testguard-cli 0.13.0__tar.gz → 0.14.1__tar.gz

{testguard_cli-0.13.0 → testguard_cli-0.14.1}/.gitignore

@@ -14,6 +14,7 @@ coverage/
 # Local agent tooling — not part of the public project
 .wolf/
 .claude/
+.codex/
 .agent/
 CLAUDE.local.md
 graphify-out/

{testguard_cli-0.13.0 → testguard_cli-0.14.1}/.npmignore

@@ -3,6 +3,7 @@
 .github/
 .wolf/
 .claude/
+.codex/
 graphify-out/
 test/
 fixtures/

{testguard_cli-0.13.0 → testguard_cli-0.14.1}/AGENTS.md

@@ -1,6 +1,6 @@
 # AI Agent Instructions — TestGuard
 
-<!-- docguard:last-reviewed 2026-09-19 -->
+<!-- docguard:last-reviewed 2026-09-22 -->
 
 Read this before changing anything. It is short on purpose.
 
@@ -17,6 +17,7 @@ their first consumer.
 
 ```bash
 npm test               # unit + fixture acceptance (~15s)
+npm ci --prefix fixtures/known-answer-playwright   # once; without it the Playwright fixture acceptance silently skips
 npm run test:spec      # conformance suite only
 npm run self:probe     # TestGuard probes its own claims; must exit 0
 npm run test:install   # the packed tarball must run with production deps only

{testguard_cli-0.13.0 → testguard_cli-0.14.1}/CHANGELOG.md

@@ -7,6 +7,165 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [0.14.1] - 2026-09-27
+
+Automated weekly release — everything merged since `v0.14.0`.
+
+### Changed
+
+- fix: four defects that made `nocover` report discovery failures as findings (#169)
+- chore: untrack local agent tooling and a generated fixture artifact (#168)
+- chore(homebrew): sha256 for v0.14.0 (#167)
+- docs(brief): page 6 carries what 0.14.0 changed there (#166)
+
+
+### Fixed
+
+- **`sweep` no longer refuses to write after a sweep that learned nothing.**
+  `learnedProductivity` named every evidence document it *read* as an ordering
+  source, while `observed` counts only `killed` and `survived` records. A
+  document whose records are all `nocover` — the ordinary shape of a first
+  sweep — therefore produced `sources: [...]` with `observed: 0`, which the
+  sweep validator correctly refuses. Because that document is written to
+  `.testguard/sweep-evidence.json`, **every later sweep failed the same way,
+  permanently**, until someone deleted a gitignored file nothing mentioned. An
+  ordering now names only the documents that contributed an observation, which
+  is what "the documents it was learned from" always meant. Measured on an
+  external corpus: this fired on 10 of 34 sweep invocations.
+- **`replay` resolves Python importers with the Python resolver.**
+  `replay` matched test files against a reverted source file with the
+  JavaScript importer for every language. `from pkg.mod import x` carries no
+  quoted specifier, so nothing ever matched, the defender set was always empty
+  for Python, and **every Python verdict was `nocover`** — "no test imports the
+  reverted source" — however complete the suite. `discoverDefendersDetailed`
+  has always branched on the target's language; `replay` now does the same.
+- **A runner that matches no test file is no longer selected silently.**
+  `--runner auto` tries vitest, jest, then python. A TypeScript project on
+  Playwright resolves neither JavaScript runner, so `auto` reached python
+  wherever a `python3` existed, globbed for `.py`, found none, and reported
+  every fault as `nocover`. `auto` now prefers a resolvable runner that can see
+  test files, and when none can it says so (`no runner matched a test file …
+  every verdict will be nocover`) instead of letting discovery's failure read
+  as a finding about the project. An explicitly named `--runner` is still
+  honoured; every selection now reports `testFiles`.
+
+- **`replay` no longer reports `nocover` when it removed the only test file.**
+  Removing the fix's own test removes the whole FILE, and on a project with
+  few, large test files that also removes tests which pre-dated the fix and
+  might have caught the bug. Nothing is left to run, so nothing can be
+  concluded: the verdict is now `unverifiable` with reason
+  `the-fix-shipped-the-only-test-file`. `nocover` is a statement about the
+  PROJECT — "no test exercises this" — and it enters the calibration as a
+  miss, so the old behaviour charged a project for evidence the measurement
+  itself destroyed. The validator now refuses the mislabelled form, and
+  `GATE-SEMANTICS.md` carries it as a third rule beside de-duplication and
+  test removal.
+
+### Changed
+
+- **Python: a module-level dunder assignment is no longer proposed as a
+  fault.** `__version__`, `__all__` and `__author__` at module level are
+  metadata nobody writes a test for, so a survivor on one teaches the
+  survival-learned ordering to prefer a barren class — the same reasoning that
+  already sets a presentational JSX element aside. Narrow on purpose: a
+  module-level *constant* such as `DEFAULT_MAX_SIZE = 100` is still proposed,
+  because removing a real default changes a real default.
+
+### Changed
+
+- The brief's page 6 says what 0.14.0 changed there: the evidence now names
+  the mocked layer and the assertion shape beside a save-path survivor's
+  verdict, and the fourth rule of the lower rungs — whatever a sweep does not
+  probe, it counts, presentational elements included. Re-rendered; still eight
+  sheets from eight pages.
+
+## [0.14.0] - 2026-09-22
+
+Automated weekly release — everything merged since `v0.13.0`.
+
+### Changed
+
+- fix: three defects the arid measurement found, presentational JSX set aside, and the claimspec signal bump (#164)
+- docs: carry the 0.12 and 0.13 results into the brief and the prior-art record (#162)
+- chore(homebrew): sha256 for v0.13.0 (#161)
+
+
+### Added
+
+- **claimspec v1 evidence admits `persistence-payload-unasserted`** to
+  `defenders.signals`, the enum shared with every claimspec consumer. The
+  signal had lived only in the sweep document, so `probe` could not surface
+  why a save-path survivor was missed. Now a `survived` record whose fault
+  sits on the write path carries it for each resolved defender that mocks the
+  persistence layer, with the mocked `specifiers` and the file's assertion
+  `counts` (exact, partial, argument-free). The validator refuses it on any
+  other verdict, on a file that is not a resolved defender, or without its
+  reason — the same rule the sweep document already enforced on its
+  findings, and the sweep now repeats what the record says rather than
+  re-deriving it. Conformance carries a valid example and three invalid
+  cases. No consumer outside this repository validates claimspec evidence
+  today; DocGuard's adoption (docguard#420) is notified rather than broken.
+- `sweep` sets aside a purely presentational JSX element — an icon, or a
+  static wrapper with no expression and no handler — instead of spending a
+  probe run on it, and says so: `selection.presentational` in the document, a
+  line in the report, and the remainder arithmetic now proves
+  proposed = probed + deferred + set aside. Measured on a 14-file UI diff:
+  150 of 510 proposals, 29 of 30 probe slots and 7 of 10 survivors were of
+  this shape — Google's definition of an arid node, in a syntax Google never
+  mutated. Because the ordering learns from survival, those survivors were
+  also teaching it to rank the class higher; set-aside proposals never enter
+  the evidence, so they no longer can. Google's own five arid categories were
+  measured at under 1% of proposals and are not suppressed.
+
+### Fixed
+
+- Python defender discovery lost the last name on an import line that ends in
+  a comment: `from pkg import cli, demo  # noqa: E402` found only `cli`, and
+  `import pkg.demo  # noqa` found nothing. On a real suite where `# noqa` is
+  the idiom of every src-layout test, 12 of 30 probed faults were reported
+  NOCOVER for modules whose tests import them — a gating verdict in the
+  forbidden direction. Comments are now stripped before names are read.
+- File walking descended into `.claude/`, so a nested agent worktree under
+  `.claude/worktrees/` contributed another branch's tests as defenders of this
+  tree — files the scratch worktree cannot even contain, because the directory
+  is gitignored. `.claude` joins the tool-directory skip list, and the claim
+  that promised this now names it.
+- The Python `statement-deleted` producer proposed on lines inside a bracket
+  opened earlier — `help="…")` inside an `add_argument(` — and none of those
+  faults compiled: 81 of 600 proposals on a real CLI (13.5%). The producer now
+  tracks bracket depth across lines (triple-quoted strings included, so a
+  docstring's parentheses cannot leave the rest of the file "inside") and
+  refuses the `pass` shapes there; dict entries and call arguments keep their
+  own producers. Re-measured: 7 of 526 (1.3%).
+
+### Changed
+
+- The self-probe cost budget is 1650 s, from 1440. Six new claims (85 s on
+  the Node 22 PR leg, worst 22 s, all under the 100 s per-claim ceiling) took
+  that leg from 1367 s to 1457 s, over by 17 s. The v0.13.0 release job
+  measured 1113 s from scratch, but the PR leg runs the same claims 25-30%
+  slower and is where the ceiling is checked, so 1650 restores ~13% headroom
+  over the leg that binds. The per-claim ceiling is unchanged.
+- The technical brief carries the 0.12 and 0.13 results it was missing: the
+  whole-surface provability measurement (32 of 37 files that write are defended
+  only by tests that mock the database) replaces the sample-level number in
+  Fig. 7; the ladder's second rung is now a shipped verb with a real finding
+  (a five-line concern found an admin route whose owner/manager check can be
+  forced to `false` with no test failing) rather than a description of intent;
+  and the first rung says its ordering learns from the project's own runs.
+  Re-rendered; still eight sheets from eight pages.
+- `docs-canonical/PRIOR-ART.md` records the arid-node measurement instead of
+  a promise: every proposal from four sweeps over two of the maintainer's
+  repositories was classified by hand against Google's five arid categories,
+  and they account for under 1% of what the producers propose. No suppressor
+  is built for them. The same pass found what IS material — presentational
+  JSX taking 29 of 30 probe slots on a UI diff, and 13.5% of Python proposals
+  that cannot compile — and lists both as open, with numbers.
+- `docs-canonical/PRIOR-ART.md` no longer lists the feedback loop and concerns
+  as unbuilt. The two gaps that remain are restated precisely: the loop learns
+  from verdicts rather than explicit developer clicks, and concerns have no
+  model-backed producer.
+
 ## [0.13.0] - 2026-09-22
 
 Automated weekly release — everything merged since `v0.12.0`.

{testguard_cli-0.13.0 → testguard_cli-0.14.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: testguard-cli
-Version: 0.13.0
+Version: 0.14.1
 Summary: Breaks your code on purpose and reports every promise your tests did not notice breaking. Mutation testing bound to the claims a project makes — vitest, jest, Playwright, pytest and unittest. Ships the Node.js CLI (requires Node.js 20+).
 Project-URL: Homepage, https://github.com/raccioly/testguard
 Project-URL: Documentation, https://github.com/raccioly/testguard#readme
@@ -151,9 +151,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.13.0` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.14.1` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.13.0/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.14.1/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -258,6 +258,10 @@ npx testguard-cli admit test/x.test.ts --claim X   # is this test green on HEAD
    static signal `mocked-never-asserted` — the cheapest blind-spot signal
    there is, and the exact signature of one escaped bug in the field
    reports. Silence it, visibly, with `// unasserted: <why>` above the mock.
+   Its sibling `persistence-payload-unasserted` is attached to a **survivor
+   on a write path** whose defender mocks the database: the test can prove
+   the call shape and never that the row landed, and the signal names the
+   mocked layer and the file's assertion mix (exact, partial, argument-free).
 
    Runners: **vitest**, **jest**, **Playwright** and **Python** (`--runner
    auto` picks the first of vitest, jest, python that resolves). A JavaScript
@@ -447,8 +451,9 @@ alarming: something was deliberately broken and not one test failed.
 
 ```
 swept 13 of 14 unclaimed changed files against origin/main.
-proposed 510 faults, probed 10 (cap 10), deferred 500.
-  The 500 deferred are not a verdict: raise --cap, or sweep a smaller change.
+proposed 510 faults, probed 10 (cap 10), deferred 350.
+  The 350 deferred are not a verdict: raise --cap, or sweep a smaller change.
+  150 presentational elements (icons, static wrappers) set aside: nobody writes a test for those, and a survivor there would teach the ordering the wrong lesson.
 
 9 findings — a deliberate break that no test noticed:
 
@@ -682,12 +687,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.13.0
+- uses: raccioly/testguard@v0.14.1
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.13.0/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.14.1/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 
@@ -1002,12 +1007,20 @@ The table above is JavaScript. `scaffold` reads Python too, and proposes the
 same fault classes in Python syntax: `if <guard>:` → `if False:`,
 `return <check>` → `return True`, `verify=True` → `verify=False`, a
 parameter-derived argument swapped for `None`, a key dropped from a payload
-`dict` or an allow-list. Two differences are deliberate. A statement is
+`dict` or an allow-list. Three differences are deliberate. A statement is
 removed by replacing it with `pass`, never by deleting the line, because a
 block whose only statement is gone is an `IndentationError`; and a line that
-leaves a bracket open (`COLOURS = {`) is never removed at all. Both exist
+leaves a bracket open (`COLOURS = {`), or sits inside one opened on an earlier
+line (`help="…"` in an `add_argument(`), is never removed at all. Both exist
 because a fault that cannot compile is a `fault-invalid` verdict — a probe run
-spent saying nothing about the tests. The two JSX shapes (`element-removed`,
+spent saying nothing about the tests. Third, a **module-level dunder
+assignment** (`__version__`, `__all__`, `__author__`) is not proposed. Deleting
+one does change behaviour, so it is not an equivalent mutant; it is something
+nobody writes a test for, which is the disqualification an icon already gets on
+the JSX side — a survivor there teaches the survival-learned ordering to prefer
+a barren class. The rule is narrow on purpose: a module-level *constant*
+(`DEFAULT_MAX_SIZE = 100`) is still proposed, because removing a real default
+changes a real default. The two JSX shapes (`element-removed`,
 `handler-dropped`) have no Python meaning and are absent rather than faked.
 
 Every proposal's `find` is the exact line with `expectHits`/`occurrence`

{testguard_cli-0.13.0 → testguard_cli-0.14.1}/README.md

@@ -127,9 +127,9 @@ raises coverage. TestGuard admits it because it fails when the claim is false.
 | npm | `npm i -D testguard-cli` then `npx testguard probe` |
 | pip | `pip install testguard-cli` then `testguard probe` (needs Node ≥ 20) |
 | Homebrew | `brew tap raccioly/tap && brew install testguard` |
-| GitHub Action | `uses: raccioly/testguard@v0.13.0` — see [`action.yml`](./action.yml) |
+| GitHub Action | `uses: raccioly/testguard@v0.14.1` — see [`action.yml`](./action.yml) |
 | pre-commit | `repo: https://github.com/raccioly/testguard`, hooks `testguard-claims`, `testguard-probe` |
-| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.13.0/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
+| GitLab CI | `include: - remote: https://raw.githubusercontent.com/raccioly/testguard/v0.14.1/packaging/gitlab/testguard.gitlab-ci.yml` with `inputs:` — see [`packaging/gitlab/`](./packaging/gitlab/testguard.gitlab-ci.yml) |
 
 Projects that set `min-release-age` in `.npmrc` cannot see a version published
 less than that many days ago (`ENOVERSIONS`); install that one with
@@ -234,6 +234,10 @@ npx testguard-cli admit test/x.test.ts --claim X   # is this test green on HEAD
    static signal `mocked-never-asserted` — the cheapest blind-spot signal
    there is, and the exact signature of one escaped bug in the field
    reports. Silence it, visibly, with `// unasserted: <why>` above the mock.
+   Its sibling `persistence-payload-unasserted` is attached to a **survivor
+   on a write path** whose defender mocks the database: the test can prove
+   the call shape and never that the row landed, and the signal names the
+   mocked layer and the file's assertion mix (exact, partial, argument-free).
 
    Runners: **vitest**, **jest**, **Playwright** and **Python** (`--runner
    auto` picks the first of vitest, jest, python that resolves). A JavaScript
@@ -423,8 +427,9 @@ alarming: something was deliberately broken and not one test failed.
 
 ```
 swept 13 of 14 unclaimed changed files against origin/main.
-proposed 510 faults, probed 10 (cap 10), deferred 500.
-  The 500 deferred are not a verdict: raise --cap, or sweep a smaller change.
+proposed 510 faults, probed 10 (cap 10), deferred 350.
+  The 350 deferred are not a verdict: raise --cap, or sweep a smaller change.
+  150 presentational elements (icons, static wrappers) set aside: nobody writes a test for those, and a survivor there would teach the ordering the wrong lesson.
 
 9 findings — a deliberate break that no test noticed:
 
@@ -658,12 +663,12 @@ detected base that does not resolve is a warning for `status` and `brief`
 # GitHub Actions
 - uses: actions/checkout@v4
   with: { fetch-depth: 0 }
-- uses: raccioly/testguard@v0.13.0
+- uses: raccioly/testguard@v0.14.1
   with: { command: gate }
 
 # GitLab CI — the component-shaped template: gate + probe, brief as an artifact and, opted in, as a merge-request note
 include:
-  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.13.0/packaging/gitlab/testguard.gitlab-ci.yml'
+  - remote: 'https://raw.githubusercontent.com/raccioly/testguard/v0.14.1/packaging/gitlab/testguard.gitlab-ci.yml'
     inputs: { dir: backend, post_note: true }   # post_note needs TESTGUARD_GITLAB_TOKEN (api scope); one note, updated in place
 ```
 
@@ -978,12 +983,20 @@ The table above is JavaScript. `scaffold` reads Python too, and proposes the
 same fault classes in Python syntax: `if <guard>:` → `if False:`,
 `return <check>` → `return True`, `verify=True` → `verify=False`, a
 parameter-derived argument swapped for `None`, a key dropped from a payload
-`dict` or an allow-list. Two differences are deliberate. A statement is
+`dict` or an allow-list. Three differences are deliberate. A statement is
 removed by replacing it with `pass`, never by deleting the line, because a
 block whose only statement is gone is an `IndentationError`; and a line that
-leaves a bracket open (`COLOURS = {`) is never removed at all. Both exist
+leaves a bracket open (`COLOURS = {`), or sits inside one opened on an earlier
+line (`help="…"` in an `add_argument(`), is never removed at all. Both exist
 because a fault that cannot compile is a `fault-invalid` verdict — a probe run
-spent saying nothing about the tests. The two JSX shapes (`element-removed`,
+spent saying nothing about the tests. Third, a **module-level dunder
+assignment** (`__version__`, `__all__`, `__author__`) is not proposed. Deleting
+one does change behaviour, so it is not an equivalent mutant; it is something
+nobody writes a test for, which is the disqualification an icon already gets on
+the JSX side — a survivor there teaches the survival-learned ordering to prefer
+a barren class. The rule is narrow on purpose: a module-level *constant*
+(`DEFAULT_MAX_SIZE = 100`) is still proposed, because removing a real default
+changes a real default. The two JSX shapes (`element-removed`,
 `handler-dropped`) have no Python meaning and are absent rather than faked.
 
 Every proposal's `find` is the exact line with `expectHits`/`occurrence`

{testguard_cli-0.13.0 → testguard_cli-0.14.1}/action.yml

@@ -46,7 +46,7 @@ inputs:
   version:
     description: 'testguard-cli version to run'
     required: false
-    default: '0.13.0'
+    default: '0.14.1'
   node-version:
     description: 'Node.js version (20+)'
     required: false

{testguard_cli-0.13.0 → testguard_cli-0.14.1}/docs/testguard-explained.html

@@ -144,7 +144,7 @@
 <div class="page">
   <div class="masthead">
     <div class="wordmark">Test<span class="mark">Guard</span></div>
-    <div class="meta">Technical Brief · v0.13.0 · MIT</div>
+    <div class="meta">Technical Brief · v0.14.1 · MIT</div>
   </div>
 
   <h1>Your tests pass. That is not the same as your tests working.</h1>
@@ -678,7 +678,7 @@
       <tr><td><code>init</code></td><td>Installs the agent layer — skill, session-start hook, AGENTS.md section — at the git root.</td></tr>
       <tr><td><code>claims</code></td><td>Lists the claims and reports drift against the <code>@claim</code> annotations in the code.</td></tr>
       <tr><td><code>scaffold</code></td><td>Proposes faults mechanically for one file, as a draft claims document. A starting point, not an answer.</td></tr>
-      <tr><td><code>sweep</code></td><td>The cold start: propose and probe faults for changed files that carry <em>no</em> claim.</td></tr>
+      <tr><td><code>sweep</code></td><td>The cold start: probe files with <em>no</em> claim — a diff, the write surface, or a one-line <code>concern</code>.</td></tr>
       <tr><td class="v-good"><code>probe</code></td><td>The engine. Inject each fault, run its defenders, report what survived.</td></tr>
       <tr><td><code>admit</code></td><td>The two-gate rule as one verb: green on HEAD <em>and</em> failing on every fault of the claim. Otherwise the test is not a defender.</td></tr>
       <tr><td><code>baseline</code></td><td>Freezes today's unproven findings so only new ones gate.</td></tr>
@@ -752,10 +752,10 @@ field-dropped  missed 4/4  p=1.00  ci [0.51, 1.00]</pre>
 
   <section class="rule-top">
     <h2>Field report C — where a save button actually fails</h2>
-    <p>Twenty-six faults injected on the persistence path of seven server actions in a real
-    AI-authored application: the database write itself, and the fields of the payload it carries.</p>
+    <p>Twenty-six faults on the persistence path of seven server actions in a real AI-authored
+    application: the write itself, and the fields it carries.</p>
     <figure style="margin-top:11px">
-      <svg viewBox="0 0 760 150" role="img" aria-label="Save-path measurement: 12 of 26 faults survived, all of them a dropped payload field; 10 of 10 tests mock the database and none read back">
+      <svg viewBox="0 0 760 150" role="img" aria-label="Save-path measurement: 12 of 26 faults survived, all of them a dropped payload field; across the whole write surface, 32 of 37 files are defended only by tests that mock the database">
         <rect x="0" y="0" width="243" height="74" rx="4" fill="#ffffff" stroke="#e6e2d8"/>
         <text x="18" y="38" style="font-family:var(--sans);font-size:27px;font-weight:700;letter-spacing:-0.03em;fill:#b85636">12 of 26</text>
         <text class="s-sub" x="18" y="56" style="font-size:8px">survived a fully green suite</text>
@@ -767,9 +767,9 @@ field-dropped  missed 4/4  p=1.00  ci [0.51, 1.00]</pre>
         <text class="s-sub" x="276" y="68" style="font-size:8px">field — not one was anything else</text>
 
         <rect x="516" y="0" width="244" height="74" rx="4" fill="#ffffff" stroke="#e6e2d8"/>
-        <text x="534" y="38" style="font-family:var(--sans);font-size:27px;font-weight:700;letter-spacing:-0.03em;fill:#191917">10 of 10</text>
-        <text class="s-sub" x="534" y="56" style="font-size:8px">tests mock the database; none</text>
-        <text class="s-sub" x="534" y="68" style="font-size:8px">read the record back</text>
+        <text x="534" y="38" style="font-family:var(--sans);font-size:27px;font-weight:700;letter-spacing:-0.03em;fill:#b85636">32 of 37</text>
+        <text class="s-sub" x="534" y="56" style="font-size:8px">files that write are defended only</text>
+        <text class="s-sub" x="534" y="68" style="font-size:8px">by tests that mock the database</text>
 
         <rect x="0" y="86" width="760" height="58" rx="4" fill="#fbf1ec" stroke="#e8d5cc"/>
         <text class="s-tiny" x="16" y="104" style="fill:#b85636">The worst case — user registration</text>
@@ -778,9 +778,12 @@ field-dropped  missed 4/4  p=1.00  ci [0.51, 1.00]</pre>
       </svg>
       <p class="figcap">Fig. 7 — The save button reports success. The suite agrees. The column is empty.</p>
     </figure>
-    <p class="note">This is the page-one exhibit again, measured rather than recounted: an assertion that
-    names the call but not the payload cannot fail when a field goes missing. It is invisible to coverage,
-    invisible to a mutation score, and invisible to the test's own author.</p>
+    <p class="note">The third number is the read-back answer. A test that replaced the database proves the
+    call shape and nothing beyond it — a <code>where</code> matching no rows, a rolled-back transaction, a
+    rejected constraint all pass against a mock. On this surface a clean probe is not evidence of
+    persistence; it is evidence that nothing could have measured it, and the tool says so before any verdict.
+    The evidence now names the mocked layer and the assertion shape — exact, partial or argument-free —
+    beside the survivor’s verdict.</p>
   </section>
 
   <section class="rule-top">
@@ -788,33 +791,33 @@ field-dropped  missed 4/4  p=1.00  ci [0.51, 1.00]</pre>
     <div class="cols-3">
       <div>
         <h3>Nothing written</h3>
-        <p class="note"><code>sweep</code> takes the changed files the gate just called uncovered,
-        proposes faults with the mechanical producers, probes a bounded selection, and reports what
-        nothing noticed. A fault that survives needs no claim to be alarming.</p>
+        <p class="note"><code>sweep</code> takes the files the gate just called uncovered, proposes
+        faults mechanically, probes a bounded selection, and reports what nothing noticed — ordering
+        candidates by what this project’s own runs have shown survives, the feedback that took
+        Google’s productive rate from 15% to 89%.</p>
       </div>
       <div>
         <h3>A sentence or ten</h3>
-        <p class="note">A <em>concern</em> — “every save persists its data” — is one sentence that applies
-        across two hundred screens. It is human-anchored and machine-instantiated, and every proposal it
-        produces still has to survive an execution gate.</p>
+        <p class="note">A <em>concern</em> names a kind of promise and where to look. Five lines of JSON — “every admin route refuses a caller without the admin role” — found a
+        route whose owner/manager check can be forced to <code>false</code> with no test failing. One
+        sentence, twenty-four routes, no model.</p>
       </div>
       <div>
         <h3>A claim</h3>
         <p class="note">The survivors worth defending become the first claims: a statement, its faults,
-        and a reproducer already in hand. The ladder ends where the rest of this brief begins.</p>
+        and a reproducer already in hand.</p>
       </div>
     </div>
-    <p class="note" style="margin-top:9px">Three rules keep the bottom rung safe on a repository that has
-    never seen this tool. A sweep <strong>never writes the claims file</strong> — a sentence nobody wrote
-    is not a claim. Its evidence <strong>never replaces</strong> the canonical evidence, which is the
-    record of what the project actually claims. And it <strong>does not fail on its own bad guess</strong>:
-    only a survivor or an untested file exits non-zero, because a proposal that would not compile is the
-    tool’s mistake, and a tool that fails on its own mistakes gets switched off.</p>
+    <p class="note" style="margin-top:9px">Four rules keep the lower rungs safe. A sweep <strong>never
+    writes the claims file</strong> — a sentence nobody wrote is not a claim. Its evidence <strong>never
+    replaces</strong> the canonical record. And it <strong>does not fail on its own bad guess</strong>:
+    only a survivor or an untested file exits non-zero. And whatever it does not probe, it counts —
+    past the cap, outside the concern, or presentational: an icon or a static wrapper nobody would test.</p>
   </section>
 
   <div class="pull">
-    <p>A sweep is weaker evidence than a probe, and says so. Nobody stated that the behaviour mattered.
-    It is stronger than nothing, which is what a repository with no claims has.</p>
+    <p>A sweep is weaker evidence than a probe, and says so. It is stronger than nothing,
+    which is what a repository with no claims has.</p>
     <div class="attrib">Why the ladder has a bottom rung</div>
   </div>
 
@@ -843,7 +846,9 @@ field-dropped  missed 4/4  p=1.00  ci [0.51, 1.00]</pre>
         A later study found reported mutants are coupled to real faults: the bugs they analysed would
         have been caught had a mutant been surfaced.</p>
         <p class="note"><em>Taken here:</em> the diff scope, the cap, and a productivity-ordered
-        selection — measured on real probed faults rather than assumed.</p>
+        selection — measured on real probed faults rather than assumed. Their arid-node suppression
+        was measured, not copied: Google's categories are under 1% of what the producers propose;
+        the arid class here is presentational JSX, now set aside and counted.</p>
       </div>
       <div>
         <h3>Meta — making it specific</h3>

{testguard_cli-0.13.0 → testguard_cli-0.14.1}/docs-canonical/PRIOR-ART.md

@@ -2,7 +2,7 @@
 
 <!-- docguard:version 1.0.0 -->
 <!-- docguard:status approved -->
-<!-- docguard:last-reviewed 2026-09-21 -->
+<!-- docguard:last-reviewed 2026-09-22 -->
 <!-- docguard:owner @raccioly -->
 <!-- docguard:quality passive-voice off — the subject of this document is what was taken from other people's work. "Diff scoping was taken from Google" is the true sentence; rewriting every one to name us as the actor would put the borrower in the foreground of a document about the lender. -->
 <!-- docguard:quality negation-load off — half the value here is what was deliberately NOT taken: not their mutation score, not their equivalence auto-drop, not a model judging a verdict. A record of borrowings that only lists borrowings is the half that misleads. -->
@@ -49,14 +49,16 @@ numbers are the reason several of our defaults are what they are.
 | **Diff scoping** — mutate only changed lines, surfaced during code review. | `gate --changed`, and `sweep`, which proposes only for changed files. |
 | **A hard cap on what is surfaced** — at most 7 × the number of files in the change, because past that the reader stops reading. | `capFor()` in `src/supply/select.mjs`; the remainder is reported as `deferred`, never dropped. |
 | **Productivity-ordered selection** — order candidates by how often that operator produced a useful mutant in similar context. Developer feedback over six years took their productive rate from **15% to 89%**. | `MEASURED_PRODUCTIVITY` and `scoreOf()` in `src/supply/select.mjs`. Ours is measured on 56 probed faults from a real AI-authored codebase and shrunk toward a neutral prior, so one observation cannot dominate. |
-| **Arid-node suppression** — do not mutate code nobody would write a test for (logging, timeouts, config flags). | Partially: our producers are line-oriented and never propose on comments or blank lines, and `testguard.ignore.json` carries path exclusions with reasons. We have no AST-level arid heuristic. |
+| **Arid-node suppression** — do not mutate code nobody would write a test for (logging, timeouts, config flags). | **Measured, not built.** On 2026-09-22 every fault the producers proposed on two of the maintainer's repositories (`sweep --changed` and `sweep --save-paths`, cap 30, 510 + 581 proposals on a Next.js app and 600 on a Python CLI) was classified by hand against Google's five categories — logging, time/sleep/deadline, config flag, memoisation, monitoring counter. They account for **2 of 510, 0 of 581 and about 4 of 600** proposals: under 1% everywhere, against the ~10% that would have justified a suppressor. The reason is structural: the producers are already shape-targeted (a guard, a payload field, a security literal), so they rarely land on a log line in the first place. What the same measurement found instead is recorded under *Known gaps*. |
 | **Fault coupling as the justification** — their 2021 study found reported mutants are coupled to real faults: bugs they analysed would have been caught had a mutant been surfaced. | The premise behind `replay`, which calibrates fault classes against real fix commits rather than assuming the coupling. |
 
 **Not taken.** Their mutation score, their exhaustive per-line generation, and
 their AST-based arid heuristics (ours is a different scale and a different
-language surface). Their selection learns continuously from developer
-feedback; **ours does not yet** — see
-[Known gaps](#known-gaps-in-what-we-borrowed).
+language surface). Their selection learns from explicit developer feedback;
+**ours learns from the project's own probed verdicts** (v0.13.0) — every
+evidence record already carries a fault class and a verdict, so the feedback
+is a tally rather than a thing to collect. The combination is a Beta-Binomial
+posterior mean, which is strictly proper; see the Laya section.
 
 ## Meta — making it specific
 
@@ -75,7 +77,7 @@ concern, and every step is gated by execution.
 
 | Taken | Where it lives here |
 |---|---|
-| **The concern as the unit a human writes.** One plain-text sentence generates faults across a whole surface. | The planned Level 1 `testguard.concerns.json`. Not yet implemented — see [Known gaps](#known-gaps-in-what-we-borrowed). |
+| **The concern as the unit a human writes.** One plain-text sentence generates faults across a whole surface. | `testguard.concerns.json` and `sweep --concern` (v0.13.0). Taken WITHOUT the generator: a concern's core is a named scope plus a producer selection, which the mechanical producers already satisfy, so it ships offline. On a real application a five-line concern found an admin route whose owner/manager check can be forced to `false` with no test failing. |
 | **An execution gate between every model step and the record.** A drafted fault must build, must survive the existing suite, and must not be equivalent before a test is generated for it; the generated test must build, pass on the original N times, and kill the fault. | The rule that nothing a model proposes enters `testguard.claims.json` without passing `probe` and a human keep — already how `scaffold` drafts work. |
 | **Show the reviewer the fault as proof.** The engineer sees the concrete fault the test catches, so the model's output is independently checkable rather than self-referential. | Every finding names its fault, its anchor and its reproducer; `admit` reports which fault a candidate test kills. |
 | **Learned, realistic faults rather than syntactic ones** (Beller 2021: operators learned from a corpus of real Java errors and from changes that caused operational anomalies; **>50% of 15,000 generated mutants survived** their suite). | The premise behind `replay`'s fault-class calibration, and behind the planned intent-based producer. Our built-in producers remain deterministic and line-oriented. |
@@ -148,13 +150,37 @@ difference between a metric and an audit.
 
 Recorded so they are not mistaken for decisions.
 
-- **The feedback loop is not built.** Google's 15% → 89% gain came from
-  developer feedback refining suppression and selection over six years. Ours
-  ships a static measured prior. Until keep/drop decisions feed back,
-  `MEASURED_PRODUCTIVITY` is a snapshot of one repository.
-- **Concerns are not implemented.** ACH's central idea — the plain-text concern
-  as the unit a human writes — is planned, not shipped.
-- **No arid-node heuristic.** We suppress by path, not by AST shape.
-- **The persistence signal is confined to the sweep document.** It is not yet
-  in `evidence.defenders.signals`, which is a closed enum in the shared
-  claimspec contract and needs a coordinated bump.
+- **The feedback loop learns from verdicts, not from explicit developer
+  clicks.** Google's gain came from "Please fix" / "Not useful" feedback on
+  surfaced mutants. Ours reads survival per fault class from the project's own
+  evidence — the same signal, but it cannot yet distinguish a survivor the
+  developer *acted on* from one they ignored. A keep/drop record would close
+  that.
+- **Concerns have no model-backed producer.** The unit shipped; the ACH
+  generator that drafts intent-level faults for a concern did not, and is the
+  one piece of the rung that would touch the network.
+- **No arid-node heuristic, and the measurement says none is needed for
+  Google's categories** (under 1% of proposals; see the Google table). Two
+  different things ARE material, measured on the same runs:
+  - **Presentational JSX.** On a 14-file UI diff, 150 of 510 proposals (29%)
+    were `element-removed` on an icon (`<X />`, `<ChevronLeft />`) or a static
+    wrapper (`<div>`, `<span>`, `<p>` with no expression and no handler). The
+    ranker spent 29 of 30 probe slots on that class and 7 of the 10 survivors
+    were of this shape — findings nobody will write a test for, which is
+    Google's definition of arid, in a syntax Google never mutated. Because the
+    ordering learns from survival, these survivors also teach it to rank the
+    class higher. A line-oriented demotion is designed; it is not built.
+  - **Python continuation lines.** 81 of 600 proposals on a Python CLI
+    (13.5%) did not compile, 77 of them a `statement-deleted` on a line that
+    sits inside a bracket opened on an earlier line. `isIncomplete()` in
+    `src/scaffold/producers.python.mjs` checks only whether the line itself
+    leaves a bracket open. Measured with the tokenizer's exact depth, a
+    running-depth guard on that class catches 74 of the 77 and drops no
+    valid proposal. Not arid — a producer that spends probe runs saying
+    nothing — but found by the same pass.
+- **The persistence signal reached the evidence on 2026-09-22**
+  (`persistence-payload-unasserted` in `evidence.defenders.signals`, a closed
+  enum in the shared claimspec contract). No tool outside this repository
+  validated claimspec evidence at the time; DocGuard's adoption (docguard#420)
+  was notified rather than broken. Listed here because the enum is shared:
+  the next addition needs the same notice.

{testguard_cli-0.13.0 → testguard_cli-0.14.1}/docs-canonical/TEST-SPEC.md

@@ -2,7 +2,7 @@
 
 <!-- docguard:version 1.0.0 -->
 <!-- docguard:status approved -->
-<!-- docguard:last-reviewed 2026-09-19 -->
+<!-- docguard:last-reviewed 2026-09-22 -->
 <!-- docguard:owner @raccioly -->
 <!-- docguard:quality negation-load off — the governing rule is a prohibition (a test that would pass with the behaviour broken is not a test), and the verdict rules are defined by what does not count as detection. -->
 
@@ -20,7 +20,7 @@ the test that defends it, and CI fails if any injected fault survives.
 | Unit | `test/*.test.mjs` | One pure function's branches, without a runner | milliseconds |
 | Conformance | `spec/conformance/` | Every valid example validates; every must-reject document is rejected for the defect its filename names | ~1 s |
 | Anchor preflight | `test/claims-anchors.test.mjs` | Exact anchors still locate, supported replacements parse, the check stays below one second, and CI reaches it before self-probe | <1 s |
-| Fixture acceptance | `test/probe.fixture.test.mjs`, `test/probe.jest.test.mjs`, `test/probe.playwright.test.mjs` | The whole pipeline reproduces a known-answer oracle, one per runner | 10–50 s each |
+| Fixture acceptance | `test/probe.fixture.test.mjs`, `test/probe.jest.test.mjs`, `test/probe.playwright.test.mjs` | The whole pipeline reproduces a known-answer oracle, one per runner. The Playwright fixture carries its own dependencies: without `npm ci --prefix fixtures/known-answer-playwright` that file skips, and a skipped acceptance is not a passing one | 10–50 s each |
 | Self-verification | `testguard.claims.json`, run by `npm run self:probe` | The tool's own invariants survive fault injection | **20.2 min** cold (measured by the v0.10.1 release job on 2026-09-19 at `70e9d61`: 154 faults, 924 defender runs, 1210 s); seconds when verdicts are reused, which is why PR CI restores previous evidence from cache. Budgeted at 1440 s in `testguard.cost-budget.json` for the additional four-fault live-tap claim and **gated** in CI — cost growth is reviewed instead of disappearing into a passing log |
 | Install smoke | `.github/scripts/install-smoke.mjs` | The **packed tarball** runs with production dependencies only | ~20 s |
 | Runtime budget | `ci.yml` | The suite has not silently started walking the wrong tree | gate, not a test |