Related reading: A Flaky Test Is a Corrupted Reward Signal names the false red; this post names the false green. Tamper-Resistant Test Design Is What the Suite Now Owes the Codebase names the design property against the system under test’s author; this post applies the same property against the tooling. World-Building Is the Test Discipline Agents Need names the oracle shape the refactor move points at.
Self-healing is the test suite’s alarm, muted by subscription.
Across the 2026 round-ups the healing-engine category sells the same product. A test drifted. The CSS class was renamed, the div was moved, the automation framework lost its grip on the element it used to click. The engine finds the visually similar element, patches the locator at runtime, and the bar stays green. The reviewer thanks the vendor for a happier suite. The subscription auto-renews. The dashboard reports fewer broken tests this quarter than last.
Strip the branding and the pitch has one empirical shape: the test passed after the application changed. The healing engine cannot tell a class rename from a Save-to-Update-to-Submit rewrite. It picks the visually similar element because that is what it was built to do. Sometimes the visually similar element is the one the author intended. Sometimes it is a button on a different flow with a comparable glyph. In both cases, the suite now reports green on behavior nobody wrote a test for.
The Vendor Pitch Is a Passing Test After a Behavior Change
Read the category’s marketing without reading the branding and the sentence resolves. Behavior changed. The test passed anyway. That is sold as a feature. In every other context in software, a passing test after an unreviewed behavior change is the exact failure mode the discipline was built to prevent. The suite’s one job is to turn red when the system drifts from the specification. The healing engine’s one job is to prevent that red.
The failure is not that the engine is naive. The current generation reasons about accessibility trees, cross-checks attributes, and emits healing logs the reviewer can audit. The failure is that the oracle was never behavior in the first place. The test asserted that an element called .checkout-btn-v2 was present and clickable. The engine kept the assertion satisfied by finding something button-shaped near where the element used to be. Neither the test nor the engine knows what the button was supposed to do. The green bar certifies a locator match. The reviewer reads it as a certified behavior.
The green bar certifies a locator match. The reviewer reads it as a behavior. That is the whole misunderstanding.
The Flaky-Test Post Named the False Red. This Is the False Green.
The flaky-test argument named one axis of corrupted signal. A test that fails on Tuesday and passes on Wednesday injects random noise into the reward signal. The agent, having no folklore filter, treats every red as a defect and starts changing correct code to make the noise go away. Determinism was the first-order fix.
Self-healing is the same corruption, inverted. The flaky test produces a red the signal does not deserve. The self-healing test produces a green the signal does not deserve. The failure axis is identical: the bar no longer carries the information it was designed to carry. The direction is opposite. The party silencing the alarm is different.
In the flaky-test case, the system under test’s own non-determinism silenced the alarm. In the self-healing case, a third party outside the suite silences the alarm on the reviewer’s behalf, as a monthly line item. The mechanism is the same. The invoice is new.
Determinism was the price of letting the loop run unattended on red. The same discipline on green asks a different question. Who is allowed to decide this test still passes? The honest answer is the author of the oracle, and no one else.
A False Green Is More Dangerous Than a False Red
Humans filter reds. Nobody filters greens.
A team that has lived with a flaky integration suite builds a folklore around it. “Re-run that one.” “Ignore it on Fridays.” “The timeouts here are optimistic, retry.” The folklore is a bug by any serious measure, and it is also a damping function. A red the team believes is noise never reaches the fix queue. The suite over-reports failure and the team under-reacts to it. The net result is noisy, and survivable.
Greens do not get folklore. The green bar is read as permission to ship. A passing suite is treated as evidence that the specification holds, because the whole point of the suite is to produce that evidence. A reviewer looking at a merged PR with a green bar does not re-run the suite. The reviewer does not ask whether the bar is honest. The bar is the terminal state.
A healed green is a bar that the reviewer did not earn and did not audit. The healing engine made it happen. The healing log sat in a dashboard the reviewer did not open. The suite reported green on a locator that bound to a different element than the one the author named. Nothing in the review process was built to catch that, because nothing in the review process was asked to.
A false red costs the team an hour. A false green costs the team the specification.
Cosmetic Drift Is Real. The Fix Lives in the Oracle.
Concede the honest counterexample. UIs move. CSS classes get renamed when the design system refactors. Divs shift position when the frontend framework upgrades. The team that ships weekly ships cosmetic drift weekly, and a suite full of selector-bound tests breaks weekly on changes that are not behavior changes. The pain the vendor describes is real pain. The vendor is correct about the symptom.
The vendor is wrong about where the fix belongs.
A test whose oracle was .checkout-btn-v2 was never a test of behavior. It was a test of a rendered attribute the framework happened to expose at this release. The attribute is a presentation detail. The behaviors the team actually cares about are the receipt totalling to the right number, the discount applying to the right customer, the cart surviving a refresh. None of those behaviors have a rendering-time dependency to break. A test asserting on receipt.Total.Should().Be(54.dollars()) does not need healing because it has nothing to heal.
[Fact]
public void Loyalty_members_get_a_ten_percent_discount_on_qualifying_orders()
{
var world = aCartReadyForCheckout()
.withCustomer(aLoyaltyMember())
.containing(aBookCosting(60.dollars()));
var receipt = checkout.Process(world.Order);
receipt.Discount.Should().Be(6.dollars());
receipt.Total.Should().Be(54.dollars());
receipt.Should().Satisfy(sumOfLineTotalsEqualsSubtotal());
}Nothing in that test can drift when a button moves. Nothing in that test needs a healing engine to patch a selector. The oracle is the composed receipt in the domain the team owns. The redesign that renames every CSS class in the application does not touch a single assertion in the suite. The redesign that changes the discount from ten percent to fifteen flips the suite red, because the suite was asserting on behavior.
The locator-bound sibling of that test is the one the healing engine was invented for. The two tests look superficially similar in a demo. They are not the same test. One is a receipt for a behavior. The other is a receipt for a rendering decision. Only one is worth paying a subscription to keep green.
Fix the oracle. The locator stops needing a sponsor.
A Healed Green Is Tampering, at the Vendor’s Cost Center
Tamper-resistant test design named the general property. A test whose author can silence its own alarm is a test whose green bar does not mean what it says. The design response was structural: redundant assertions, separation of authorship, verifiers on infrastructure the system under test’s author cannot edit.
Self-healing generalizes the failure to a party the earlier post did not name. The party silencing the alarm does not have to be the agent that wrote the code. It can be a vendor on subscription, operating a runtime that rewrites the test’s binding mid-run, on the reviewer’s behalf, in return for a line item on the quarterly bill. The alarm is still silenced. The suite’s passing state is still manipulated by someone outside the oracle’s chain of authorship. The reviewer is still certifying a bar whose provenance now sits partly outside the team.
Call that what it is. A suite whose green state can be moved by an actor outside the codebase is a suite the team no longer owns the verdict of. The verdict’s authoring has been subcontracted. The subcontractor is paid to keep the verdict favorable. The incentive gradient on the subcontractor’s side does not match the incentive gradient on the team’s side.
A healed green is cheaper than a refactored oracle for this sprint. A healed green is more expensive than a refactored oracle for every sprint after. The subscription is the churn, capitalized. The refactor pays it down.
Vendors Are Right About the Symptom. They Are Wrong About Where the Fix Belongs.
The honest shape of the argument is not that the category is a scam. The category exists because the pain is real. Selector churn is a weekly expense on any team shipping to a frontend of nontrivial complexity. The engines are more sophisticated than the naive patchers that preceded them, and the healing log, when actually read, catches a nontrivial fraction of mismatched heals. The false-green rate is lower than the critique would suggest for a team that audits every heal.
Few teams audit every heal. That is the workflow failure the vendor pricing is quietly built on. The subscription is cheap exactly because the audit does not happen. If the audit happened, the healing engine would be a complicated way to pay for a problem the team could solve with a refactor pass.
The refactor pass is unglamorous and finite. Walk the suite. Identify tests whose oracle is a selector, a locator, or a visible element identifier. Rewrite them to assert on domain state the team owns in named vocabulary. The world-building discipline named the shape of that vocabulary: aCartReadyForCheckout(), aLoyaltyMemberWithExpiredCard(), assertions on composed domain objects. A suite rewritten against that oracle does not churn on frontend redesigns, because the frontend redesign does not touch the oracle. The healing subscription becomes a line item the team can cancel.
A read of the healing log over a sprint is the metric worth taking. Count the heals the engine performed. Count how many changed which element the test bound to. Compare that count against the behavior changes the team actually shipped in the same window. The ratio is a number the team can defend or cannot. A team that cannot defend the ratio is a team paying a vendor to keep a suite green on the vendor’s judgment, not the team’s.
The prose spec is a claim. The test is a receipt. Production is the verdict. A healed test is a receipt the vendor forged on the team’s behalf. The verdict is still waiting in production, where the receipt the team thought it had is not the receipt the system was actually asked to honor.
Self-healing is the test suite’s alarm, muted by subscription. The honest version of what the vendor sells is a refactor the team can do once and own forever. The suite that pays to keep the alarm quiet is a suite that will find out, in production, what the alarm was trying to say.