[Deep-Sixed]

Item 2 of the career-ops queue: a semantic upgrade regression, not "the SQL executed."

Head: d5676b1
Base: main @ a50e83c
Three commits, two files.

commit	what
ccf5c9a	the regression itself — src/system/tests/test_historical_upgrade.py, +326
a107781	narrows two pytest.raises(Exception) to the exact exception and message
d5676b1	withholds the body on the one refuse-before-read call site that still sent it

No production code changes in any of the three.

Why

Every existing migration test starts from nothing — fresh database, apply all seven, assert the result. What none of them covers is a database that genuinely predates the later migrations being opened by current code.

It lives in src/system/tests/ rather than src/data/tests/ because the semantic assertions run the real outward workflow, and verify_tree.py allows data → recruiting only.

How the old database is built

monkeypatch.setattr(store, "migration_files", ...) narrows the list to <= 0003, then the real runner applies them. The old database therefore carries the same schema_migrations digests a real operator's would, and the later store.migrate() treats it as an ordinary upgrade rather than a special case.

No fixture .db is committed — a checked-in binary is one nobody reviews, and it would drift from the migrations it claims to predate.

What is asserted

old facts survive	an opportunity recorded then is readable now
0004 backfills honestly	the row says actor='migration', not an operator
0005 invents no authority	an old approval authorizes no draft
0006 invents no target	no addressing appears for one
0007 keeps one-attempt	an old intent still bars a second

The three "invents nothing" claims are the point. 0005–0007 each added columns binding an approval to what the operator read, and each deliberately left old rows unmatched because the database has no record of what those approvals were for. A migration that backfilled a plausible value would authorize an outward write nobody approved — and every structural test in this repo would still pass.

Refusals are asserted on provider.calls == 0, following the repo's rule that a refusal and a rejection read alike to a person and only the call count says whether anything was contacted.

I wrote the defect this catches

The first version of the fixture pointed one opportunity's current_review at one of three reviews, leaving the other two stale. An authorization check reads its binding through current_review, so a stale review refuses before any 0005/0006/0007 column is consulted. All seven tests passed — and both outward tests were green about staleness while claiming to be about migrations.

It surfaced by testing the test: I fabricated a complete, correct binding for the old approval, as a dangerous migration would, and asked whether draft() then created one.

before the fix:  ValueError: Review is missing or stale     <- wrong refusal
after the fix:   draft() SUCCEEDED, provider.calls = 1, intent confirmed

The semantic test asserts calls == 0 and intent is None. Only after the fix does asserting that mean anything. The staleness precondition is now asserted in the vacuity test rather than left to hold by luck.

a107781 — the same vacuity class, one level up

Review was right that pytest.raises(Exception) proved a weaker property than this file's own claim. It passes for the intended refusal, but would also pass silently if an unrelated failure in _binding(), draft_material(), provider identity resolution or SQLite access threw first — provider.calls == 0 and intent is None would still hold, and the test would stay green while proving nothing. Both assertions now name the exception and match its message.

d5676b1 — the Windows failure, and a claim of mine that was wrong

Windows 3.12 failed on test_an_outward_command_refuses_an_unknown_query_parameter with WinError 10053. That is the unread-body reset race #39 was written to remove: _outward settles accepted() on the query before it reaches for _body(), so a declared body goes unread, and closing on unread bytes is a reset rather than a clean shutdown on Windows.

#39's docstring claimed it had removed "the last instance ... from this file". That claim was wrong when I wrote it. This call site arrived in #35 and I missed it — the sweep behind #39 was not a sweep. An AST pass over all 112 client call sites now says this was the only one remaining: every other send carrying a body either already declares transmit=False, or is an address that genuinely reads (malformed JSON, the charset 200, the provenance-in-order half of the ordering test), and the 39 calls through outward() / decide() never override provenance. The whole-file count in that docstring is replaced by the mechanism, which cannot rot the same way.

Withholding is the stronger fix than tolerating the race with unread() — and it strengthens the test:

Mutation	Result
drop accepted() from _outward	FAIL — TimeoutError
check the query after _body()	FAIL — TimeoutError
the same reorder, body transmitted	PASS ← what the old form allowed

The third row is the point. With the body sent, reading first and judging the query second still answers 400, so the old assertion held while the ordering the test is named for had been inverted. Withheld, the refusal can only arrive if the query was judged first — the test now proves its own title rather than a status code.

Mutation coverage — ccf5c9a

Mutation	Result
0004 backfills actor='operator'	FAIL
0007 defaults provider to 'controlled'	FAIL
the fixture builds a current database	FAIL — 7 errors
the three reviews share one opportunity again	FAIL

The last two are vacuity guards. Note the honest limit: mutation 2 is caught by the structural assertion, not the semantic one — 0005's empty digests refuse independently, so the end-to-end test cannot attribute a refusal to any single column. The per-column claim is the structural test's job; the semantic test is the end-to-end backstop, and the fabricated-binding experiment above is what proves it is not vacuous.

Verification on d5676b1

1686 tests (1679 → 1686), Ruff check and format clean, verify_tree 100 publishable text files / 5 reviewed renders / 1 reviewed screenshot, verify_secrets PASS, verify_wheel PASS.

🤖 Generated with Claude Code

https://claude.ai/code/session_01B8kjhqYENShpeZ16QDnsyo

---

Generated by Claude Code