[Feature] Test coverage gaps: admin domain + 5 critical pure modules untested

[chronoai-shining]

Severity: High

Beyond the existing structural test issues (#5, #8), there are real coverage holes against business-critical logic.

1. Entire admin domain has zero tests

• sisyphus-api/test/admin/ is empty.
• SettingsController.updateSettings does an upsert with $setOnInsert defaults — untested. The verifyCronIntervalHours field feeds the runner's cron schedule; a regression here breaks production cadence silently.
• AuditController.listEvents builds a multi-field filter (userId / action / resource / service / since / until) plus a pageSize = Math.min(pageSize, 200) cap — untested.

2. Five critical pure modules have no isolated unit tests

File	What it does	Why it matters
sisyphus-api/src/workflows/content-hash.ts	computes deploymentState.contentHash for "out_of_sync" detection	Wrong hash → spurious "deployed" UI / missed redeploys
sisyphus-api/src/workflows/dto-mappers.ts	converts internal connector + role shape → mainnet PascalCase DTOs	Casing regression (camelCase) breaks every deploy silently
sisyphus-api/src/workflows/reference-resolver.ts	replaces /skill-xxx and /schema-xxx references with content	Indentation logic, frontmatter strip, end-to-start replacement preserving offsets — tricky correctness
sisyphus-api/src/runner/sse-parser.ts	partial-line buffering for AG-UI SSE	Off-by-one in buffering = corrupted events
sisyphus-api/src/runner/session-manager.recoverStaleSessions	flips orphaned running sessions to failed on boot	Smoke-tested only via GET /history?status=failed returning 200 — proves nothing about behavior

The team already knows the pure-test pattern (sanitizer.test.ts, generator.test.ts, topological-sort.test.ts exist and are good) — it just wasn't applied to the workflow + runner pure modules.

Remediation

NEW test files:

• sisyphus-api/test/admin/settings.test.ts — GET-defaults / PUT-upsert / partial-merge / invalid defaultResearchMode.
• sisyphus-api/test/admin/audit.test.ts — POST 201 / GET filter combinations / pageSize > 200 clamp / since/until range.
• sisyphus-api/test/workflows/content-hash.test.ts — determinism, sort-order independence, sensitivity to connector field changes, exclusion of id/createdAt/updatedAt/deploymentState.
• sisyphus-api/test/workflows/dto-mappers.test.ts — http vs mcp branches, default TimeoutMs: 60000, role name → kebab-case Id, PascalCase casing locked.
• sisyphus-api/test/workflows/reference-resolver.test.ts (with vi.fn for fetch) — multi-line indentation, /skill- and /schema- regexes, end-to-start preserving offsets, frontmatter strip, case-insensitive skill.md lookup.
• sisyphus-api/test/runner/sse-parser.test.ts — partial line buffering, [DONE] skip, malformed JSON skip, abort signal.
• sisyphus-api/test/runner/recover-stale.test.ts — pre-seed Mongo with a running session before app import, assert it gets flipped to failed.

Coupled with #5 (empty test/admin/) and #8 (test setup refactor) — those are structural; this is the actual coverage.