Tests: internal/infra/pg

internal/infra/pg · 291 tests

Each test is named for the property it holds, and runs against a real deployment: there is no mock of the database and no arm that skips when it is absent. The sentence is the test's name read back; the name is what go test -run takes.

anchorlayout_qualification_test.go

• Anchor layout operating envelope — TestAnchorLayoutOperatingEnvelope

anchorlimits_test.go

• Direct anchor callers cannot bypass parameter limits — TestDirectAnchorCallersCannotBypassParameterLimits
• Anchor match overflow refuses instead of returning an arbitrary slice — TestAnchorMatchOverflowRefusesInsteadOfReturningAnArbitrarySlice
• Canonical duplicates and subject attribution preserve exact matches — TestCanonicalDuplicatesAndSubjectAttributionPreserveExactMatches

anchorplans_test.go

• Anchor query plans — TestAnchorQueryPlans. These are reproducible plan diagnostics, not production latency benchmarks.

artifactcontent_test.go

• Artifact content requires canonical base 64 and preserves empty bytes — TestArtifactContentRequiresCanonicalBase64AndPreservesEmptyBytes
• Artifact sources cannot change owner or enter formation — TestArtifactSourcesCannotChangeOwnerOrEnterFormation

artifacterasure_test.go

• Artifact overwrite racing erasure cannot retain deleted bytes or quota — TestArtifactOverwriteRacingErasureCannotRetainDeletedBytesOrQuota

artifactfailure_test.go

• Artifact invalid inputs are refused before storage — TestArtifactInvalidInputsAreRefusedBeforeStorage
• Artifact storage failures rollback payload registration quota and audit — TestArtifactStorageFailuresRollbackPayloadRegistrationQuotaAndAudit
• Failed artifact overwrite delete and policy audit preserve accepted state — TestFailedArtifactOverwriteDeleteAndPolicyAuditPreserveAcceptedState
• Artifact policy bounds missing projects and database failures are explicit — TestArtifactPolicyBoundsMissingProjectsAndDatabaseFailuresAreExplicit

artifactprivileges_test.go

• Runtime artifact writes use quota without receiving quota administration — TestRuntimeArtifactWritesUseQuotaWithoutReceivingQuotaAdministration

artifactstore_test.go

• Agent artifacts round trip opaque bytes and erase through the projection registry — TestAgentArtifactsRoundTripOpaqueBytesAndEraseThroughTheProjectionRegistry
• Agent artifact versions prevent lost updates and retain only current bytes — TestAgentArtifactVersionsPreventLostUpdatesAndRetainOnlyCurrentBytes
• Concurrent artifact creates and quota reservations are atomic — TestConcurrentArtifactCreatesAndQuotaReservationsAreAtomic
• Artifact expiry and policy reduction do not extend or strand stored objects — TestArtifactExpiryAndPolicyReductionDoNotExtendOrStrandStoredObjects
• Artifact pages stay bounded and scoped when cursor rows disappear — TestArtifactPagesStayBoundedAndScopedWhenCursorRowsDisappear

auditactivity_test.go

• The ledger is counted by window bucket operation and project — TestTheLedgerIsCountedByWindowBucketOperationAndProject. The console's activity is the ledger counted, and counted exactly: this window against the one of the same length before it, cut into buckets aligned to the window's start, by operation busiest first and by project busiest first — and narrowed to one project when asked, with the instance's own operations kept out of the project ranking.

auditseal_test.go

• A seal waits for an entry still being written — TestASealWaitsForAnEntryStillBeingWritten. A seal covers only what is final.

chunkrecovery_test.go

• Chunk recovery preserves message identity across pages and erasure — TestChunkRecoveryPreservesMessageIdentityAcrossPagesAndErasure
• Chunk recovery refuses conflicts and rolls back the whole page — TestChunkRecoveryRefusesConflictsAndRollsBackTheWholePage
• Concurrent chunk recovery preserves embeddings and serializes erasure — TestConcurrentChunkRecoveryPreservesEmbeddingsAndSerializesErasure

citationstore_test.go

• Citation preserves exact message bytes and survives supersession — TestCitationPreservesExactMessageBytesAndSurvivesSupersession
• Citation pagination is bounded and does not lose supporting spans — TestCitationPaginationIsBoundedAndDoesNotLoseSupportingSpans
• Citation refuses invalid pages and corrupt or oversized sources — TestCitationRefusesInvalidPagesAndCorruptOrOversizedSources
• Citation rejects broken message links and UTF 8 spans — TestCitationRejectsBrokenMessageLinksAndUTF8Spans
• Citation cursor retains multiple spans from one message — TestCitationCursorRetainsMultipleSpansFromOneMessage

claimreplay_test.go

• Concurrent source claim replay preserves identity version and evidence — TestConcurrentSourceClaimReplayPreservesIdentityVersionAndEvidence

connectionslots_test.go

• Connection exhaustion is recognised from the code and from the connect error — TestConnectionExhaustionIsRecognisedFromTheCodeAndFromTheConnectError. ── Connection exhaustion is recognised two ways ────────────────────────────────────────────── The condition arrives two ways and both have to be recognised.

correctionrefusal_test.go

• Correction input bounds and historical targets never mutate — TestCorrectionInputBoundsAndHistoricalTargetsNeverMutate
• Curated replay refuses changed identity without writing — TestCuratedReplayRefusesChangedIdentityWithoutWriting

correctionsource_test.go

• Original source expiry preserves independently authored correction — TestOriginalSourceExpiryPreservesIndependentlyAuthoredCorrection

embedding_live_test.go

• Configured embedding provider persists and retrieves its actual dimensions — TestConfiguredEmbeddingProviderPersistsAndRetrievesItsActualDimensions. The actual configured provider establishes the dimension; PostgreSQL must retain every coordinate and find the exact source under both retrieval modes.
• Configured embedding provider persists entity candidates at actual dimensions — TestConfiguredEmbeddingProviderPersistsEntityCandidatesAtActualDimensions. Entity inputs occupy a distinct generation identity and still use the configured provider's real vector width.
• Configured embedding provider persists report themes at actual dimensions — TestConfiguredEmbeddingProviderPersistsReportThemesAtActualDimensions. Community reports are the third model space.

embeddingbuild_test.go

• Embedding build resumes repairs and does not resurrect erased sources — TestEmbeddingBuildResumesRepairsAndDoesNotResurrectErasedSources
• Embedding build cancellation fences in flight results — TestEmbeddingBuildCancellationFencesInFlightResults

embeddingcatchup_test.go

• Catch up embeddings extends finite coverage without repeating old inputs — TestCatchUpEmbeddingsExtendsFiniteCoverageWithoutRepeatingOldInputs
• Catch up embeddings fences provider failures erasure and activation — TestCatchUpEmbeddingsFencesProviderFailuresErasureAndActivation
• Catch up embeddings refuses invalid and unverified coverage — TestCatchUpEmbeddingsRefusesInvalidAndUnverifiedCoverage
• Catch up embeddings advances past expired and non message sources — TestCatchUpEmbeddingsAdvancesPastExpiredAndNonMessageSources

embeddingcutover_test.go

• Embedding cutover checks coverage and pruning refuses renamed storage — TestEmbeddingCutoverChecksCoverageAndPruningRefusesRenamedStorage
• Embedding pages respect the combined UTF 8 byte budget — TestEmbeddingPagesRespectTheCombinedUTF8ByteBudget

embeddingfailure_test.go

• Embedding page database failures never publish partial state or strand the worker lock — TestEmbeddingPageDatabaseFailuresNeverPublishPartialStateOrStrandTheWorkerLock
• Embedding allocation failure is atomic at every storage boundary — TestEmbeddingAllocationFailureIsAtomicAtEveryStorageBoundary
• Embedding policy failures preserve the active generation — TestEmbeddingPolicyFailuresPreserveTheActiveGeneration

embeddinggeneration_test.go

• Embedding generations preserve identity and require explicit cutover — TestEmbeddingGenerationsPreserveIdentityAndRequireExplicitCutover

embeddingownership_test.go

• All embedding generations are exported and removed by source retention — TestAllEmbeddingGenerationsAreExportedAndRemovedBySourceRetention

embeddingpartition_test.go

• Generation index is directly owned by its child partition — TestGenerationIndexIsDirectlyOwnedByItsChildPartition

embeddingrefusal_test.go

• Embedding boundaries refuse invalid models identifiers and search work — TestEmbeddingBoundariesRefuseInvalidModelsIdentifiersAndSearchWork
• Embedding build refuses provider failures changed sources and conflicting chunks — TestEmbeddingBuildRefusesProviderFailuresChangedSourcesAndConflictingChunks
• Embedding build does not send oversized or blank sources to the provider — TestEmbeddingBuildDoesNotSendOversizedOrBlankSourcesToTheProvider

embeddingsearch_test.go

• Message embedding search uses current sources and explicit model identity — TestMessageEmbeddingSearchUsesCurrentSourcesAndExplicitModelIdentity
• The vector search prunes to one partition and uses its index — TestTheVectorSearchPrunesToOnePartitionAndUsesItsIndex. This is an index eligibility and partition-pruning proof, not a latency or recall claim.
• Embedding generation audit failure rolls back its partition index and metadata — TestEmbeddingGenerationAuditFailureRollsBackItsPartitionIndexAndMetadata

entityembedding_test.go

• Entity embedding candidates are source owned and rebuild after erasure — TestEntityEmbeddingCandidatesAreSourceOwnedAndRebuildAfterErasure
• Entity embedding generation separates model space and refuses changed input — TestEntityEmbeddingGenerationSeparatesModelSpaceAndRefusesChangedInput
• Entity embedding retention invalidates aggregate and lifecycle remains bounded — TestEntityEmbeddingRetentionInvalidatesAggregateAndLifecycleRemainsBounded
• Entity embedding generation becomes stale when named entity is created — TestEntityEmbeddingGenerationBecomesStaleWhenNamedEntityIsCreated
• Entity embedding lifecycle refuses invalid and incompatible operations — TestEntityEmbeddingLifecycleRefusesInvalidAndIncompatibleOperations
• Entity embedding publication refuses lost sources and incompatible stored input — TestEntityEmbeddingPublicationRefusesLostSourcesAndIncompatibleStoredInput

entityembeddingfailure_test.go

• Entity embedding allocation rolls back at every storage boundary — TestEntityEmbeddingAllocationRollsBackAtEveryStorageBoundary
• Entity embedding page failures rollback and release the worker lock — TestEntityEmbeddingPageFailuresRollbackAndReleaseTheWorkerLock
• Entity embedding policy failures preserve active and candidate generations — TestEntityEmbeddingPolicyFailuresPreserveActiveAndCandidateGenerations

entityinspection_test.go

• Entity inventory bounds previews and keeps cursor after deletion — TestEntityInventoryBoundsPreviewsAndKeepsCursorAfterDeletion
• Entity inventory uses project identity index — TestEntityInventoryUsesProjectIdentityIndex
• Entity inspection keeps shared identity and only surviving variants — TestEntityInspectionKeepsSharedIdentityAndOnlySurvivingVariants

entitynames_test.go

• Entity name ownership survives sharing and erases only departing variants — TestEntityNameOwnershipSurvivesSharingAndErasesOnlyDepartingVariants
• Entity name cache repair is reported and expiry removes variants — TestEntityNameCacheRepairIsReportedAndExpiryRemovesVariants

entitynamesfailure_test.go

• Entity name variants are concurrent bounded and transactional — TestEntityNameVariantsAreConcurrentBoundedAndTransactional
• Entity name receipt rejects foreign identity and rolls back storage failure — TestEntityNameReceiptRejectsForeignIdentityAndRollsBackStorageFailure

entityrecovery_test.go

• Recovery refuses conflicting entity identity without partial writes — TestRecoveryRefusesConflictingEntityIdentityWithoutPartialWrites

entityrecoveryfailure_test.go

• Recovery validates receipt endpoint before restoring identity — TestRecoveryValidatesReceiptEndpointBeforeRestoringIdentity
• Recovery preserves compatible shared entity and existing aliases — TestRecoveryPreservesCompatibleSharedEntityAndExistingAliases

erasure_test.go

• Everything derived from a subject is erased with a residual of zero — TestEverythingDerivedFromASubjectIsErasedWithAResidualOfZero. ── Everything derived from a subject's observations goes ───────────────────────────────────── Everything derived from a subject's observations goes, and the residual is counted against the same predicate in the same transaction.
• A projection kind that is not declared cannot be registered — TestAProjectionKindThatIsNotDeclaredCannotBeRegistered. ── An undeclared projection kind cannot be registered ──────────────────────────────────────── A projection kind that has not been declared cannot be registered at all.
• Every declared projection kind names a table that exists — TestEveryDeclaredProjectionKindNamesATableThatExists. Every declaration names a table and column that exist.
• A projection shared with another subject is kept and is not a residual — TestAProjectionSharedWithAnotherSubjectIsKeptAndIsNotAResidual. ── A projection shared with another subject is kept ────────────────────────────────────────── A projection somebody else also produced is kept, and keeping it is not a residual.
• The receipt is a row carrying its residual — TestTheReceiptIsARowCarryingItsResidual. The receipt is a row, with its residual, findable by asking.
• An erasure with no subject is refused — TestAnErasureWithNoSubjectIsRefused. An erasure with no subject is refused.
• An export without a subject is refused before it reads anything — TestAnExportWithoutASubjectIsRefusedBeforeItReadsAnything. An export of a subject who was never here is refused only for having no subject, never for having nothing — and one with no subject at all is refused before it reads anything.
• An export is internally consistent — TestAnExportIsInternallyConsistent. The export reads at one instant, so its sections cannot disagree with each other.
• An expired turn takes its projections with it — TestAnExpiredTurnTakesItsProjectionsWithIt. An expired turn takes its projections with it, and the sweep reports what went.
• A project with no policy keeps everything — TestAProjectWithNoPolicyKeepsEverything. A project with no retention policy keeps everything, and a sweep over it finds nothing.
• Shortening a policy does not expire what is already held — TestShorteningAPolicyDoesNotExpireWhatIsAlreadyHeld. Shortening a policy does not reach back.
• A sweep is bounded — TestASweepIsBounded. A sweep takes at most what it was asked for, so a large expiry does not become one enormous transaction that holds locks across every project on the instance.
• The audit store refuses an uncountable entry — TestTheAuditStoreRefusesAnUncountableEntry. The ledger refuses an entry it cannot count, and the refusal reaches the caller rather than being swallowed by the store.
• A kind that aggregates text is not saved by being shared — TestAKindThatAggregatesTextIsNotSavedByBeingShared. The rule that keeps a shared entity is right for an identity and wrong for anything holding several people's words.
• A kind that does not say is treated as holding text — TestAKindThatDoesNotSayIsTreatedAsHoldingText. The default is the safe one.
• A document observed without a subject is erased by its sources with a residual of zero — TestADocumentObservedWithoutASubjectIsErasedByItsSourcesWithAResidualOfZero
• An erasure by source cannot reach another project and refuses what is not an id — TestAnErasureBySourceCannotReachAnotherProjectAndRefusesWhatIsNotAnId. An observation id from another project matches nothing: the predicate is scoped before it is keyed, so the caller's credential reaches its own project and no other, and the receipt says so by deleting nothing rather than by reaching across.
• Evidence names only its own turn so the erasure guard catches nothing — TestEvidenceNamesOnlyItsOwnTurnSoTheErasureGuardCatchesNothing. Every quote names its own turn, so the erasure walk's evidence guard catches nothing.
• An export can be taken by the turns it is for — TestAnExportCanBeTakenByTheTurnsItIsFor. An export can be taken by source, the way an erasure can: a document observed project-wide has no person, so a subject was no way to reach it and neither was an export.
• An export beyond its ceiling is refused rather than truncated — TestAnExportBeyondItsCeilingIsRefusedRatherThanTruncated. An export is one answer at one instant, so it is bounded rather than paged: past the ceiling it is refused, and the caller takes those turns by source.

extractionpin_test.go

• Extraction pins serialize conflicting versions and cascade with sources — TestExtractionPinsSerializeConflictingVersionsAndCascadeWithSources
• Lost extraction pin cannot relabel surviving evidence or receipts — TestLostExtractionPinCannotRelabelSurvivingEvidenceOrReceipts

extractionpinfailure_test.go

• Extraction pin failures refuse writes without partial state — TestExtractionPinFailuresRefuseWritesWithoutPartialState

extractionpinreadfailure_test.go

• Extraction pin cannot be invented when surviving output cannot be checked — TestExtractionPinCannotBeInventedWhenSurvivingOutputCannotBeChecked

factexpiry_test.go

• An expired turn stops answering before it is swept — TestAnExpiredTurnStopsAnsweringBeforeItIsSwept. Expired memory stops answering when the policy says it does, not when the sweep reaches it.
• Two turns saying the same thing expire separately — TestTwoTurnsSayingTheSameThingExpireSeparately. A fact's identity includes the turn it came from, so the same words in two turns are two facts, each keeping the deadline of its own turn.

factgeneration_test.go

• Generation cutover preserves old citations and publishes new identities — TestGenerationCutoverPreservesOldCitationsAndPublishesNewIdentities
• Generation refuses changed sources and rolls back publication failure — TestGenerationRefusesChangedSourcesAndRollsBackPublicationFailure
• Generation advances lineage for a second interpretation — TestGenerationAdvancesLineageForASecondInterpretation
• Generation refuses a second current value and keeps the rest — TestGenerationRefusesASecondCurrentValueAndKeepsTheRest. A generation whose plan carries two current values for one single-cardinality relation admits the first and refuses the second, instead of aborting the whole generation on the constraint.

facthistory_test.go

• Earlier knowledge retains its original validity — TestEarlierKnowledgeRetainsItsOriginalValidity
• Failed supersession rolls back history and known time — TestFailedSupersessionRollsBackHistoryAndKnownTime
• Erasing only the supersession cause invalidates derived validity — TestErasingOnlyTheSupersessionCauseInvalidatesDerivedValidity
• Historical lookup uses fact range index — TestHistoricalLookupUsesFactRangeIndex
• Concurrent supersession commits one coherent knowledge transition — TestConcurrentSupersessionCommitsOneCoherentKnowledgeTransition
• Retention removes temporal state derived from expired cause — TestRetentionRemovesTemporalStateDerivedFromExpiredCause
• Citation reports recorded successor and cause — TestCitationReportsRecordedSuccessorAndCause
• Supersession racing cause erasure cannot retain its closing date — TestSupersessionRacingCauseErasureCannotRetainItsClosingDate

factreceipt_test.go

• Receipt recovery preserves citations temporal history and human edits — TestReceiptRecoveryPreservesCitationsTemporalHistoryAndHumanEdits
• Receipt recovery pages are atomic scoped and safe to retry — TestReceiptRecoveryPagesAreAtomicScopedAndSafeToRetry

factreceiptfailure_test.go

• Recovery storage failures never commit partial memory — TestRecoveryStorageFailuresNeverCommitPartialMemory
• Recovery rejects damaged receipts and unregistered admission — TestRecoveryRejectsDamagedReceiptsAndUnregisteredAdmission
• Recovery racing erasure cannot retain deleted sources — TestRecoveryRacingErasureCannotRetainDeletedSources
• Receipt erasure also removes knowledge depending on another subject — TestReceiptErasureAlsoRemovesKnowledgeDependingOnAnotherSubject

factsupportconcurrency_test.go

• Concurrent support repair and retraction preserve the human withdrawal — TestConcurrentSupportRepairAndRetractionPreserveTheHumanWithdrawal
• Concurrent support repair cannot recreate erased memory — TestConcurrentSupportRepairCannotRecreateErasedMemory

factsupportrecovery_test.go

• Recovery repairs missing evidence and history without replacing retained facts — TestRecoveryRepairsMissingEvidenceAndHistoryWithoutReplacingRetainedFacts
• Support recovery preserves withdrawals and does nothing on a repeated page — TestSupportRecoveryPreservesWithdrawalsAndDoesNothingOnARepeatedPage
• Support recovery never rewrites conflicting evidence or ownership — TestSupportRecoveryNeverRewritesConflictingEvidenceOrOwnership
• Support recovery failures roll back the entire page — TestSupportRecoveryFailuresRollBackTheEntirePage

feedbackplans_test.go

• Feedback pages seek indexes rather than scanning the queue — TestFeedbackPagesSeekIndexesRatherThanScanningTheQueue. The queue is read by seeking an index, not by scanning the table.

feedbackstore_test.go

• Recording feedback changes no fact and no recall — TestRecordingFeedbackChangesNoFactAndNoRecall. The property the whole feature exists for.
• Promoting feedback with a proposed object produces the correction — TestPromotingFeedbackWithAProposedObjectProducesTheCorrection. A proposed object makes the promotion a correction, and it must be the same correction a caller could have written by hand: the same withdrawal, the same curated authorship, the same boundary.
• Promoting feedback without a proposed object produces the retraction — TestPromotingFeedbackWithoutAProposedObjectProducesTheRetraction. No proposed object means "this should not be here", and the promotion withdraws without replacing.
• One feedback is promoted once even when two promotions race — TestOneFeedbackIsPromotedOnceEvenWhenTwoPromotionsRace. Promoting twice would withdraw a record nobody disputed.
• Promotion against a stale record version is refused — TestPromotionAgainstAStaleRecordVersionIsRefused. The record moves between reading it and promoting the feedback about it.
• Feedback refuses what it cannot store — TestFeedbackRefusesWhatItCannotStore. Every refusal the writer can produce, named.
• Feedback list pages narrows and refuses an unusable page — TestFeedbackListPagesNarrowsAndRefusesAnUnusablePage. The queue is paged, narrowed and bounded.
• Erasing the subject of a record removes the feedback about it — TestErasingTheSubjectOfARecordRemovesTheFeedbackAboutIt. Erasure reaches feedback through the registry, and the residual is what proves it.
• Feedback on a shared record goes even though the record stays — TestFeedbackOnASharedRecordGoesEvenThoughTheRecordStays. A record two people contributed to survives one of them leaving.
• Promotion is refused when the proposed object would pass the entity name bound — TestPromotionIsRefusedWhenTheProposedObjectWouldPassTheEntityNameBound. A bound the feedback writer cannot see.
• Feedback writes roll back completely when any part of them fails — TestFeedbackWritesRollBackCompletelyWhenAnyPartOfThemFails. Every write in the feedback store is one transaction, so a failure anywhere in it leaves nothing: no report, no registration, no ledger row.

formationrecovery_test.go

• Parked pages are bounded project scoped and never contain provider text — TestParkedPagesAreBoundedProjectScopedAndNeverContainProviderText
• Operator recovery is scoped audited and concurrent retries change one turn — TestOperatorRecoveryIsScopedAuditedAndConcurrentRetriesChangeOneTurn
• Operator recovery rolls back when its audit cannot be recorded — TestOperatorRecoveryRollsBackWhenItsAuditCannotBeRecorded

generationfailure_test.go

• Generation publication failures leave every projection unchanged — TestGenerationPublicationFailuresLeaveEveryProjectionUnchanged. Fail writes at different publication stages, including after retirement and after the new interpretation exists.
• Concurrent generation cutovers have one publication — TestConcurrentGenerationCutoversHaveOnePublication

generationrecovery_test.go

• Generation retires missing facts before receipt recovery can revive them — TestGenerationRetiresMissingFactsBeforeReceiptRecoveryCanReviveThem
• Generation refuses damaged recovery receipts without publishing — TestGenerationRefusesDamagedRecoveryReceiptsWithoutPublishing

generationtemporal_test.go

• Generation cannot step around a human correction by changing the object — TestGenerationCannotStepAroundAHumanCorrectionByChangingTheObject
• Generation bounds an earlier fact at a later human assertion and keeps its cause — TestGenerationBoundsAnEarlierFactAtALaterHumanAssertionAndKeepsItsCause
• Generation export and erasure include lineage without changing other subjects — TestGenerationExportAndErasureIncludeLineageWithoutChangingOtherSubjects
• Generation requests are bounded and published results can be looked up — TestGenerationRequestsAreBoundedAndPublishedResultsCanBeLookedUp
• Generation source rejects authoritative and oversized input — TestGenerationSourceRejectsAuthoritativeAndOversizedInput
• Generation message time uses source and ingested fallbacks — TestGenerationMessageTimeUsesSourceAndIngestedFallbacks
• Generation validates claims and preserves message role policy — TestGenerationValidatesClaimsAndPreservesMessageRolePolicy
• Generation records unbound relative speaker as rejected — TestGenerationRecordsUnboundRelativeSpeakerAsRejected
• Generation refuses more than bounded prior facts — TestGenerationRefusesMoreThanBoundedPriorFacts

ingestionbudget_test.go

• Backlog capacity survives parking and releases on formation or erasure — TestBacklogCapacitySurvivesParkingAndReleasesOnFormationOrErasure
• Concurrent writers cannot oversubscribe durable capacity — TestConcurrentWritersCannotOversubscribeDurableCapacity
• A stale repeatable read snapshot cannot oversubscribe capacity — TestAStaleRepeatableReadSnapshotCannotOversubscribeCapacity
• Retention releases capacity held by parked observations — TestRetentionReleasesCapacityHeldByParkedObservations
• Deferred reservations use the final observation state — TestDeferredReservationsUseTheFinalObservationState
• Inconsistent quota counters refuse erasure without partial data loss — TestInconsistentQuotaCountersRefuseErasureWithoutPartialDataLoss

ingestionprivileges_test.go

• Runtime writes use reservations without permission to forge them — TestRuntimeWritesUseReservationsWithoutPermissionToForgeThem

integrityrollback_test.go

• Failed report registration rolls back the generated row — TestFailedReportRegistrationRollsBackTheGeneratedRow
• Evidence delete failure rolls back erasure and retention — TestEvidenceDeleteFailureRollsBackErasureAndRetention

knowledgeclock_test.go

• Supersession after clock rollback preserves ordered knowledge — TestSupersessionAfterClockRollbackPreservesOrderedKnowledge. Move the retained knowledge stamp ahead of wall time rather than changing the machine's clock.

messagewindow_test.go

• Message reference survives projection loss and has an unambiguous index — TestMessageReferenceSurvivesProjectionLossAndHasAnUnambiguousIndex. The saved UUID belongs to the source, not the losable chunk projection.

observationadmission_test.go

• Direct observation callers cannot bypass message admission — TestDirectObservationCallersCannotBypassMessageAdmission
• Concurrent store retries remain atomic without the HTTP gate — TestConcurrentStoreRetriesRemainAtomicWithoutTheHTTPGate

operationalhealth_test.go

• Operational health separates required formation and never returns memory — TestOperationalHealthSeparatesRequiredFormationAndNeverReturnsMemory

purgedentityrecovery_test.go

• A purged entity is not brought back by fact recovery — TestAPurgedEntityIsNotBroughtBackByFactRecovery. A purge withdraws a node the extractor got wrong, and the claims standing on it go with it.
• A purge that left something behind does not report itself clean — TestAPurgeThatLeftSomethingBehindDoesNotReportItselfClean. A purge that left something behind does not report itself clean.

rebuildjob_test.go

• Project rebuild fences a replaced runner at publication — TestProjectRebuildFencesAReplacedRunnerAtPublication
• Project rebuild cancellation settles an orphaned checkpoint — TestProjectRebuildCancellationSettlesAnOrphanedCheckpoint
• Project rebuild refuses a connection pool that would deadlock — TestProjectRebuildRefusesAConnectionPoolThatWouldDeadlock
• Project rebuild control writes require their audit — TestProjectRebuildControlWritesRequireTheirAudit
• Project rebuild metadata is project scoped and references are validated — TestProjectRebuildMetadataIsProjectScopedAndReferencesAreValidated

rebuildjobfinish_test.go

• Orphaned project cancellation finishes published source bookkeeping — TestOrphanedProjectCancellationFinishesPublishedSourceBookkeeping
• Orphaned cancellation rolls back freshness when its audit fails — TestOrphanedCancellationRollsBackFreshnessWhenItsAuditFails
• Orphaned cancellation and erasure serialize without reviving memory — TestOrphanedCancellationAndErasureSerializeWithoutRevivingMemory

rebuildstaleness_test.go

• A rebuild says what it left behind and says nothing when it left nothing — TestARebuildSaysWhatItLeftBehindAndSaysNothingWhenItLeftNothing. ── A rebuild says what it left behind ──────────────────────────────────────────────────────── A rebuild publishes a new interpretation and finishes.
• A staleness read that cannot count refuses rather than reporting none — TestAStalenessReadThatCannotCountRefusesRatherThanReportingNone. When a table it counts is gone, the staleness read fails rather than reporting zero.

rebuildvisibility_test.go

• Freshness reports an active rebuild and nothing before or after it — TestFreshnessReportsAnActiveRebuildAndNothingBeforeOrAfterIt. A project being reinterpreted answers from two extractors at once, and freshness is where a caller finds that out.

recallevidence_test.go

• A fact with several spans is recalled once — TestAFactWithSeveralSpansIsRecalledOnce. A fact several spans support is recalled once, citing the earliest of them in the log.

recallplans_test.go

• The fanout cap bounds the rows a hub entity is read for — TestTheFanoutCapBoundsTheRowsAHubEntityIsReadFor. The fanout cap bounds the rows the traversal reads for an entity, not only the rows it returns.

receiptsilence_test.go

• Every table an erasure empties is named in its receipt — TestEveryTableAnErasureEmptiesIsNamedInItsReceipt. Every table an erasure empties is a table the receipt names.

recordassertion_test.go

• Authored assertions keep attribution and retry without resurrecting erasure — TestAuthoredAssertionsKeepAttributionAndRetryWithoutResurrectingErasure
• Concurrent authored assertion retries create one source — TestConcurrentAuthoredAssertionRetriesCreateOneSource
• Assertion batch failures rollback sources history and retry keys — TestAssertionBatchFailuresRollbackSourcesHistoryAndRetryKeys
• Assertion input bounds refuse before mutation — TestAssertionInputBoundsRefuseBeforeMutation
• Authored assertion preserves ordered knowledge after clock rollback — TestAuthoredAssertionPreservesOrderedKnowledgeAfterClockRollback
• Maximum assertion batch returns final versions in request order — TestMaximumAssertionBatchReturnsFinalVersionsInRequestOrder
• Authored assertion storage failures rollback the whole source — TestAuthoredAssertionStorageFailuresRollbackTheWholeSource

recordcorrection_test.go

• Correction preserves attribution and one knowledge boundary — TestCorrectionPreservesAttributionAndOneKnowledgeBoundary. Corrections author new evidence; an old saved citation must never silently resolve to new words.
• Curated replay recovers the saved identity and honors later retraction — TestCuratedReplayRecoversTheSavedIdentityAndHonorsLaterRetraction
• Correction batch rolls back sources versions and audit on failure — TestCorrectionBatchRollsBackSourcesVersionsAndAuditOnFailure
• Replacement expiry removes links without resurrecting the original — TestReplacementExpiryRemovesLinksWithoutResurrectingTheOriginal
• Concurrent corrections create exactly one replacement — TestConcurrentCorrectionsCreateExactlyOneReplacement

recordplans_test.go

• Record pages seek indexed positions and history pages do not repeat — TestRecordPagesSeekIndexedPositionsAndHistoryPagesDoNotRepeat

recordretraction_test.go

• Retraction preserves past knowledge and suppresses source reextraction — TestRetractionPreservesPastKnowledgeAndSuppressesSourceReextraction
• Retraction batches are atomic and version checked — TestRetractionBatchesAreAtomicAndVersionChecked
• Retraction source bounds and project refusals leave memory unchanged — TestRetractionSourceBoundsAndProjectRefusalsLeaveMemoryUnchanged
• Concurrent retractions commit exactly one version transition — TestConcurrentRetractionsCommitExactlyOneVersionTransition

recordstore_test.go

• Record inventory preserves shared attribution and bounds previews — TestRecordInventoryPreservesSharedAttributionAndBoundsPreviews
• Record cursor survives deletion and concurrent insertions — TestRecordCursorSurvivesDeletionAndConcurrentInsertions
• Record history explains supersession and disappears with its source — TestRecordHistoryExplainsSupersessionAndDisappearsWithItsSource
• Record inspection rejects invalid inputs and propagates cancellation — TestRecordInspectionRejectsInvalidInputsAndPropagatesCancellation

rejectedreplay_test.go

• Concurrent rejected replay retains one diagnostic and recovers its identity — TestConcurrentRejectedReplayRetainsOneDiagnosticAndRecoversItsIdentity
• Rejected replay refuses foreign sources and rolls back registration failure — TestRejectedReplayRefusesForeignSourcesAndRollsBackRegistrationFailure

reportembedding_quality_test.go

• Report embedding named corpus quality and ANN recall — TestReportEmbeddingNamedCorpusQualityAndANNRecall

reportembedding_test.go

• Report embedding retrieval has source owned lifecycle — TestReportEmbeddingRetrievalHasSourceOwnedLifecycle
• Report embedding expires with its source — TestReportEmbeddingExpiresWithItsSource
• Report embedding finite snapshot and model cutover — TestReportEmbeddingFiniteSnapshotAndModelCutover
• Report embedding operations refuse invalid and conflicting requests — TestReportEmbeddingOperationsRefuseInvalidAndConflictingRequests
• Report embedding refuses provider result after report changes — TestReportEmbeddingRefusesProviderResultAfterReportChanges

reportembeddingfailure_test.go

• Report embedding allocation rolls back at every storage boundary — TestReportEmbeddingAllocationRollsBackAtEveryStorageBoundary
• Report embedding page failures rollback and release the worker lock — TestReportEmbeddingPageFailuresRollbackAndReleaseTheWorkerLock
• Report embedding policy failures preserve active and candidate generations — TestReportEmbeddingPolicyFailuresPreserveActiveAndCandidateGenerations

reportfreshness_test.go

• Supersession invalidates reports and refuses their in flight snapshots — TestSupersessionInvalidatesReportsAndRefusesTheirInFlightSnapshots
• Reports refuse missing and conflicting source revisions — TestReportsRefuseMissingAndConflictingSourceRevisions
• Report invalidation rolls back with the fact change — TestReportInvalidationRollsBackWithTheFactChange
• Report publication racing fact changes cannot leave a stale report — TestReportPublicationRacingFactChangesCannotLeaveAStaleReport
• The database refuses a report registration for another source revision — TestTheDatabaseRefusesAReportRegistrationForAnotherSourceRevision

reportprovenance_test.go

• Report registration uses exact sources and concurrent retries leave no ghosts — TestReportRegistrationUsesExactSourcesAndConcurrentRetriesLeaveNoGhosts
• Parent reports inherit substituted source dependencies — TestParentReportsInheritSubstitutedSourceDependencies
• Reports refuse missing foreign or erased source snapshots atomically — TestReportsRefuseMissingForeignOrErasedSourceSnapshotsAtomically

reportwriter_test.go

• A report says what wrote it and is rewritten when the writer changes — TestAReportSaysWhatWroteItAndIsRewrittenWhenTheWriterChanges. ── A report carries what wrote it ──────────────────────────────────────────────────────────── A report is a model's prose written under a particular prompt, and until now nothing recorded which.

retractionfailure_test.go

• Retraction storage failures and missing support preserve the version — TestRetractionStorageFailuresAndMissingSupportPreserveTheVersion. Broken storage must fail closed on reads and writes, with no partially applied withdrawal.
• Closed record inspection requires available withdrawal metadata — TestClosedRecordInspectionRequiresAvailableWithdrawalMetadata
• Claim assertion refuses an invalid source before writing — TestClaimAssertionRefusesAnInvalidSourceBeforeWriting

retractionlifecycle_test.go

• Retraction allows independent knowledge without changing retained evidence — TestRetractionAllowsIndependentKnowledgeWithoutChangingRetainedEvidence. An independent source can assert overlapping valid time after knowledge of the old claim ends.
• Retention removes source owned retraction instructions — TestRetentionRemovesSourceOwnedRetractionInstructions
• Retraction invalidates published and in flight reports — TestRetractionInvalidatesPublishedAndInFlightReports
• Source replay racing retraction leaves no active duplicate — TestSourceReplayRacingRetractionLeavesNoActiveDuplicate
• A reassertion after the clock stepped back is recorded not refused — TestAReassertionAfterTheClockSteppedBackIsRecordedNotRefused. Knowledge time for a single-valued slot does not go backwards when the clock does.

retryfingerprint_test.go

• A retry is the same turn whatever time it carries — TestARetryIsTheSameTurnWhateverTimeItCarries. A retry is the same turn whatever time it carries.

segmentstore_test.go

• A segment is registered to every turn it covers and erasure reaches it — TestASegmentIsRegisteredToEveryTurnItCoversAndErasureReachesIt. A segment is written with a registration per covered turn, in one transaction; a second segment over the same range is refused; a range whose turns moved is refused; and an erasure of the subject removes their segments through the registrations and leaves another subject's.

sharedevidence_test.go

• Erasure and retention keep shared identity but remove departing evidence — TestErasureAndRetentionKeepSharedIdentityButRemoveDepartingEvidence

subjectconcurrency_test.go

• Concurrent subject references cannot be claimed by two identities — TestConcurrentSubjectReferencesCannotBeClaimedByTwoIdentities
• Subject rotation racing erasure cannot retain or resurrect mapping — TestSubjectRotationRacingErasureCannotRetainOrResurrectMapping

subjectfailure_test.go

• Subject storage failures rollback identity retry and audit — TestSubjectStorageFailuresRollbackIdentityRetryAndAudit
• Subject update and governance failures preserve accepted state — TestSubjectUpdateAndGovernanceFailuresPreserveAcceptedState
• Subject retention failure rolls back expired sources and mapping together — TestSubjectRetentionFailureRollsBackExpiredSourcesAndMappingTogether
• Runtime subject governance preserves identity and reaches source storage — TestRuntimeSubjectGovernancePreservesIdentityAndReachesSourceStorage

subjectretention_test.go

• Subject retention keeps mappings until all attributed sources expire — TestSubjectRetentionKeepsMappingsUntilAllAttributedSourcesExpire
• Subject expiry cannot remove an in flight sources mapping — TestSubjectExpiryCannotRemoveAnInFlightSourcesMapping
• Subject expiry is bounded and preserves future deadlines — TestSubjectExpiryIsBoundedAndPreservesFutureDeadlines
• Erasure removes registered and application managed source attribution — TestErasureRemovesRegisteredAndApplicationManagedSourceAttribution

subjectstore_test.go

• Subject references rotate without changing identity and erase with their retries — TestSubjectReferencesRotateWithoutChangingIdentityAndEraseWithTheirRetries
• Concurrent subject registration and version checks admit one winner — TestConcurrentSubjectRegistrationAndVersionChecksAdmitOneWinner
• Subject inventory pages across deleted cursors and refuses reference collisions — TestSubjectInventoryPagesAcrossDeletedCursorsAndRefusesReferenceCollisions
• Subject request bounds refuse before storage — TestSubjectRequestBoundsRefuseBeforeStorage

vectorlayout_qualification_test.go

• Vector layout operating envelope — TestVectorLayoutOperatingEnvelope

writepath_test.go

• An assistants sentence does not become the users fact — TestAnAssistantsSentenceDoesNotBecomeTheUsersFact. ── An assistant's sentence does not become the user's fact ─────────────────────────────────── A two-message turn where the assistant's sentence produces no user fact.
• The same name under two types is one entity — TestTheSameNameUnderTwoTypesIsOneEntity. ── One entity when the same name arrives under two types ───────────────────────────────────── One entity when the same name arrives under two types.
• An evidence span resolves against its own message — TestAnEvidenceSpanResolvesAgainstItsOwnMessage. ── Evidence spans index into one message ───────────────────────────────────────────────────── Evidence spans index into ONE MESSAGE, not the turn.
• Everything written registers for erasure — TestEverythingWrittenRegistersForErasure. ── Everything written registers for erasure ────────────────────────────────────────────────── Everything written registers, so erasure can prove residual zero without knowing what the write path produced.
• A turn round trips in order with its groups intact — TestATurnRoundTripsInOrderWithItsGroupsIntact. ── The caller's order is authoritative, and groups survive ─────────────────────────────────── The caller's order is authoritative and groups survive.
• The log offset is contiguous within a scope — TestTheLogOffsetIsContiguousWithinAScope. The offset is contiguous per scope, which is the whole reason the watermark can mean "everything below this is present".
• A refused turn leaves nothing behind — TestARefusedTurnLeavesNothingBehind. A refused turn writes nothing at all — including no offset, since a claimed-and-abandoned offset is exactly the permanent gap the watermark cannot survive.
• An unmapped relation is refused and leaves nothing behind — TestAnUnmappedRelationIsRefusedAndLeavesNothingBehind. ── An unmapped relation is refused, on the write path ──────────────────────────────────────── An unmapped relation is refused, and the refusal leaves nothing behind.
• What extraction refused is kept and is erasable — TestWhatExtractionRefusedIsKeptAndIsErasable. ── What extraction refused is kept, on the write path ──────────────────────────────────────── What extraction refused is kept, with the model's own wording, and it registers for erasure.
• The vocabulary is read from the table that enforces it — TestTheVocabularyIsReadFromTheTableThatEnforcesIt. The vocabulary an extractor is given is the one the database enforces.
• A citation resolves against the message its evidence names — TestACitationResolvesAgainstTheMessageItsEvidenceNames. ── Evidence names the message it indexes ───────────────────────────────────────────────────── Evidence names the message it indexes, and the citation is resolved by that name.
• Every refusal reason the code names is one the schema admits — TestEveryRefusalReasonTheCodeNamesIsOneTheSchemaAdmits. ── The refusal reasons are closed by the schema ────────────────────────────────────────────── The reasons a claim can be refused are closed by the schema, and the closed set is the one the Go constants name.
• A single cardinality fact supersedes rather than accumulates — TestASingleCardinalityFactSupersedesRatherThanAccumulates. ── A fact that stops being true ────────────────────────────────────────────────────────────── Eleven of the thirty-nine relations hold one value at a time.
• A many cardinality fact accumulates rather than superseding — TestAManyCardinalityFactAccumulatesRatherThanSuperseding. A many-cardinality relation accumulates, and must not be superseded.
• The database refuses two overlapping single cardinality facts — TestTheDatabaseRefusesTwoOverlappingSingleCardinalityFacts. The invariant is in the substrate, so a write that goes around the application cannot break it.
• A fact cannot claim a cardinality the vocabulary does not give it — TestAFactCannotClaimACardinalityTheVocabularyDoesNotGiveIt. The copy of cardinality cannot disagree with the vocabulary, because a composite foreign key makes the disagreeing row unstorable.
• Concurrent writers cannot produce two current facts — TestConcurrentWritersCannotProduceTwoCurrentFacts. The invariant holds under concurrency with no application lock in the path.
• A claim with no cardinality is refused with a reason — TestAClaimWithNoCardinalityIsRefusedWithAReason. A claim that does not say its cardinality is refused before it reaches the database.
• A superseded fact keeps its evidence — TestASupersededFactKeepsItsEvidence. Superseding leaves the earlier fact's evidence intact.
• A blank end is unresolved rather than refused — TestABlankEndIsUnresolvedRatherThanRefused. A fact with a blank end is stored with that end unresolved, not refused.
• A claim the message did not assert is storable as a refusal — TestAClaimTheMessageDidNotAssertIsStorableAsARefusal. The fourth refusal reason is one the schema admits, and the set is still closed.
• Suspending a project is reversible and says when there is nothing to do — TestSuspendingAProjectIsReversibleAndSaysWhenThereIsNothingToDo. Suspending is reversible and deleting is not, so they are different operations and only one of them exists here.
• A fact records whose words it came from — TestAFactRecordsWhoseWordsItCameFrom. A fact carries the role of the message it came from.
• A recall returns what the principal said and not what a tool asserted — TestARecallReturnsWhatThePrincipalSaidAndNotWhatAToolAsserted. A recall returns what the principal said, and not what a tool result asserted.
• An empty source set returns nothing — TestAnEmptySourceSetReturnsNothing. An empty source set returns nothing rather than everything.
• The vocabulary is read from both tables that enforce it — TestTheVocabularyIsReadFromBothTablesThatEnforceIt. Both closed sets are read from the tables that enforce them, in one call.
• A subject that names nothing is storable as a refusal — TestASubjectThatNamesNothingIsStorableAsARefusal. The fifth refusal reason is one the schema admits, and the set is still closed.
• A citation carries the words around it and nothing from another message — TestACitationCarriesTheWordsAroundItAndNothingFromAnotherMessage
• Context is not read from another projects message — TestContextIsNotReadFromAnotherProjectsMessage. The context join carries the scope predicate, because this is the one join in the read path that returns text nobody cited.
• A fact whose message is gone keeps its quote with no context — TestAFactWhoseMessageIsGoneKeepsItsQuoteWithNoContext. A fact whose message is gone keeps its quote and comes back without context.
• Three questions about one subject get three answers — TestThreeQuestionsAboutOneSubjectGetThreeAnswers
• A historical read is bounded like the current one — TestAHistoricalReadIsBoundedLikeTheCurrentOne. The historical read is a second statement, which is where a bound gets forgotten.
• A fact recorded a moment ago is visible to a read of the past — TestAFactRecordedAMomentAgoIsVisibleToAReadOfThePast. A read that names only a moment in the world is answered from what we believe NOW, and "now" is the open interval rather than a timestamp anybody computed.
• A second hop is reached only when asked for and comes back with its chain — TestASecondHopIsReachedOnlyWhenAskedForAndComesBackWithItsChain
• The second hop carries every bound the first one does — TestTheSecondHopCarriesEveryBoundTheFirstOneDoes. Every bound is on every level of the recursion, not only on the seed.
• A traversal does not follow a cycle — TestATraversalDoesNotFollowACycle. A cycle is followed once and not forever.
• A report is read back and a missing one says so — TestAReportIsReadBackAndAMissingOneSaysSo. A parent too large to describe from its own facts is described from its children's reports, so the pass reads them back.
• A store that cannot read does not report an empty memory — TestAStoreThatCannotReadDoesNotReportAnEmptyMemory. A store that cannot read says so, rather than reporting an empty scope.
• A second current value from one message is refused by name — TestASecondCurrentValueFromOneMessageIsRefusedByName. Two current values for a single-cardinality relation from one message share one occurrence time, so neither supersedes the other and the constraint refuses the second.
• A tool message under a subject asserts about others but not for the principal — TestAToolMessageUnderASubjectAssertsAboutOthersButNotForThePrincipal. A tool message observed under a data subject may assert facts about named third parties.
• The vocabulary marks events and the loader carries it — TestTheVocabularyMarksEventsAndTheLoaderCarriesIt. The vocabulary says which relations are events, and the loader carries that to the extractor: the five completed-occurrence relations are events, and a state such as lives_in is not.