[Jacob-Met]

Problem

A truncated unified-diff hunk can be rejected by Git while TestPilot derives a partial target selection, generates tests, and writes a passing report. Automatic runs also constructed the model client before validating this malformed input.

Change

Validate complete file headers and declared old/new hunk counts before returning any target selection. Reject incomplete, overlong, malformed, or unsupported numeric ranges through a dedicated DiffFormatError. Preflight automatic runs before model setup and return a clean input-error exit.

The change preserves physical-line and encoded-path handling, deletion anchors, real Git/GNU unified diffs, and ordinary Git mail signatures. It composes the accepted coverage-option and raw Git acquisition changes from main. Diff structure validation does not assert that a patch applies to the current working tree.

Verification

• Original baseline: 20 failing cases and 4 positive controls; an actual malformed-input run produced a passing report although Git refused the patch.
• Composition on cec50d8df4499ba509615e179d82ef3861379bd2: 54 tests passed, 1 skipped, and 7 subtests passed across hunk validation, coverage options, and Git acquisition.
• Independent receiving: all 11 frozen real Git/GNU fixtures and all 4 malformed CLI cases passed. Earlier mail-signature and model-initialization-order failures remain alongside their repaired results.
• Versioned native console: a valid diff completed local ScriptedModel generation and actual pytest successfully; damaged input returned exit 2 before model configuration or output writes. Independent installed-console checks passed, with all 11 installed source files matching source commit 40860534.
• Root review found inherited Git variables could redirect the new test fixtures outside their temporary directories. The final test-only correction isolates Git environment/configuration; all 44 hunk cases pass. The same private Git-directory/worktree and external-index sentinels fail on the original tests and pass on the correction, preserving every sentinel byte.
• An intermediate full suite recorded 410 passed, 4 skipped, 18 subtests passed, and one existing deadline-startup failure. The identical deadline fixture and sandbox code subsequently passed a controlled replay on both the original baseline and final composition. The original failure is retained; that full run is not represented as green.

Source and receiving

Only testpilot/diff.py and testpilot/__main__.py change among existing production files. Dedicated regression tests, source-bound negative evidence, independent review, fixture-containment receipts, exact source custody, and installed-console receipts are retained under docs/receiving/diff-hunks-6cc6795e89f4/ and docs/receiving/git-compat-6cc6795e89f4/.

Hosted checks remain the final shared-source integration gate. No external model provider was called during native receiving.

Canonical source: c7b593ea652dd6b572d0f1076c839d155e0f4599, exact tree 11405f150fbfe31602dec709fadc5fdfd4438dc8. This complete tree matches native source/evidence head 156664881ea0536f36cfda1cdad15d181e88a2a3 byte for byte.