts",
+  },
+  {
+    id: "type-annotation/pytest",
+    file: "testing/test_iniconfig.py",
+    context: "# fixtures",
+    removed: ["def make_config(data):"],
+    added: ["def make_config(data: str) -> IniConfig:"],
+    why: "a helper's signature, typed; no claim changed",
+  },
+  {
+    id: "add-fixture/go",
+    file: "calc_test.go",
+    context: "// helpers",
+    removed: [],
+    added: ["var cases = []int{1, 2, 3}"],
+    why: "test data added, nothing asserted or unasserted",
+  },
   // Renaming a test is one of the most ordinary edits there is. On the
   // one-line form the name blanked to the same shape as its replacement, the
   // two paired, and the pair was reported as a rewritten expectation.
@@ -598,6 +649,129 @@ export const INNOCENT_EDITS = [
  * will always end somewhere; what must never happen again is that the edge
  * is silent.
  */
+/**
+ * Renames that delete a test from the run without deleting a line of it.
+ *
+ * pytest collects `test_*`, Go collects `Test*`. For those runners the name is
+ * the registration, so `def test_totals` → `def totals` removes the test as
+ * completely as deleting the file, and every count in the tamper guard stays
+ * level: nothing removed, nothing weakened, nothing rewritten.
+ *
+ * These were caught only as a side effect of the blanket that rejected every
+ * unrecognised edit to a test file — which also rejected adding an import, and
+ * whose printed remedy switched the real checks off. They are their own
+ * finding now, so narrowing that blanket costs nothing.
+ */
+export const DEREGISTRATION_CANARIES = [
+  {
+    id: "pytest/underscore",
+    file: "tests/test_totals.py",
+    context: "# totals",
+    removed: ["def test_totals_round_to_cents():"],
+    added: ["def totals_round_to_cents():"],
+    why: "pytest collects by the test_ prefix, so this test no longer runs",
+  },
+  {
+    id: "pytest/camel",
+    file: "tests/test_totals.py",
+    context: "# totals",
+    removed: ["def testTotals():"],
+    added: ["def Totals():"],
+    why: "the prefix is what registers it, in either spelling",
+  },
+  {
+    id: "go/test",
+    file: "calc_test.go",
+    context: "// totals",
+    removed: ["func TestTotals(t *testing.T) {"],
+    added: ["func Totals(t *testing.T) {"],
+    why: "go test collects by the Test prefix",
+  },
+  {
+    id: "go/benchmark",
+    file: "calc_test.go",
+    context: "// totals",
+    removed: ["func BenchmarkTotals(b *testing.B) {"],
+    added: ["func Totals(b *testing.B) {"],
+    why: "the same rule for the other collected prefixes",
+  },
+];
+
+/**
+ * A verification command that exits 0 having written nothing at all.
+ *
+ * The one absence that is evidence. The floor is otherwise deliberately
+ * one-sided — an unrecognised runner states no count and passes, because
+ * hard-redding every runner not on the list would be worse than the hole it
+ * closes — but an unrecognised runner still prints something. Zero bytes on
+ * both streams is a command that ran nothing, and `pnpm -r test` on a
+ * workspace whose packages declare no test script is exactly that: it was
+ * indistinguishable from a full suite by every signal the gate had.
+ */
+export const SILENT_RUN_CANARIES = [
+  { id: "pnpm -r test", command: "pnpm -r test", stdout: "", stderr: "" },
+  { id: "npm test", command: "npm test", stdout: "", stderr: "" },
+  { id: "yarn workspaces test", command: "yarn workspaces foreach run test", stdout: "", stderr: "" },
+  { id: "pytest", command: "python3 -m pytest", stdout: "", stderr: "" },
+  { id: "go test", command: "go test ./...", stdout: "", stderr: "" },
+  { id: "whitespace is not output", command: "npm test", stdout: "  \n", stderr: "\n" },
+];
+
+/**
+ * Honest static gates that print nothing, and must keep passing.
+ *
+ * The counterweight, and the reason the rule above reads the command as well
+ * as the output. `tsc --noEmit`, `node --check`, `go vet` and `compileall`
+ * all exit 0 in silence when they succeed — that is what success looks like
+ * for a checker — and two of them are commands this kit writes itself for a
+ * repository that has no suite yet. A rule keyed on silence alone hard-redded
+ * every one of them, which is exactly the first-run rejection of correct code
+ * that the collection floor is otherwise so careful to avoid.
+ */
+export const SILENT_STATIC_GATES = [
+  { id: "tsc", command: "tsc --noEmit" },
+  { id: "node --check", command: "node --check index.js" },
+  { id: "go vet", command: "go vet ./..." },
+  { id: "compileall", command: "python3 -m compileall -q ." },
+  { id: "generated parse gate", command: "node --check src/index.mjs" },
+];
+
+/**
+ * Values that must survive a trip through the emitter and back.
+ *
+ * `yamlScalar` writes the manifests and `parseYaml` reads them, and a pair
+ * like that disagreeing about one character is this project's recurring
+ * defect with both halves in a single module. The parser opened a comment at
+ * the first `#` on a line, quoted or not, so `verify.test` containing a hash
+ * was silently truncated on the way in and the gate ran a command the user
+ * never wrote — reporting on it as if it were theirs.
+ *
+ * The corpus is the hard cases on purpose: hashes, colons, leading stars,
+ * apostrophes, the empty string, and the words YAML would otherwise read as
+ * booleans.
+ */
+export const YAML_ROUNDTRIP_CASES = [
+  "pnpm -r test",
+  "PYTHONPATH=src python3 -m pytest",
+  'pytest -k "not #slow"',
+  "has #hash",
+  "# leading hash",
+  "a: b",
+  "**/*.pem",
+  "**/.env.*",
+  ".github/**",
+  "",
+  "true",
+  "yes",
+  "1.5",
+  "it's fine",
+  "it's #1",
+  "O'Brien",
+  "agent/",
+  "  leading space",
+  "trailing space  ",
+];
+
 export const UNREADABLE_DIALECTS = [
   {
     id: "hspec",

package/src/ops/test-collection.mjs

@@ -111,6 +111,56 @@ const GO_RAN_SOMETHING = /^(?:(?:ok|FAIL)\s+(?!\d+\s)\S+|---\s+(?:PASS|FAIL|SKIP
  *   `count` is null when no recognised runner stated one — which is not a
  *   finding, only an absence of evidence.
  */
+/**
+ * Did the command write nothing at all, on either stream?
+ *
+ * This is the one absence that is evidence rather than the lack of it. The
+ * one-sided floor exists because an unrecognised runner states no count, and
+ * hard-redding every runner not on the list would be worse than the hole it
+ * closes. But an unrecognised runner still *prints*: dots, a summary line,
+ * a package name, something. Zero bytes on both streams is not a dialect the
+ * list has yet to learn — it is a command that ran nothing.
+ *
+ * `pnpm -r test` on a workspace whose packages declare no test script is the
+ * shape that made this necessary: it exits 0, writes nothing anywhere, and
+ * was indistinguishable from a full suite by every signal the gate had.
+ *
+ * Resolved here and consumed in two places — the gate's floor and `init`'s
+ * oracle probe — because writing the rule once in each is how this project
+ * has repeatedly ended up with two answers to one question.
+ */
+export function producedNoOutput(stdout = "", stderr = "") {
+  return `${stdout || ""}${stderr || ""}`.trim() === "";
+}
+
+/**
+ * Does this command claim to run a test suite?
+ *
+ * Silence alone cannot carry the verdict, and the first version of this rule
+ * assumed it could. `node --check index.js`, `tsc --noEmit`, `go vet ./...`
+ * and `python3 -m compileall -q .` all exit 0 having printed nothing — and
+ * they are honest static gates, two of which this kit writes itself for
+ * repositories that have no suite yet. Failing on silence alone hard-redded
+ * every one of them, which is the same first-run rejection of correct code
+ * that the whole collection floor is careful to avoid.
+ *
+ * Nothing in the *output* separates `pnpm -r test` from `tsc --noEmit`; both
+ * are empty. The difference is in what the command says it is. So this reads
+ * the command, the same way `isPlaceholderTestScript` does: a command that is
+ * recognisably a suite invocation and printed nothing ran no suite, while a
+ * static checker that printed nothing did exactly what it promised.
+ *
+ * One-sided in the safe direction, like everything else here. An unrecognised
+ * command is not treated as a suite, so an unusual runner keeps its advisory
+ * pass rather than becoming a hard red.
+ */
+const TEST_SUITE_COMMAND =
+  /(?:^|\s|\/)(?:pytest|jest|vitest|mocha|ava|karma|jasmine|nyc|c8|tap|tape|rspec|minitest|phpunit|behave|nose2?|ginkgo|gotestsum|nextest)\b|\b(?:go|cargo|swift|dart|flutter|deno|bun|dotnet|mix|lein|sbt|gradlew?|mvn)\s+test\b|\bunittest\b|-m\s+(?:pytest|unittest)\b|\bnode\s+--test\b|(?:^|&&|;|\|)\s*(?:npm|pnpm|yarn|bun|npx)\b[^&;|]*?\btest\b/;
+
+export function looksLikeTestSuiteCommand(cmd) {
+  return typeof cmd === "string" && TEST_SUITE_COMMAND.test(cmd);
+}
+
 export function parseCollectedTests(stdout = "", stderr = "") {
   const text = `${stdout || ""}\n${stderr || ""}`;
   if (!text.trim()) return { count: null, runner: null };
@@ -168,6 +218,30 @@ export function checkCollectionFloor(testResult, opts = {}) {
     return { ok: true, count: null, runner: null, reason: null };
   }
 
+  // A command that says it runs a suite, and printed nothing, ran no suite.
+  //
+  // Both halves are required. Silence alone would hard-red `tsc --noEmit` and
+  // `python3 -m compileall`, which are honest static gates this kit generates
+  // itself; the command shape alone would say nothing, because a real suite
+  // prints. Together they are decidable, and they are exactly `pnpm -r test`
+  // on a workspace whose packages declare no test script.
+  if (looksLikeTestSuiteCommand(testResult.command) && producedNoOutput(testResult.stdout, testResult.stderr)) {
+    return {
+      ok: false,
+      count: 0,
+      runner: null,
+      silent: true,
+      reason:
+        `The verification command ${testResult.command ? `${JSON.stringify(testResult.command)} ` : ""}` +
+        `exited 0 and wrote nothing at all — no test names, no summary, no count. ` +
+        `Every test runner prints something, so this command ran no suite, and approving this change ` +
+        `would certify nothing. A workspace command such as \`pnpm -r test\` does this when no package ` +
+        `declares a test script. Point verify.test at the suite that covers this repository ` +
+        `(often the root script rather than the recursive one), or — if this repository intentionally ` +
+        `uses only the scope and secret phases — set verify.required: false, which says so on the record.`,
+    };
+  }
+
   const { count, runner } = parseCollectedTests(testResult.stdout, testResult.stderr);
 
   // Deliberately one-sided: only a *stated* zero fails, because failing on

package/src/security.mjs

@@ -1875,6 +1875,51 @@ function splitTrailingMessage(clean) {
   return { head: clean.slice(0, lastComma), msg: tail };
 }
 
+/**
+ * Test declarations that a runner finds by the *name* of the function.
+ *
+ * pytest collects `def test_*`, Go collects `func Test*`, and unittest and
+ * Minitest collect `def test_*` off the case class. For those runners the
+ * name is not prose — it is the registration. Renaming `test_totals` to
+ * `totals` deletes the test from the run as completely as removing the file,
+ * and the diff shows a rename.
+ *
+ * Only these name-driven runners are listed. `it("...")`, `#[test]` and
+ * `@Test` register by call, attribute or annotation, so renaming what they
+ * declare removes nothing, and the ordinary rename rules already cover them.
+ */
+const NAME_REGISTERED_DECLS = [
+  { lang: "python", re: /^\s*(?:async\s+)?def\s+([A-Za-z_]\w*)\s*\(/, discovered: /^test/i },
+  { lang: "go", re: /^\s*func\s+([A-Za-z_]\w*)\s*\(/, discovered: /^(?:Test|Benchmark|Fuzz|Example)/ },
+];
+
+/**
+ * The declared name on this line, and whether the runner would collect it.
+ *
+ * @returns {{ name: string, collected: boolean }|null}
+ */
+function declaredTestName(text) {
+  for (const rule of NAME_REGISTERED_DECLS) {
+    const m = rule.re.exec(text);
+    if (m) return { name: m[1], collected: rule.discovered.test(m[1]) };
+  }
+  return null;
+}
+
+/**
+ * Is `after` the same declaration as `before` with its discovery prefix gone?
+ *
+ * Exact on the remainder, deliberately. `test_totals` → `totals` is a
+ * de-registration; `test_totals` → `test_totals_rounded` is a rename and must
+ * stay silent, which is the false red this check exists alongside rather than
+ * instead of.
+ */
+function isDeregistration(before, after) {
+  if (!before.collected || after.collected) return false;
+  const stripped = before.name.replace(/^test[_-]?/i, "").replace(/^(?:Test|Benchmark|Fuzz|Example)/, "");
+  return stripped.length > 0 && stripped === after.name;
+}
+
 // A test declaration whose first argument is the test's name. The name is
 // prose about the test, not a value the test asserts — `test("adds", ...)`
 // renamed to `test("adds positives", ...)` is the rename the diff says it is.
@@ -2211,6 +2256,7 @@ export const TAMPER_KINDS = new Map([
   ["ASSERTION_REMOVAL", "removal"],
   ["ASSERTION_WEAKENED", "weakening"],
   ["ASSERTION_EXPECTATION_CHANGED", "expectation"],
+  ["TEST_DEREGISTERED", "deregistration"],
 ]);
 
 /** Every kind name, for CLI validation and help text. */
@@ -2406,7 +2452,7 @@ export function checkTestTampering(diffOrText = "", options = {}) {
     }
 
     if (!fileAssertions.has(currentFile)) {
-      fileAssertions.set(currentFile, { removed: [], added: 0, addedTexts: [], removedSpecific: [], addedSpecific: 0, hunks: [], examined: 0, recognised: 0, unreadable: [] });
+      fileAssertions.set(currentFile, { removed: [], added: 0, addedTexts: [], removedSpecific: [], addedSpecific: 0, hunks: [], examined: 0, recognised: 0, unreadable: [], declRemoved: [], declAdded: [] });
     }
     const fileStats = fileAssertions.get(currentFile);
     if (pendingHunk) {
@@ -2419,6 +2465,10 @@ export function checkTestTampering(diffOrText = "", options = {}) {
       const deletedText = line.slice(1);
       if (hunk) hunk.lines.push({ kind: "-", text: deletedText, oldNo: currentOldLineNo, newNo: null });
       countExamined(fileStats, deletedText);
+      if (!isCommentLine(deletedText)) {
+        const decl = declaredTestName(deletedText);
+        if (decl) fileStats.declRemoved.push({ ...decl, line: currentOldLineNo, text: deletedText });
+      }
       if (!isCommentLine(deletedText) && ASSERTION_PATTERN.test(deletedText)) {
         fileStats.removed.push({ line: currentOldLineNo, text: deletedText });
         if (isSpecificAssertion(deletedText)) {
@@ -2430,6 +2480,10 @@ export function checkTestTampering(diffOrText = "", options = {}) {
       const addedText = line.slice(1);
       if (hunk) hunk.lines.push({ kind: "+", text: addedText, oldNo: null, newNo: currentNewLineNo });
       countExamined(fileStats, addedText);
+      if (!isCommentLine(addedText)) {
+        const decl = declaredTestName(addedText);
+        if (decl) fileStats.declAdded.push({ ...decl, line: currentNewLineNo, text: addedText });
+      }
       let isVacuous = false;
 
       // Check skip injections
@@ -2563,6 +2617,40 @@ export function checkTestTampering(diffOrText = "", options = {}) {
     }
   }
 
+  // A test renamed out of its runner's discovery convention.
+  //
+  // pytest collects `test_*` and nothing else, so `def test_totals` becoming
+  // `def totals` deletes the test from every future run while leaving it in
+  // the file, fully written, with all its assertions intact. Every count in
+  // this guard stays level: nothing was removed, weakened or rewritten.
+  //
+  // Until now this was caught only by accident, as a side effect of the
+  // blanket that blocked every unrecognised edit to a test file — which also
+  // blocked adding an import, and whose printed remedy (`tamperGuard: "warn"`)
+  // switched off the real checks along with the blanket. Narrowing that blanket
+  // is what makes this its own finding, with its own name and its own remedy.
+  for (const [file, stats] of fileAssertions.entries()) {
+    const takenAdds = new Set();
+    for (const before of stats.declRemoved || []) {
+      if (!before.collected) continue;
+      const idx = (stats.declAdded || []).findIndex((after, i) => !takenAdds.has(i) && isDeregistration(before, after));
+      if (idx === -1) continue;
+      takenAdds.add(idx);
+      const after = stats.declAdded[idx];
+      violations.push({
+        file,
+        line: after.line ?? before.line,
+        type: "TEST_DEREGISTERED",
+        reason:
+          `Test Tamper Guard: ${JSON.stringify(before.name)} was renamed to ${JSON.stringify(after.name)} in ${file}` +
+          `${after.line ? `:${after.line}` : ""}. The runner collects tests by name, so the test still exists in ` +
+          `the file and no longer runs — the same effect as deleting it, with none of the signs. ` +
+          `If the test is genuinely obsolete, delete it; if it is being turned into a helper, say so with ` +
+          `--allow-test-change deregistration.`,
+      });
+    }
+  }
+
   for (const [file, stats] of fileAssertions.entries()) {
     // An expectation that was rewritten rather than removed.
     //
@@ -2668,10 +2756,33 @@ export function checkTestTampering(diffOrText = "", options = {}) {
   // assertion, is not the same as "checked and clean" — it is the state where
   // this guard has nothing to say. Saying nothing and saying "approved" have
   // to look different, which is the whole reason `status` exists.
+  // `unreadable` is the evidence, and it is required.
+  //
+  // `|| examined > 0` used to stand here, and it threw away the distinction
+  // this whole apparatus exists to draw. `ASSERTION_SHAPED` and `unreadable[]`
+  // were built to separate "assertion-shaped lines were present and none of
+  // them parsed" — a dialect the guard cannot read — from "there were no
+  // assertions in these lines at all", which is most ordinary work on a test
+  // file. That clause collapsed the two, so *any* changed substantive line in
+  // a test file with no recognised assertion became a CRITICAL block:
+  // measured on `pytest-dev/iniconfig`, renaming a test function did it, and
+  // so did adding `import os`.
+  //
+  // The tell was in the finding itself: it carried `file: null`, `line: null`
+  // and no sample, because `unreadable` was empty — the guard blocked while
+  // holding no evidence of anything, and advised a pytest repository that its
+  // assertion library might be unsupported, from a list that names pytest.
+  //
+  // Nothing is weakened by requiring the evidence. A removed or rewritten
+  // assertion is a recognised assertion line, so it raises `assertionsSeen`
+  // and goes to the ordinary removal and weakening checks; it never reached
+  // this branch. What is lost is only the blanket, and a blanket that fires
+  // on `import os` teaches its way around itself: the remedy it printed was
+  // `tamperGuard: "warn"`, which switches the real guard off too.
   const status =
     reported.length > 0
       ? "FAIL"
-      : assertionsSeen === 0 && (unreadable.length > 0 || examined > 0)
+      : assertionsSeen === 0 && unreadable.length > 0
         ? "UNREADABLE"
         : examined > 0
           ? "PASS"