From f5d33932dbac37c2c58e9a42cd71b88f25e02a49 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Kyle=20=F0=9F=90=86?= <kyle@privkey.io>
Date: Sun, 2 Aug 2026 15:05:19 -0400
Subject: [PATCH] Fail loudly when a probe is not staged

---
 scripts/test-rng-hygiene.sh | 17 +++++++++++++++++
 1 file changed, 17 insertions(+)

diff --git a/scripts/test-rng-hygiene.sh b/scripts/test-rng-hygiene.sh
index 57b3963..6d91faf 100755
--- a/scripts/test-rng-hygiene.sh
+++ b/scripts/test-rng-hygiene.sh
@@ -57,6 +57,23 @@ run_probe() {
         return
     fi
 
+    # Both that the tree is populated AND that this probe is in it. The git
+
+    # errors above are discarded, so a failed `git add` would otherwise leave
+
+    # the guard scanning a probe-free tree and the case judged on a file it
+
+    # never saw.
+
+    if ! GIT_INDEX_FILE="$TMPDIR_T/index" git ls-files --error-unmatch "$name" >/dev/null 2>&1; then
+
+        echo "  HARNESS BROKEN: $name was not staged; the guard would never see it"
+
+        fails=$((fails + 1)); rm -f "$name"; PROBE=""; return
+
+    fi
+
+
     local rc=0 out
     out=$(GIT_INDEX_FILE="$TMPDIR_T/index" "$GUARD" 2>&1) || rc=$?