test: cover the exclusion matcher from both import identities so shard attribution cannot miss it

Author: JSONbored

test/unit/screenshot-table-gate-engine.test.ts

@@ -17,6 +17,7 @@ import {
   requiredScreenshotMatrixPairs,
   type ScreenshotMatrixPair,
 } from "../../packages/loopover-engine/src/review/screenshot-table-gate";
+import { matchesAnyWithExclusions } from "../../packages/loopover-engine/src/signals/change-guardrail";
 import type { ScreenshotTableGateConfig } from "../../packages/loopover-engine/src/types/manifest-deps-types";
 
 function config(overrides: Partial<ScreenshotTableGateConfig> = {}): ScreenshotTableGateConfig {
@@ -795,3 +796,27 @@ describe("extractTableRowImageUrls (#4366)", () => {
     ]);
   });
 });
+
+// #9434: the exclusion matcher exercised through the ENGINE source path (change-guardrail.test.ts reaches the
+// same function through the `src/signals/change-guardrail` re-export shim, a distinct coverage identity).
+// Both paths are asserted so the lines stay attributed under either identity regardless of how CI shards the
+// suites — the misattribution class vitest.config.ts's coverage-include comment documents.
+describe("matchesAnyWithExclusions via the engine path (#9434)", () => {
+  it("excludes a generated file from a directory glob, and leaves the rest matching", () => {
+    const globs = ["apps/ui/public/**", "!apps/ui/public/openapi.json"];
+    expect(matchesAnyWithExclusions("apps/ui/public/openapi.json", globs)).toBe(false);
+    expect(matchesAnyWithExclusions("apps/ui/public/hero.png", globs)).toBe(true);
+  });
+
+  it("requires an include: an all-exclude list never matches, and a non-matching path stays false", () => {
+    expect(matchesAnyWithExclusions("apps/ui/public/x.png", ["!apps/ui/public/**"])).toBe(false);
+    expect(matchesAnyWithExclusions("docs/readme.md", ["apps/ui/**", "!apps/ui/public/**"])).toBe(false);
+  });
+
+  it("SECURITY: an over-complex exclude glob excludes NOTHING — it can only widen gate scope, never shrink it", () => {
+    // Opposite fail direction from an include: an unsafe exclude resolving to 'matches everything' would
+    // silently shrink a safety gate's coverage.
+    const result = matchesAnyWithExclusions("apps/ui/public/openapi.json", ["apps/ui/public/**", "!apps/*-*-*-x.json"]);
+    expect(result).toBe(true);
+  });
+});

test/unit/screenshot-table-gate.test.ts

@@ -792,3 +792,33 @@ describe("extractTableRowImageUrls (#4366)", () => {
     ]);
   });
 });
+
+// #9434: the same exclusion behaviour asserted in screenshot-table-gate-engine.test.ts, but reached through
+// the `src/review/screenshot-table-gate` re-export shim rather than the engine source path.
+//
+// Not redundant: the two import paths are DISTINCT coverage identities (the shim is its own real file), and
+// CI sharding means a given shard may run only one of the two suites. Exercising the exclusion from both
+// sides keeps these lines attributed under either identity in whichever shard picks them up — the
+// misattribution class vitest.config.ts's own coverage-include comment documents from the 2026-07-24
+// codecov/patch incident.
+describe("whenPaths exclusions via the src re-export (#9434)", () => {
+  const scoped = ["apps/ui/public/**", "!apps/ui/public/openapi.json"];
+
+  it("carves a generated file out of an otherwise-in-scope directory", () => {
+    expect(isScreenshotTableGateInScope(config({ whenPaths: scoped }), [], ["apps/ui/public/openapi.json"])).toBe(false);
+    expect(isScreenshotTableGateInScope(config({ whenPaths: scoped }), [], ["apps/ui/public/hero.png"])).toBe(true);
+  });
+
+  it("applies the SAME exclusion to the committed-image check, so the two cannot disagree on what is scoped", () => {
+    // A path excluded from gate scope must not still count as a stray committed image — that disagreement is
+    // exactly what sharing one matcher prevents.
+    expect(hasCommittedImageFile(["apps/ui/public/openapi.json"], scoped)).toBe(false);
+    expect(hasCommittedImageFile(["apps/ui/public/hero.png"], scoped)).toBe(true);
+  });
+
+  it("INVARIANT: a plain whenPaths list with no exclusions behaves exactly as before", () => {
+    expect(isScreenshotTableGateInScope(config({ whenPaths: ["apps/ui/**"] }), [], ["apps/ui/src/App.tsx"])).toBe(true);
+    expect(hasCommittedImageFile(["apps/ui/src/logo.png"], ["apps/ui/**"])).toBe(true);
+    expect(hasCommittedImageFile(["docs/logo.png"], ["apps/ui/**"])).toBe(false);
+  });
+});