test(gate): cover the presence-mode staleness checkpoint and two long-untested reject arms

Brings packages/loopover-engine/src/review/screenshot-table-gate.ts and
src/signals/change-guardrail.ts (and both re-export shims) to 100% statement,
branch and function coverage.

Three branches had no test on any identity:

- evaluateScreenshotTableGate's PRESENCE-mode freshness checkpoint. Matrix mode's
  identical correlation was pinned by #8866's tests, but presence mode runs it
  through a separate return site and never saw a headSha in a test. Presence mode
  is the DEFAULT shape, so the miss meant one table pasted on push #1 could hold
  the gate green for every later push -- the exact regression the checkpoint
  exists to stop. Six tests: first-push checkpoint, stale-on-new-head (asserting
  no checkpoint is re-issued, which would launder the staleness away after one
  extra push), re-affirmation with fresh URLs, custom message on the stale path,
  no-headSha degradation, and same-head replay.

- guardrailPathMatches' empty-path skip, a deliberate divergence from matchesAny's
  fail-safe: the boolean form matches an empty path under an over-complex glob,
  the structured form must not, because its output is rendered verbatim into
  public review text and audit metadata.

- extractTableRows' non-table reject arm, which is what stops ordinary PR prose
  (and a shell pipe inside backticks) from parsing as table rows.

Mirrored across both import identities so a sharded, flag-merged coverage upload
cannot report a branch as uncovered on one copy.

Author: JSONbored

test/unit/change-guardrail.test.ts

@@ -123,6 +123,25 @@ describe("change-guardrail glob matching", () => {
     expect(isGuardrailHit(["unrelated/file.ts"], [pathological])).toBe(true);
   });
 
+  it("INVARIANT: guardrailPathMatches SKIPS an empty changed path — deliberately diverging from matchesAny's fail-safe", () => {
+    // matchesAny("") returns true for an over-complex glob (asserted above): fail-safe means "match everything
+    // rather than silently disable a maintainer's guardrail". The STRUCTURED form cannot inherit that, because
+    // its output is rendered verbatim into public review text and audit metadata — emitting `{ path: "" }` puts
+    // a blank filename in front of a maintainer, which is worse than useless. So an empty path is dropped here
+    // even though the boolean form would report it, and that asymmetry is intentional, not an oversight.
+    const pathological = `${"**/".repeat(12)}*.ts`;
+    expect(matchesAny("", [pathological])).toBe(true); // the boolean form still fails safe
+    expect(guardrailPathMatches([""], [pathological])).toEqual([]); // ...the structured one does not invent a row
+
+    // The skip is per-path, not a whole-call bail: real paths alongside an empty one are still reported.
+    expect(guardrailPathMatches(["", "src/scoring/x.ts", ""], ["src/scoring/**"])).toEqual([
+      { path: "src/scoring/x.ts", glob: "src/scoring/**" },
+    ]);
+
+    // ...and it holds for ordinary (safe) globs too, so this is a property of the path, not of the glob.
+    expect(guardrailPathMatches([""], ["**"])).toEqual([]);
+  });
+
   it("SECURITY (ReDoS): a glob AT the safe cap (2 wildcards) still compiles and matches NORMALLY (not the fail-safe path)", () => {
     // Exactly 2 stars: at the cap, still safely compiled/evaluated — proves the cap is inclusive, not exclusive,
     // and that ordinary (non-pathological) multi-wildcard globs keep their real matching semantics. This is also

test/unit/screenshot-table-gate-engine.test.ts

@@ -17,7 +17,7 @@ import {
   requiredScreenshotMatrixPairs,
   type ScreenshotMatrixPair,
 } from "../../packages/loopover-engine/src/review/screenshot-table-gate";
-import { matchesAnyWithExclusions } from "../../packages/loopover-engine/src/signals/change-guardrail";
+import { guardrailPathMatches as engineGuardrailPathMatches, matchesAnyWithExclusions } from "../../packages/loopover-engine/src/signals/change-guardrail";
 import type { ScreenshotTableGateConfig } from "../../packages/loopover-engine/src/types/manifest-deps-types";
 
 function config(overrides: Partial<ScreenshotTableGateConfig> = {}): ScreenshotTableGateConfig {
@@ -341,6 +341,23 @@ describe("extractTableRows", () => {
 
     expect(extractTableRows(body)).toHaveLength(38);
   });
+
+  it("INVARIANT: a line pair that is not header+separator is skipped, so prose and pipe-bearing text are never rows", () => {
+    // The scan walks EVERY adjacent line pair, so the reject arm is what stops ordinary PR-description prose
+    // from being parsed as a table. Three distinct rejection shapes, each of which alone would produce a bogus
+    // row if the guard were dropped:
+    expect(extractTableRows("just prose\nmore prose")).toEqual([]); // neither line is pipe-delimited
+    expect(extractTableRows("| a | b |\nnot a separator\n| 1 | 2 |")).toEqual([]); // header, but no separator under it
+    expect(extractTableRows("intro text\n| --- | --- |\n| 1 | 2 |")).toEqual([]); // separator with no header above it
+
+    // A pipe inside prose (a shell command, a regex alternation) is the realistic false positive this prevents.
+    expect(extractTableRows("run `cat x | grep y` to check\nand then rerun it")).toEqual([]);
+
+    // ...and the reject arm does not consume a REAL table that follows the rejected prose.
+    expect(extractTableRows("some intro prose\n\n| before | after |\n| --- | --- |\n| a.png | b.png |")).toEqual([
+      ["a.png", "b.png"],
+    ]);
+  });
 });
 
 describe("missingScreenshotMatrixPairs (#4535)", () => {
@@ -748,6 +765,122 @@ describe("evaluateScreenshotTableGate", () => {
       expect(result).toEqual({ violated: false, reason: null });
     });
   });
+
+  // Matrix mode's staleness checkpoint is covered above; PRESENCE mode runs the identical
+  // evidenceFreshnessForHead correlation through a separate return site, and that site had no headSha test at
+  // all. The gap matters more here than in matrix mode: presence mode is the DEFAULT shape (any image-bearing
+  // table passes), so a stale-evidence miss means one table pasted on push #1 keeps the gate green for every
+  // later push — exactly the #stale-screenshot-table-fix regression, silently un-pinned.
+  describe("presence mode staleness (#stale-screenshot-table-fix)", () => {
+    it("issues a head-keyed checkpoint on the first satisfying push, so a later push has something to compare against", () => {
+      const push1 = evaluateScreenshotTableGate({
+        config: config({ enabled: true }),
+        prBody: TABLE_BODY,
+        prLabels: [],
+        changedFiles: ["apps/ui/src/App.tsx"],
+        headSha: "presence-push-1",
+      });
+      expect(push1.violated).toBe(false);
+      expect(push1.presenceModeSatisfiedState?.headSha).toBe("presence-push-1");
+      expect(push1.presenceModeSatisfiedState?.evidenceFingerprint).toEqual(expect.any(String));
+    });
+
+    it("REGRESSION: the SAME table on a new head is stale — it must not keep passing the gate across pushes", () => {
+      const push1 = evaluateScreenshotTableGate({
+        config: config({ enabled: true }),
+        prBody: TABLE_BODY,
+        prLabels: [],
+        changedFiles: ["apps/ui/src/App.tsx"],
+        headSha: "presence-push-1",
+      });
+      const staleOnPush2 = evaluateScreenshotTableGate({
+        config: config({ enabled: true }),
+        prBody: TABLE_BODY, // byte-identical body: no re-affirmation
+        prLabels: [],
+        changedFiles: ["apps/ui/src/App.tsx"],
+        headSha: "presence-push-2",
+        presenceModeSatisfied: push1.presenceModeSatisfiedState,
+      });
+      expect(staleOnPush2.violated).toBe(true);
+      expect(staleOnPush2.reason).toContain(DEFAULT_SCREENSHOT_CONTRACT_MESSAGE);
+      // No checkpoint is issued on a stale result — re-issuing one would let push #3 compare against push #2
+      // and read as "fresh", laundering the staleness away after a single extra push.
+      expect(staleOnPush2.presenceModeSatisfiedState).toBeUndefined();
+    });
+
+    it("a re-affirmed table (fresh image URLs) on the new head is NOT stale, and re-checkpoints to that head", () => {
+      const push1 = evaluateScreenshotTableGate({
+        config: config({ enabled: true }),
+        prBody: TABLE_BODY,
+        prLabels: [],
+        changedFiles: ["apps/ui/src/App.tsx"],
+        headSha: "presence-push-1",
+      });
+      const push2 = evaluateScreenshotTableGate({
+        config: config({ enabled: true }),
+        prBody: TABLE_BODY.replaceAll(".png", "-v2.png"), // a fresh upload gets a fresh URL
+        prLabels: [],
+        changedFiles: ["apps/ui/src/App.tsx"],
+        headSha: "presence-push-2",
+        presenceModeSatisfied: push1.presenceModeSatisfiedState,
+      });
+      expect(push2.violated).toBe(false);
+      expect(push2.presenceModeSatisfiedState?.headSha).toBe("presence-push-2");
+    });
+
+    it("a custom config.message wins over the default contract text on the stale path too", () => {
+      const push1 = evaluateScreenshotTableGate({
+        config: config({ enabled: true }),
+        prBody: TABLE_BODY,
+        prLabels: [],
+        changedFiles: [],
+        headSha: "presence-push-1",
+      });
+      const stale = evaluateScreenshotTableGate({
+        config: config({ enabled: true, message: "custom contract text" }),
+        prBody: TABLE_BODY,
+        prLabels: [],
+        changedFiles: [],
+        headSha: "presence-push-2",
+        presenceModeSatisfied: push1.presenceModeSatisfiedState,
+      });
+      expect(stale).toEqual({ violated: true, reason: "custom contract text" });
+    });
+
+    it("INVARIANT: no headSha ⇒ byte-identical to pre-fix behavior — no checkpoint issued, no staleness possible", () => {
+      // The caller may have no persistence wired up. Degrading to the old always-pass shape is deliberate:
+      // without a head SHA there is nothing to correlate, and inventing a violation would fail closed on a
+      // deployment that never opted in.
+      const result = evaluateScreenshotTableGate({
+        config: config({ enabled: true }),
+        prBody: TABLE_BODY,
+        prLabels: [],
+        changedFiles: [],
+        presenceModeSatisfied: { headSha: "old", evidenceFingerprint: "anything" },
+      });
+      expect(result).toEqual({ violated: false, reason: null });
+    });
+
+    it("INVARIANT: the SAME head re-evaluated is never stale — a webhook replay must not flip a passing gate", () => {
+      const push1 = evaluateScreenshotTableGate({
+        config: config({ enabled: true }),
+        prBody: TABLE_BODY,
+        prLabels: [],
+        changedFiles: [],
+        headSha: "presence-push-1",
+      });
+      const replay = evaluateScreenshotTableGate({
+        config: config({ enabled: true }),
+        prBody: TABLE_BODY,
+        prLabels: [],
+        changedFiles: [],
+        headSha: "presence-push-1",
+        presenceModeSatisfied: push1.presenceModeSatisfiedState,
+      });
+      expect(replay.violated).toBe(false);
+      expect(replay.presenceModeSatisfiedState?.headSha).toBe("presence-push-1");
+    });
+  });
 });
 
 describe("extractTableRowImageUrls (#4366)", () => {
@@ -820,3 +953,13 @@ describe("matchesAnyWithExclusions via the engine path (#9434)", () => {
     expect(result).toBe(true);
   });
 });
+
+// Mirrored from the app suite so BOTH import identities own this branch (CI shards + merges by flag).
+describe("guardrailPathMatches empty-path skip via the engine path", () => {
+  it("INVARIANT: an empty changed path is dropped rather than rendered as a blank filename", () => {
+    expect(engineGuardrailPathMatches([""], ["**"])).toEqual([]);
+    expect(engineGuardrailPathMatches(["", "src/scoring/x.ts"], ["src/scoring/**"])).toEqual([
+      { path: "src/scoring/x.ts", glob: "src/scoring/**" },
+    ]);
+  });
+});

test/unit/screenshot-table-gate.test.ts

@@ -822,3 +822,84 @@ describe("whenPaths exclusions via the src re-export (#9434)", () => {
     expect(hasCommittedImageFile(["docs/logo.png"], ["apps/ui/**"])).toBe(false);
   });
 });
+
+// Mirrored from the engine suite so BOTH import identities own these branches: CI shards the coverage run and
+// merges by flag, so a branch proven only through one identity can read as uncovered on the other.
+describe("extractTableRows rejects non-table line pairs", () => {
+  it("INVARIANT: a line pair that is not header+separator is skipped, so prose and pipe-bearing text are never rows", () => {
+    expect(extractTableRows("just prose\nmore prose")).toEqual([]); // neither line is pipe-delimited
+    expect(extractTableRows("| a | b |\nnot a separator\n| 1 | 2 |")).toEqual([]); // header, but no separator under it
+    expect(extractTableRows("intro text\n| --- | --- |\n| 1 | 2 |")).toEqual([]); // separator with no header above it
+    expect(extractTableRows("run `cat x | grep y` to check\nand then rerun it")).toEqual([]); // a pipe inside prose
+    expect(extractTableRows("some intro prose\n\n| before | after |\n| --- | --- |\n| a.png | b.png |")).toEqual([
+      ["a.png", "b.png"],
+    ]);
+  });
+});
+
+// Presence mode is the DEFAULT gate shape (any image-bearing table passes), and its staleness correlation ran
+// through a separate return site from matrix mode's — one that had no headSha test at all. Untested, a stale
+// -evidence miss means one table pasted on push #1 holds the gate green for every later push.
+describe("evaluateScreenshotTableGate presence-mode staleness (#stale-screenshot-table-fix)", () => {
+  const satisfying = { config: config({ enabled: true }), prBody: TABLE_BODY, prLabels: [] as string[], changedFiles: ["apps/ui/src/App.tsx"] };
+
+  it("issues a head-keyed checkpoint on the first satisfying push", () => {
+    const push1 = evaluateScreenshotTableGate({ ...satisfying, headSha: "presence-push-1" });
+    expect(push1.violated).toBe(false);
+    expect(push1.presenceModeSatisfiedState?.headSha).toBe("presence-push-1");
+    expect(push1.presenceModeSatisfiedState?.evidenceFingerprint).toEqual(expect.any(String));
+  });
+
+  it("REGRESSION: the SAME table on a new head is stale — it must not keep passing the gate across pushes", () => {
+    const push1 = evaluateScreenshotTableGate({ ...satisfying, headSha: "presence-push-1" });
+    const stale = evaluateScreenshotTableGate({
+      ...satisfying, // byte-identical body: no re-affirmation
+      headSha: "presence-push-2",
+      presenceModeSatisfied: push1.presenceModeSatisfiedState,
+    });
+    expect(stale.violated).toBe(true);
+    expect(stale.reason).toContain(DEFAULT_SCREENSHOT_CONTRACT_MESSAGE);
+    // No checkpoint on a stale result — re-issuing one would let push #3 compare against push #2 and read as
+    // fresh, laundering the staleness away after a single extra push.
+    expect(stale.presenceModeSatisfiedState).toBeUndefined();
+  });
+
+  it("a re-affirmed table (fresh image URLs) on the new head is NOT stale, and re-checkpoints to that head", () => {
+    const push1 = evaluateScreenshotTableGate({ ...satisfying, headSha: "presence-push-1" });
+    const push2 = evaluateScreenshotTableGate({
+      ...satisfying,
+      prBody: TABLE_BODY.replaceAll(".png", "-v2.png"), // a fresh upload gets a fresh URL
+      headSha: "presence-push-2",
+      presenceModeSatisfied: push1.presenceModeSatisfiedState,
+    });
+    expect(push2.violated).toBe(false);
+    expect(push2.presenceModeSatisfiedState?.headSha).toBe("presence-push-2");
+  });
+
+  it("a custom config.message wins over the default contract text on the stale path too", () => {
+    const push1 = evaluateScreenshotTableGate({ ...satisfying, headSha: "presence-push-1" });
+    const stale = evaluateScreenshotTableGate({
+      ...satisfying,
+      config: config({ enabled: true, message: "custom contract text" }),
+      headSha: "presence-push-2",
+      presenceModeSatisfied: push1.presenceModeSatisfiedState,
+    });
+    expect(stale).toEqual({ violated: true, reason: "custom contract text" });
+  });
+
+  it("INVARIANT: no headSha ⇒ byte-identical to pre-fix behavior — no checkpoint issued, no staleness possible", () => {
+    const result = evaluateScreenshotTableGate({ ...satisfying, presenceModeSatisfied: { headSha: "old", evidenceFingerprint: "anything" } });
+    expect(result).toEqual({ violated: false, reason: null });
+  });
+
+  it("INVARIANT: the SAME head re-evaluated is never stale — a webhook replay must not flip a passing gate", () => {
+    const push1 = evaluateScreenshotTableGate({ ...satisfying, headSha: "presence-push-1" });
+    const replay = evaluateScreenshotTableGate({
+      ...satisfying,
+      headSha: "presence-push-1",
+      presenceModeSatisfied: push1.presenceModeSatisfiedState,
+    });
+    expect(replay.violated).toBe(false);
+    expect(replay.presenceModeSatisfiedState?.headSha).toBe("presence-push-1");
+  });
+});