test: repair dead test wiring, normalize placement, cover high-risk modules

[Harry19081]

Summary

Repairs the test suite's wiring, makes test placement consistent, covers the worst-covered high-risk modules, then mutation-tests that new coverage and fixes what it exposed.

The thread connecting all of it: several suites reported green while running nothing, and nothing prevented that from recurring.

• cargo:test never reached the workspace — ~5,700 Rust tests had never run
• 5 cargo:test:* scripts filtered on modules that don't exist, exiting 0
• CI's rust job was clippy-only, so none of it was caught
• The one test that did fail once reached had been silently broken for a long time
• Four boundary modules sat at 0–4% coverage, including deletion logic and git remote ops
• The new tests were then audited by mutation testing, which found three product bugs the tests had been certifying as correct

Problem

1. Dead test configuration. cargo test --lib <filter> prints test result: ok. 0 passed and exits 0 when the filter matches nothing — verified on a throwaway crate. Five scripts were in that state. Separately, src-tauri/Cargo.toml is a workspace with "." plus 44 members and no default-members, so a bare cargo test runs the root package only.

2. No standard for test placement. 642 tests colocated, 506 in __tests__/, 53 directories using both, nothing documenting either.

3. Doc rot pointing agents at nothing. CLAUDE.md/AGENTS.md cited .cursor/rules/ui-feature-workflow.mdc twice as the authority on unit-test gates — a file never present in this repo's history. Plus two ~/.orgii/skills/… paths resolving nowhere, and 5 of 7 Rust test paths in TEST_CASES.md stale.

4. Untested high-risk code. cleanup.ts (deletion logic reached from src/index.tsx) and remoteOps.ts (push/fetch against a real repo) at 0% and 0.43%. The SessionCore/sync adapters — where external CLI/IDE output becomes domain state, exactly where CLAUDE.md's root-cause-first doctrine says invariants belong — at 0–28%.

5. Coverage that doesn't mean coverage. All 16 targeted files hit exactly 100%/100%. That uniformity is a red flag, so the new tests were mutation-tested: 103 probes, 78 killed (76%). The survivors clustered, and two clusters were serious.

Solution

Eleven commits, each independently reviewable.

Commit	What
fix(tooling)	cargo:test → --workspace; agent_core repaired to -p agent_core (a crate, not a deleted module — 3170 tests); 4 absent scripts removed; cargo test added to CI
refactor(test)	83 files moved, 105 imports rewritten; 53 mixed dirs → 0; convention documented in CONTRIBUTING.md
test(pm)	Rollback invariant re-armed (below)
docs	Dead rule/skill references removed, replaced with a live pointer; stale Rust test paths fixed; undocumented E2E_OPENAI_MODEL gate recorded
test	no-restricted-syntax guard: .only is now a lint error
test(session-core) · test(database-core) · test(git,storage)	+591 tests; the four boundary areas 0–28% → 100%
test (audit)	Assertion gaps closed in remoteOps and DatabaseCore
test(session-core) (audit)	Tests that could not fail, replaced
fix(session-core)	Three product bugs fixed at the producing boundary

The rollback bug. invoke_rolls_back_the_whole_graph_when_a_node_collides seeded a cross-org short_id and expected ALREADY_EXISTS. It stopped colliding: the allocator now deliberately steps over same-prefix ids across orgs. In fact ALREADY_EXISTS is unreachable from invoke by any seeded row — the allocator floors the counter and loops past taken ids, and the guard checks that same predicate. Now split in two: one pins the step-over contract, the other drives rollback from a BEFORE INSERT trigger with a count-based predicate so renumbering can't disarm it again. Post-conditions 4 → 7, compared against a post-apply() baseline. Product code unchanged; rollback verified by breaking it with DropBehavior::Commit.

What mutation testing found

remoteOps.ts — destructive flags entirely unasserted on the credential-retry path. Four mutations left all 69 tests green, including force: params.force → force: true. A plain push that hit an auth failure, picked up a stored credential and retried could have been silently converted into a force-push with credentials attached. Cause: the file's one strict toEqual used a fixture already passing force: true, so hardcoding was invisible; the rest used toMatchObject, which cannot detect an added flag. Fixed, all four now fail.

NeonProvider.getTableSchema maps rows positionally but its test pinned the SELECT with toContain fragments. Swapping c.data_type ↔ c.is_nullable left 45/45 passing while production would report every column's type as "YES"/"NO". Five introspection blocks converted to exact-SQL assertions.

cleanup.ts came out clean — 11 probes, 0 survivors, including dropping the isValidUUID gate that would delete every session at a human path. It asserts full remaining-storage snapshots via toEqual, the right shape for deletion logic.

Three product bugs, fixed at the boundary

Each was asserted as correct by a test until the audit exposed it.

1. sessionSyncReconcile.ts narrowed the run status for the runtime atom, then force-cast the raw wire string into the session list cache on the next line — so a value outside the union reached Session.status, which drives sidebar grouping and Kanban lanes. The unions are genuinely not assignable (CliSessionStatus carries installing), so rather than swap one cast for another this adds toSessionListStatus, a compiler-checked map. Behavior-preserving: every consumer that mentions installing already groups it with running.

2. worktree_created/merge_result frames inserted empty created_at/updated_at. upsertSession pins timestamps on update but inserts verbatim, and taskTimestamps.ts reads empty as 0 — sorting the session to the epoch and dropping it out of every Kanban time window.

3. A plan_approval chunk with no planPath was silently swallowed, so the plan vanished from the transcript — and the old test asserted that emptiness was correct, actively blocking its own repair. The guard now skips only the Build-card atom write; the chunk falls through to the event store. Verified the transcript renders such an event (planPath is never read on that path).

Potential risks

• CI time. The rust job now runs cargo test --workspace. Measured 385 s warm, of which only 47 s is execution — the rest is building 94 test binaries, which the existing cargo clippy --workspace --all-targets step already pays for. A cold runner will be materially slower; if this hurts, the cache is the lever, not the test count.
• 83 moved test files. Pure git mv + import rewrites, no logic changed. Verified against a clean-HEAD worktree: identical file and test counts before and after.
• fix(session-core) changes runtime behavior — the only commit here that does. The status map is behavior-preserving by inspection of every consumer; the timestamp and plan-approval fixes change what reaches the store, deliberately.
• frontend-ui-audit is still referenced by 5 routing rules with no SKILL.md anywhere. Deliberately not deleted — that would quietly end UI audits. Both files now carry an explicit callout instead. Restoring that skill is a follow-up someone needs to own.
• 630 lines test four zero-caller exports. cleanupStaleRepoReferences, clearProjectRepoCache, clearSessionData, clearAllProjectData have no callers outside cleanup.ts and its tests, so half the cleanup.ts coverage jump guards dead code. Kept deliberately, flagged here: wire them up or delete them.
• A latent data-loss hazard is pinned, not fixed. clearProjectRepoCache's over-broad substring sweep would destroy six real keys including orgii_recent_workspaces and orgii:codeSearchIndexedRepos. Harmless while nothing calls it; dangerous the moment a "Clear project cache" button appears.

Follow-ups found but out of scope

• createStreamMessageId uses Date.now() (sync/utils/activityIds.ts:135), so two turns in the same millisecond collide. Reproduced at HEAD with a clean tree — 2 failures in 6 runs — so it is pre-existing, not introduced here. A real collision would corrupt a live transcript.
• Four more status as SessionStatus casts with the same defect as bug 1: sessionSyncStateHelpers.ts:181 and :269, cliTurnLifecycleCoordinator.ts:134, useNativeSessionStatusMonitor.ts:133.

Validation

Check	Result
npx vitest run	1166 files / 9560 tests passed, 0 failed, 0 skipped
cargo test --workspace --no-fail-fast	6814 passed, 0 failed, 36 ignored
npx tsc --noEmit	exit 0
ESLint	clean; .only guard verified to fire on all three forms and clean against all 1166 files
Mutation testing	103 probes; every fix in the audit commits proven by turning its mutant red

Baseline before this branch: 1148 files / 8966 tests, and cargo test reaching 1111.

Coverage (product code): 42.9% → 44.2% overall; DatabaseCore 3.2% → 100%, services/git 47.1% → 64.7%, SessionCore 54.5% → 60.4%, util/core 34.2% → 44.8%.

E2E was not run — it needs a built desktop app and a display. No e2e spec logic was changed, only README.md and one dead export removed.