Fresh session audit caught a release blocker same-author tests missed

An adversarial audit run in a fresh session found a release blocker that the implementing sessions had missed. Each fix and its verification were written by the same author, so the verification inherited the fix's assumptions.

The blocker

The previous day's fix made one thing installation-global while leaving its inputs resolved per process. Two configurations each saw the other's work as wrong on start, each corrected it, and they overwrote each other every time. Forcing a rebuild did not settle the disagreement, it alternated it forever.

What the dependency audit found

A dependency audit asked, for every removal in the release range, what depended on the old behavior and whether anyone had checked. It found one live break in a different repo and one case where a correct fix had removed an accidental guard that nobody knew existed.

Verification lessons

A demonstration returning zero proves nothing unless zero is falsifiable. One run reported zero rebuilds. The real cause was an import failure that a fail-open handler swallowed, so the count was zero because nothing had run. A positive control was added.

A scanner written with literal special characters in its own detection table flags itself. The table is now written with escape sequences in source.

A guard that must be remembered to activate is not a guard. With no continuous integration in this repo, a check outside the default test run is not automated. It is a note.

A delta tool cannot serve as a test. A clean checkout hands it nothing to read and it passes vacuously.

The fixes

Three commits shipped. Index absence now triggers a rebuild regardless of the refresh preference. Previously that preference gated the absent case too, so an install with it turned off would have come up carrying no index at all instead of building one. Source-root drift was downgraded from forcing a rebuild to advisory.

Packaging omissions now fail the test suite instead of shipping. This deliberately restored a signal that an earlier change to the pytest paths had removed by accident.

The dash scanner is now tracked in the repo instead of being rebuilt from a diary line at the start of each session, and its advisory verdict is wired into the pre-push hook.