• Issue: #1805
• Branch: fix/issue-1805
• Commits: 96632e116 (the gate), 583854d4b (the three rulebooks), e6eec7c37 (regression suite), plus the docs/wiki/CHANGELOG commit
• Area: test-suite maintenance / the ai/*.md rulebooks. No application code, no API endpoint, no template, no i18n bundle, no DB row was touched
• Severity: minor for the product, major for the safety net — the check every agent run executes to protect the shared QA evidence trail could not detect the loss it was written to prevent, and the loss had already happened three times.

The report says the whole ## Task — Issue #1048: Implement SSO auto-login … suite is absent from the default branch, and that the mandated gate passes on a tree where a suite is missing.

Correction, measured. The data loss was already repaired: 966a7997d (feat(#1286), 141 0 on the suite file) carried the #1048 block back to the default branch. At dea6f4bea the file holds 55 suite headings and grep -c "Issue #1048" returns 1. There was nothing left to restore.

What remained open is the part the report itself calls the silent part: the absence of any check that can see such a loss. That is what this fix adds.

Reproduction (/tmp/repro1805, a throwaway clone seeded with the tracked suite file via git show HEAD:tmp/TLU_Test_Cases.md; 4 commands, no app or DB involved — the defect is in the verification procedure, not in the product):

BASE           suites=55  #1048=1
AFTER          suites=56  #1048=0          <-- a whole suite GONE

==== MANDATED GATE, rule 9 of ai/AGENTS.md ====
$ git diff --numstat HEAD~1 HEAD -- t.md
4	0	t.md
=> 0 deletions: GATE PASSES

==== what the gate is blind to ====
$ comm -23 <(grep -E "$H" base.md | sort) <(grep -E "$H" t.md | sort)
## Task — Issue #1048: Implement SSO auto-login (SSO_enabled) + ssodisable bypass in login.html (gap vs legacy)
$ git diff --numstat <base> HEAD -- t.md
8	23	t.md                      <-- 23 deleted lines, invisible to the gate

The third row matters beyond this issue: it is the check the report's Expected section proposes to add, so the report's own remedy would not have caught its own bug. Only a set difference over suite headings can.

Both sides of a rebase append at EOF of a 4.5k-line file, so git reports a conflict whose hunk starts a few lines after the ## Task — Issue #1048 heading. Everything outside the marked region is auto-resolved — here git took upstream for the heading line — so the heading survives while the suite body, absent from the agent's stale copy, is never restored. The agent then resolves the visible markers; scanning only the markers shows nothing wrong, the commit is append-only relative to its rebased parent, and every per-commit gate reports 0 deletions.

The invariant that actually matters is a merge-base property — "every suite heading that existed before this run still exists" — and nothing in the repository computed it. docs/Bugfix-Issue-1793-… had already reached that conclusion for its own deletion gate ("compares against the merge-base with the default branch, not HEAD~1") but never turned it into a runnable check.

A tracked, read-only gate next to the rulebooks that mandate it. It compares the candidate suite file against the merge-base with origin/<default> (origin/HEAD as a second try; the root commit is not used as a baseline — see "an unrunnable check is a FAIL") and checks seven invariants:

Two pattern details that a first draft got wrong and code review caught:

• H='^## ', not H='^## (Regression|Suite|Task|Modernize) '. All 60 ## headings in the tracked file are suites, but four do not use those prefixes (## T1637 — Regression: …, ## 1783 — Regression: …, ## 1785 — Modernize …, ## 1787 — Modernize …), so the narrow pattern silently ignored them — four suites whose loss check 6 would still catch, but not check 5. Matching the heading level is the safer default here: the consequence of a false positive is a conservative FAIL, the consequence of a false negative is a lost suite.
• TLU_REQUIRE_SUITE is matched against headings, case-insensitively. A whole-file grep -F is a proven false negative — the issue number also occurs in prose, so the gate reported own suite present on a candidate from which that very suite had been deleted — and three real headings spell it lowercase (## Suite 1644 — … (issue #1644)), a proven false positive.

Usage — bash ai/verify_test_suites.sh [--allow-skip] [<candidate-file>].

Two deliberate design points:

• An unrunnable check is a FAIL, never a silent PASS. Outside a clone, checks 5–7 report FAIL and exit 1; only an explicit --allow-skip downgrades them to a visible SKIP with exit 0. The same applies to a weak baseline: when neither origin/<default> nor origin/HEAD is reachable, the root commit cannot support the claim "nothing that existed before this run is missing" (it only contains the suites from repository start), so it is reported as unverifiable rather than silently accepted — a first draft used it as a silent fallback and a review reproduced three healthy suites being declared LOST off it. For the same reason each command substitution is status-checked: an empty result from a failed grep/diff/comm is not evidence of zero.
• It lives in ai/, not tmp/. The 22 sibling harnesses (tmp/verify_*.sh — 28 of them) sit under the git-ignored tmp/ and survive only because they were force-added — the very ignore rule that makes this bug possible would also make the fix vanish. ai/verify_test_suites.sh is tracked by an ordinary git add and cannot be lost that way.

The script never writes, moves or deletes the suite file or anything in the repository; it only creates and removes scratch directories under $TMPDIR (cleaned up by an EXIT/INT/TERM trap) while resolving the baseline.

ai/AGENTS.md rule 9, ai/FIX-ISSUE.md §5 and ai/IMPLEMENT-TASK.md §5 now require TLU_REQUIRE_SUITE="Issue #<n>" bash ai/verify_test_suites.sh, keep the two numstat checks as extra evidence only, and state — with the measured numbers above — why the per-commit gate and the count cannot work. All three were edited in one commit so they cannot drift. Hardening only ai/AGENTS.md would have left the hole open in the two rulebooks whose runs actually produce the clobber (the conclusion #1793 reached).

Review note: the first version of the ai/FIX-ISSUE.md edit added the new bullet while leaving the old "verify git diff --cached --numstat shows 0 deletions" sentence in place immediately above it, so that rulebook alone still mandated the blind gate and contradicted itself. The old sentence was replaced, as in the other two files.

$ bash -n ai/verify_test_suites.sh                       # syntax OK, no output
$ TLU_REQUIRE_SUITE="Issue #1048" bash ai/verify_test_suites.sh
suite file: tmp/TLU_Test_Cases.md
  PASS  candidate is readable and non-empty
  PASS  candidate contains suite headings
  PASS  markdown code fences balanced (= 72)
  PASS  no suite heading left without a body (= 0)
baseline: dea6f4bea (59) -> candidate: 60 suites
  PASS  no suite lost vs merge-base with origin/sebiboga (= 0)
  PASS  no line removed from the suite file vs merge-base with origin/sebiboga (= 0)
  PASS  own suite heading present (Issue #1048)
G1805 result: 7 PASS / 0 FAIL / 0 SKIP          # exit 0

Negative controls — a gate that only ever passes proves nothing:

All commands below run bash ai/verify_test_suites.sh [<candidate>]; the counts are the verbatim final lines of each run.

Event Viewer: SELECT COUNT(*) FROM events; → 0 rows, unchanged. Nothing in this change reaches PHP at all.

## Regression — Issue #1805: ai/verify_test_suites.sh sees the suite loss that the mandated gates cannot in tmp/TLU_Test_Cases.md — 10 steps covering the syntax gate, the clean tree, the original loss, the count-is-not-a-set control, the append-only false-positive control, the three unrunnable-gate controls, the header-only signature, the post-append re-run and the events table, plus the four controls that code review added (unreadable candidate, index fallback, unknown option, invocation from ai/). 10/10 PASS. Appended with >> — 97 insertions / 0 deletions against dea6f4bea, verified with git diff --numstat dea6f4bea -- tmp/TLU_Test_Cases.md and, after committing, with git diff --numstat HEAD~1 HEAD.

• Re-restore the #1048 suite — already restored by 966a7997d; measured 1/1 present at dea6f4bea. Nothing to restore.
• Add the count check the report proposes — measured blind (row 3 of the blind-gates table). Rejected on evidence, not on preference.
• A sixth CI workflow running the gate — rejected on rule 18 (do not fight the five existing workflows), and noted as the natural follow-up: the suite file is tracked (git ls-tree origin/sebiboga tmp/TLU_Test_Cases.md → a blob), and .gitignore does not affect path filters on tracked paths, so an unconditional on: push step running bash ai/verify_test_suites.sh would work today and none of the five workflows does (they only mention the file in their agent prompts). A first draft of this page rejected the option on the claim that a git-ignored path cannot drive a paths: filter; that premise was wrong and is corrected here. Server-side enforcement is the real answer to a bug that has now recurred three times, but it is a workflow change, not a bug fix.
• Move the suite file out of tmp/ to a tracked path — removes the root ignore problem, but breaks the reference contract of every existing Refs #<n> suite and every in-flight agent. Recorded as a follow-up (already noted in #1793); out of scope for a bug fix. The gate script is placed in ai/ instead so at least the check is unconditionally tracked.
• Prose-only guidance for rebase conflicts — cannot help: the loss is produced by git's auto-resolution outside the conflict markers, i.e. invisible to any review that reads the markers.

The merge-base gate described above proves "nothing was lost since the merge-base". It says nothing about a loss an ancestor commit already made: once 136fc4426 ("testcases: append suite for #1089") landed as a +12 / -6332 replacement of tmp/TLU_Test_Cases.md, the merge-base carried the damage and the gate reported 6 PASS / 0 FAIL / EXIT=0 on a file that had lost 87 of its 88 suites.

ai/verify_test_suites.sh therefore gained a check 3 — "no suite lost vs the pre-image of the newest destructive commit in history" — which anchors the baseline to a commit that replaced the file instead of to a baseline that moves with the default branch. The same input that used to pass now fails with the 87 lost headings named and the git show <sha>^:tmp/TLU_Test_Cases.md >> … recovery command. The 87 suites were also restored.

Full write-up: Bugfix-Issue-1849-Test-Suite-Clobber-87-Suites.