testguard-cli 0.14.0 → 0.14.2

package/CHANGELOG.md

@@ -7,6 +7,87 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.14.2] - 2026-09-28
+
+Automated weekly release — everything merged since `v0.14.1`.
+
+### Changed
+
+- chore(homebrew): sha256 for v0.14.1 (#171)
+
+
+## [0.14.1] - 2026-09-27
+
+Automated weekly release — everything merged since `v0.14.0`.
+
+### Changed
+
+- fix: four defects that made `nocover` report discovery failures as findings (#169)
+- chore: untrack local agent tooling and a generated fixture artifact (#168)
+- chore(homebrew): sha256 for v0.14.0 (#167)
+- docs(brief): page 6 carries what 0.14.0 changed there (#166)
+
+
+### Fixed
+
+- **`sweep` no longer refuses to write after a sweep that learned nothing.**
+  `learnedProductivity` named every evidence document it *read* as an ordering
+  source, while `observed` counts only `killed` and `survived` records. A
+  document whose records are all `nocover` — the ordinary shape of a first
+  sweep — therefore produced `sources: [...]` with `observed: 0`, which the
+  sweep validator correctly refuses. Because that document is written to
+  `.testguard/sweep-evidence.json`, **every later sweep failed the same way,
+  permanently**, until someone deleted a gitignored file nothing mentioned. An
+  ordering now names only the documents that contributed an observation, which
+  is what "the documents it was learned from" always meant. Measured on an
+  external corpus: this fired on 10 of 34 sweep invocations.
+- **`replay` resolves Python importers with the Python resolver.**
+  `replay` matched test files against a reverted source file with the
+  JavaScript importer for every language. `from pkg.mod import x` carries no
+  quoted specifier, so nothing ever matched, the defender set was always empty
+  for Python, and **every Python verdict was `nocover`** — "no test imports the
+  reverted source" — however complete the suite. `discoverDefendersDetailed`
+  has always branched on the target's language; `replay` now does the same.
+- **A runner that matches no test file is no longer selected silently.**
+  `--runner auto` tries vitest, jest, then python. A TypeScript project on
+  Playwright resolves neither JavaScript runner, so `auto` reached python
+  wherever a `python3` existed, globbed for `.py`, found none, and reported
+  every fault as `nocover`. `auto` now prefers a resolvable runner that can see
+  test files, and when none can it says so (`no runner matched a test file …
+  every verdict will be nocover`) instead of letting discovery's failure read
+  as a finding about the project. An explicitly named `--runner` is still
+  honoured; every selection now reports `testFiles`.
+
+- **`replay` no longer reports `nocover` when it removed the only test file.**
+  Removing the fix's own test removes the whole FILE, and on a project with
+  few, large test files that also removes tests which pre-dated the fix and
+  might have caught the bug. Nothing is left to run, so nothing can be
+  concluded: the verdict is now `unverifiable` with reason
+  `the-fix-shipped-the-only-test-file`. `nocover` is a statement about the
+  PROJECT — "no test exercises this" — and it enters the calibration as a
+  miss, so the old behaviour charged a project for evidence the measurement
+  itself destroyed. The validator now refuses the mislabelled form, and
+  `GATE-SEMANTICS.md` carries it as a third rule beside de-duplication and
+  test removal.
+
+### Changed
+
+- **Python: a module-level dunder assignment is no longer proposed as a
+  fault.** `__version__`, `__all__` and `__author__` at module level are
+  metadata nobody writes a test for, so a survivor on one teaches the
+  survival-learned ordering to prefer a barren class — the same reasoning that
+  already sets a presentational JSX element aside. Narrow on purpose: a
+  module-level *constant* such as `DEFAULT_MAX_SIZE = 100` is still proposed,
+  because removing a real default changes a real default.
+
+### Changed
+
+- The brief's page 6 says what 0.14.0 changed there: the evidence now names
+  the mocked layer and the assertion shape beside a save-path survivor's
+  verdict, and the fourth rule of the lower rungs — whatever a sweep does not
+  probe, it counts, presentational elements included. Re-rendered; still eight
+  sheets from eight pages.
+
 ## [0.14.0] - 2026-09-22
 
 Automated weekly release — everything merged since `v0.13.0`.

package/README.md

@@ -127,9 +127,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.14.0` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.14.2` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.14.0/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.14.2/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -663,12 +663,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.14.0
+- uses: raccioly/testguard@v0.14.2
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.14.0/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.14.2/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 
@@ -983,13 +983,20 @@ The table above is JavaScript. `scaffold` reads Python too, and proposes the
 same fault classes in Python syntax: `if <guard>:` → `if False:`,
 `return <check>` → `return True`, `verify=True` → `verify=False`, a
 parameter-derived argument swapped for `None`, a key dropped from a payload
-`dict` or an allow-list. Two differences are deliberate. A statement is
+`dict` or an allow-list. Three differences are deliberate. A statement is
 removed by replacing it with `pass`, never by deleting the line, because a
 block whose only statement is gone is an `IndentationError`; and a line that
 leaves a bracket open (`COLOURS = {`), or sits inside one opened on an earlier
 line (`help="…"` in an `add_argument(`), is never removed at all. Both exist
 because a fault that cannot compile is a `fault-invalid` verdict — a probe run
-spent saying nothing about the tests. The two JSX shapes (`element-removed`,
+spent saying nothing about the tests. Third, a **module-level dunder
+assignment** (`__version__`, `__all__`, `__author__`) is not proposed. Deleting
+one does change behaviour, so it is not an equivalent mutant; it is something
+nobody writes a test for, which is the disqualification an icon already gets on
+the JSX side — a survivor there teaches the survival-learned ordering to prefer
+a barren class. The rule is narrow on purpose: a module-level *constant*
+(`DEFAULT_MAX_SIZE = 100`) is still proposed, because removing a real default
+changes a real default. The two JSX shapes (`element-removed`,
 `handler-dropped`) have no Python meaning and are absent rather than faked.
 
 Every proposal's `find` is the exact line with `expectHits`/`occurrence`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "testguard-cli",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest.",
   "type": "module",
   "license": "MIT",

package/spec/GATE-SEMANTICS.md

@@ -197,8 +197,8 @@ Its verdicts mirror the probe's, for the same reasons:
 |---|---|
 | `caught` | a remaining test failed **by assertion** on the reverted source, every run. The suite knew. |
 | `blind` | the suite stayed green on known-broken code. |
-| `nocover` | no test imports the reverted files. Worse than `blind`: nothing was even tried. |
-| `unverifiable` | the revert did not apply, the suite failed to load, or it timed out. Carries a `reason`. |
+| `nocover` | no test imports the reverted files, **and at least one test file remained to ask**. Worse than `blind`: nothing was even tried. |
+| `unverifiable` | the revert did not apply, the suite failed to load, it timed out, or removing the fix's own test left **no test file at all** (`the-fix-shipped-the-only-test-file`). Carries a `reason`. |
 | `flaky` | the runs disagreed. A flaky failure reads as "the suite caught it", so flakiness biases this metric **optimistically** — mixed runs are never `caught`. |
 
 Two rules that follow:
@@ -208,6 +208,13 @@ Two rules that follow:
    twice corrupts the corpus a calibration is computed from.
 2. **The fix's own test is removed before the run.** It proves nothing about
    what the suite knew before the fix existed.
+3. **If that leaves no test file, the run is `unverifiable`, not `nocover`.**
+   Removal takes the whole FILE, so on a project with few, large test files it
+   also removes tests that pre-dated the fix and might have caught the bug. The
+   suite the measurement needed no longer exists, so nothing can be concluded.
+   `nocover` is a statement about the PROJECT — "no test exercises this" — and
+   using it here would charge the project, in the calibration, for evidence the
+   method itself destroyed.
 
 `caught`, `blind` and `nocover` are measurements and enter the calibration
 ratio: `caught` as a hit, the other two as misses. `nocover` counts as a miss
@@ -216,7 +223,9 @@ because it is one — the worst kind. Leaving it out would let a project with
 since its worst outcomes would leave the denominator before the ratio is
 taken; Stryker and PIT count no-coverage mutants against the headline score
 for the same reason. `flaky` and `unverifiable` are failed measurements and
-enter neither side.
+enter neither side — which is why rule 3 above matters: a run with no test
+file left is a failed measurement wearing `nocover`'s clothes, and left
+unclassified it would inflate every miss rate computed from the corpus.
 
 ### Calibration arithmetic is reproducible
 

package/spec/lib/validate.mjs

@@ -297,6 +297,14 @@ const semantic = {
       }
       if (r.verdict === 'nocover' && r.ranTests) errors.push({ path: `${p}/ranTests`, message: 'nocover means no test exercises the reverted files; it cannot have run tests' });
       if (r.verdict === 'unverifiable' && !r.reason) errors.push({ path: `${p}/reason`, message: 'unverifiable requires a reason (e.g. revert-did-not-apply, suite-failed-to-load)' });
+      // A run that had no test file left is a FAILED MEASUREMENT, never a
+      // finding about the project: removing the fix's test removed the file it
+      // lived in, and with it any pre-existing test that might have caught the
+      // bug. Recording that as `nocover` would put it in the calibration as a
+      // miss and charge the project for evidence the method destroyed.
+      if (r.reason === 'the-fix-shipped-the-only-test-file' && r.verdict !== 'unverifiable') {
+        errors.push({ path: `${p}/verdict`, message: 'no test file remained after removing the fix\'s own, so nothing could be concluded: that is unverifiable, not a finding about the project' });
+      }
     });
     return errors;
   },

package/spec/schemas/replay.schema.json

@@ -1,29 +1,70 @@
 {
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "$id": "urn:claimspec:v1:replay",
-  "title": "claimspec v1 — bug replay",
-  "description": "Would this suite have caught the bugs that actually escaped? For each fix commit in a range: revert only the source to its parent, remove the test the fix shipped, run what remains. `blind` means the suite was blind to a bug that really shipped. Unlike an injected fault, a replayed bug is ground truth — a human already confirmed it was a defect — which is what makes this the oracle a fault model is calibrated against.",
+  "title": "claimspec v1 \u2014 bug replay",
+  "description": "Would this suite have caught the bugs that actually escaped? For each fix commit in a range: revert only the source to its parent, remove the test the fix shipped, run what remains. `blind` means the suite was blind to a bug that really shipped. Unlike an injected fault, a replayed bug is ground truth \u2014 a human already confirmed it was a defect \u2014 which is what makes this the oracle a fault model is calibrated against.",
   "type": "object",
-  "required": ["schemaVersion", "tool", "run", "records"],
+  "required": [
+    "schemaVersion",
+    "tool",
+    "run",
+    "records"
+  ],
   "properties": {
-    "$schema": { "type": "string" },
-    "schemaVersion": { "const": 1 },
-    "tool": { "$ref": "urn:claimspec:v1:common#/$defs/tool" },
+    "$schema": {
+      "type": "string"
+    },
+    "schemaVersion": {
+      "const": 1
+    },
+    "tool": {
+      "$ref": "urn:claimspec:v1:common#/$defs/tool"
+    },
     "run": {
       "type": "object",
-      "required": ["id", "startedAt", "range", "confirmRuns"],
+      "required": [
+        "id",
+        "startedAt",
+        "range",
+        "confirmRuns"
+      ],
       "properties": {
-        "id": { "type": "string", "minLength": 1, "maxLength": 128 },
-        "startedAt": { "$ref": "urn:claimspec:v1:common#/$defs/isoDateTime" },
-        "finishedAt": { "$ref": "urn:claimspec:v1:common#/$defs/isoDateTime" },
+        "id": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 128
+        },
+        "startedAt": {
+          "$ref": "urn:claimspec:v1:common#/$defs/isoDateTime"
+        },
+        "finishedAt": {
+          "$ref": "urn:claimspec:v1:common#/$defs/isoDateTime"
+        },
         "range": {
           "description": "The commit range searched for fix commits, as given.",
           "type": "string",
           "minLength": 1,
           "maxLength": 256
         },
-        "runner": { "type": "object", "required": ["name"], "properties": { "name": { "type": "string" }, "version": { "type": "string" } }, "additionalProperties": false },
-        "confirmRuns": { "type": "integer", "minimum": 1 },
+        "runner": {
+          "type": "object",
+          "required": [
+            "name"
+          ],
+          "properties": {
+            "name": {
+              "type": "string"
+            },
+            "version": {
+              "type": "string"
+            }
+          },
+          "additionalProperties": false
+        },
+        "confirmRuns": {
+          "type": "integer",
+          "minimum": 1
+        },
         "candidates": {
           "description": "Fix commits found in the range before de-duplication by patch-id.",
           "type": "integer",
@@ -41,32 +82,61 @@
       "type": "array",
       "items": {
         "type": "object",
-        "required": ["commit", "patchId", "verdict", "source", "removedTests", "runs"],
+        "required": [
+          "commit",
+          "patchId",
+          "verdict",
+          "source",
+          "removedTests",
+          "runs"
+        ],
         "properties": {
-          "commit": { "$ref": "urn:claimspec:v1:common#/$defs/gitSha" },
+          "commit": {
+            "$ref": "urn:claimspec:v1:common#/$defs/gitSha"
+          },
           "patchId": {
             "description": "`git patch-id --stable` of the fix: the identity of the CHANGE rather than of the commit. A dual-branch topology carries the same fix under several shas, and counting it twice corrupts the corpus. Hex, 40 characters for a SHA-1 repository and 64 for a SHA-256 one; the commit sha when git could not compute one.",
             "type": "string",
             "pattern": "^[a-f0-9]{40}(?:[a-f0-9]{24})?$"
           },
-          "subject": { "description": "The fix commit's subject line, for a human reading the corpus.", "type": "string", "maxLength": 512 },
+          "subject": {
+            "description": "The fix commit's subject line, for a human reading the corpus.",
+            "type": "string",
+            "maxLength": 512
+          },
           "verdict": {
-            "description": "`caught` = a remaining test failed by assertion on the reverted source, every run. `blind` = the suite stayed green on known-broken code. `nocover` = no test exercises the reverted files at all, which is worse than blind. `unverifiable` = nothing could be concluded: the revert did not apply, the suite could not load, it timed out, or the commit only ADDS source (`no-prior-version` \u2014 there is no earlier behaviour to have been blind to, so it is not a bug the suite could have caught and it never enters a calibration). `flaky` = the runs disagreed, so nothing can be concluded.",
-            "enum": ["caught", "blind", "nocover", "unverifiable", "flaky"]
+            "description": "`caught` = a remaining test failed by assertion on the reverted source, every run. `blind` = the suite stayed green on known-broken code. `nocover` = no test exercises the reverted files at all, which is worse than blind; it requires that at least one test file REMAINED after the fix's own were removed, otherwise nothing could be concluded and the verdict is `unverifiable` with reason `the-fix-shipped-the-only-test-file`. `unverifiable` = nothing could be concluded: the revert did not apply, the suite could not load, it timed out, or the commit only ADDS source (`no-prior-version` \u2014 there is no earlier behaviour to have been blind to, so it is not a bug the suite could have caught and it never enters a calibration). `flaky` = the runs disagreed, so nothing can be concluded.",
+            "enum": [
+              "caught",
+              "blind",
+              "nocover",
+              "unverifiable",
+              "flaky"
+            ]
+          },
+          "reason": {
+            "type": "string",
+            "maxLength": 256
           },
-          "reason": { "type": "string", "maxLength": 256 },
           "source": {
             "description": "Source files reverted to the fix's parent.",
             "type": "array",
             "minItems": 1,
-            "items": { "$ref": "urn:claimspec:v1:common#/$defs/repoPath" }
+            "items": {
+              "$ref": "urn:claimspec:v1:common#/$defs/repoPath"
+            }
           },
           "removedTests": {
             "description": "Test files the fix shipped, removed before the run: the fix's own test proves nothing about what the suite knew before it.",
             "type": "array",
-            "items": { "$ref": "urn:claimspec:v1:common#/$defs/repoPath" }
+            "items": {
+              "$ref": "urn:claimspec:v1:common#/$defs/repoPath"
+            }
+          },
+          "ranTests": {
+            "type": "integer",
+            "minimum": 0
           },
-          "ranTests": { "type": "integer", "minimum": 0 },
           "faultClass": {
             "description": "The injected-fault class this real diff most resembles, derived mechanically from the diff shape. This is the join key between ground truth and a fault model: it is what lets P(this fault class is a real bug) be computed.",
             "$ref": "urn:claimspec:v1:common#/$defs/faultClass"
@@ -74,7 +144,9 @@
           "runs": {
             "type": "array",
             "minItems": 1,
-            "items": { "$ref": "urn:claimspec:v1:evidence#/$defs/testRun" }
+            "items": {
+              "$ref": "urn:claimspec:v1:evidence#/$defs/testRun"
+            }
           }
         },
         "additionalProperties": false

package/src/probe/runners/index.mjs

@@ -39,11 +39,30 @@ export async function selectRunner({ projectDir, sourceDir, python, name = 'auto
   const candidates = name === 'auto' ? [vitest, jest, pythonRunner] : [RUNNERS[name]];
   if (!candidates[0]) return { error: `unknown runner "${name}"; use ${RUNNER_NAMES.join(', ')} or auto` };
   const messages = [];
+  // A runner that resolves but whose globs match ZERO test files is not an
+  // answer. A pure TypeScript project using Playwright resolves neither vitest
+  // nor jest, and `auto` then reaches python — which resolves wherever a
+  // python3 exists — globs for `.py`, finds none, and reports every fault as
+  // `nocover`: a damning statement about the project produced by a runner that
+  // could not have seen its tests.
+  //
+  // So `auto` prefers a candidate that can actually see tests. An explicitly
+  // named runner is still honoured, because the caller asked for it; it is
+  // reported with `testFiles` so a caller can say what it is working with.
+  let blind = null;
   for (const r of candidates) {
     const c = await r.check({ projectDir, sourceDir, python });
-    if (c.ok) return { runner: r, version: c.version, source: c.source, engine: c.engine };
-    messages.push(`${r.name}: ${c.message}`);
+    if (!c.ok) { messages.push(`${r.name}: ${c.message}`); continue; }
+    const selected = { runner: r, version: c.version, source: c.source, engine: c.engine };
+    let testFiles = 0;
+    try { testFiles = r.tests(projectDir).length; } catch { testFiles = 0; }
+    if (testFiles > 0 || name !== 'auto') return { ...selected, testFiles };
+    blind ??= { ...selected, testFiles: 0 };
+    messages.push(`${r.name}: resolved but matched no test files`);
   }
+  // Nothing saw a test file. Return the first that resolved, and say plainly
+  // what that means, rather than letting every verdict read as a finding.
+  if (blind) return { ...blind, warning: `no runner matched a test file in this project; using ${blind.runner.name}, which sees none — every verdict will be nocover` };
   return { error: messages.join('; ') };
 }
 

package/src/replay/replay.mjs

@@ -7,6 +7,7 @@ import { selectRunner, RUNNERS } from '../probe/runners/index.mjs';
 import { parseCommandTemplate } from '../probe/runners/shared.mjs';
 import { fileImports } from '../probe/rank.mjs';
 import { IS_PY_TEST, pyFileImports } from '../probe/pyimports.mjs';
+import { isPython } from '../probe/discover.mjs';
 import { labelDiff } from './label.mjs';
 import { wilsonInterval, roundTo } from '../../spec/lib/wilson.mjs';
 
@@ -211,7 +212,27 @@ async function replayOne({ fix, iso, root, projectDir, confirmRuns, budgetMs, co
   // reverted source file. `nocover` means nothing does — worse than blind,
   // and a coverage report shows it as a red line you can ignore.
   const all = runner.tests(iso.projectDir).filter((t) => !fix.tests.some((ft) => rel(ft) === t));
-  const related = all.filter((t) => fix.source.some((sf) => fileImports(iso.projectDir, join(iso.projectDir, t), rel(sf))));
+  // Removing the fix's test removes the whole FILE, which on a project with
+  // few, large test files takes pre-existing tests with it — tests that did
+  // exist before the fix and might have caught the bug. When nothing is left,
+  // the suite this measurement needed no longer exists, so nothing can be
+  // concluded. That is `unverifiable`, not `nocover`: `nocover` is a finding
+  // about the project ("no test exercises this"), and counting it as a miss
+  // would charge the project for evidence the method itself destroyed.
+  if (all.length === 0) {
+    return { ...base, faultClass, verdict: 'unverifiable', reason: 'the-fix-shipped-the-only-test-file', ranTests: 0, runs: [{ outcome: 'error', durationMs: 0 }] };
+  }
+  // A target's language decides how its importers are found, exactly as
+  // `discoverDefendersDetailed` decides it. Resolving a `.py` target with the
+  // JavaScript resolver matches nothing — `IMPORT_RE` wants a quoted
+  // specifier and `from pkg.mod import x` has none — so `related` was always
+  // empty for Python and EVERY verdict was `nocover`, however good the suite.
+  const related = all.filter((t) => fix.source.some((sf) => {
+    const target = rel(sf);
+    return isPython(target)
+      ? pyFileImports(iso.projectDir, join(iso.projectDir, t), target, t)
+      : fileImports(iso.projectDir, join(iso.projectDir, t), target);
+  }));
   if (related.length === 0) {
     return { ...base, faultClass, verdict: 'nocover', reason: 'no-test-imports-the-reverted-source', ranTests: 0, runs: [{ outcome: 'error', durationMs: 0 }] };
   }

package/src/scaffold/producers.python.mjs

@@ -208,6 +208,25 @@ function argumentSwapProposals(lines, i, params) {
  * parameter names; `ctx.fieldDrops` disables payload shapes in files where a
  * dict literal is data rather than something the product sends.
  */
+/**
+ * A module-level dunder assignment — `__version__`, `__all__`, `__author__`.
+ *
+ * Deleting one changes behaviour (an attribute stops existing, a star-import
+ * exports differently), so it is not an equivalent mutant. It is something
+ * nobody writes a test for, which is a different disqualification and the same
+ * one the JSX side already applies to an icon: a survivor there teaches the
+ * survival-learned ordering to prefer the class, and the class is barren.
+ *
+ * Measured on this corpus: every false positive in the adjudicated sample was
+ * a module-level metadata assignment, and `statement-deleted` already took 55%
+ * of a 3% sample of proposals, so the class does not need the help.
+ *
+ * Deliberately NARROW. Only a dunder, and only at module level. A module-level
+ * CONSTANT (`DEFAULT_MAX_SIZE = 100`) is excluded from this rule on purpose:
+ * removing one changes a real default and a test may well be owed.
+ */
+const MODULE_DUNDER = /^__\w+__\s*(?::[^=]+)?=[^=]/;
+
 export function proposalsForLine(lines, i, ctx = {}) {
   const out = [];
   const line = lines[i];
@@ -238,7 +257,7 @@ export function proposalsForLine(lines, i, ctx = {}) {
   const complete = !inside && !isIncomplete(line);
   if (complete && CHECK_CALL.test(line)) {
     out.push({ faultClass: 'call-removed', description: `Check call removed: \`${line.trim()}\` no longer runs.`, replace: `${indent}pass` });
-  } else if (complete && MUTATION.test(line)) {
+  } else if (complete && MUTATION.test(line) && !(indent === '' && MODULE_DUNDER.test(line))) {
     out.push({ faultClass: 'statement-deleted', description: `State change removed: \`${line.trim()}\` no longer runs.`, replace: `${indent}pass` });
   }
 

package/src/supply/feedback.mjs

@@ -129,11 +129,23 @@ export function readEvidence(projectDir, paths = EVIDENCE_PATHS) {
  */
 export function learnedProductivity(projectDir, { paths, shipped } = {}) {
   const docs = readEvidence(projectDir, paths);
-  const local = mergeTallies(docs.map((d) => tallyEvidence(d.doc)));
+  const tallied = docs.map((d) => ({ path: d.path, tally: tallyEvidence(d.doc) }));
+  // A document is a SOURCE only if it contributed an observation. One that was
+  // read but yielded nothing countable is not something an ordering was
+  // "learned from", and naming it anyway is what produced a sweep document the
+  // validator correctly refused to write: sources named, observed zero.
+  //
+  // That state is the ORDINARY shape of a first sweep. `tallyEvidence` counts
+  // only `killed` and `survived`, so evidence whose records are all `nocover`
+  // teaches nothing — and once such a document was on disk, EVERY later sweep
+  // failed the same check, permanently, until someone deleted a gitignored
+  // file nothing told them about.
+  const contributing = tallied.filter((t) => Object.keys(t.tally).length > 0);
+  const local = mergeTallies(contributing.map((t) => t.tally));
   const observed = Object.values(local).reduce((a, e) => a + e.n, 0);
   return {
     table: combinedProductivity(local, shipped),
-    sources: docs.map((d) => d.path),
+    sources: contributing.map((t) => t.path),
     observed,
     classes: Object.keys(local).sort(),
   };