From 3cc47daae711b4d1225fab92eff3cf8d1395f6b6 Mon Sep 17 00:00:00 2001
From: AHMED YOUNIS <aether.x.eg@gmail.com>
Date: Sat, 24 Oct 2026 03:18:10 +0300
Subject: [PATCH 1/2] test(diff): add bounded metamorphic and ambiguous-subject
 regressions

---
 crates/execsurface-diff/src/lib.rs | 75 ++++++++++++++++++++++++++++++
 1 file changed, 75 insertions(+)

diff --git a/crates/execsurface-diff/src/lib.rs b/crates/execsurface-diff/src/lib.rs
index b5a6f6ca..be509b31 100644
--- a/crates/execsurface-diff/src/lib.rs
+++ b/crates/execsurface-diff/src/lib.rs
@@ -572,6 +572,81 @@ mod tests {
         ));
     }
 
+    // A rearranged or duplicated observer event must not manufacture drift.
+    #[test]
+    fn event_order_and_duplicate_observations_do_not_create_false_drift() {
+        let access = file_open(false);
+        let execution = CanonicalEffect::ProcessExec {
+            from: None,
+            executable: executable(),
+        };
+        let before = baseline(vec![access.clone(), execution.clone()]);
+        let after = candidate(vec![
+            execution.clone(),
+            access.clone(),
+            execution,
+            access,
+        ]);
+        let report = diff(&before, &after).unwrap();
+
+        assert!(report.added.is_empty());
+        assert!(report.removed.is_empty());
+        assert!(report.changed.is_empty());
+        assert!(!has_drift(&report));
+    }
+
+    // A unique same-subject mutation must remain visible even when
+    // an unrelated effect is added in the same candidate.
+    #[test]
+    fn changed_file_intent_and_unrelated_process_effect_are_both_reported() {
+        let original_access = file_open(false);
+        let changed_access = file_open(true);
+        let unrelated_exec = CanonicalEffect::ProcessExec {
+            from: None,
+            executable: executable(),
+        };
+        let report = diff(
+            &baseline(vec![original_access.clone()]),
+            &candidate(vec![unrelated_exec.clone(), changed_access.clone()]),
+        )
+        .unwrap();
+
+        assert_eq!(report.changed.len(), 1);
+        assert_eq!(report.changed[0].before, original_access);
+        assert_eq!(report.changed[0].after, changed_access);
+        assert_eq!(report.added, vec![unrelated_exec]);
+        assert!(report.removed.is_empty());
+        assert!(has_drift(&report));
+    }
+
+    // With two old effects having the same subject, a new effect must
+    // not be arbitrarily paired with one of them as a trustworthy change.
+    #[test]
+    fn ambiguous_file_subjects_remain_added_and_removed() {
+        let read = file_open(false);
+        let write = file_open(true);
+        let mut replacement = file_open(true);
+        if let CanonicalEffect::FilePathAccess {
+            open_intent: Some(intent),
+            ..
+        } = &mut replacement
+        {
+            intent.create = true;
+        }
+        let report = diff(
+            &baseline(vec![read.clone(), write.clone()]),
+            &candidate(vec![replacement.clone()]),
+        )
+        .unwrap();
+
+        assert!(report.changed.is_empty());
+        assert_eq!(report.removed.len(), 2);
+        assert!(report.removed.contains(&read));
+        assert!(report.removed.contains(&write));
+        assert_eq!(report.added, vec![replacement]);
+        assert!(has_drift(&report));
+    }
+
     #[test]
     fn corrupted_baseline_is_rejected() {
         let mut baseline = baseline(vec![]);

From dbf18797814f17f15bc2b6a1ac7751128a797324 Mon Sep 17 00:00:00 2001
From: AHMED YOUNIS <aether.x.eg@gmail.com>
Date: Sat, 24 Oct 2026 03:19:15 +0300
Subject: [PATCH 2/2] style(test): apply exact rustfmt CI feedback without
 altering assertions

---
 crates/execsurface-diff/src/lib.rs | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/crates/execsurface-diff/src/lib.rs b/crates/execsurface-diff/src/lib.rs
index be509b31..4b1cd1f6 100644
--- a/crates/execsurface-diff/src/lib.rs
+++ b/crates/execsurface-diff/src/lib.rs
@@ -581,12 +581,7 @@ mod tests {
             executable: executable(),
         };
         let before = baseline(vec![access.clone(), execution.clone()]);
-        let after = candidate(vec![
-            execution.clone(),
-            access.clone(),
-            execution,
-            access,
-        ]);
+        let after = candidate(vec![execution.clone(), access.clone(), execution, access]);
         let report = diff(&before, &after).unwrap();
 
         assert!(report.added.is_empty());