📦 WP-174 — test(eval): the keypoint tier's shipped surface is executed¶
Engineering log · Phase 15 — Audit remediation, v0.8.0
WP-174 — three shipped surfaces that a callable(...) Example stood in for¶
predict_keypoints had zero executed lines in the gate. pose_eval.py, the keypoint tier's acceptance scorer, sat at 37%. _overlay_ema was unexecuted entirely. All three carried a docstring Example of the form >>> callable(run), which satisfies --doctest-modules and the repository's own doctest-coverage audit while asserting nothing a broken implementation would fail. That is the pattern worth naming: a required Example is a coverage obligation, and an Example that only asserts the symbol exists discharges the obligation without discharging the purpose. detect_eval.py and rotated_eval.py carry the identical Example and sit at 97% and 96%, so the pattern only bites where nothing else happens to reach the code.
After: predict.py 76% → 99%, pose_eval.py 37% → 100%, checkpoint.py 47% → 94%. 31 new test items.
The keypoint expectations are hand-computed, not recorded. On the 64×128 planted canvas the letterbox scale is min(64/64, 64/128) = 0.5, content is 32×64, pad_top is 16 and pad_left is 0, so the inverse is x_orig = 2·x_canvas and y_orig = 2·(y_canvas − 16). Those literals are in the test with the arithmetic beside them. A test that asserts whatever the code returned would have passed against a broken inverse just as well.
The fixture is built to fail in the interesting ways. The one-to-one and dense branches carry disjoint point sets, so a path reading the other branch's stem returns a plausible pose of the wrong object beside a correct box — the failure the source docstring warns about, and one no shape assertion can see. A decoy set sits on anchor 0, which is never the selected anchor, while every other anchor carries zero offsets decoding to its own centre; a fixed-row gather therefore returns the decoy or a centre rather than the plant. That case is self-guarding: if the decoy anchor ever coincided with the selected one, the decoy would overwrite the plant and the primary assertion fails rather than passing vacuously. K is 3 throughout rather than 17, so a function that assumed the human schema fails.
One brief corrected against the data. The row asked for the K != 17 refusal "at minimum"; that branch was already covered at K=7, which the audit's own coverage line implies — missing 130-175 means 117-129 runs. The real gap was the scoring body. Both landed: the scoring body is now executed, and the refusal gains K=16, the value adjacent to the boundary where an off-by-one or a table padded by one joint lets a foreign schema through. The pose split is hand-built in the layout run resolves, which is what pins the annotation file name — person_keypoints_ rather than instances_, the substitution that divides a person detector's AP by eighty.
_overlay_ema was the one place the tests found real defects. Three, all in how the EMA claim was established rather than in arithmetic. The callback's key was resolved by substring in one place and by literal name in another, so a checkpoint written by a parametrized callback — whose state_key carries its arguments — passed the substring match, was overlaid, and then died on a bare KeyError after the module had been mutated. Two matching entries were resolved by iteration order, the last silently winning. And the copy walked the shadow's keys rather than the module's, so any module tensor absent from the shadow kept its raw value with nothing said — a run reporting a mixture of EMA and raw weights under the EMA name, which is neither of the two claims a report can make.
The key is now resolved once and handed back so the shadow and the update counter come from the same entry; more than one match raises; and coverage is checked before any copy rather than after. Validating after would have reproduced the defect's own shape — naming the problem while leaving the module in the state the message declares invalid. Validating first means no half-overlaid module ever exists, and the test asserts that stronger contract by snapshotting every float tensor and proving none moved after the refusal.
What the row did not find is worth recording too. predict_keypoints and pose_eval.run are correct as written — every hand-computed coordinate matched on the first functional run. Their gap was evidentiary, not behavioural. That is the honest result for two of the three surfaces, and it is why the row is test(eval) rather than fix.