Close repo reality scanner rollout

tests/test_reconciliation.py

@@ -126,6 +126,63 @@ def test_scan_cli_reconciles_against_previous_snapshot(tmp_path: Path, capsys) -
     assert any(tombstone["stable_key"] == vanished_key for tombstone in payload["tombstones"])
 
 
+def test_three_rescans_keep_stable_identity_and_retire_vanished_evidence(tmp_path: Path) -> None:
+    repo = tmp_path / "fixture-repo"
+    repo.mkdir()
+    (repo / "README.md").write_text("# Fixture Repo\n", encoding="utf-8")
+    _write_pyproject(repo, ["PyYAML>=6.0"])
+
+    first = scan_repo(
+        ScanOptions(
+            repo_path=repo,
+            repo_slug="fixture-repo",
+            repo_name="Fixture Repo",
+            commit="commit-1",
+        )
+    )
+    _assert_unique_candidate_keys(first)
+
+    _write_pyproject(repo, ["PyYAML>=6.0", "requests>=2.31"])
+    second = reconcile_discovery_snapshots(
+        first,
+        scan_repo(
+            ScanOptions(
+                repo_path=repo,
+                repo_slug="fixture-repo",
+                repo_name="Fixture Repo",
+                commit="commit-2",
+            )
+        ),
+    )
+    _validate_schema("discovery-snapshot.schema.yaml", second)
+    _assert_unique_candidate_keys(second)
+
+    requests_key = discovery_stable_key("fixture-repo", "ExternalLibrary", "requests")
+    pyyaml_key = discovery_stable_key("fixture-repo", "ExternalLibrary", "PyYAML")
+    assert requests_key in second["reconciliation"]["diff"]["added"]
+    assert requests_key in {node["stable_key"] for node in second["candidates"]["nodes"]}
+
+    _write_pyproject(repo, ["PyYAML>=6.0"])
+    third = reconcile_discovery_snapshots(
+        second,
+        scan_repo(
+            ScanOptions(
+                repo_path=repo,
+                repo_slug="fixture-repo",
+                repo_name="Fixture Repo",
+                commit="commit-3",
+            )
+        ),
+    )
+    _validate_schema("discovery-snapshot.schema.yaml", third)
+    _assert_unique_candidate_keys(third)
+
+    assert requests_key in third["reconciliation"]["diff"]["retired"]
+    assert pyyaml_key not in third["reconciliation"]["diff"]["retired"]
+    assert requests_key not in {node["stable_key"] for node in third["candidates"]["nodes"]}
+    assert any(tombstone["stable_key"] == requests_key for tombstone in third["tombstones"])
+
+
 def _snapshot(
     *,
     replacement_scopes: list[dict[str, object]],
@@ -206,6 +263,31 @@ def _anchor(source_kind: str, path: str) -> dict[str, object]:
     return anchor
 
 
+def _write_pyproject(repo: Path, dependencies: list[str]) -> None:
+    dependency_lines = "\n".join(f'  "{dependency}",' for dependency in dependencies)
+    (repo / "pyproject.toml").write_text(
+        f"""
+[project]
+name = "fixture-service"
+version = "0.1.0"
+dependencies = [
+{dependency_lines}
+]
+""".lstrip(),
+        encoding="utf-8",
+    )
+
+
+def _assert_unique_candidate_keys(snapshot: dict[str, object]) -> None:
+    candidates = snapshot["candidates"]
+    assert isinstance(candidates, dict)
+    for collection_name in ("nodes", "edges", "attributes"):
+        collection = candidates[collection_name]
+        assert isinstance(collection, list)
+        stable_keys = [item["stable_key"] for item in collection]
+        assert len(stable_keys) == len(set(stable_keys))
+
+
 def _validate_schema(schema_name: str, payload: dict[str, object]) -> None:
     validator = draft202012_validator(Path("schemas") / schema_name)
     validator.validate(payload)