diff --git a/.dev-loop/INGEST_REPORT.md b/.dev-loop/INGEST_REPORT.md
index 55ccfd1..ce27936 100644
--- a/.dev-loop/INGEST_REPORT.md
+++ b/.dev-loop/INGEST_REPORT.md
@@ -1,53 +1,247 @@
-# Knowledge consolidation — 15 open PRs (#17–#40) → one reconciled state
+# Knowledge flush — 3 insight(s)
 
-The 15 open `knowledge/*` PRs (created 2026-08-04 → 2026-08-05, before the
-harvest processed-store dedupe fix in #41) contained 123 file-versions of ~75
-unique pages, with the same insight landing at up to 3 different paths across
-up to 8 PRs. Per-PR review would re-import those duplicates, so — as with the
-#6–#13 consolidation — this branch carries the reconciled end-state and the 15
-PRs are closed in its favor.
+Drained the 3 pending rows in `~/.dev-loop/queue/` (session files `5d6b4056`,
+`cea5f63a`, `ef805210`; the other 10 queue files were already empty). All three
+carried `domain: testing`. None was dropped.
+
+Cross-Check: independent adversarial review (claude CLI headless, `--permission-mode plan`) returned BLOCK on the first commit with 17 findings — 2 critical, 9 major, 6 minor; all were accepted and fixed in the second commit, the most serious being a source miscitation inherited from an existing page and two `verified` confidences downgraded to `field-tested`.
+
+**Confidence after review:** `unasserted-return-fields` = `verified`;
+`value-preserving-refactor-assertions` and `stale-artifact-baselines` =
+`field-tested`. The first commit marked all three `verified`; the review showed
+that for two of them the cited docs support only the background mechanism, not the
+central directive, so they were downgraded rather than defended.
 
 ## Verified best-practice
 
-Every adopted page's sources were carried from its originating PR's flush, where
-they were live-verified at flush time; no new URLs were introduced during
-consolidation (checked mechanically: every `http(s)` URL in every merged page
-appears in a source PR's diff; every added body line in amended pages traces to
-a source PR hunk — orphan-line verification). Confidence fields were kept as the
-originating flushes set them, except client-side-rate-limiting where the union
-of provider-doc citations (Okta, Auth0, GitHub, OpenAI, RFC 6585) supports
-`verified` for the load-bearing claims. One subagent's fabricated content (12
-files matching neither main nor any PR, with invented source URLs) was detected
-by the same verification and replaced with true PR content.
+**1. A value-preserving literal→SSOT refactor cannot be guarded by an assertion that holds the config fixed → `field-tested`.**
+Claim: when the config value renders byte-identical to the literal you removed,
+every assertion that holds the config fixed passes on the reverted-literal version
+too; the separating input is the config value itself, so the test must vary it
+through a seam a caller or operator reaches.
+Sources opened: [pytest monkeypatch](https://docs.pytest.org/en/stable/how-to/monkeypatch.html)
+("All modifications will be undone after the requesting test function or fixture
+has finished"; `monkeypatch.context()` applies patches "only in a specific scope"),
+[unittest.mock](https://docs.python.org/3/library/unittest.mock.html) ("you must
+ensure that you patch the name used by the system under test"),
+[Stryker equivalent-mutants](https://stryker-mutator.io/docs/mutation-testing-elements/equivalent-mutants/),
+[PIT basic concepts](https://pitest.org/quickstart/basic_concepts/).
+What the review changed here, and why it matters: the first commit called this "the
+equivalent-mutant condition" and cited Stryker/PIT as its mechanism. That was
+self-refuting — an equivalent mutant is one *no input* separates, while this page
+then tells you to separate the versions by varying the config. The two are now
+cited as a near analogy with the difference stated explicitly. Three further
+corrections: the `try/finally` rationale was factually wrong (a `finally` block does
+run on assertion failure, so the honest reasons are "no restore code to review" and
+"covers a patch applied in a fixture whose test body never runs"); the
+wrong-patch-site failure mode is a *misleading red*, not a silent green (the
+sentinel assertion fails on correct code); and the presence/absence halves were
+described backwards — presence is the discriminator, absence is a supplement.
+Confidence is `field-tested` because no cited document supports the central
+directive; the only evidence for it is one in-house reproduction (manday renderer,
+2026-08-05: `"DB ×%s" % E.DB_MULT` rendered exactly the removed literal `DB ×1.3`,
+computed before the test was written; only the sentinel form reddened on the
+reverted version).
+
+**2. A composite return's unread fields are unguarded, and cross-field invariants need their own assertion → `verified`.**
+Claim: diff the returned field list against the fields assertions mention, confirm
+each absence with a per-field mutation plus the harness no-op control, then assert
+the relations binding the fields across the input grid.
+Sources opened: [arXiv:2211.12003](https://arxiv.org/abs/2211.12003) (Alzahrani,
+Spichkova, Harland, *Application of property-based testing tools for metamorphic
+testing*) — "The core concept in MT is metamorphic relations (MRs) which provide
+formal specification of the system under test";
+[hypothesis.works](https://hypothesis.works/articles/what-is-property-based-testing/)
+— property-based testing as "the construction of tests such that, when these tests
+are fuzzed, failures in the test reveal problems with the system under test that
+could not have been revealed by direct fuzzing of that system";
+[PIT](https://pitest.org/quickstart/basic_concepts/) for the Survived-vs-No-coverage
+distinction step 2 depends on;
+[abseil ch12](https://abseil.io/resources/swe-book/html/ch12.html).
+This page keeps `verified`: the two sources above back its central directive, and
+its field reproduction carries measured numbers (58 passing assertions over a
+`lo`/`sp`/`hi` return in which `lo` and `hi` appeared in none of them; four formula
+mutations left all 58 green while the no-op control survived, so the harness
+discriminated; the invariant over the full discrete grid found 13 combinations with
+`sp > hi`).
+Honest limit: Hypothesis's own `readthedocs` quickstart does not contain a
+definitional "property/invariant" statement — I fetched it, found none, and cited
+the maintainers' article rather than inventing a docs quote.
+
+**3. A previously published artifact needs its generation dated and a row-level diff before it is a baseline → `field-tested`.**
+Claim: matching aggregates do not establish matching rows; date the artifact's
+generation from its schema fields, and rebuild the before side by reverting only the
+change under measurement when the generation differs.
+Sources opened: [SLSA v1.0 provenance](https://slsa.dev/spec/v1.0/provenance)
+(provenance is "the verifiable information about software artifacts describing
+where, when and how something was produced"; a build records "the specific git
+commit that the URI resolved to as a dependency") — backs the stamping directive;
+[Jest snapshot-testing](https://jestjs.io/docs/snapshot-testing) ("we would need to
+fix the bug before re-generating snapshots to avoid recording snapshots of the buggy
+behavior") — backs one edge row;
+[octopusinvitro](http://octopusinvitro.gitlab.io/blog/code-and-tech/approval-testing)
+— a practitioner blog, not a primary spec, used only for the golden-master naming
+caution.
+What the review changed here: the first commit explained the failure with
+non-injectivity of summation, which describes *cancelling* summands — but the field
+evidence is a rollup parent **excluded from the total**, which was never a summand,
+so no cancellation occurred. An engineer following the stated reason would hunt for
+offsetting deltas, find none, and wrongly trust the total. The page now enumerates
+three mechanisms and leads with exclusion (the one requiring no coincidence). The
+generation-dating heuristic was also split: an *absent* field dates the file before
+the field existed, a *present-but-empty* field dates it before the writer populated
+it — two different conclusions the first commit conflated.
+Confidence is `field-tested`: the three central directives (dating by schema field,
+row-level full match, in-memory single-revert rebuild) cite nothing and rest on one
+in-house reproduction (manday engine, 2026-08-05: counted-SP total 211.48 matched
+HEAD exactly while the row diff found NEWRTB-2182 differing — 분석조사/0.19 vs
+인프라/0.56 — with `dead: None` dating the file before the classifier's lookbehind
+change, and the issue being a rollup parent excluded from the counted total).
+
+**Retraction.** The first commit's report asserted "Every URL cited below and on the
+pages was opened in this session — no citation is carried over on trust." That was
+false. Two of my new pages attributed the reachability–infection–propagation (RIP)
+fault-detection model to
+`https://stryker-mutator.io/docs/mutation-testing-elements/mutant-states-and-metrics/`.
+I had not opened that URL; I copied the attribution from an existing wiki page. The
+cross-check flagged it and I then fetched the page: it contains the mutant-state set
+and the metric formulas and says nothing about reachability, infection, propagation,
+or RIP. Both citations are removed from my pages (the Stryker URL is retained on
+`unasserted-return-fields` for the mutant states it does document, and dropped
+entirely from `stale-artifact-baselines`).
+
+**Pre-existing defect flagged, not silently edited.** The same miscitation exists in
+`wiki/testing/quality/differential-run-agreement.md:92` ("reachability, infection,
+and propagation (RIP) model for fault detection") and its directives at `:60` and
+`:83` rest on it. That page is not mine to rewrite in this flush — the RIP model is
+real but belongs to Ammann & Offutt, *Introduction to Software Testing*, not to
+Stryker's docs. Flagged here and in `log.md` for the owner.
 
 ## Existing-layer check
 
-- Merged-main near-dup scan before consolidation: pairwise Jaccard over
-  title + "When this applies" across all 141 merged pages → **0 flagged pairs**;
-  previously merged content carries no duplication.
-- Cross-PR dedup during consolidation: 10 duplicate clusters collapsed to one
-  canonical page each (rate limiting 8→1, call-site enumeration 7→folded into
-  the canonical merged in #20, stderr/exit-0 diagnostics 4→1, sysroot 2→1,
-  env-off-switch 2→1, completion predicates 2→1, robots.txt 2→1,
-  harness-mediated results 2→1, leaked artifacts 2→1, orchestration category
-  naming unified). Three near-pairs kept distinct after trigger comparison,
-  with mutual `related:` links (differential setup vs interpretation; expansion
-  semantics vs off-switch design; import-time tactics vs level choice).
-- 24 existing pages received union-merged amendments; additions already present
-  in main (from #16/#20) were skipped, and all non-canonical `related:` ids
-  were remapped to canonical page ids (post-merge broken-link scan: 0).
+Pages read: testing-quality-tests-that-cannot-fail, testing-quality-minimum-case-set, testing-quality-harness-reverse-controls, testing-quality-differential-run-agreement, testing-quality-behavior-not-implementation, testing-quality-guard-shape-vs-consequence
+
+Read in full: the first five. `guard-shape-vs-consequence` was read as its PR #47
+hunks plus its index line (partial — stated rather than implied). Screened by their
+`load when` lines in `wiki/testing/index.md` without opening the body, having found
+no trigger overlap: completion-predicates, injected-clock-duration-assertions,
+write-path-assertions, checks-that-cannot-pass, spec-artifact-checks,
+schema-additions-under-a-golden-gate. I also read `wiki/qa/index.md` end to end to
+test whether insight 3 belonged in `qa` rather than `testing` (see Routing).
+
+**Overlaps found, and merge-vs-create.** `tests-that-cannot-fail` owns the general
+rule all three insights descend from ("a test proves something only if it can
+fail"), but its trigger is retrospective — reviewing an always-green suite. All
+three candidates trigger at authoring time on a specific shape. The house already
+resolves this shape as *dedicated page + pointer row* (`write-path-assertions`,
+`injected-clock-duration-assertions`, `schema-additions-under-a-golden-gate` are all
+narrower cases of the same page, each linked from its Edge cases), so I followed
+that precedent rather than growing a page already at 105 body lines. Merged instead
+of duplicated: `tests-that-cannot-fail` +3 Edge rows, `minimum-case-set` +1 Edge row
+(its "assert an observable outcome" is underspecified when the outcome is a
+composite — the fields *and* their invariants), `differential-run-agreement` +1 Edge
+row (its subject is two live runs; a stale artifact as one side is the adjacent
+case).
+
+**Conflict found, and the resolution tightened after review.**
+`behavior-not-implementation` step 2 asserts "a refactor that preserves behavior
+keeps every test green", which pulls against insight 1's test — one that goes red
+when someone re-inlines a literal, a change with identical output. I resolved it
+with a condition-dependent Edge row on *both* pages rather than overwriting either.
+The cross-check then attacked my first wording as a rationalization, correctly: it
+justified the test by "configurability is behavior … through the seam an operator
+controls", while another edge row extended the same test to a *module-local*
+constant no operator can set — where re-inlining removes no observable capability
+and the assertion becomes exactly what `behavior-not-implementation:41` orders
+deleted. Generalized, that would let any implementation detail be relabelled a
+capability and would quietly remove step 2's diagnostic force. Both rows now carry
+the boundary: the value must be settable through an interface a caller or operator
+reaches **without editing source** (config file, env var, DI parameter, CLI flag);
+when it is not, step 2 stands unchanged and the guard moves to a static check. The
+module-local edge row was rewritten to route there instead of asserting the
+substitution test "still applies". That page's step 2 text is untouched, and its
+`last_verified` was returned to `2026-07-10` — I added an edge row without
+re-opening its three sources, so bumping the date would have claimed a verification
+I did not do.
+
+**Related links** are now genuinely bidirectional for all five adjacent pages (the
+first commit left two one-way: `minimum-case-set` → value-preserving and
+`harness-reverse-controls` → stale-artifact-baselines; both back-links added).
+One-way references remain, by design, to `checks-that-cannot-pass`,
+`write-path-assertions` and `backend-common-change-impact-call-site-enumeration`.
+
+Verified programmatically: every `related:` id and inline `[page-id]` reference
+**repo-wide** resolves; all three new pages are listed in `wiki/testing/index.md`;
+every touched page's body is under the 120-line limit (max 105); template sections
+and frontmatter keys present; no banned vague qualifier in a directive sentence (one
+"usually" was caught and rewritten as the condition that decides it). The checker
+was itself controlled — injecting a bogus `related:` id and a banned qualifier made
+it report both, and it returned to PASS after restore. Note the limit that mattered:
+that checker validates link *resolution*, never whether a source says what a page
+claims, which is why the RIP miscitation above needed the independent review to
+surface.
+
+## Open-PR check
+
+`gh pr list --repo choiyounggi/dev-loop --state open` → **#47**
+(`knowledge/dch0202-20260806-130040`, label `dev-loop:knowledge`) and #48
+(`feat/tmux-coordinator-gaps`, code not wiki). I fetched #47's head and diffed
+`origin/main...origin/knowledge/dch0202-20260806-130040 -- wiki/` in full.
+
+| Candidate | Verdict | Basis |
+|---|---|---|
+| 1. value-preserving refactor assertions | **new** | #47's only `tests-that-cannot-fail` change is a bats/bash-3.2 `[[ ]]` row plus three sources; no overlap of trigger or directive |
+| 2. unasserted return fields | **new** | #47 touches no page about return-value coverage or invariants |
+| 3. stale artifact baselines | **new** | #47 touches no page about baselines, snapshots, or impact measurement |
+
+Textual adjacency handled rather than ignored: #47 also edits
+`wiki/testing/quality/tests-that-cannot-fail.md` and `wiki/testing/index.md`, the two
+files this flush edits too. My edits were placed away from its hunks (Edge-cases
+table and the `related:` line; three *appended* index rows below the last row it
+touches), and where we both bump `last_verified` on `tests-that-cannot-fail` I set
+the identical value it sets (`2026-08-06`, today) so the two branches converge
+instead of conflicting. Whichever merges second should still be re-read at merge
+time — the claim here is that no hunk overlaps, not that git is guaranteed silent.
 
 ## Routing decision
 
-- New categories: `infrastructure/agent-orchestration` (5 pages; unified the
-  competing `orchestration`/`agent-orchestration` names), `databases/data-survey`
-  (1), `qa/deliverables` (1). All other pages route into existing categories.
-- Canonical-path decisions: rate limiting → `backend/common/reliability/`
-  (sits beside timeouts-and-retries; 6 of 8 variants chose it); stderr
-  diagnostics → `platforms/processes/` (concern spans beyond shells); leaked
-  artifacts → `testing/data/artifact-leakage-from-a-suite`; call-site
-  enumeration → the existing `backend/common/change-impact/` page.
-- All 38 new pages listed in their domain indexes (nearest-index rule; backend
-  routes via its python sub-index for bytecode-cache-staleness); INDEX.md domain
-  summaries updated for infrastructure/qa/databases. Full-wiki lint: frontmatter,
-  ids, related-links, index coverage, size, qualifiers, staleness → 0 findings.
+`INDEX.md` routes all three to **testing** ("writing or structuring automated
+tests: level choice, cases/assertions…"), and within it to the existing
+**quality** category. No new category: quality already holds the
+"is this assertion capable of failing / may I cite this verdict" family
+(`tests-that-cannot-fail`, `harness-reverse-controls`, `differential-run-agreement`,
+`spec-artifact-checks`), which is precisely what all three are.
+
+| Insight | Target | Page |
+|---|---|---|
+| 1 | `testing/quality` (new page) | `value-preserving-refactor-assertions.md` — `testing-quality-value-preserving-refactor-assertions` |
+| 2 | `testing/quality` (new page) | `unasserted-return-fields.md` — `testing-quality-unasserted-return-fields` |
+| 3 | `testing/quality` (new page) | `stale-artifact-baselines.md` — `testing-quality-stale-artifact-baselines` |
+
+Rejected alternatives, with the reason each was rejected:
+- **Insight 2 → merge into `minimum-case-set`**: that page selects cases over the
+  *input* space (normal/error/boundary per behavior); insight 2 is coverage of the
+  *output* shape and the relations inside it. Distinct axis, so it became a page and
+  the two are cross-linked — the same split the house already made for
+  `write-path-assertions`.
+- **Insight 3 → `qa` domain**: I read `wiki/qa/index.md` in full. `qa` owns
+  release-process quality (gates, regression scope, deliverable documents) and
+  explicitly sends automated-test-code concerns to `testing/`. Insight 3 is about
+  whether a comparison is valid evidence, which is what `testing/quality` already
+  hosts for non-test-code artifacts (`differential-run-agreement`,
+  `harness-reverse-controls` govern reports and PR bodies, not only suites). Routed
+  to `testing/quality` for that precedent, with a `related:` link to
+  `qa-deliverables-generated-artifacts-as-deliverable-source`.
+- **All three → Edge rows on `tests-that-cannot-fail`**: rejected on the page's own
+  constraint. It is at 105 body lines against a 120 limit and #47 adds to it; three
+  full cases would push it over and bury three distinct triggers inside a page whose
+  routing line is retrospective auditing.
+
+## Reviewing this PR
+
+The two `field-tested` pages are the ones to read hardest: their central directives
+rest on single in-house reproductions, described on each page, and are the parts no
+external source backs. If you would rather not carry a page at that confidence,
+`stale-artifact-baselines` is the most self-contained one to drop — the other two are
+cross-linked from four existing pages. The `differential-run-agreement:92` RIP
+miscitation is pre-existing and left for you to decide on.
diff --git a/log.md b/log.md
index c930fc2..2864ab2 100644
--- a/log.md
+++ b/log.md
@@ -43,3 +43,5 @@ Append-only. Format: `## [YYYY-MM-DD] <ingest|revise|lint|gap|contradiction|drif
 ## [2026-08-06] revise | Union-merged amendments from the same 15 PRs into 24 existing pages (largest: tests-that-cannot-fail — 7 PRs: per-assertion mutation granularity, restore-mechanism-by-commit-state, suite-total-drop detection; portable-shell-scripts — 8 PRs: POSIX inline set-- reordering, ${VAR:-} vs ${VAR-} colon semantics, quote-by-what-the-text-is; test-data-and-isolation — 6 PRs: env-derived write paths, absent-variable cases, exec-bit fixtures, leak attribution; change-impact/call-site-enumeration — 8 unique additions from 7 path-variants: rename-in-place, same-type reorder, *args forwarding, two-searches-agree fallacy, codemod, coverage completion check). All non-canonical cross-page ids remapped to canonical pages; every added line traced to its source PR hunk (fabricated worker output was detected by orphan-line verification and replaced with true PR content).
 ## [2026-08-06] dedup | Cross-PR duplicate clusters collapsed: client-side rate limiting (8 PR versions at 3 paths → 1), call-site enumeration (7 versions at 7 paths → additions folded into the already-merged canonical page), stderr/exit-0 diagnostics (4 versions at 4 paths → 1), macOS sysroot (2→1), env-var off switch (2→1), completion predicates (2→1), robots.txt (2→1), harness-mediated results (2→1), leaked test artifacts (2→1), orchestration category naming (orchestration vs agent-orchestration → agent-orchestration). Kept distinct after trigger comparison: differential-testing vs differential-run-agreement (setup vs interpretation), unset-versus-empty-parameters vs env-var-off-switches (semantics vs design, cross-linked), import-time-side-effects vs test-level-choice edge (tactics vs level choice, cross-linked). Merged-main near-dup scan (Jaccard over title+trigger, 141 pages): 0 pairs — no duplication among previously merged content.
 ## [2026-08-06] ingest | Reconciled post-consolidation flush PRs #42–#43 (created against pre-#44 main). Folded unique content: platforms/filesystems/permissions-and-exec-bits (+`sh "$SCRIPT"` interpreter-invocation rows — stubs need no exec bit, avoids EDR chmod+x heuristics), platforms/shells/command-text-inspected-before-execution (+gate-AUTHOR step 8: parse all three POSIX quoting forms, expand only ~/$HOME/${HOME}; red-then-green bats evidence), testing/quality/checks-that-cannot-pass (+vacuously-green pre-implementation test row), platforms/processes/tool-diagnostics-without-a-failing-exit-code (+repeat-suppression edge, +clang reproduction source), infrastructure/ci-cd/secrets-handling (+independent credential channels row: gh token vs git SSH vs API token, git push --dry-run / author:@me probes), testing/mocking/what-to-mock (+ESM read-only-bindings DI rows, +PATH-emptied tripwire negative-proof). Dropped as duplicates of the #44 state: #42's rate-limit row (already in timeouts-and-retries + client-side-rate-limiting), #42's warning-only-diagnostics page (same trigger as tool-diagnostics-without-a-failing-exit-code), #42's leak-attribution row (already in test-data-and-isolation).
+## [2026-08-06] ingest | knowledge-flush of 3 queued insights, all routed to testing/quality (existing category — no new category needed). New pages (3): value-preserving-refactor-assertions (a literal→config/SSOT refactor whose value is unchanged renders byte-identical output, so it is an equivalent-mutant condition no output assertion can detect — compute the byte comparison first, then assert the dependency by substituting the constant with a sentinel, restoring via the runner's scoped patcher rather than try/finally, and patching the name the renderer looks up); unasserted-return-fields (diff a composite return's field list against the fields assertions mention, confirm each absence with one per-field mutation plus the harness no-op control, then assert the cross-field invariants — ordering/sum/derivation — over the discrete input grid rather than one sampled case); stale-artifact-baselines (date a previously published output file's generation from its schema fields and compare row-by-row before using it as a "before" baseline — summation is not injective, so an aggregate-excluded rollup or cancelled row can differ while totals agree; rebuild the before side by reverting only the change under measurement in-memory and keep the published headline numbers in a separate labelled section). Merged: tests-that-cannot-fail +3 edge rows (pointers to all three), minimum-case-set +1 edge row (a composite observable outcome is fields plus their invariants), differential-run-agreement +1 edge row (one side a stale artifact rather than a run), behavior-not-implementation +1 edge row resolving a real tension in place rather than overwriting it — its step-2 invariant ("a refactor that preserves behavior keeps every test green") pulls against a test that distinguishes two same-output versions, and the resolution is that configurability is itself behavior, so re-inlining removes an observable capability and is not behavior-preserving (index load-when line extended for the new use case). Confidence after independent adversarial review (17 findings, all accepted): unasserted-return-fields verified (arXiv 2211.12003 metamorphic relations + hypothesis.works back its central directive, field reproduction carries measured numbers); value-preserving-refactor-assertions and stale-artifact-baselines field-tested (their cited docs — pytest monkeypatch, unittest.mock "where to patch", SLSA v1.0 provenance, Jest snapshot-testing — back only background mechanism and single edge rows, so the central directives rest on one in-house reproduction each). Review also corrected: the equivalent-mutant framing was self-refuting (an equivalent mutant is one no input separates, while the config value does separate these versions — Stryker/PIT demoted to analogy with the difference stated); the try/finally rationale was factually wrong (a finally block does run on assertion failure); the wrong-patch-site failure mode is a misleading red, not a silent green; presence/absence assertion roles were reversed; and the aggregate mechanism was mis-stated as summation non-injectivity when the evidence is a rollup parent excluded from the total (never a summand) — now enumerated with exclusion leading.
+## [2026-08-06] contradiction | wiki/testing/quality/differential-run-agreement.md:92 attributes the reachability–infection–propagation (RIP) fault-detection model to https://stryker-mutator.io/docs/mutation-testing-elements/mutant-states-and-metrics/, and its directives at :60 ("Ground the choice of input in reachability") and :83 ("RIP requires reachability before any detection is possible") rest on that attribution. The page was fetched 2026-08-06: it documents the mutant-state set (Pending/Killed/Survived/No coverage/Timeout/Runtime error/Compile error/Ignored) and the detected/valid metric formulas, and contains no mention of reachability, infection, propagation, or RIP. The RIP model itself is real (Ammann & Offutt, Introduction to Software Testing) — the directives are sound, the citation is not. Found because the 2026-08-06 flush copied the attribution into two new pages without opening the URL; removed there, flagged here rather than rewriting another page's sourced line.
diff --git a/wiki/testing/index.md b/wiki/testing/index.md
index 5f3ed78..a4761be 100644
--- a/wiki/testing/index.md
+++ b/wiki/testing/index.md
@@ -28,12 +28,15 @@ Match your situation to a "load when" line; load only matching pages.
 | [injected-clock-duration-assertions](quality/injected-clock-duration-assertions.md) | Asserting an elapsed duration between two readings of an injected/fake float clock (rate-limit interval, backoff, debounce, TTL); choosing that fake clock's start value; a single duration test fails on correct code by a margin in the far decimal places; choosing a comparison tolerance, or deciding between float seconds and integer nanoseconds |
 | [write-path-assertions](quality/write-path-assertions.md) | Writing an HTTP-level test for an endpoint that persists something (form submit, create/update, onboarding step) and choosing what to assert beyond the status code; such a test is green while the records are empty or defaulted; sending repeated form fields from a client (httpx/TestClient) and deciding the `data=` shape |
 | [minimum-case-set](quality/minimum-case-set.md) | Writing tests for a function/endpoint/change and choosing which cases to cover; reviewing whether coverage suffices; picking boundary values by input type; adding a regression test for a bug fix |
-| [behavior-not-implementation](quality/behavior-not-implementation.md) | Deciding what a test should assert; a behavior-preserving refactor broke tests; tempted to expose privates for testing; deciding whether a snapshot test is appropriate |
+| [behavior-not-implementation](quality/behavior-not-implementation.md) | Deciding what a test should assert; a behavior-preserving refactor broke tests; tempted to expose privates for testing; deciding whether a snapshot test is appropriate; a value-preserving move of a literal into config needs a test that detects re-inlining without asserting an internal |
 | [tests-that-cannot-fail](quality/tests-that-cannot-fail.md) | Reviewing tests that always pass; a bug shipped through an area the suite reported as covered; auditing a suspiciously green suite; judging whether an assertion, error-path test, or mock-based test can actually detect a defect |
 | [checks-that-cannot-pass](quality/checks-that-cannot-pass.md) | Authoring a check whose target does not exist yet (grep/regex gate on an unwritten file or doc section, lint/scan rule, schema assertion on an unbuilt endpoint, a plan's verification command) and it has only ever been observed failing; reviewing a plan's gates before adopting them; separating "target missing" from "content missing" in a gate's exit status |
 | [spec-artifact-checks](quality/spec-artifact-checks.md) | Writing or reviewing an automated check that a mapping table covers every rule/field/enum case, or that ids resolve across documents; deciding whether a green check earned "verified" or only "present"; designing one negative control per check in a multi-check harness; parsing Markdown table rows programmatically in a doc-as-spec repo |
 | [schema-additions-under-a-golden-gate](quality/schema-additions-under-a-golden-gate.md) | Adding a node kind, variant, discriminator value, or field to a document format (IR, JSON Schema, spec artifact) whose only automated gate builds its negatives by mutating one committed golden example; the gate or the whole suite comes back green right after a schema change; deciding which negative each new schema keyword needs, and whether a green suite that never loads the schema is evidence at all |
 | [harness-reverse-controls](quality/harness-reverse-controls.md) | You built a harness that scores how well something is verified (mutation run, doc/spec gate suite, CI check matrix) and are about to cite its score in a commit, PR, README, or report; its verdicts come out uniform (every case caught, or every case green); deciding what control run proves the harness discriminates, how to score errored/never-ran cases, and what the harness's isolated working tree must contain |
+| [value-preserving-refactor-assertions](quality/value-preserving-refactor-assertions.md) | Adding or reviewing the regression test for a refactor that replaced a hardcoded literal with a read from config/constants/SSOT while the value stayed the same; deciding what such a test can assert when the rendered output is byte-identical before and after; choosing a sentinel and the seam to substitute it through, and how to restore it; deciding when the value is too private for a test and the guard belongs in a static check instead; a sentinel assertion is red on code you believe correct |
+| [unasserted-return-fields](quality/unasserted-return-fields.md) | Testing a function that returns a composite (dict/record/tuple) of computed fields while assertions read only some of them; judging whether a large assertion count covers such a return; auditing which fields no assertion mentions and confirming it by mutation; asserting invariants that bind fields to each other (`lo ≤ point ≤ hi`, parts sum to total) and choosing between an input grid and generated inputs |
+| [stale-artifact-baselines](quality/stale-artifact-baselines.md) | Using a previously published output file (JSON/CSV export, approved snapshot) as the "before" baseline for measuring a code change's impact; its totals match the current run and you are about to treat the comparison as clean; dating an artifact's generation from its schema fields; rebuilding a before side by reverting only the change under measurement; reporting previously published numbers beside a new delta |
 
 ## data
 
diff --git a/wiki/testing/quality/behavior-not-implementation.md b/wiki/testing/quality/behavior-not-implementation.md
index e1181df..2039055 100644
--- a/wiki/testing/quality/behavior-not-implementation.md
+++ b/wiki/testing/quality/behavior-not-implementation.md
@@ -9,7 +9,7 @@ sources:
   - https://abseil.io/resources/swe-book/html/ch12.html
   - https://testing.googleblog.com/2015/01/testing-on-toilet-change-detector-tests.html
 last_verified: 2026-07-10
-related: [testing-quality-minimum-case-set, testing-mocking-what-to-mock, testing-quality-guard-shape-vs-consequence, backend-common-change-impact-call-site-enumeration]
+related: [testing-quality-minimum-case-set, testing-mocking-what-to-mock, testing-quality-guard-shape-vs-consequence, testing-quality-value-preserving-refactor-assertions, backend-common-change-impact-call-site-enumeration]
 ---
 
 # Asserting Behavior Through the Public Interface
@@ -55,6 +55,7 @@ the code.
 | Legacy code has no seams and extraction is too risky right now | Pin current behavior with tests at the nearest public boundary (characterization tests), refactor under them, then extract |
 | Framework/library requires lifecycle hooks that look like internals (React hooks, Spring beans) | Assert what the user of the component/bean observes (rendered result, endpoint response), not hook call order or bean internals |
 | A test asserts a mock of your own class was called (interaction test on owned code) | Replace with a state/output assertion on the real collaborator; keep interaction assertions only for external boundaries |
+| The behavior-preserving change moved a hardcoded literal into config/SSOT and you need a test that detects re-inlining | Apply the seam test: when the value is settable through an interface a caller or operator reaches without editing source (config file, env var, DI parameter, CLI flag), configurability is behavior — assert that the output follows the configured value, and step 2's invariant is intact because re-inlining removes an observable capability. When the only way to vary it is editing source or patching a module attribute the public interface never exposes, it is an implementation detail: keep step 2 as written and move the guard to a static check ([testing-quality-value-preserving-refactor-assertions]) |
 
 ## Instead of
 
diff --git a/wiki/testing/quality/differential-run-agreement.md b/wiki/testing/quality/differential-run-agreement.md
index 2a1190f..4372110 100644
--- a/wiki/testing/quality/differential-run-agreement.md
+++ b/wiki/testing/quality/differential-run-agreement.md
@@ -10,7 +10,7 @@ sources:
   - https://pitest.org/quickstart/basic_concepts/
   - https://stryker-mutator.io/docs/mutation-testing-elements/mutant-states-and-metrics/
 last_verified: 2026-08-05
-related: [testing-strategy-differential-testing, testing-quality-harness-reverse-controls, testing-quality-tests-that-cannot-fail, testing-quality-minimum-case-set]
+related: [testing-strategy-differential-testing, testing-quality-harness-reverse-controls, testing-quality-tests-that-cannot-fail, testing-quality-minimum-case-set, testing-quality-stale-artifact-baselines]
 ---
 
 # Citing an "Agree" Verdict from a Differential Run
@@ -73,6 +73,7 @@ session the other stubs out, omits, or hard-codes.
 | The forcing input makes both sides fail identically | Confirm they fail for the same reason before counting it as agreement; identical failure text from different causes is a coincidence, not a comparison |
 | Agreement is reported across a matrix of inputs, all of them defaults | The matrix size is not evidence; one forcing input per asymmetric dimension outranks a hundred default rows |
 | The harness reports agreement and the score has already been published | Re-run with the forcing inputs before defending the number, and correct the citation when a dimension turns out untested |
+| One side is not a run but a previously published output file | Date that file's generation before comparing, and compare row by row — an aggregate agreement between a live run and a stale artifact hides which revision produced the difference ([testing-quality-stale-artifact-baselines]) |
 
 ## Instead of
 
diff --git a/wiki/testing/quality/harness-reverse-controls.md b/wiki/testing/quality/harness-reverse-controls.md
index aa62831..942a06d 100644
--- a/wiki/testing/quality/harness-reverse-controls.md
+++ b/wiki/testing/quality/harness-reverse-controls.md
@@ -13,7 +13,7 @@ sources:
   - https://testing.googleblog.com/2021/04/mutation-testing.html
   - https://docs.python.org/3/library/unittest.mock.html
 last_verified: 2026-08-04
-related: [testing-quality-tests-that-cannot-fail, testing-quality-minimum-case-set, testing-quality-schema-additions-under-a-golden-gate, testing-quality-differential-run-agreement, testing-quality-completion-predicates, backend-python-language-bytecode-cache-staleness, qa-exploratory-override-control-pairs]
+related: [testing-quality-tests-that-cannot-fail, testing-quality-minimum-case-set, testing-quality-schema-additions-under-a-golden-gate, testing-quality-differential-run-agreement, testing-quality-completion-predicates, testing-quality-unasserted-return-fields, testing-quality-value-preserving-refactor-assertions, testing-quality-stale-artifact-baselines, backend-python-language-bytecode-cache-staleness, qa-exploratory-override-control-pairs]
 ---
 
 # Citing a Verification Harness's Own Score
diff --git a/wiki/testing/quality/minimum-case-set.md b/wiki/testing/quality/minimum-case-set.md
index 1540584..17863ef 100644
--- a/wiki/testing/quality/minimum-case-set.md
+++ b/wiki/testing/quality/minimum-case-set.md
@@ -9,7 +9,7 @@ sources:
   - https://abseil.io/resources/swe-book/html/ch12.html
   - https://martinfowler.com/bliki/TestDrivenDevelopment.html
 last_verified: 2026-07-10
-related: [testing-strategy-test-level-choice, testing-quality-behavior-not-implementation, testing-quality-checks-that-cannot-pass, qa-exploratory-guard-true-path-coverage]
+related: [testing-strategy-test-level-choice, testing-quality-behavior-not-implementation, testing-quality-checks-that-cannot-pass, testing-quality-unasserted-return-fields, testing-quality-value-preserving-refactor-assertions, qa-exploratory-guard-true-path-coverage]
 ---
 
 # Selecting the Minimum Case Set for a Function or Endpoint
@@ -57,6 +57,7 @@ sufficient.
 | Inputs are combinatorial (many flags/fields) | Test each behavior's cases independently plus one representative combination — enumerate combinations only where behaviors interact |
 | The boundary is unreachable through the public interface (guarded upstream) | Test at the level that owns the guard; do not force unreachable inputs through the unit ([testing-quality-behavior-not-implementation]) |
 | Reviewing a change that only adds a case to existing behavior | Require the new case's test; the existing normal/error/boundary set stands |
+| The observable outcome is a composite of several computed fields | "The return value" is then a set of fields plus the invariants binding them — cover the fields and assert the relations ([testing-quality-unasserted-return-fields]) |
 
 ## Instead of
 
diff --git a/wiki/testing/quality/stale-artifact-baselines.md b/wiki/testing/quality/stale-artifact-baselines.md
new file mode 100644
index 0000000..bf9b48b
--- /dev/null
+++ b/wiki/testing/quality/stale-artifact-baselines.md
@@ -0,0 +1,109 @@
+---
+id: testing-quality-stale-artifact-baselines
+domain: testing
+category: quality
+applies_to: [general]
+confidence: field-tested
+sources:
+  - https://slsa.dev/spec/v1.0/provenance
+  - https://jestjs.io/docs/snapshot-testing
+  - http://octopusinvitro.gitlab.io/blog/code-and-tech/approval-testing
+last_verified: 2026-08-06
+related: [testing-quality-differential-run-agreement, testing-quality-tests-that-cannot-fail, testing-quality-harness-reverse-controls, qa-deliverables-generated-artifacts-as-deliverable-source]
+---
+
+# A Previously Published Artifact as the "Before" Baseline
+
+## When this applies
+
+You are measuring what a code change did — blast radius, row deltas, a
+regression report — and the "before" side is an output file produced by an
+earlier run (`estimated.json`, a CSV export, an approved snapshot) rather than a
+run of the current code. Also when that file's totals match the current run's
+and you are about to treat the comparison as clean.
+
+## Do this
+
+1. **Establish the artifact's generation before comparing anything.** Check the
+   schema fields the current code emits and read their values, keeping the two
+   conclusions distinct:
+
+| What you find | What it dates |
+|---|---|
+| A field the current code always emits is **absent** | The file predates the field's introduction |
+| The field is **present but empty/`None`**, and `None` is not a legal value for it | The file predates the code that began *populating* it — the field existed, the writer did not |
+| The field is present and populated | Nothing yet; this field does not date the file, so check another |
+
+   Provenance is "the verifiable information about software artifacts describing
+   where, when and how something was produced" — an artifact carrying none has to
+   be dated from its schema like this.
+
+2. **Compare row by row, keyed on the row identity, and require every row to
+   match — the aggregate is not the check.** Three distinct mechanisms let a
+   total agree while rows do not, and they are not equally likely:
+
+| Mechanism | Why the total is unmoved | Requires |
+|---|---|---|
+| **Rows the aggregate never included** — rollup parents, cancelled or filtered statuses | The differing row was never a summand | Nothing; this is the default case |
+| Rows inside the aggregate whose deltas cancel | Equal and opposite differences sum to zero | A coincidence |
+| Rounding or precision absorbing small deltas | The delta falls below the reported precision | Small deltas |
+
+   Lead with the first: look at what the aggregate *excludes* before looking for
+   offsetting deltas, because a search for cancellation finds nothing in the
+   common case and wrongly concludes the total is trustworthy.
+
+3. **Read the outcome of that comparison as the decision about what the baseline
+   may be used for:**
+
+| Row-level comparison | Then |
+|---|---|
+| Every row matches and the schema generation matches the current code | Use the artifact as the before-baseline; cite it with its generation |
+| Totals match but some rows differ | Discard it as the baseline — the differing rows are a foreign revision's output that would be counted as your change's effect |
+| Rows differ only in fields your change is meant to alter | Still discard it: you cannot separate your change's effect from the intervening revisions' inside the same file |
+| The artifact predates a field the comparison keys on | Discard it; a comparison keyed on a field one side never had reports every row as changed or every row as new |
+
+4. **When the artifact is not usable, rebuild the before side from the current
+   code with only the change under measurement reverted, in memory.** Re-run the
+   pipeline on the same input with that one revert applied, and diff the two
+   in-process results. This holds every other revision constant, which is the
+   property the published file lacks.
+
+5. **Keep the published artifact's headline numbers in a separate, labelled
+   section of the report.** They are the record of what was previously
+   communicated and are worth stating; merged into the delta table they
+   attribute intervening revisions to your change. State the two as "previously
+   published: X" and "this change: Y", each with its generation.
+
+6. **Stamp new artifacts with their generation as you produce them** — the
+   source revision, the config version, the run timestamp — so the next
+   measurement dates the file by reading it rather than by inferring from
+   schema. A build's provenance records "the specific git commit that the URI
+   resolved to as a dependency"; the same field on a data artifact is what makes
+   it reusable as a baseline.
+
+## Edge cases
+
+| Case | Then |
+|------|------|
+| The artifact is an approved snapshot in the suite (`.approved`, `.snap`) | Regenerating it to match current output is the deliberate act the tooling warns about — "we would need to fix the bug before re-generating snapshots to avoid recording snapshots of the buggy behavior"; review the diff row by row before approving |
+| The row identity is not stable across generations (positional index, re-issued ids) | Key on a natural composite (entity id + period) and report rows whose key resolves in one side only as a separate class from rows whose values differ |
+| Only aggregates are available (the rows were never published) | Report the aggregate comparison as an aggregate claim and state that row-level agreement was not evaluated — the number is real and its scope is narrow |
+| Regenerating the before side is expensive (long pipeline, external data) | Regenerate on the subset the change can reach, chosen by the code paths the revert touches, and mark the rest untested rather than assuming |
+| The published artifact and the current run disagree on rows the change cannot reach | Treat that as a finding about the intervening revisions and report it separately; it is evidence about the pipeline, not noise to reconcile away |
+| Two implementations were compared and both sides were live runs | Different situation — asymmetric modelled state is the risk there ([testing-quality-differential-run-agreement]) |
+
+## Instead of
+
+| If you are about to | Do this instead | Why |
+|---------------------|-----------------|-----|
+| Accept a matching total as evidence the published artifact is the right baseline | Compare row by row on the row key and require every row to match | A row the aggregate excludes (rollup parent, cancelled record) was never a summand, so it can differ freely while the total stays identical — no cancellation needed |
+| Use the newest published artifact because it is the most recent one available | Date it by its schema fields, then rebuild the before side if the generation differs | Recency is not generation — an artifact published after a revision can still be the output of the code before it |
+| Reconcile the differing rows by adjusting your delta table | Rebuild the baseline with only your change reverted and re-diff | Adjusting the table encodes another revision's effect as your change's, in the direction that makes the report look consistent |
+| Drop the published numbers from the report once the baseline is rebuilt | Keep them in a labelled section beside the new delta | They are what was previously communicated; removing them hides a discrepancy readers already saw |
+
+## Sources
+
+- https://slsa.dev/spec/v1.0/provenance — provenance is "the verifiable information about software artifacts describing where, when and how something was produced", recorded so consumers "can verify that the artifact was built according to expectations"; a build records "the specific git commit that the URI resolved to as a dependency" — the generation stamp step 6 asks for
+- https://jestjs.io/docs/snapshot-testing — "If we had any additional failing snapshot tests due to an unintentional bug, we would need to fix the bug before re-generating snapshots to avoid recording snapshots of the buggy behavior"; snapshots are to be committed and reviewed "as you would any other type of test or code in your project"
+- http://octopusinvitro.gitlab.io/blog/code-and-tech/approval-testing — on the golden-master framing: "'Golden Master' is not a great name for the snapshot, as it implies that it will never change, and this is not always true"
+- Field reproduction 2026-08-05 (manday engine, impact measurement of one regex change): `estimated.json`'s counted-SP total was 211.48, matching the current HEAD run exactly, so the file read as a clean baseline. A row-level comparison found NEWRTB-2182 differing (분석조사/0.19 in the file vs 인프라/0.56 on HEAD). The file was generated before the classifier's lookbehind change — its `dead` field being `None`, which current code always populates, dated it — and the issue was a rollup parent excluded from the counted total, which is why the totals agreed while a row did not
diff --git a/wiki/testing/quality/tests-that-cannot-fail.md b/wiki/testing/quality/tests-that-cannot-fail.md
index b0534af..273ffe7 100644
--- a/wiki/testing/quality/tests-that-cannot-fail.md
+++ b/wiki/testing/quality/tests-that-cannot-fail.md
@@ -15,8 +15,8 @@ sources:
   - https://www.gnu.org/software/sed/manual/html_node/Exit-status.html
   - https://git-scm.com/docs/git-checkout
   - https://git-scm.com/docs/git-restore
-last_verified: 2026-08-05
-related: [testing-quality-minimum-case-set, testing-quality-behavior-not-implementation, testing-mocking-what-to-mock, testing-async-async-testing, testing-quality-checks-that-cannot-pass, testing-quality-spec-artifact-checks, testing-quality-harness-reverse-controls, testing-quality-schema-additions-under-a-golden-gate, testing-quality-differential-run-agreement, testing-quality-completion-predicates, testing-quality-guard-shape-vs-consequence, testing-quality-injected-clock-duration-assertions, testing-quality-write-path-assertions, backend-common-change-impact-call-site-enumeration, platforms-shells-portable-shell-scripts, qa-document-verification-spec-document-gates]
+last_verified: 2026-08-06
+related: [testing-quality-minimum-case-set, testing-quality-behavior-not-implementation, testing-mocking-what-to-mock, testing-async-async-testing, testing-quality-checks-that-cannot-pass, testing-quality-spec-artifact-checks, testing-quality-harness-reverse-controls, testing-quality-schema-additions-under-a-golden-gate, testing-quality-differential-run-agreement, testing-quality-completion-predicates, testing-quality-guard-shape-vs-consequence, testing-quality-injected-clock-duration-assertions, testing-quality-write-path-assertions, testing-quality-value-preserving-refactor-assertions, testing-quality-unasserted-return-fields, testing-quality-stale-artifact-baselines, backend-common-change-impact-call-site-enumeration, platforms-shells-portable-shell-scripts, qa-document-verification-spec-document-gates]
 ---
 
 # Proving a Test Can Fail
@@ -95,6 +95,9 @@ suite reported as covered, or you are auditing a suspiciously green suite.
 | HTTP test of a write endpoint asserting only the response status | Read the persisted record back and assert the values sent — a request whose body never decoded still returns the success status ([testing-quality-write-path-assertions]) |
 | The suite total dropped after a restore but the run still looks green | Read it as a lost import or file, not a passing suite: a module that fails to import contributes one error and removes all of its tests from the total. Compare totals against the pre-mutation run, then restore from the copy again |
 | Several sessions or agents mutate the same working tree | Each one keeps its own hashed copy and restores before handing the tree on; a shared `git checkout --` discards whichever uncommitted work landed most recently |
+| The change under test moved a literal into config/SSOT without changing the value | No observation of the output can separate the two versions — assert the dependency by substituting the constant with a sentinel ([testing-quality-value-preserving-refactor-assertions]) |
+| The subject returns a composite and the assertions read one field | Diff the returned field list against the fields assertions mention, then mutate each unread field and add the invariant that binds them ([testing-quality-unasserted-return-fields]) |
+| The "before" side of a comparison is a previously published output file | Date its generation from its schema fields and compare row by row before citing it; matching totals do not establish matching rows ([testing-quality-stale-artifact-baselines]) |
 
 ## Instead of
 
diff --git a/wiki/testing/quality/unasserted-return-fields.md b/wiki/testing/quality/unasserted-return-fields.md
new file mode 100644
index 0000000..9969644
--- /dev/null
+++ b/wiki/testing/quality/unasserted-return-fields.md
@@ -0,0 +1,105 @@
+---
+id: testing-quality-unasserted-return-fields
+domain: testing
+category: quality
+applies_to: [general]
+confidence: verified
+sources:
+  - https://pitest.org/quickstart/basic_concepts/
+  - https://stryker-mutator.io/docs/mutation-testing-elements/mutant-states-and-metrics/
+  - https://arxiv.org/abs/2211.12003
+  - https://hypothesis.works/articles/what-is-property-based-testing/
+  - https://abseil.io/resources/swe-book/html/ch12.html
+last_verified: 2026-08-06
+related: [testing-quality-tests-that-cannot-fail, testing-quality-minimum-case-set, testing-quality-harness-reverse-controls, testing-quality-write-path-assertions, testing-quality-value-preserving-refactor-assertions]
+---
+
+# Return Fields No Assertion Reads
+
+## When this applies
+
+The function under test returns a composite — dict, record, tuple, struct — with
+several computed fields, and the suite's assertions read one or a few of them
+(the headline number, the label). Also when a suite reports a large assertion
+count for such a function and you are judging whether that count is coverage.
+
+## Do this
+
+1. **Enumerate the returned fields and diff that list against the fields any
+   assertion mentions.** Grep the test files for each field name; a field that
+   appears in zero assertions has its whole computation path unverified,
+   whatever the suite's assertion count is. Record the list — it is the page's
+   working output, not a side note.
+
+2. **Confirm each absence with one mutation per unread field before writing
+   anything.** Change that field's computation (swap the percentile it reads,
+   widen the multiplier, invert the scope factor) and run the suite. A survived
+   mutation is the proof the field is unguarded; a killed one means some
+   assertion does read it indirectly, so re-read that assertion instead of
+   adding a duplicate. A suite that stays green under the mutation is the
+   *survived* verdict; keep it distinct from **No coverage**, where the field's
+   computation never executed at all — the first says no assertion checks the
+   field, the second says the test never reached it.
+
+3. **Run the harness's no-op control in the same session.** A semantics-
+   preserving edit must survive; when it is reported as caught, the mutations
+   proved nothing about the fields and the environment is what failed
+   ([testing-quality-harness-reverse-controls]).
+
+4. **When two or more returned fields are bound by a relation, assert that
+   relation as its own assertion.** An ordering (`lo ≤ point ≤ hi`), a sum
+   (`parts == total`), or a derivation (`rate * base == amount`) is a claim no
+   single field's value expresses, so no per-field assertion can fail on a
+   formula that breaks it. This is a metamorphic relation: MT reasons about
+   "relations between outputs" instead of a full input-output specification, and
+   such relations "provide formal specification of the system under test" where
+   per-field expected values are impractical to enumerate. Choose the assertion
+   by what binds the fields:
+
+| Relation between fields | Assert |
+|---|---|
+| Interval around an estimate (`lo`, `point`, `hi`) | `lo ≤ point ≤ hi` on every case, as its own assertion separate from any value check |
+| Parts and a total | The parts sum to the total, and each part is within the total's domain |
+| A field derived from others (rate × base) | The derivation recomputed from the returned inputs equals the returned result |
+| A label or category paired with a numeric field | The pairing is consistent both ways — the label implies the numeric band and the band implies the label |
+| Optional field plus a flag that says whether it is present | The flag and the field's presence agree, in both truth values |
+
+5. **Exercise the relation over the input grid, not one sampled case.** Take the
+   cartesian product of the discrete inputs that feed the fields (size buckets ×
+   scope factors × type flags) and assert the invariant on every combination.
+   The invariant is a property that must hold for all inputs, so a grid — or a
+   generator when the space is too large to enumerate — is what can falsify it;
+   one hand-picked case can only confirm it.
+
+6. **Report a violated invariant with the combinations that violate it.** The
+   count and the specific inputs localize the fault to the field whose formula
+   crosses the bound, which a single failing case does not.
+
+## Edge cases
+
+| Case | Then |
+|------|------|
+| A field is deliberately informational (a debug string, a trace id) | Exclude it explicitly in the test file with the reason; keep it out of the unread-field list so the list stays actionable |
+| The grid is too large to enumerate | Generate the inputs with a property-based runner and keep the invariant as the assertion; record the seed with any failure so it replays |
+| The invariant holds for all grid points and you cannot construct a violation | Mutate the field's formula and require the invariant assertion to redden — an invariant no input can violate on correct code still has to be provably violable on broken code |
+| Two fields are computed by the same expression | Assert each field's value independently, and either drop the relation between them or record it as non-discriminating with that reason — a relation between two copies of one expression cannot fail on a defect that moves both, so keeping it unlabelled adds an assertion that cannot fail |
+| The invariant is violated on inputs the caller cannot produce | Fix the field's domain guard or narrow the grid to reachable inputs, and state which it was — a violation on unreachable input is not a bug in the formula |
+| The composite is returned across a boundary you own (HTTP/JSON) | Assert the fields on the deserialized response, not the internal object, so the serialization is covered too ([testing-quality-write-path-assertions]) |
+
+## Instead of
+
+| If you are about to | Do this instead | Why |
+|---------------------|-----------------|-----|
+| Read a high assertion count on a multi-field return as coverage of that return | Diff the field list against the fields assertions mention, then mutate each unread field | Assertion count measures how often the read fields were checked, not how much of the return is guarded |
+| Add one more value assertion for each unread field and stop | Add the value assertions *and* the cross-field invariant | Per-field values cannot express an ordering or sum between fields, so a formula that keeps each field plausible while breaking their relation stays green |
+| Assert the invariant on one representative case | Assert it across the grid of discrete inputs, or generate them | An invariant claims something for all inputs; a single case is consistent with it failing everywhere else |
+| Trust a survived mutation as proof of a coverage gap without a control | Run the no-op control in the same session and require it to survive too | A harness whose cases die before the rule runs reports survival and catch for reasons unrelated to the tests |
+
+## Sources
+
+- https://pitest.org/quickstart/basic_concepts/ — "**No coverage** is the same as **Survived** except there were no tests that exercised the line of code where the mutation was created": the distinction step 2 depends on when reading a survived per-field mutation as an unguarded field
+- https://stryker-mutator.io/docs/mutation-testing-elements/mutant-states-and-metrics/ — the mutant state set (`Killed`, `Survived`, `No coverage`, `Timeout`, `Runtime error`, `Compile error`, `Ignored`) and the `detected / valid` score, cited for those states only
+- https://arxiv.org/abs/2211.12003 — Alzahrani, Spichkova, Harland, "Application of property-based testing tools for metamorphic testing": "The core concept in MT is metamorphic relations (MRs) which provide formal specification of the system under test", the approach used when determining each expected output directly is impractical
+- https://hypothesis.works/articles/what-is-property-based-testing/ — property-based testing as "the construction of tests such that, when these tests are fuzzed, failures in the test reveal problems with the system under test that could not have been revealed by direct fuzzing of that system" — why an invariant plus generated inputs finds what per-case assertions miss
+- https://abseil.io/resources/swe-book/html/ch12.html — test the behaviors (guarantees) a unit makes; a cross-field invariant is one such guarantee and needs its own assertion
+- Field reproduction 2026-08-05 (manday estimation engine): the suite held 58 passing assertions over a function returning `lo`/`sp`/`hi`; `lo` and `hi` appeared in none of them. Four mutations of their formulas (percentile `p25`→`p75`, `p75`→`p25`, scope factor large→small) each left all 58 assertions passing, while the no-op control survived — confirming the harness discriminated. Adding `lo ≤ sp ≤ hi` over the full discrete input grid surfaced 13 combinations with `sp > hi`
diff --git a/wiki/testing/quality/value-preserving-refactor-assertions.md b/wiki/testing/quality/value-preserving-refactor-assertions.md
new file mode 100644
index 0000000..efa92c5
--- /dev/null
+++ b/wiki/testing/quality/value-preserving-refactor-assertions.md
@@ -0,0 +1,109 @@
+---
+id: testing-quality-value-preserving-refactor-assertions
+domain: testing
+category: quality
+applies_to: [general]
+confidence: field-tested
+sources:
+  - https://docs.pytest.org/en/stable/how-to/monkeypatch.html
+  - https://docs.python.org/3/library/unittest.mock.html
+  - https://stryker-mutator.io/docs/mutation-testing-elements/equivalent-mutants/
+  - https://pitest.org/quickstart/basic_concepts/
+last_verified: 2026-08-06
+related: [testing-quality-tests-that-cannot-fail, testing-quality-harness-reverse-controls, testing-quality-behavior-not-implementation, testing-quality-minimum-case-set, testing-quality-unasserted-return-fields, testing-quality-checks-that-cannot-pass, backend-common-change-impact-call-site-enumeration]
+---
+
+# Regression Tests for a Value-Preserving Refactor
+
+## When this applies
+
+You replaced a hardcoded literal with a read from config, a constants module, or
+another single source of truth (`"DB ×1.3"` → `"DB ×%s" % E.DB_MULT`), the
+current config holds the same value the literal did, and you are adding the test
+that stops the literal from coming back. Also when reviewing such a test.
+
+## Do this
+
+1. **Render the output under the current config and compare it byte-for-byte
+   with the literal you removed, before writing any assertion.** When the two
+   strings are equal, the refactored and the reverted-literal versions produce
+   identical output *for that config value*, so every assertion that holds the
+   config fixed passes on both. The separating input exists — it is the config
+   value itself — and the test's job is to vary it.
+
+2. **Choose the assertion target from that comparison:**
+
+| Byte comparison of output vs. removed literal | Assert |
+|---|---|
+| Differs (the refactor changed the rendering) | The new output directly; the natural assertion already discriminates |
+| Identical, and the value is settable through an interface a caller or operator reaches without editing source | The *dependency*: substitute the source value with a sentinel no literal would produce, then require the output to carry the sentinel |
+| Identical, and the value is only reachable by editing source (module-local constant, build-time inlining) | Nothing at unit level — the reversion is invisible to any test that respects the public interface; put the guard in a static check (item 7) |
+
+3. **Pick the sentinel so that the reverted code fails loudly.** Use a value
+   outside the plausible range and distinct in rendering (`DB_MULT = 9.9` when
+   production is `1.3`), then assert the rendered sentinel (`"DB ×9.9"`) is
+   present. On the reverted version the output still reads `DB ×1.3`, so the
+   presence assertion is what fails — it is the discriminator. Add "the
+   production literal is absent" as a second assertion when the renderer could
+   emit both values; it is a supplement, not the detector.
+
+4. **Substitute through the seam the caller or operator uses**, not a private
+   field: the config object, the environment variable, the injected parameter,
+   the CLI flag. That keeps the assertion a behavior claim — *the output follows
+   the configured value* — which is why it does not conflict with
+   [testing-quality-behavior-not-implementation]; see its own edge row for the
+   boundary.
+
+5. **Restore the value with the runner's scoped patcher rather than a
+   hand-rolled `try/finally`.** pytest's `monkeypatch` states that "All
+   modifications will be undone after the requesting test function or fixture
+   has finished", and `monkeypatch.context()` applies a patch "only in a
+   specific scope". Both forms restore on assertion failure, so pick the fixture
+   for the reasons that do differ: there is no restore code to review, it undoes
+   patches applied in a *fixture* whose test body never runs, and it composes
+   with fixture teardown ordering instead of competing with it.
+
+6. **Patch the name the renderer looks up, not the name where the value is
+   defined.** `patch()` "works by (temporarily) changing the object that a
+   *name* points to", so "you must ensure that you patch the name used by the
+   system under test". When a module copied the constant into a local at import
+   time it never reads the substitution, and the sentinel assertion then fails
+   *on correct code* — read that red as a wrong patch site, not as a caught
+   regression, and move the patch to the name the renderer reads.
+
+7. **Know all three detectors and pick by reachability of the value:**
+
+| Detector | Use when |
+|---|---|
+| Sentinel substitution asserted in a test | The value is settable through a caller- or operator-reachable interface |
+| A red control run against a copy with the literal restored | Once, to prove whichever assertion you wrote can fail at all ([testing-quality-tests-that-cannot-fail] for the restore mechanics) |
+| A static check that greps for the literal outside the SSOT | The value is module-local or inlined at build time, so no test can observe the difference ([testing-quality-checks-that-cannot-pass] for authoring that gate) |
+
+## Edge cases
+
+| Case | Then |
+|------|------|
+| The constant is one of several the output renders | Substitute one constant per test so a red run names which read regressed; a single test substituting all of them cannot localize the reversion |
+| The value is a float and the rendering rounds it | Pick a sentinel that survives the rounding (differs in a kept digit), and assert the rendered form rather than the raw value |
+| The refactor moved the literal into the same module's own constant, no operator can set it | Take the static-check row of item 7 — asserting a substitution of a module-local private is an implementation-detail assertion, and re-inlining removes no capability a caller can observe |
+| The config value legitimately equals a magic number the output already contains for another reason | Assert the sentinel-substituted output only, and drop the "production literal absent" supplement — it would match the unrelated occurrence and redden on correct code |
+| Several call sites were meant to switch to the SSOT and you tested one | Enumerate the call sites and give each its own substitution assertion — a passing test on one site says nothing about the others ([backend-common-change-impact-call-site-enumeration]) |
+| The sentinel assertion is red on code you believe is correct | Check the patch site first (item 6) — a name the renderer never reads produces exactly this red |
+
+## Instead of
+
+| If you are about to | Do this instead | Why |
+|---------------------|-----------------|-----|
+| Assert the rendered text (`assert "DB ×1.3" in out`) as the refactor's regression test | Substitute the value with a sentinel through its public seam and assert the output follows | The rendered text is identical for the shipped config value, so the assertion passes on the reverted literal too — it guards nothing it was written to guard |
+| Read a green run plus coverage of the changed line as proof the SSOT read is enforced | Require a red run against a copy that has the literal restored | Holding the config fixed makes the two versions indistinguishable by construction; only varying it, or a red control, discriminates |
+| Wrap the substitution in `try/finally` to restore the value | Use the runner's scoped patch fixture (`monkeypatch`, `patch` as a context manager) | Both restore on failure, but the fixture leaves no restore code to review and also covers a patch applied in a fixture whose test never runs |
+| Assert a substitution of a module-local constant to guard re-inlining | Put that guard in a static check for the literal outside the SSOT | A value no caller or operator can set is an implementation detail; a test asserting it fails refactors and detects no behavior change |
+| Skip the byte comparison and write whichever assertion looks natural | Compute the comparison first and let its result choose the assertion target | The comparison is what tells you whether the natural assertion can fail at all |
+
+## Sources
+
+- https://docs.pytest.org/en/stable/how-to/monkeypatch.html — "All modifications will be undone after the requesting test function or fixture has finished"; `monkeypatch.context()` applies patches "only in a specific scope"
+- https://docs.python.org/3/library/unittest.mock.html — "Where to patch": `patch()` "works by (temporarily) changing the object that a *name* points to with another one … you must ensure that you patch the name used by the system under test"
+- https://stryker-mutator.io/docs/mutation-testing-elements/equivalent-mutants/ — cited as the near analogy, not as this page's mechanism: for a mutant that leaves output identical, "There is no definitive way for Stryker to find and ignore them" and "the only solution is by finding these by hand". A value-preserving refactor differs in one decisive way — the config value is an input that *does* separate the two versions, which is what makes a test possible here
+- https://pitest.org/quickstart/basic_concepts/ — the same analogy from PIT: an equivalent mutation is one whose result "behaves in exactly the same way as the original"
+- Field reproduction 2026-08-05 (manday report renderer): the removed literal `DB ×1.3` and `"DB ×%s" % E.DB_MULT` under the shipped config rendered byte-identical, computed before writing the test — so `assert "DB ×1.3" in out` passed on both the SSOT version and the restored-literal version. Substituting `E.DB_MULT` with a sentinel and asserting the rendered sentinel was the form that reddened on the literal version