Guard against a tool gutting a test file, and close #Y30AXB

[BigSimmo]

Summary

Closes #Y30AXB, which asked for two things. The first turned out to be already done, and proving that was most of the work.

• Nothing needed restoring. d1485d6e8 is not an ancestor of main and never was — it lived only on refs/pull/2481/head. PR fix(ui/answer): keep answer-surface counts neutral and the safety tile amber #2481 squash-merged as e16d5f66d, whose diff is two src/components files; tests/ui-smoke.spec.ts is not in the merged diff at all, because the branch's later merge of main (31f41450a) took main's blob. Verified by blob hash and by full test-title comparison: every one of the 89 test cases present at d1485d6e8^ is on main today (now 90), with one legitimate rename by dc15d0c69 and one addition by 07df3f6d5. tests/ui-smoke.spec.ts is therefore deliberately unmodified in this PR. Two independent agents reached this conclusion separately.
• The bad commit contained no recoverable intent either. Its four "insertions" were not code but a file-reading tool's truncation banner written back as file content, including a marker reporting tens of thousands of elided tokens spliced mid-token into what should have been TypeScript. The file did not parse, so Playwright would have failed to load the spec rather than run 8 tests. The work it was reaching for landed separately as 47af5819c.
• New gate npm run check:diff-integrity (scripts/check-diff-integrity.mjs, diff-integrity.json), the remedy #Y30AXB asked for. Two rules over the diff against the merge base with origin/main — never the previous commit, so removing tests across several small commits is still measured as the whole drop.
  • Test-case floor. Cases are counted from the TypeScript AST, not by grepping for test(: a grep counts the RegExp test method and, worse, keeps counting a block of tests after someone comments it out. Measured in aggregate across changed test files (25%) and per surviving file (50%, above a 3-case floor). The aggregate alone flags the ordinary refactor that deletes one spec and adds its replacement; the per-file rule alone misses a suite gutted inside a large PR whose other additions absorb the loss.
  • Truncation artefact. No added line, in any file, may carry a tool's truncation banner — the actual signature here, and the half that also covers the same failure landing in src/ rather than a spec.
  • A deliberate reduction is a reviewed change: an exact {path, before, after, reason, approvedOn} entry in diff-integrity.json, pinned to both counts so an approval cannot quietly cover a later, larger cut. Fails closed on an unresolvable base or unreadable blob.
• Registration: unconditional in verify:cheap and verify:pr-local, plus a static-pr step in CI; gate counts in CLAUDE.md (34 → 35) and .claude/skills/gates/SKILL.md (37 → 38) updated so check:gate-manifest stays satisfied. The gate's rationale lives in docs/agents/test-deletion-guard.md behind a pointer stub in AGENTS.md — see the merge note below.
• Ledger: immutable done request for #Y30AXB under docs/outstanding-issues-inbox/; run npm run issues:reconcile after this lands.

Evidence the gate works, not just that it runs:

• Replayed against the real d1485d6e8 through the script's own injectable seams: fails all three signals (per-file 89 → 9 at 89.9%, aggregate, and three banner lines). Pinned as a test that self-skips where the PR head ref is absent, as it will be in CI.
• Calibrated against 300 real commits touching tests/: zero flagged, before and after the threshold tightening below.
• It caught this PR's own first commit — my initial #Y30AXB ledger write-up quoted the truncation banner verbatim. I reworded the prose rather than widening the exemption list.

Review fixes folded in before the first push, from a frontend-ui-reviewer pass:

• Curried modifiers (it.runIf(cond)("t"), test.skipIf, test.for) have a call expression for a callee and counted as zero. That was live on four real files, including the sole test in tests/guard-push-no-merge-base.test.ts — which could have been regenerated away with no signal at all. Counts now match reality (1, 6, 24, 35).
• The per-file floor was 10 cases, so a 10 → 1 file (90% gutted) passed while an unrelated new spec absorbed it in the aggregate. Lowered to 3, then re-swept 300 commits: still zero flagged.
• CI now also runs on docs-only diffs, matching verify:pr-local and the documented claim — a truncation banner lands in markdown just as easily as in a spec.

Merge note (4fc452691)

main advanced twice while this branch was open. The only conflict was data/repo-awareness-snapshot.json, a generated file, resolved by regenerating it with npm run docs:update rather than by hand.

569d85658 also tiered AGENTS.md into a slim always-loaded core plus reference files under docs/agents/, which left this branch's new section as the one full-length block in a file that had just been cut in half — partially undoing that commit's intent. It moved verbatim to docs/agents/test-deletion-guard.md behind a heading + pointer stub, matching its immediate neighbour dead-code-deletion.md. No wording changed.

Verification

• npm run verify:cheap (pre-merge head) — all 35 static gates green, lint recorded a pass, typecheck clean, unit suite 948 files / 12,093 passed, 1 skipped, exit 0. Two runs before that failed for real reasons and were fixed: check:ledger-write-discipline refused a verdict while the inbox request was untracked, and typecheck rejected a NodeJS.ProcessEnv JSDoc type in the new test.
• Post-merge re-verification on 4fc452691 — docs:check-index, docs:check-inventory, docs:check-scripts, docs:check-links, check:gate-manifest, check:verification-plan, check:ci-scope, check:diff-integrity and check:repo-awareness-snapshot all pass; typecheck clean; unit suite 948 files / 12,095 passed, 1 skipped, exit 0.
• npm run check:gate-manifest — all 38 verify:cheap gates are enforced in CI (static-pr + mapped jobs), and the 35 static gates are documented consistently
• npm run check:diff-integrity on this diff — PASS; self-test 23/23
• tests/diff-integrity.test.ts — 38 unit tests passing
• Playwright tests/ui-smoke.spec.ts under npm run test:e2e --project=chromium: 105 tests collected, 103 passed, 2 failed (3.9m). The two failures are document frame stretches the canvas owner at phone and desktop and document viewer puts the PDF preview first with pinned evidence after it on mobile — both PDF/document-viewer visibility assertions. This container's Chromium is headless_shell rev 1194 against the repo's pinned 1234 (cdn.playwright.dev is blocked by this environment's network policy, so the pinned build cannot be fetched here; #255 drift). This PR touches no product code and no ui-smoke code, so it cannot have caused them. Not independently reproduced on the base commit — the browser is the only variable, so hosted CI is the authority.
• PR policy — failed on the first ready-for-review run because this body lacked the section below. Reproduced offline against evaluatePullRequestPolicy with this PR's exact file list (ok: false, "Clinical-risk paths require the ## Clinical Governance Preflight section."), then re-evaluated with the section added: ok: true, zero errors. Body-only fix.
• PR mergeability — failed because main advanced; confirmed a real conflict with git merge-tree rather than assuming staleness, then resolved as described in the merge note.
• npm run verify:ui — not run: superseded by the direct full-file ui-smoke run above, and blocked from being authoritative here by the same browser-revision drift.
• npm run verify:release — not run; no release or handoff confidence claimed.

Verification not run: check:production-readiness, eval:*, and every other provider-backed gate. This change touches no clinical, ingestion, answer-generation, privacy, Supabase, or deployment behaviour, and provider-backed gates were not authorized.

Risk and rollout

• Risk: Low, but not zero — this adds a blocking gate to verify:cheap and CI's static-pr, so a false positive blocks unrelated PRs. Mitigated by calibrating against 300 real commits (zero flagged) and by the diff-integrity.json approval escape hatch, which is a reviewed one-line entry rather than a threshold edit. The gate reads git and parses source; it writes nothing and touches no provider.
• Rollback: revert the commits. Nothing depends on the gate; removing check:diff-integrity from verify:cheap:internal and the static-pr step, and restoring the two documented gate counts, fully disarms it.
• Provider or production effects: None.
• RAG impact: none — no RAG ranking surface is touched.

Clinical Governance Preflight

Required because data/outstanding-issues-snapshot.json and data/repo-awareness-snapshot.json are under data/, which classifyPullRequestFiles treats as clinical-risk. Both are generated files, refreshed by npm run docs:update because this PR adds a script and a ledger inbox request. Neither carries clinical content, and no clinical behaviour is touched by this change.

• Source-backed claims still require linked source verification before clinical use
• No patient-identifiable document workflow was introduced or expanded without explicit governance approval
• Supabase target remains Clinical KB Database (sjrfecxgysukkwxsowpy)
• Service-role keys and private document access remain server-only
• Demo/synthetic content remains clearly separated from real clinical sources
• Source metadata, review status, and outdated/unknown-source behavior remain conservative
• Deployment classification/TGA SaMD impact was checked when clinical decision-support behavior changed

Every item above is affirmed as unchanged rather than re-established: this PR adds a static verification gate plus documentation, and touches no ingestion, retrieval, answer-generation, source-rendering, document-access, privacy, or deployment code path.

The policy also emits one warning, deliberately not acted on: operational-risk paths (package.json, .github/workflows/ci.yml) are bundled with the clinical-classified data/ snapshots. Splitting is not practical here — the snapshots are regenerated because of the script and ledger changes, so they cannot be landed independently of them.

Notes

Known limitation, deliberately accepted and documented in docs/agents/test-deletion-guard.md: a test() inside a for (const viewport of …) loop counts once, not once per iteration, so shrinking that loop's array loses real cases without moving the count. ui-smoke has 6 such loops (7 declarations → 22 runtime cases; 90 declarations → 105 collected). Any static count has this hole, the aggregate and truncation rules are unaffected, and closing it would mean evaluating the spec rather than parsing it.

Not done, and offered rather than assumed: the gate is not registered as a seventh guard in scripts/guard-push.mjs. That layer would catch the failure earliest, but the repo's own notes record that an agent pushing from its own environment bypasses core.hooksPath entirely — which is exactly the #Y30AXB scenario — so CI is the load-bearing layer. Happy to add it if you want the belt as well as the braces.

The #Y30AXB row's premise that "a gutted suite goes green trivially" did not hold for this particular corruption, since the file did not parse and CI would have errored on load. It does hold for any truncation that happens to leave valid syntax, which is what this gate is calibrated for.

🤖 Generated with Claude Code

https://claude.ai/code/session_0193brbqFWHbpVnLfgDBkVNP

---

Note

Medium Risk
Adds a blocking gate on every PR and verify:cheap; false positives would block merges, though calibration and diff-integrity.json approvals are meant to limit that. No runtime or clinical behaviour changes.

Overview
Adds npm run check:diff-integrity to block silent test-suite destruction and tool truncation banners committed as source (incident #Y30AXB). The checker compares the branch to the merge base with origin/main and applies two rules: an AST-based test-case floor (aggregate 25% / per-file 50% above a 3-case minimum) and a truncation-artefact scan on added lines in any changed file.

Wiring: new scripts/check-diff-integrity.mjs, config in diff-integrity.json (thresholds + pinned approvedReductions), Vitest coverage in tests/diff-integrity.test.ts. The gate is unconditional in verify:cheap, verify:pr-local’s common scripts, and CI static-pr (DIFF_INTEGRITY_BASE_SHA). Agent docs add docs/agents/test-deletion-guard.md and an AGENTS.md pointer; gate counts move to 35 / 38 in CLAUDE.md and the gates skill.

Housekeeping: marks #Y30AXB done in the outstanding-issues inbox and refreshes data/repo-awareness-snapshot.json.

^{Reviewed by Cursor Bugbot for commit 902d967. Configure here.}

[supabase]

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.

---

Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Team

Run ID: 85b0badd-a847-4814-80c2-89a66f523ef5

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-02T06:02:18.049133Z	26fe3e0	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_05250b86-97c0-491d-9fca-35d12da52012)

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 26fe3e0649

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_06fb22cf-2d99-4d78-9623-23133c62bed1)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_52bdddf2-75c9-4d62-80ec-ff1e6d0c85b5)

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_6a263e9d-65a9-4a32-9c0f-08028f70fa59)