From 0aaa5829777d34b988dec955d2a6a0a894e92be1 Mon Sep 17 00:00:00 2001
From: morluto <76467478+morluto@users.noreply.github.com>
Date: Thu, 5 Nov 2026 17:37:29 +0800
Subject: [PATCH] test(ghidra): check retained historical snapshot evidence
 (#8381)

* test(ghidra): check retained historical snapshot evidence

* test(ghidra): select historical observations by address
---
 .../lib/real-ghidra-snapshot-lifecycle.mjs    | 40 ++++++++++---------
 1 file changed, 21 insertions(+), 19 deletions(-)

diff --git a/scripts/lib/real-ghidra-snapshot-lifecycle.mjs b/scripts/lib/real-ghidra-snapshot-lifecycle.mjs
index 7b4221bc92..73d5e69ab3 100644
--- a/scripts/lib/real-ghidra-snapshot-lifecycle.mjs
+++ b/scripts/lib/real-ghidra-snapshot-lifecycle.mjs
@@ -9,7 +9,7 @@ import { join } from "node:path";
 import { parseAnalysisSnapshot } from "../../dist/domain/analysisSnapshot.js";
 import { parseEvidenceBundle } from "../../dist/domain/evidenceBundle.js";
 
-/** Keep mutable Ghidra observations out of immutable snapshots across target opens. */
+/** Keep live Ghidra edits distinct from historical Evidence across snapshots. */
 export async function verifyGhidraSnapshotLifecycle(
   client,
   target,
@@ -93,18 +93,21 @@ export async function verifyGhidraSnapshotLifecycle(
     const bundle = parseEvidenceBundle(
       JSON.parse(await readFile(bundlePath, "utf8")),
     );
-    assert.ok(
-      bundle.records.some(
-        (record) => record.operation === "annotate_native_function",
-      ),
+    const annotation = bundle.records.find(
+      (record) =>
+        record.operation === "annotate_native_function" &&
+        record.normalized_result.annotations.name === edited.procedure.name &&
+        record.normalized_result.annotations.address ===
+          edited.procedure.address,
     );
-    assert.ok(
-      bundle.records.some(
-        (record) =>
-          record.operation === "inspect_native_api" &&
-          record.normalized_result.procedure.name === edited.procedure.name,
-      ),
+    const editedApi = bundle.records.find(
+      (record) =>
+        record.operation === "inspect_native_api" &&
+        record.normalized_result.procedure.name === edited.procedure.name &&
+        record.normalized_result.procedure.address === edited.procedure.address,
     );
+    assert.ok(annotation);
+    assert.ok(editedApi);
 
     await call("close_binary");
     await call("open_binary", {
@@ -124,14 +127,13 @@ export async function verifyGhidraSnapshotLifecycle(
     const fresh = parseAnalysisSnapshot(
       JSON.parse(await readFile(freshPath, "utf8")),
     );
-    assert.ok(
-      !fresh.evidence_bundle.records.some(
-        (record) =>
-          record.operation === "annotate_native_function" ||
-          (record.operation === "inspect_native_api" &&
-            record.normalized_result.procedure.name === edited.procedure.name),
-      ),
-    );
+    for (const historical of [annotation, editedApi])
+      assert.deepEqual(
+        fresh.evidence_bundle.records.find(
+          (record) => record.evidence_id === historical.evidence_id,
+        ),
+        historical,
+      );
     await call("open_binary", {
       path: target.path,
       provider_id: "ghidra",