test: promote five regression anchors, each measured green on main and red without its fix

[kriszyp]

Five exploratory-QA specs promoted to permanent regression anchors. Test-only, no product code.

Every one was measured twice — green on current main, and red with the commit that fixed the issue it anchors rewound. Only the delta is evidence, so both numbers are stated:

spec	anchors	fixed by	green on main	failures with the fix rewound
security/mcp-record-scoped-rbac	#1487	#1522 (2e3620c6e)	11/11	5 of 11 ¹
server/sse-throw-midstream	#1763	#1789 (8930b1ef2)	4/4	2 of 4
database/condition-mutation-integrity	#1572	#1911 (b8c843a24)	17/17	12 of 17
database/eviction-phantom-null	#1894	#1896 (21c521000)	4/4	3 of 4
database/longtxn-index-orphan	#1407	#1411 (3249fb58e)	3/3	2 of 3 ¹

39/39 running together, on RocksDB, against main at 11a1c4891.

¹ These two rewound figures are from the original QA measurement against the head each spec was written on. Both fixes have since been built on — #1522's liveResource indirection, and #1411's abort/poison path (chainStillActive, the canonical-source exclusions from harper-pro#348) — so neither reverts cleanly onto current main, and a surgical partial rewind measures the rewind rather than the anchor. The other three rows were re-measured today by rewinding the fix on this head. Two of them moved: eviction-phantom-null is a 4-test suite (not 5), and sse-throw-midstream now fails 2 of 4 rather than 3.

What changed since this PR was opened

• QA-686 (server/log-rotation-fd-reuse) is dropped. It was attributed to Log rotator: potential FD leak + add option to delete old log files #683 (the fd leak on rotate), but its docstring, fixture and schema all describe maxSize unit-parsing against Log rotation maxSize not respected properly #1877 — which is still open — and it never inspects a file descriptor. Its red result with Log rotator: potential FD leak + add option to delete old log files #683's fix rewound was incidental, so it failed the promotion criterion that a spec must detect the defect it anchors. Dropping it also reconciles the batch arithmetic: the citation gate produced 13 candidates → 5 promoted, 7 red on main anyway, 1 that could not execute. QA-686 was never one of the 13.
• The anchors column had two wrong issue numbers, the same class of error the log-rotation thread caught. mcp-record-scoped-rbac was listed against allowRead has two critical security gaps: (1) throw → fail-open, (2) not enforced on collection scans #1422 (an unrelated allowRead issue); it verifies Consolidate row-level allowRead enforcement — apply it on all read paths, not just the single-record point-read #1487, fixed by PR fix(mcp): enforce row-level RBAC on MCP application verb tools (#1487) #1522. sse-throw-midstream was listed against SSE: streaming a finite async generator to completion hangs the response + throws uncaughtException (terminal-step serialize) #1628; that is the sibling issue fixed by Fix SSE hang + uncaughtException on finite generator streamed to completion (#1628) #1632 — this spec anchors SSE: a generator that throws mid-stream hangs the response + uncaughtException (follow-up to #1628) #1763, fixed by Fix SSE hang + uncaughtException when a generator throws mid-stream #1789. Both are corrected above.
• Four rounds of pre-push review hardened the oracles, which is most of the diff since. Every one of these was a way for an anchor to pass without proving anything:
  • readDoc() returned null when the ops-API read-back was unparsable — and null is that same oracle's "row is absent" answer, so a 500 during read-back was indistinguishable from a successful denial, and every strictEqual(after, null) below it would have passed vacuously.
  • The search_Doc case accepted "rejected the call" as enforcement without checking why it was rejected, so a schema or parameter-validation failure would have satisfied it without the search ever running. It now requires the rejection to be an authorization rejection (measured: Unauthorized access to resource) or the success to contain the lowuser-owned row.
  • Both uncaughtException sweeps in the SSE anchor read hdb.log the instant the response closed. They assert a non-event, so simply outrunning the worker's log flush passed them — hiding the exact crash the spec exists to catch.
  • bypassed = !result.isError && persisted would have printed ENFORCED for a handler that wrote the row and then failed while formatting its reply. Unauthorized persistence is the bypass, whatever the tool reported.
  • Unbounded fetch calls in two before() hooks (Node's fetch has no default timeout, and a before() hook has no runner timeout) would have hung the suite forever against a wedged server instead of failing the poll; unread response bodies held sockets in undici's keep-alive pool across a 480-request readiness poll.

Why five and not thirteen

These came from 13 candidates that a citation-based gate classified as ratified invariants — each cites a closed issue, so each looked like a regression anchor. Measuring them changed the answer:

• 7 are red on main anyway. Identical fail counts with and without the fix, so rewinding it changed nothing and the red proved nothing about detection. They fail criterion 1 (green on current main) and are not promotable in either direction.
• 1 could not execute on main at all.

Those eight need triage — stale spec versus a genuine regression in main — and that is worth doing separately, because if any is the latter it is a defect report rather than a test problem. Listed in the branch's commit message.

This is now the third time in this batch's history that measurement contradicted a plausible classification, counting QA-686. Worth stating plainly: a citation-gated auto-merge lane would have merged all 13, including 7 tests that cannot fail, 1 that does not run, and 1 attributed to the wrong issue.

For the human reviewer

• The base has drifted again, and CI is red on one Windows shard because of it. This branch is now 104 commits behind origin/main (df5355aaa), so the main figure above is measured against 11a1c4891, not against today's main — the same freshness objection that held this PR in draft. Integration Tests 2/6 (Windows, Node.js v24) fails twice deterministically (re-run to confirm it is not a flake) in integrationTests/apiTests/describe-metadata-upgrade.test.ts, a file this PR does not touch: HTTP workers never come back after restart_service (Probe /SeoPageCache/ did not become ready within 120000ms, ECONNREFUSED). That path has since been worked on upstream — #2316 (worker respawns blocking restarts), #2112 (swallowed uWS startup-listen failures), #2227 (Windows deploy deflake) — none of which are in this base. A base refresh, followed by re-measuring the green on main column, is the next step; it needs a force-push, so it is not something this pass could do.
• The two runs per spec are the claim; the two ¹ rows are the weakest part of it. Their rewound figures are older than the rest of the table, for the reason given in the footnote. If you want a durable answer there rather than a footnote, the honest options are to re-derive each fix's behaviour against current main in a follow-up, or to drop the rewound column for those two rows and let the green run stand alone.
• Declined from the pre-push review, twice each: the reviewer wants the provenance narration removed from the spec docstrings (issue numbers, the code reading, the disproven hypothesis in QA-601) as PR-ephemeral clutter, and it objects to the ordered suites sharing state across tests (pristineLive set in Q0a and read in Q2+, so a single test run in isolation fails). I left both. For these specs the narration is the artifact — the value of a promoted QA spec is that the next reader can tell what it measured and why the oracle is not vacuous — and the ordering is what makes the non-vacuity controls (Q0c proves the oracle can detect a real mutation before anything trusts its silence) meaningful. Both are worth a maintainer's opinion rather than mine.
• countOverTimeOccurrences() counts each monitor firing twice, once from hdb.log and once from the captured process output. It is only ever compared as > baseline, and the baseline is measured the same way, so nothing is wrong today — but it is a trap for anyone who later asserts an exact count. Pre-existing; not touched here.
• One reviewer nit left unfixed on purpose: consumeSse's error/close paths finish without calling decoder.end(), so an abruptly-closed stream that ends mid-multi-byte-sequence drops those trailing bytes rather than recording them as replacement characters. Every payload these cases send is ASCII, so it changes nothing today; it would matter only if the fixtures later yield non-ASCII at the crash boundary. integrationTests/server/sse-throw-midstream.test.ts:175.
• Two fixture resources.js files needed unused-parameter fixes. They had never been linted, because the promotion gate globbed *.test.* only and never the fixtures sitting beside them — a gap in the gate, now known.

Verification

• npm run build, then all five specs together: 39/39 pass, 0 fail, 0 skipped on RocksDB.
• Re-measured with the fix rewound, on this head, rebuilding each time: condition-mutation-integrity 12 of 17 fail (removing the cloneConditions call), eviction-phantom-null 3 of 4 fail (restoring record && … in updateIndices), sse-throw-midstream 2 of 4 fail (restoring the bare body.pipe(nodeResponse) in pipeBodyToResponse). Working tree restored and rebuilt after each.
• oxlint --deny-warnings and prettier --check clean on all five specs.
• QA-601 still reports overTimeFired=true on both trials after the log-scanning rewrite, so the incremental counter still detects a fresh monitor firing per trial.

What these do and do not prove

They prove each spec detects the specific defect it anchors, on the engine and surface it exercises. They do not prove anything about the areas the dropped eight covered — allowRead enforcement across delivery surfaces, MCP tool authz, deployment-payload boundaries, env/config boot, redeploy staleness, astral-plane index bounds — that coverage is still missing and now has a measured reason for being missing.

Refs #1487, #1763, #1572, #1894, #1407

Generated by Claude Opus 5.

_{Review-Coverage: authored=claude; ran=gemini; declined=codex,cursor-grok,cursor-composer,domain; rounds=6 @ ec36e86}

_{Human-Review-Need: 3 @ ec36e86}

[claude]

Reviewed; no blockers found.

[gemini-code-assist]

Code Review

This pull request introduces a comprehensive suite of integration tests covering critical database and server behaviors, including query condition mutation integrity, TTL eviction index cleanup, multi-store transaction timeouts, MCP row-level RBAC enforcement, log rotation unit parsing, and mid-stream SSE generator errors. The review feedback provides highly actionable improvements to ensure these tests are robust and reliable. Key recommendations include replacing fixed sleeps with bounded polling loops to prevent test flakiness, wrapping test bodies and teardown hooks in try/finally blocks to guarantee process cleanup, and using unique temporary filenames incorporating the process ID to avoid conflicts on shared CI environments.

[kriszyp]

Refreshed before flipping this out of draft, because the reason it was still open is the same thing it argues about.

It was 123 commits behind main. The green CI on it was green against that stale base — which is exactly the failure F-287 describes and the freshness assertion now added to the QA skill exists to prevent. A green on a stale main does not satisfy criterion 1, so flipping it on that evidence would have been the wrong shape of confidence for a PR whose whole claim is "measured".

Rebased onto current main (11a1c4891) and re-ran all six specs: 43/43 pass, 0 fail, 0 behind. The red-without-the-fix half is unchanged — that is a property of each spec against its own anchored fix, not of the base.

Also removed a commit that did not belong here. fix(config): extend Windows atomic-write retry budget (config/configUtils.ts) had been pushed onto this branch and existed nowhere else — no PR of its own. This PR says "test-only, no product code changes", which was no longer true. It has been relocated verbatim onto current main as #2191 so it is not lost, and dropped from here. This PR is test-only again.

_{Claude Opus 5}