compass(tests): give the two unguarded own-package globs a non-empty guard

[jgong5]

Closes #189 (items 1 and 3 of "What a fix should do"; item 2 is a process change, not a code change).

tests/compass/test_backend_interface.py and tests/compass/test_runner_non_allocating.py
each parametrised sorted(PACKAGE.rglob("*.py")) straight into the decorator. A root that
does not resolve yields nothing, and a parametrisation of nothing is a pass, so the pin is
inert the moment the package it governs is renamed or moved. Both now derive the list
through a helper and assert it non-empty first.

Design principles this turns on: 6 (refuse rather than fall back — an empty collection
is the fallback here), 8 (every claim carries its measurement — both directions below
are measured, not argued), and 3 for what was deliberately not added.

Which is which, and why the loud one is not evidence the class is handled

Measured on node 18 in xiaobizh_n18_cpu, by renaming the package in the tree
(atom/compass/backends → cost_backends, atom/compass/runner → sim_runner, every
atom.compass.<pkg> import updated with it) and running that file alone. Updating the
imports is what a real rename does: they fail loudly, so they get fixed. The path constant
in the test does not fail, so it does not.

	control 92f1fdafe	this branch 09ff555e8
test_backend_interface.py, backends renamed	PYTEST_RC=0 — 4 passed, 1 skipped, got empty parameter set for (path) at :91	PYTEST_RC=1 — 1 failed, 5 passed, 1 skipped; test_the_package_was_found fails: no modules under .../atom/compass/backends, assert []
test_runner_non_allocating.py, runner renamed	PYTEST_RC=1 — 1 failed, 19 passed, 1 skipped; the same empty-parameter-set skip at :313, red only through test_the_replaced_methods_are_the_ones_that_own_memory_or_run_a_step raising FileNotFoundError on .../runner/overrides.py	PYTEST_RC=1 — 2 failed, 20 passed, 1 skipped; the sibling and test_the_package_was_found

test_backend_interface.py is the silent one: it reports green with its only pin asserting
nothing. test_runner_non_allocating.py reddens — but not through its own scan, which is
just as inert (same skip, same zero cases). It reddens because a neighbour happens to read
a file under the same root.

And the neighbour's redness is itself an artefact of a half-finished rename. Measured on
review: let that sibling follow the rename through its import, which is what a real rename
does to a path it can resolve, and the control tree goes to PYTEST_RC=0 — 20 passed, 1
skipped, fully green, with the scan still collecting nothing. The same edit on this branch
stays PYTEST_RC=1, because the guard is a statement about the scan's own root. The rescue
was entirely borrowed.

So the two sites are not one silent and one caught. They are both silent; one of them was
being carried, for the length of time it took somebody to finish a rename. A protection you
get from who your sibling is, and lose without a diff to the test, is not the class being
handled. Both needed the guard; neither would reliably have been caught.

Named result — both directions, per site

Run on staging copies of this branch, __pycache__ purged, atom.__file__ confirmed under
the staged root before each run.

1 — the guard fires when its package is renamed or moved. The two right-hand cells above.
Both new test_the_package_was_found cases fail with the package's resolved path in the
message, and the file that used to be rc=0 is now rc=1.

2 — the test it guards still fails for its original reason when that reason is reinstated.
A module that breaks the invariant, added to the package with the package in place:

reinstated defect	result
atom/compass/backends/leaky.py importing atom.model_engine.model_runner	PYTEST_RC=1, 1 failed 12 passed — test_the_package_imports_nothing_from_the_engine[leaky.py]: leaky.py:1 imports atom.model_engine.model_runner. The guard passed.
atom/compass/runner/leaky.py importing the same	PYTEST_RC=1, 1 failed 26 passed — test_only_the_binding_module_reaches_the_engine[leaky.py]. The guard passed.

So the guard has not replaced a real assertion with a liveness check: with the package
present the parametrised assertion still does its own job, and the guard is silent.

#189's own direction 2 — it does not fail for a reason nobody intended. A module added to
an unrelated Compass package (atom/compass/spec/unrelated_new_module.py): both files
PYTEST_RC=0, 12 passed and 26 passed, unchanged from untouched.

Baseline, untouched: 12 passed / 26 passed (control: 10 / 24 — the +2 each are the guard
and its control).

The control, and why the guard alone was not enough

Each guard carries test_the_guard_finds_nothing_when_the_root_moves, which points the
derivation at a root that does not resolve and asserts it comes back empty, with a module one
level out so a derivation that widened past its own root is caught there. Without it the
guard is only ever seen passing, which is the shape this board has now found eight tests in:
a pin that passes with its defect reinstated. The three landed guards
(test_clock_lp_identity.py, test_spec_schema.py, test_ir_data_model.py) have no such
control; these two do, and that is the only place this PR departs from the landed spelling.
The guard itself is that spelling verbatim — helper, then
assert _<pkg>_modules(), f"no modules under {PACKAGE}" — rather than a second spelling of
something the suite already has.

Site #2 is untouched

_call_sites at test_runner_rpc_surface.py:117 still reads all of atom/. Narrowing it
would convert a reported exclusion into a silent one, which #190 ruled on. This PR does not
touch that file.

Gates

Gate 1 — ATOM's suite unmodified. scripts/compass/gate_cpu.sh from each tree's own
scripts/compass/ (never overlaid, never committed to), staged by git archive + docker cp
into xiaobizh_n18_cpu, content digests verified identical on both ends, both stamps written.

tree	gate commit:	result	GATE_CPU_RC
control feature/atomcompass_new	92f1fdafe	4557 passed, 149 skipped, 3 xfailed	0
this branch	09ff555e8	4561 passed, 149 skipped, 3 xfailed	0

Delta +4 passed, 0 failed, skips and xfails unchanged — the two guards and their two
controls. The control reproduces the stated 4557. No failure to triage, so the
TestTheRegionIsNotCopiedPerChunk three-way flake did not arise on either side.

Gate 2 — new CPU-only tests. Four, all in tests/compass/; they read paths and parse
text, and touch no device.

Gate 3 — the named result. Above, both directions, per site, with counts.

Effort

Counted after ruff format, statements = every ast.stmt node with docstring Expr nodes
included.

file	statements	code	physical
tests/compass/test_backend_interface.py	45 → 54 (+9)	62 → 70 (+8)	102 → 130 (+28)
tests/compass/test_runner_non_allocating.py	134 → 143 (+9)	162 → 170 (+8)	326 → 355 (+29)
test total	+18	+16	+57
production total	0	0	0

Production is zero because nothing under atom/ or scripts/ is touched — this is a defect
in what two tests assert, not in what they assert about. +18 is just under the 20-50 estimate:
reusing the landed guard spelling verbatim is what keeps it there, and padding it to reach a
band would have meant inventing a second spelling.

ruff format on these two files also wants to rewrap a pre-existing assert in
test_backend_interface.py that the tree carries unwrapped. That rewrap is reverted here, and
the reason is not that a baseline is not mine to move — it is that ruff format is not the
baseline. .github/workflows/pre-checks.yaml runs psf/black@stable as the formatter job
and ruff check . (not ruff format) as the ruff job. This branch as committed passes
black --check; with ruff's rewrap applied, Black wants to revert it, so taking ruff's version
would have broken conformance with the gate that actually exists. The ruff format baseline is
separately already dirty, and identically so on both sides — 42/210 files in tests/, 2/17 in
tests/compass/. Run ruff format here to check a count, never to decide a shape.

Audit of the rest of tests/compass/

17 test modules, 61 collection sites checked — 50 @pytest.mark.parametrize calls (31
with a literal display, 19 deriving their argvalues) plus 11 assert-bearing for loops over a
non-literal iterable inside a test body.

Found: the 2 filed here, plus 4 more, spanning 6 further sites in 3 files — filed as
#202, not folded in, per #189's instruction and because handing a finding to whatever
touches the file next is what created #186. All four are measured and all four report
PYTEST_RC=0 with their defect in place:

#	site	with the defect in place
1	test_cpu_gate_exclude.py:138 (gpu_gate_triggers.txt renamed)	rc=0, 66 → 36 passed, 1 skipped — 30 cases gone
2	test_spec_schema.py:194, :212 (DEPLOYMENT_OWNED emptied)	rc=0, 97 → 79 passed, 2 skipped
3	test_ir_data_model.py:691, test_spec_schema.py:509 (__all__ emptied)	rc=0, 160 → 160 and 97 → 97, no skip line and no count change
4	test_cpu_gate_exclude.py:122 (MANUAL section emptied, both markers kept)	rc=0, 66 → 64 passed, 1 skipped — 2 cases gone

Instance 3 is not a weaker signal than the others; it is none. A parametrisation that
collects nothing at least prints got empty parameter set and drops the pass count. A for
loop over an empty iterable inside a passing test prints nothing, moves no count, and returns
a byte-identical summary line.

Correction to this PR's first count, which said 56 sites cleared and three instances.
Instance 4 was found on review, by the same method, in a file this audit had already flagged
— twenty lines above its own finding 1, with the same return [] fallback. The manual section
is legitimately allowed to be empty, which is what made it look cleared; that it is allowed
to be empty is not the same as its being asserted non-empty, and the two cases it drops go
with it. So the sweep was one short: 55 cleared, not 56, and #202 is four instances across
six sites. Reporting 56 as a cleared total, with an under-inspected member inside it, is the
aggregate-without-its-decomposition failure principle 7 names; the decomposition is above so
the next reader can check each row rather than the sum.

The 55 cleared each have something that states the non-empty case: a
test_the_package_was_found, a pinned length (assert len(RPC_SURFACE) == 12), a superset
assertion, a literal-valued sibling covering the same mechanism, or a literal display that can
only be empty if written empty.

🤖 Generated with Claude Code

[jgong5]

Reproduced, both directions, on my own staging. node 18, xiaobizh_n18_cpu, git archive + docker cp into /tmp/globguardgates, tarball md5 identical on both ends, __pycache__ purged, atom.__file__ printed and confirmed under the staged root before every count (/tmp/globguardwork/<tree>/atom/__init__.py in each block), each rc captured on its own line — never through a pipe (#191).

Renaming atom/compass/backends → cost_backends and updating every atom.compass.backends import, leaving the PACKAGE path constant stale as a real rename does:

	control 92f1fdafe	branch 09ff555e8
test_backend_interface.py	PYTEST_RC=0 — 4 passed, 1 skipped, SKIPPED ... :91: got empty parameter set for (path)	PYTEST_RC=1 — 1 failed, 5 passed, 1 skipped; test_the_package_was_found: AssertionError: no modules under /tmp/globguardwork/branch_be/atom/compass/backends, assert [], at :102

Baseline untouched: control 10 passed, branch 12 passed — the +2 are this guard and its control.

And the guard has not replaced a real assertion with a liveness check. atom/compass/backends/leaky.py importing atom.model_engine.model_runner, package in place: PYTEST_RC=1, 1 failed, 12 passed — test_the_package_imports_nothing_from_the_engine[leaky.py]: leaky.py:1 imports atom.model_engine.model_runner. Baseline is 12 passed and leaky.py adds one case, so all 12 survivors include this guard: it passes while the assertion it protects does its own job. A module added to an unrelated package (atom/compass/spec/unrelated_new_module.py) leaves both files at PYTEST_RC=0, 12 / 26, unchanged.

The control below is the part that matters, and it is not itself inert — which is worth naming, because nine tests on this board this month passed with their defect reinstated. It has two independent ways to go red and no way to pass vacuously:

• if monkeypatch.setitem(globals(), ...) ever stopped reaching the derivation — a default argument, an inlined rglob, a closure over the old value — _backend_modules() returns the real, non-empty list and assert not ... fails;
• if the derivation widened past its own root (PACKAGE.parent.rglob), sibling.py one level out makes it non-empty and the same assert fails.

monkeypatch.setitem(globals(), ...) is also not a new spelling: tests/plugin/test_sglang_gdn_verify_batched_ssm.py:117 already uses it.

The guard itself is tests/compass/test_spec_schema.py:471-477 verbatim, comment line included. Principle 4, honoured — no second spelling for something the suite already has.

[jgong5]

This paragraph's claim is the load-bearing one in the PR, and it is now measured rather than argued. I checked it because "the loud site proves the class is handled" is exactly the reasoning that would have left test_backend_interface.py unfixed.

Same staging as my other comment: node 18 xiaobizh_n18_cpu, git archive + docker cp, md5 verified both ends, __pycache__ purged, atom.__file__ asserted under the staged root before each run, rcs captured separately.

Step 1 — reproduce the two cells. atom/compass/runner → sim_runner, imports updated, PACKAGE left stale:

	control 92f1fdafe	branch 09ff555e8
test_runner_non_allocating.py	PYTEST_RC=1 — 1 failed, 19 passed, 1 skipped. The only failure is test_the_replaced_methods_are_the_ones_that_own_memory_or_run_a_step, FileNotFoundError: .../atom/compass/runner/overrides.py. The scan itself: SKIPPED ... :313: got empty parameter set for (path)	PYTEST_RC=1 — 2 failed, 20 passed, 1 skipped: the sibling and test_the_package_was_found at :325, no modules under .../atom/compass/runner

So on the control the scan is as inert here as it is in the other file. The file is red on someone else's behalf.

Step 2 — the part the PR asserts and did not measure: that the rescue disappears with no diff to this test. I let the neighbour follow the rename the way a real rename carries an import, deriving overrides.py from the imported module instead of from the stale PACKAGE constant:

def _overrides_path():
    import atom.compass.sim_runner.overrides as _ov
    return pathlib.Path(_ov.__file__)

	result
control 92f1fdafe, runner renamed, neighbour follows	PYTEST_RC=0 — 20 passed, 1 skipped, SKIPPED ... :318: got empty parameter set for (path)
branch 09ff555e8, same edit	PYTEST_RC=1 — test_the_package_was_found FAILED, 21 passed, 1 skipped

The whole file goes green on the control with its scan collecting nothing, and the edit that silences it is one a rename would make for its own reasons. That is the argument, confirmed: the protection was an accident of who the sibling is, and only the guard is a statement about the scan. Principle 6 — the empty collection was the fallback, in both files equally.

[jgong5]

On the reverted ruff format rewrap — the revert is right, and for a stronger reason than the one given.

The PR reverts the rewrap on the ground that "the formatter baseline is not this PR's to move." Correct, but that phrasing concedes a cost the change does not actually carry. Two measurements:

1. ruff format is not this repository's formatter. .github/workflows/pre-checks.yaml runs two style jobs: psf/black@stable, and a ruff job whose command is ruff check . --output-format=rdjson --exit-zero --no-fix | reviewdog -filter-mode=diff_context. ruff check, not ruff format. The formatter of record is Black.

2. Black and ruff actively disagree on this exact construct, and Black agrees with the tree.

tree	black --check
this branch, as committed	All done! 2 files would be left unchanged.
this branch with ruff's rewrap applied	1 file would be reformatted — and the diff reverts it back to the form on this branch

(black 26.5.1, ruff 0.16.7, in the jgong5_vllm container.) So taking the rewrap would have put test_backend_interface.py out of conformance with the formatter CI actually runs. The revert is not a concession; it is the only option that keeps the file clean under the gate that exists.

3. And the ruff format baseline is already dirty, identically on both sides, so the file is not a lone hold-out: on 92f1fdafe, ruff format --check tests/ reports 42 files would be reformatted, 168 already formatted, and tests/compass/ alone is 2 of 17. Both counts are unchanged by this branch.

Ruled: leave it reverted. The one thing I would change is the PR body sentence — "the formatter baseline is not this PR's to move" understates it. The accurate statement is that ruff format is not the baseline; Black is, and Black is green. That is principle 8 applied to the PR's own dev record: the reason given is a judgement, and there was a measurement available.

[jgong5]

Review of #203 — APPROVE

Range pinned to 92f1fdafe..09ff555e8. Two files, both under tests/compass/, +59 −2.

Everything this PR claims, I reconstructed independently rather than read. All runs on node 18 in xiaobizh_n18_cpu, staged by git archive + docker cp into /tmp/globguardgates (tarball md5 identical on both ends: 6adfc10c… branch, e27b68c1… control), each tree using its own scripts/compass/, nothing committed under it, __pycache__ purged before every run, and atom.__file__ printed and confirmed under the staged root before every count — it reads /tmp/globguardgates/<side>/ATOM/atom/__init__.py and /tmp/globguardwork/<tree>/atom/__init__.py in every block, never the second clone on sys.path. Every rc captured on its own line; no pipeline anywhere near a verdict (#191).

Mechanical check first: no design-doc references in the diff. Grepping the added lines for D<n>, P0.x, backticked doc numbers, "principle N", "Gate N" and issue numbers returns zero. The new docstrings say what the code does.

---

Verdict: APPROVE

The defect is real, the fix is the landed spelling verbatim, and both directions hold at both sites on my own run. One finding, below, is against a claim in the PR body, not against the code: it needs a sentence corrected and a fourth instance added to #202, and neither requires touching this branch.

---

1. Both directions, per site — reproduced exactly

Renaming each package in-tree (backends→cost_backends, runner→sim_runner), every atom.compass.<pkg> import updated, the stale PACKAGE path constant deliberately left, and running each file alone:

	control 92f1fdafe	branch 09ff555e8
test_backend_interface.py	PYTEST_RC=0 — 4 passed, 1 skipped, SKIPPED ... :91: got empty parameter set for (path)	PYTEST_RC=1 — 1 failed, 5 passed, 1 skipped; no modules under …/atom/compass/backends, assert [], at :102
test_runner_non_allocating.py	PYTEST_RC=1 — 1 failed, 19 passed, 1 skipped; red only via FileNotFoundError: …/atom/compass/runner/overrides.py, own scan SKIPPED ... :313: got empty parameter set	PYTEST_RC=1 — 2 failed, 20 passed, 1 skipped: the sibling and test_the_package_was_found at :325

Baselines untouched: control 10 / 24, branch 12 / 26. The +2 per file are the guard and its control.

The guard-passes-while-the-real-assertion-fires pairing holds at both sites. With the package in place and the invariant broken:

reinstated defect	result	guard
atom/compass/backends/leaky.py importing atom.model_engine.model_runner	PYTEST_RC=1, 1 failed, 12 passed — test_the_package_imports_nothing_from_the_engine[leaky.py]: leaky.py:1 imports atom.model_engine.model_runner	passed
atom/compass/runner/leaky.py, same import	PYTEST_RC=1, 1 failed, 26 passed — test_only_the_binding_module_reaches_the_engine[leaky.py]	passed

The arithmetic is what makes this conclusive: baseline is 12 / 26 passed, leaky.py adds exactly one parametrised case, so all 12 and all 26 survivors include the new guard. No real assertion was traded for a liveness check. #189's own direction 2 also holds: a module in an unrelated package (atom/compass/spec/unrelated_new_module.py) leaves both files PYTEST_RC=0, 12 / 26, unchanged.

And the control is not itself inert — the failure mode this board has now hit nine times. It has two ways to go red and no way to pass vacuously: if the monkeypatch.setitem(globals(), …) ever stopped reaching the derivation, _<pkg>_modules() returns the real non-empty list and assert not … fails; if the derivation widened past its own root, sibling.py one level out makes it non-empty and the same assert fails. (Correcting my own inline citation: the pre-existing use of that idiom is tests/plugin/test_sglang_gdn_verify_batched_ssm.py:**317**, not :117.)

2. "The loud site is not evidence the class is handled" — checked, and it is stronger than argued

The PR asserts that test_runner_non_allocating.py's redness is borrowed from a neighbour and would vanish with no diff to this test. I measured that rather than accepting it. On the control with runner renamed, I let the neighbour follow the rename the way a real rename carries an import — deriving overrides.py from the imported module instead of from the stale PACKAGE constant:

	result
control 92f1fdafe, renamed, neighbour follows	PYTEST_RC=0 — 20 passed, 1 skipped, SKIPPED ... :318: got empty parameter set for (path)
branch 09ff555e8, same edit	PYTEST_RC=1 — test_the_package_was_found FAILED, 21 passed, 1 skipped

The file goes fully green on the control with its scan collecting nothing, and the edit that silences it is one the rename would make for its own reasons. Both sites needed the guard; only one would ever have been caught. Principle 6 — the empty collection was the fallback, equally in both files.

3. The audit — denominator confirmed, all three instances reproduced, instance 3 is genuinely signal-free

I rebuilt the census from the AST rather than trusting the numbers, over tests/compass/*.py on 92f1fdafe: 17 modules, 50 @pytest.mark.parametrize calls of which 31 pass a literal display and 19 derive their argvalues, plus 11 assert-bearing for loops over a non-literal iterable inside a test body. 61 sites. Exact match, every sub-total.

The three filed in #202, reproduced:

#	perturbation	measured
1 test_cpu_gate_exclude.py:138	gpu_gate_triggers.txt renamed	PYTEST_RC=0 — 66 passed → 36 passed, 1 skipped; got empty parameter set for (entry) at :138. 30 cases gone, file green
2 test_spec_schema.py:194/:212	DEPLOYMENT_OWNED emptied	PYTEST_RC=0 — 97 passed → 79 passed, 2 skipped; the skip at both lines
3 test_ir_data_model.py:691, test_spec_schema.py:509	__all__ emptied in atom/compass/ir/__init__.py and atom/compass/spec/__init__.py	PYTEST_RC=0, and 160 passed / 97 passed — byte-identical to baseline

Instance 3 is confirmed to have no observable signal at all. Not a weaker signal — none. No skip line, no count change, no report line, identical summary string, identical rc. A for loop over an empty iterable inside a passing test is indistinguishable from the assertion having held, and the two parametrised shapes at least surrender a skip line and 30 or 18 passes. #202's ranking of this as "most invisible, least urgent" is right on both halves.

4. Finding — the "56 cleared" claim is falsified by one site, in the file the audit already filed against

Principle 8. The PR body states: "The remaining 56 sites each have something that states the non-empty case." I spot-checked six of them by emptying the source and measuring, and five hold. One does not.

site	perturbation	result	cleared?
test_cpu_gate_exclude.py:80 (_entries())	every entry removed, comments kept	PYTEST_RC=1, 2 failed	yes — test_the_list_exists_and_is_not_empty
test_runner_rpc_surface.py:226/:378/:624	RPC_SURFACE emptied	PYTEST_RC=1, 3 failed	yes — assert len(RPC_SURFACE) == 12
test_clock_lp_identity.py:447/:467	clock package renamed, imports follow	PYTEST_RC=1, test_the_package_was_found at :444	yes — the landed guard, fires exactly as this PR's copies do
test_ir_data_model.py:533	AMBIENT_READINGS emptied	PYTEST_RC=1, 3 failed	yes — a literal-valued sibling, test_an_ambient_reading_is_caught_however_it_is_capitalised[…]
test_sync_inventory.py:96 (loop)	sites + anchors emptied	PYTEST_RC=1, 3 failed	yes
test_cpu_gate_exclude.py:122 (_paths(_section(MAN_BEGIN, MAN_END)))	MANUAL section emptied, both markers kept	PYTEST_RC=0 — 64 passed, 1 skipped, got empty parameter set for (entry) at :122	no

test_every_manual_entry_states_why collapses to zero cases, 2 assertions vanish, and the file reports green. It is the same class, in the same file, as #202's finding 1 — and _section() carries the same explicit return [] that #202 calls "principle 6 read backwards" at :138, twenty lines away. test_both_section_markers_are_present answers the marker-missing branch of that fallback; nothing answers the markers-present-and-section-empty branch, and test_the_list_exists_and_is_not_empty covers the whole list, not this sub-section. The realistic trigger is ordinary: regen_cpu_gate_exclude.sh preserves the MANUAL block, so the way it empties is a person removing the last hand-added entry — after which the next entry added without a stated reason is not caught, which is the thing this test exists to prevent.

An empty MANUAL section is arguably a legitimate end state. So is an empty DEPLOYMENT_OWNED, and #202 filed that one. Either way the clearing criterion was not applied consistently, and the blanket "56" sentence is wrong as written.

This is not a code defect in this PR and it does not block it. What it needs: the PR body sentence corrected to 55 cleared / 6 uncleared, and a fourth instance added to #202. I have posted the measurement there.

5. Gate, size, production zero

Gate 1, each tree's own scripts/compass/gate_cpu.sh (md5 ce05d5d5… identical both sides), .compass-commit / .compass-changed stamps written from the same rev-parse that produced the archive:

tree	gate's own commit:	result	GATE_CPU_RC
control	92f1fdafe (stamp)	4557 passed, 149 skipped, 3 xfailed	0
branch	09ff555e8 (stamp)	4561 passed, 149 skipped, 3 xfailed	0

+4 passed, 0 failed, 149 skipped and 3 xfailed conserved. The stated numbers reproduce on both sides. Both ran 29 files excluded + tests/plugin. The TestTheRegionIsNotCopiedPerChunk three-way flake did not arise.

Size, counted myself after ruff format, statements = every ast.stmt with docstring Expr nodes included:

file	statements	physical
test_backend_interface.py	45 → 54 (+9)	102 → 130 (+28)
test_runner_non_allocating.py	134 → 143 (+9)	326 → 355 (+29)
total	+18	+57

Identical before and after ruff format — the formatter changes no statement count here. Counter calibrated against the landed reference: my script reports atom/compass/spec = 275 statements / 763 physical, matching the published 275 / … / 763. So +18 is the developer's number, independently obtained, and it is genuinely just under the 20-50 band. I accept the stated reason: the alternative to 18 was inventing a second spelling of a guard the suite already has, which principles 3 and 4 both forbid. Padding an estimate is not a reason to do it.

Production 0 / 0 / 0, with the reason rather than as a bare zero. git diff --name-status 92f1fdafe..09ff555e8 returns exactly M tests/compass/test_backend_interface.py and M tests/compass/test_runner_non_allocating.py. Nothing under atom/ or scripts/ is touched, because the defect is in what two tests assert, not in what they assert about. Principle 7 — the zero is decomposed, not asserted.

6. The formatter rewrap — ruled: leave it reverted

Detail in the inline comment. Short form: .github/workflows/pre-checks.yaml runs psf/black@stable plus ruff **check** (not ruff format), so Black is the formatter of record. black --check on this branch as committed: "2 files would be left unchanged." Apply ruff's rewrap and black --check reports "1 file would be reformatted", with a diff that reverts it back. The two formatters disagree on exactly this construct, and taking ruff's version would have put the file out of conformance with the gate that exists. Separately, the ruff format baseline for tests/ is already dirty and identically so on both sides — 42 of 210 files repo-wide, 2 of 17 in tests/compass/.

So the revert costs nothing and the developer's stated ground understates its own case. The only correction I would make is to the wording: not "the baseline is not mine to move" but "ruff format is not the baseline."

7. Rebase against #188 — verified

#188 (compass/runner-docstring-truth, 52439ae55) touches tests/compass/test_runner_non_allocating.py in exactly one hunk, @@ -168,6 +168,107 @@, anchored on test_calling_that_model_refuses_and_names_the_class_it_stands_for. #203's two hunks in that file are @@ -18,6 +18,12 @@ (module docstring) and @@ -310,9 +316,32 @@. Disjoint including context. A rebase either way applies cleanly.

8. Scope and the rest

Site #2 (_call_sites at test_runner_rpc_surface.py:117) is untouched, as #190 ruled — confirmed, the file is not in the diff. Gate 2: the four new tests read paths and parse text; no device, no import of anything that needs one — principle 2 intact. Filing the rest as #202 instead of widening is principle 5, and is what #189 asked for.

---

APPROVE. The two required corrections are to the record, not the branch: the "56" sentence in the PR body, and a fourth instance in #202.

Staging cleaned up: /tmp/globguardgates, /tmp/globguardwork, /tmp/globguardaudit removed from xiaobizh_n18_cpu; the shared /tmp/xiaobizh-compass/ATOM mount was never written to.

[jgong5]

Pin re-verification of #203 — not a new review cycle

The existing APPROVE stands. Nothing below changes it. This is the reinstatement pass
that the reviewer instructions did not require when that review was written: every test #203
presents as pinning something was re-run with the defect it names put back, because a pin
nobody has seen fail is a liveness check. The PR's design, its scope and its settled findings
are not re-opened, and its head has not moved since the approval.

All four pins bite. Zero inert, zero vacuous, zero naming the wrong defect. Three
properties the two files advertise are held by nothing — all three are inherited verbatim
from the landed guard spelling, none is introduced here, and all three are recorded below with
numbers rather than left as an impression (principle 8).

State, and the base determined two ways

head	09ff555e8fc86616fd6974f980b921bba115ea68 (compass/package-glob-guards)
base	feature/atomcompass_new
.base.sha (way 1)	92f1fdafe28817f864261f632d98cf5b052016dd
git/ref/heads/feature/atomcompass_new → .object.sha (way 2)	92f1fdafe28817f864261f632d98cf5b052016dd — identical
chain, way 3	git merge-base 09ff555e8 92f1fdafe = 92f1fdafe…; git merge-base --is-ancestor = yes; git log 92f1fdafe..09ff555e8 = exactly one commit
stale?	No. The base branch tip is the merge base; the branch is one commit ahead of a base that has not moved.
draft	true (untouched — not undrafted, not merged)
labels	none; nothing need human
files	tests/compass/test_backend_interface.py, tests/compass/test_runner_non_allocating.py, +59 −2

Method

Node 18, xiaobizh_n18_cpu. Both trees staged by git archive + docker cp into my own
/tmp/pr203pin-jg/, never into the shared /tmp/xiaobizh-compass/ATOM mount and never over
anyone else's staging; content digest verified identical on both ends
(ff5ab77bcbe2a29b9d629668cd3665f9 branch, f0c7ce8dfc14ffd5132426a6f42d4b2f control). Each
tree runs its own scripts/compass/ (gate_cpu.sh md5 ce05d5d5…, same both sides);
both stamps written from the same rev-parse. __pycache__ purged before every run;
atom.__file__ printed and asserted under the staged root before any count is read — every
run reports /tmp/pr203pin-jg/wt-{branch,control}/ATOM/atom/__init__.py. Everything bounded
with timeout -k 10; no gate or pytest run is piped anywhere, each writes a file and the file
is read. Pre-fix code is the base commit's own bytes (git archive 92f1fdafe), never
reconstructed from the diff. Mutations are applied one at a time, each restored to the
verified pristine digest before the next. Every mutation is line-count preserving (a test
is disabled by renaming test_… → _disabled_…, never by deleting lines).

Baselines reproduced: branch 12 passed / 26 passed per file, gate 4561 passed, 149
skipped, 3 xfailed, GATE_CPU_RC=0; control 10 / 24, gate 4557 passed, 149 skipped, 3
xfailed, GATE_CPU_RC=0. Exactly the published numbers. TestTheRegionIsNotCopiedPerChunk
did not arise in any of the seven gate runs.

The table — every pin, its defect reinstated

#	pin	defect reinstated	published	reinstated — this run	verdict
1	test_backend_interface.py::test_the_package_was_found (:102)	package moved, path constant left stale (…/compass/backendsx)	branch rc=1, 1 failed / 5 passed / 1 skipped; control rc=0, 4 passed / 1 skipped	branch PYTEST_RC=1, 1 failed, 5 passed, 1 skipped — ::test_the_package_was_found, assert _backend_modules(), f"no modules under {PACKAGE}" → AssertionError: no modules under …/atom/compass/backendsx / assert [] at :102. Pre-fix tree, same defect: PYTEST_RC=0, 4 passed, 1 skipped, SKIPPED [1] …:91: got empty parameter set for (path)	bites
2	test_backend_interface.py::test_the_guard_finds_nothing_when_the_root_moves (:105)	derivation stops reading the module global (def _backend_modules(PACKAGE=PACKAGE):), so the monkeypatch no longer reaches it	control asserted, not measured per-mutation	PYTEST_RC=1, 1 failed, 11 passed — the control is the only failure: assert not _backend_modules() at :116, listing all six real backends/ modules. Second defect (PACKAGE.parent.rglob): file reddens at collection, PYTEST_RC=2, ValueError … determine id of parameter 'path' from ids=lambda p: str(p.relative_to(PACKAGE))	bites
3	test_runner_non_allocating.py::test_the_package_was_found (:325)	same, …/compass/runnerx	branch rc=1, 2 failed / 20 passed / 1 skipped; control rc=1, 1 failed / 19 passed / 1 skipped (red only via the neighbour)	branch PYTEST_RC=1, 2 failed, 20 passed, 1 skipped — ::test_the_package_was_found at :325 and the neighbour's FileNotFoundError: …/runnerx/overrides.py. Pre-fix tree: PYTEST_RC=1, 1 failed, 19 passed, 1 skipped — red only through the neighbour, own scan SKIPPED [1] …:313: got empty parameter set for (path)	bites
3b	same pin, with the neighbour following the rename (it derives overrides.py from the imported module instead of the stale constant)	the PR's central claim: the pre-fix redness was borrowed	control rc=0, 20 passed / 1 skipped	pre-fix tree PYTEST_RC=0, 20 passed, 1 skipped — fully green; branch PYTEST_RC=1, 1 failed, 21 passed, 1 skipped, ::test_the_package_was_found	bites; the PR's claim reproduces exactly
4	test_runner_non_allocating.py::test_the_guard_finds_nothing_when_the_root_moves (:328)	monkeypatch made unreachable, as #2	control asserted	PYTEST_RC=1, 1 failed, 25 passed — assert not _runner_modules() at :339. Under PACKAGE.parent.rglob: 5 failed, 43 passed, the control at :339 with assert not [PosixPath('…/test_the_guard_finds_nothing_w0/sibling.py')] — the sibling module one level out doing precisely what its docstring says	bites

Two further reinstatements from the PR body, re-measured rather than read: a
backends/leaky.py / runner/leaky.py importing atom.model_engine.model_runner gives
1 failed, 12 passed and 1 failed, 26 passed, failing
test_the_package_imports_nothing_from_the_engine[leaky.py] and
test_only_the_binding_module_reaches_the_engine[leaky.py] — with the new guard passing.
No real assertion was traded for a liveness check.

Half-reverts — the partial, not only the total

half-revert	with the package moved	reading
drop only the guard, keep the control and the helper	backend PYTEST_RC=0, 5 passed, 1 skipped — green; runner rc=1, 1 failed / 20 passed / 1 skipped, red only through the neighbour	the control alone does not see the defect. The guard is the load-bearing half, and the runner file's redness is still borrowed
drop only the control, keep the guard	(widening applied) backend rc=2 collection error; runner 4 failed, 43 passed via the real assertion	widening is caught without the control in these files today — but the control is the only thing that catches defect #2/#4 above
drop only the control's sibling.py line	on its own: 12 / 26 passed, rc=0. Then widen the derivation: the control passes while only the real assertions fail	that one line is load-bearing; without it the control is blind to exactly the case its docstring claims
guard disabled, no defect (gate)	4559 passed, 149 skipped, 3 xfailed, GATE_CPU_RC=0	the −2 accounts for the two disabled nodes, nothing else moves

Line-drift control

A null comment inserted at line 2 of both files, shifting every line below it:
gate 4561 passed, 149 skipped, 3 xfailed, GATE_CPU_RC=0 — byte-identical verdict to the
untouched branch. Nothing in the suite pins these files' line numbers, so none of the
reddenings above is drift, and the line-count-preserving discipline is confirmed unnecessary
rather than assumed.

What the pins would not notice — measured, all three inherited

probe	per-file	full gate	what it means
rglob → glob in both helpers (the walk stops being recursive)	12 / 26 passed, rc=0	4561 passed, GATE_CPU_RC=0	inert. Nothing anywhere in 4561 tests sees it
the same, plus atom/compass/backends/sub/leaky.py and atom/compass/runner/sub/leaky.py, each one line import atom.model_engine.model_runner	12 / 26 passed, rc=0	4561 passed, GATE_CPU_RC=0	blind spot. The exact breach these files exist to catch, one directory down, with a green gate. With the landed rglob the same two modules fail …[sub/leaky.py] and …[leaky.py]
rglob("*.py") → rglob("__init__.py") (non-empty, but incomplete)	7 passed (from 12) and 23 passed (from 26), rc=0	4553 passed, GATE_CPU_RC=0	a non-empty guard pins existence, not coverage: 8 parametrised cases vanish and the gate is green
re-inline the consumer — decorator back to sorted(PACKAGE.rglob("*.py")), guard and control untouched	12 / 26 passed, rc=0	4561 passed, GATE_CPU_RC=0	green, but not a live trap: both sides read the same module global, so with the package moved the guard still fires (1 failed, 5 passed, 1 skipped / 2 failed, 20 passed, 1 skipped, measured). It is a drift risk only — and the drifted form is silent: consumer narrowed to glob while the guard keeps rglob, with the nested breach planted, gives 4561 passed, GATE_CPU_RC=0

Depth, since this is the shape that bit #218 and #227. Both guarded globs are
PACKAGE.rglob("*.py") — unbounded depth below the package root. Both packages are flat
today: atom/compass/backends has 6 modules and atom/compass/runner 4, every one at depth
1, so glob and rglob return identical sets and no case in the suite separates them. What
the guard would miss is therefore anything in a subpackage — which is precisely what the
helper comment ("rglob, so a module added under the package is covered the day it lands")
and the module docstring ("The scan walks this package recursively, so a module added under
it is covered the day it is added") advertise. The control creates sibling.py one level
out, which catches widening; there is no counterpart one level in, so narrowing is
unguarded. Principle 8 — the recursion is a claim, and it carries no measurement.

This is not a #203 defect. The same helper-plus-test_the_package_was_found spelling is
landed at test_spec_schema.py:472, test_ir_data_model.py:663 and
test_clock_lp_identity.py:436 — whose comment reads "rglob, not glob: a transport or any
other subpackage added later would sit …", the same unpinned claim — and spec (5 modules),
ir (4) and clock (4) are flat too. #203 reproduces the landed spelling verbatim, which is
what principles 3 and 4 asked of it. Closing this belongs to whoever touches the family
next, not to this branch; the cheap close is one more case in each control asserting that a
module placed a directory below a resolvable root is found.

Verdict

pins that bite	4 of 4 (plus the PR's two leaky.py reinstatements, and the borrowed-redness claim at 3b)
inert	0
vacuous	0 — the control is not trivially true: it fails when the derivation stops reading the global, and its sibling.py line is load-bearing
names the wrong defect	0
blind spots	3, all inherited from the landed spelling, all recorded above with gate numbers

APPROVE stands. The two corrections that review asked for are still to the record (the
"56 cleared" sentence and the fourth instance in #202), not to this branch.

Staging removed from xiaobizh_n18_cpu; the shared mount was never written to.