fix(ci): scope-preserving PR auto-heal — never escalate to test_extend (#1403)

[Serhan-Asad]

Problem (#1403)

PR auto-heal was optimizing for "make the whole module synchronized" instead of "keep this PR narrowly scoped", re-bloating narrow fix PRs with unrelated test_extend output (e.g. #1390, flagged non-mergeable on 6/4).

For a Python module whose tests pass but coverage is below target, sync_determine_operation returns test_extend. In PR auto-heal, heal_module routes verify/generate/test/crash through pdd --force --strength 0.5 sync <module>, and that nested pdd sync re-derives the same coverage gap internally and appends generated tests (rewriting .pdd/meta command to test_extend). As the issue stresses, detection-only suppression is not enough — the guard must also exist at execution time.

Fix — a two-layer guard from one default-off signal

PDD_DISABLE_TEST_EXTEND, set only in PR auto-heal mode (is_pr_mode = not skip_ci):

Layer	Where	Behavior when flag set
Detection	sync_determine_operation (test_extend_disabled())	coverage-gap branch returns the existing all_synced no-op for all languages. Called by both the parent detect_drift and the nested pdd sync, so one branch covers detection and execution re-derivation.
Execution backstop	sync_orchestration test_extend branch	mirrors the existing non-Python skip: logs test_extend_skipped, accepts current state, writes no test file.
Signal source	ci_drift_heal.main	sets os.environ flag only around the in-process detect_drift (restored in finally — no leak) and passes it explicitly in the pdd sync subprocess env.
Clean no-op	ci_drift_heal.detect_drift	treats all_synced as "no drift" (with nothing/synced) so the guarded module is a clean skip, not an "unknown operation" heal failure.

Push-to-main (--skip-ci) is unaffected — whole-module coverage growth still runs. The signal is default-off, so unset behavior is byte-for-byte unchanged. update / example / required auto-deps remain allowed in PR heal.

Prompts (ci_drift_heal, sync_determine_operation, sync_orchestration) updated to match (source of truth).

Tests (genuine RED → GREEN; verified failing on unpatched source)

• sync_determine_operation: flag → all_synced; unset still returns test_extend (regression guard).
• sync_orchestration: suppressed test_extend appends no tests, logs test_extend_skipped, saves no test_extend fingerprint; Python test_extend still runs when unset (baseline).
• ci_drift_heal: PR mode sets the flag for in-process detection and the subprocess env, and restores os.environ (no leak); push-to-main with --diff-base keeps it unset (the discriminator is skip_ci, not diff_base).
• e2e (test_ci_drift_heal_e2e.py): real python -m pdd.ci_drift_heal parent + PATH-level fake pdd child proves the env contract crosses the parent→child boundary and no test_extend churn is committed.

Local: test_ci_drift_heal + test_sync_determine_operation + e2e = 315 passed; test_sync_orchestration = 214 passed. Zero new ruff findings on the changed files.

Supersedes

• feat: PR-scope guard to suppress test_extend in auto-heal (#1403) #1416 (pdd change) — edited prompt prose only; code was never regenerated, so the guard was non-functional.
• Add failing tests for #1403 #1432 (pdd fix) — failing tests + partial code; missed the all_synced detect_drift filter (guarded module became an "unknown operation" failure) and left os.environ mutated.

This PR is the complete, tested version of both. Opened as draft per the issue's workaround so the (still-unpatched) auto-heal bot doesn't re-bloat this branch before merge.

Closes #1403.

🤖 Generated with Claude Code

[Serhan-Asad]

Review loop converged (claude implement ↔ codex review, 3 rounds)

• Round 1 — codex found a real regression: detect_drift skipped all_synced before git reclassification, dropping code-only-change modules that should become update. Fixed (e6b34498c): the all_synced skip now runs after reclassification; added tests test_all_synced_with_code_only_change_reclassified_as_update + test_all_synced_terminal_is_skipped_not_unknown_operation. Also renamed test_extend_disabled → is_test_extend_disabled (so pytest doesn't collect the helper) and added falsey-parser + env-restore-on-exception tests.
• Round 2/3 — codex flagged that the coverage branch returns before file-state analysis, so an example-only change coexisting with a low-coverage run report is masked. Confirmed pre-existing (identical on main, which returns test_extend → fails the heal) and independent of this guard; the shipped non-Python all_synced branch has the same property. There is no scenario where main heals that example but this PR doesn't — the divergence is strictly fail/re-bloat → clean skip, and PDD_HEAL_SKIP_REVIEW_ONLY_EXAMPLE_DRIFT=1 already skips review-only example drift by design. Codex agreed it is not a blocker and merge-ready with a documented follow-up. Tracked in sync_determine_operation: coverage branch short-circuits before file-state drift detection #1442.

Kept as draft intentionally (issue #1403's own workaround) so the still-unpatched auto-heal bot can't re-bloat this branch before merge.