Tests: internal/api

internal/api · 155 tests

Each test is named for the property it holds, and runs against a real deployment: there is no mock of the database and no arm that skips when it is absent. The sentence is the test's name read back; the name is what go test -run takes.

admission_internal_test.go

• Admission capacity is bounded and released without keeping inactive keys — TestAdmissionCapacityIsBoundedAndReleasedWithoutKeepingInactiveKeys
• Authentication admission bounds concurrency and rate — TestAuthenticationAdmissionBoundsConcurrencyAndRate
• Admission refuses undersized pools and caps oversized ones — TestAdmissionRefusesUndersizedPoolsAndCapsOversizedOnes
• Server rejects ambiguous admission configuration — TestServerRejectsAmbiguousAdmissionConfiguration
• Anonymous audit uses the same memory capacity and only one slot — TestAnonymousAuditUsesTheSameMemoryCapacityAndOnlyOneSlot
• Audit suppression never attempts a write when memory is busy — TestAuditSuppressionNeverAttemptsAWriteWhenMemoryIsBusy

admission_test.go

• Oversized observation batches are refused before storage — TestOversizedObservationBatchesAreRefusedBeforeStorage
• A blocked project cannot take another projects memory connections — TestABlockedProjectCannotTakeAnotherProjectsMemoryConnections
• Anonymous bursts cannot queue unbounded registry queries — TestAnonymousBurstsCannotQueueUnboundedRegistryQueries

api_test.go

• The whole journey runs over HTTP — TestTheWholeJourneyRunsOverHTTP. ── The claim ───────────────────────────────────────────────────────────────────────────────── Observe a turn, watch it form, recall a fact with the words behind it, erase the person, and read a residual of zero — all of it over HTTP.
• Every operation refuses an unauthenticated caller — TestEveryOperationRefusesAnUnauthenticatedCaller. Every operation is behind a credential.
• Every refusal a client can provoke names a published code — TestEveryRefusalAClientCanProvokeNamesAPublishedCode. Every refusal a client can provoke names a code the contract publishes.
• An unknown credential is refused the same way as none — TestAnUnknownCredentialIsRefusedTheSameWayAsNone. A token that is not ours, and one that is shaped like ours but unknown, are the same answer as no token at all.
• A request cannot name a project — TestARequestCannotNameAProject. A caller cannot name a project at all, so a request that tries is refused as malformed.
• Two credentials for two projects see different memory — TestTwoCredentialsForTwoProjectsSeeDifferentMemory. Two credentials for two projects see different memory, which is the boundary stated as a property rather than as a refusal.
• An erasure without a subject is refused over the wire — TestAnErasureWithoutASubjectIsRefusedOverTheWire. An erasure without a subject would be a scope-wide delete wearing a governance label.
• A document is erased by its source observations over the wire — TestADocumentIsErasedByItsSourceObservationsOverTheWire. ── Erasing a document by its own sources, over the wire ────────────────────────────────────── A document observed project-wide is erased by the observation ids its manifest holds, with the same receipt as a subject erasure; naming both a person and sources, or something that is not an id, is refused before anything is read.
• Health is open and says nothing — TestHealthIsOpenAndSaysNothing. Health is the one unauthenticated route, and it says nothing.
• A malformed request is refused without touching the database — TestAMalformedRequestIsRefusedWithoutTouchingTheDatabase. ── What the surface refuses to parse ───────────────────────────────────────────────────────── Every one of these is a way a client can be wrong, and each must produce an answer the client can act on rather than a five hundred or a partial write.
• A turn the domain refuses is refused with its reason — TestATurnTheDomainRefusesIsRefusedWithItsReason. A turn the domain will not accept is refused with the domain's own reason, not a generic error.
• A recall without a question is refused — TestARecallWithoutAQuestionIsRefused. A question is required, because a recall with none would anchor on nothing and return an empty bundle that looks like an answer.
• A recall with no scopes uses the credentials own — TestARecallWithNoScopesUsesTheCredentialsOwn. An omitted scope list means everything the credential holds, which is the useful default and the one that cannot leak: the set it falls back to is the credential's own.
• An oversized body is refused — TestAnOversizedBodyIsRefused. A body larger than the cap is refused rather than read.
• Freshness for a scope with no turns says so — TestFreshnessForAScopeWithNoTurnsSaysSo. Freshness for a scope that exists in the grant but has never been written to is an error the caller can act on rather than a zero that looks like an empty memory.
• A revoked credential stops working at once — TestARevokedCredentialStopsWorkingAtOnce. A revoked credential stops working immediately, which is what makes revocation an answer to a leak rather than a note in a ticket.
• A credential for a suspended project is refused — TestACredentialForASuspendedProjectIsRefused. A credential for a suspended project stops working, and says only that it does not work.
• A credential naming a project that is gone is refused — TestACredentialNamingAProjectThatIsGoneIsRefused. A credential naming a project that does not exist at all is refused the same way.
• Every operation leaves an attributed ledger row — TestEveryOperationLeavesAnAttributedLedgerRow. Every operation leaves a row naming the principal that performed it.
• The ledger holds nothing a person could ask to have removed — TestTheLedgerHoldsNothingAPersonCouldAskToHaveRemoved. The ledger holds nothing that could ever be the subject of an erasure request.
• A refused credential is recorded — TestARefusedCredentialIsRecorded. A refused credential is recorded, because a repeated refusal is what an attack looks like from inside the ledger.
• An export names a person or its turns and refuses anything else — TestAnExportNamesAPersonOrItsTurnsAndRefusesAnythingElse. An export produces what an erasure would delete, and the two walks agree.
• An export produces what an erasure would delete — TestAnExportProducesWhatAnErasureWouldDelete
• An export without a subject is refused — TestAnExportWithoutASubjectIsRefused. An export names the person it is for, or it is a copy of the project wearing a governance label.
• An export for somebody with nothing held is empty rather than absent — TestAnExportForSomebodyWithNothingHeldIsEmptyRatherThanAbsent. An export for somebody with nothing held is empty sections rather than absent ones.
• An export is recorded in the ledger — TestAnExportIsRecordedInTheLedger. An export is recorded in the ledger like every other operation.
• A request succeeds even if the ledger cannot — TestARequestSucceedsEvenIfTheLedgerCannot. A ledger failure does not fail the request that produced it.
• A refused authentication records no secret — TestARefusedAuthenticationRecordsNoSecret. A refused authentication with a short or absent token is still recorded, and records nothing that could be a secret.
• A question can be asked of a moment in the past — TestAQuestionCanBeAskedOfAMomentInThePast. ── A question can be asked of a moment ─────────────────────────────────────────────────────── The wire carries both instants and the interval each fact held, because a fact returned by a read of last March that does not say it stopped holding is indistinguishable from one that holds now.
• A question can reach one relation further and says how it got there — TestAQuestionCanReachOneRelationFurtherAndSaysHowItGotThere. ── A chain over the wire ───────────────────────────────────────────────────────────────────── A fact about something the question never named is only worth returning if the route to it can be read, so the chain is on the wire beside the fact rather than implied by a score.

artifacts_internal_test.go

• Artifact storage must be configured before serving its routes — TestArtifactStorageMustBeConfiguredBeforeServingItsRoutes

artifacts_test.go

• Artifact HTTP journey stores binary state without forming or crossing projects — TestArtifactHTTPJourneyStoresBinaryStateWithoutFormingOrCrossingProjects
• Artifact HTTP refusals are bounded and do not expose storage diagnostics — TestArtifactHTTPRefusalsAreBoundedAndDoNotExposeStorageDiagnostics
• An object read under the wrong person is answered as one that is not there — TestAnObjectReadUnderTheWrongPersonIsAnsweredAsOneThatIsNotThere. ── The boundary between end users under one credential ─────────────────────────────────────── One credential, many end users.

artifactsearch_test.go

• Artifact metadata search treats names literally and never searches bytes — TestArtifactMetadataSearchTreatsNamesLiterallyAndNeverSearchesBytes

assertions_test.go

• Assertions run over HTTP with attribution scoped retries and erasure — TestAssertionsRunOverHTTPWithAttributionScopedRetriesAndErasure
• Assertion HTTP refusals leave no sources or private diagnostics — TestAssertionHTTPRefusalsLeaveNoSourcesOrPrivateDiagnostics
• Assertion at backlog capacity does not reserve work or skip freshness — TestAssertionAtBacklogCapacityDoesNotReserveWorkOrSkipFreshness

auth_audit_internal_test.go

• Refused audit sampling counts concurrent attempts within a fixed budget — TestRefusedAuditSamplingCountsConcurrentAttemptsWithinAFixedBudget

auth_audit_test.go

• Anonymous audit is content free and bounded — TestAnonymousAuditIsContentFreeAndBounded

authorization_internal_test.go

• Unknown authority and future operations fail closed for readers — TestUnknownAuthorityAndFutureOperationsFailClosedForReaders

authorization_test.go

• Read only credentials can inspect but cannot mutate every memory route — TestReadOnlyCredentialsCanInspectButCannotMutateEveryMemoryRoute

citation_test.go

• Saved citation resolves over HTTP with project privacy and audit — TestSavedCitationResolvesOverHTTPWithProjectPrivacyAndAudit

composedrecall_test.go

• Composed recall answers from themes and passages and never invents facts — TestComposedRecallAnswersFromThemesAndPassagesAndNeverInventsFacts. A question that anchors nothing is answered from the report hierarchy and from passages, over the same authenticated route, with every surface labelled for what it is: a report carries its sources, a passage carries its role, and neither is ever presented as a fact.
• Semantic surfaces refuse what is not configured and filter roles in memory — TestSemanticSurfacesRefuseWhatIsNotConfiguredAndFilterRolesInMemory. The adapter composes what is configured and refuses, by name, what is not; a passage query over several roles filters in memory because the retriever takes one role.

connectionslots_test.go

• A write that cannot get a connection is answered retryably rather than as an internal error — TestAWriteThatCannotGetAConnectionIsAnsweredRetryablyRatherThanAsAnInternalError. ── A write that cannot get a connection ────────────────────────────────────────────────────── A write that cannot get a connection used to be an internal error, which tells a caller nothing they can act on.

contexts_test.go

• A context is the newest turns verbatim and segments over the rest under a budget — TestAContextIsTheNewestTurnsVerbatimAndSegmentsOverTheRestUnderABudget. A context is one subject's history: the newest turns as they were said, the segments the pass wrote over the rest, the watermark, and the cut.

contract_test.go

• The rendered contract is stable and publishes every error code — TestTheRenderedContractIsStableAndPublishesEveryErrorCode. The contract renders the same way every time, and publishes every error code a refusal can name.
• No refusal names an undeclared code — TestNoRefusalNamesAnUndeclaredCode. No refusal names a code that is not in the published vocabulary.

contractdoc_test.go

• The published contract describes the surface that serves it — TestThePublishedContractDescribesTheSurfaceThatServesIt
• The contract check refuses a document that has drifted — TestTheContractCheckRefusesADocumentThatHasDrifted

contractfreeze_test.go

• The frozen v 1 contract is still served — TestTheFrozenV1ContractIsStillServed. Every operation, field and refusal code in the frozen snapshot is still served, with the same method, path, status and type.
• The freeze refuses removals renames and retypings — TestTheFreezeRefusesRemovalsRenamesAndRetypings. The freeze refuses what it must: a doctored snapshot with an operation this surface does not serve, a moved route, a retyped and a missing field, and a code nobody declares, is named violation by violation, while an addition on the served side is not one.
• The freeze reads inside an object rather than comparing its rendering — TestTheFreezeReadsInsideAnObjectRatherThanComparingItsRendering. ── The freeze descends into an object instead of comparing its rendering ───────────────────── wireType expands a nested object inline, so every change inside one shows up as a change to the enclosing field's rendered kind.
• A freeze written today is one the current surface keeps — TestAFreezeWrittenTodayIsOneTheCurrentSurfaceKeeps. FreezeJSON is what make freeze-contract commits, and its only caller is a script the build excludes (//go:build ignore), which is why nothing reached it.

correctioncapacity_test.go

• Correction at backlog capacity does not spend a reservation or skip freshness — TestCorrectionAtBacklogCapacityDoesNotSpendAReservationOrSkipFreshness. The reservation trigger evaluates final transaction state.

corrections_test.go

• Correction HTTP replays authored input without model inference — TestCorrectionHTTPReplaysAuthoredInputWithoutModelInference
• Correction HTTP refuses foreign readers malformed and oversized sources — TestCorrectionHTTPRefusesForeignReadersMalformedAndOversizedSources

entities_test.go

• Entity inspection resolves record endpoints and refuses foreign i ds — TestEntityInspectionResolvesRecordEndpointsAndRefusesForeignIDs
• An entity is purged only after a preview that says whose claims go and the words remain — TestAnEntityIsPurgedOnlyAfterAPreviewThatSaysWhoseClaimsGoAndTheWordsRemain. ── The entity purge ────────────────────────────────────────────────────────────────────────── An entity is an inference, and a wrong one poisons every claim anchored to it.
• A purge that cannot be recorded is not committed — TestAPurgeThatCannotBeRecordedIsNotCommitted. A confirmed purge and its ledger row commit together or not at all.
• A purge is refused to a reader and cannot reach another project — TestAPurgeIsRefusedToAReaderAndCannotReachAnotherProject. A purge is a write, and it reaches across a project only if somebody forgot the scope.

entitycandidates_test.go

• Entity candidate search is authenticated bounded and project scoped — TestEntityCandidateSearchIsAuthenticatedBoundedAndProjectScoped

entitynames_test.go

• Entity name bounds refuse authored writes without partial sources — TestEntityNameBoundsRefuseAuthoredWritesWithoutPartialSources

feedback_test.go

• Feedback is recorded listed and promoted over HTTP — TestFeedbackIsRecordedListedAndPromotedOverHTTP. The journey a caller actually performs: find a record, report a doubt about it, read the queue, promote the one that was right, and see the graph change only then.
• Feedback reveals nothing across projects — TestFeedbackRevealsNothingAcrossProjects. A project's feedback, and the records it is about, are invisible from another project — and the refusals are identical, so existence cannot be read off which one came back.
• Feedback routes refuse what they cannot serve — TestFeedbackRoutesRefuseWhatTheyCannotServe. Every refusal the routes answer with, over HTTP, in the shape a client parses.
• Promotion over HTTP names the entity name bound it hits — TestPromotionOverHTTPNamesTheEntityNameBoundItHits. The feedback writer's bounds are the correction's, and neither of them is the bound on how many spellings one entity may carry.
• Feedback routes refuse when the deployment has no feedback store — TestFeedbackRoutesRefuseWhenTheDeploymentHasNoFeedbackStore. A deployment wired without the feedback store refuses the three routes rather than panicking on the first call.

freshness_test.go

• An empty project has no stored offset and its first observation has zero — TestAnEmptyProjectHasNoStoredOffsetAndItsFirstObservationHasZero

groups_test.go

• Observation groups round trip through HTTP and export — TestObservationGroupsRoundTripThroughHTTPAndExport
• Invalid groups leave no observation or offset — TestInvalidGroupsLeaveNoObservationOrOffset

health_test.go

• Readiness bounds database failure and probe amplification while liveness works — TestReadinessBoundsDatabaseFailureAndProbeAmplificationWhileLivenessWorks
• Canceled probe cannot poison readiness and absent configuration fails closed — TestCanceledProbeCannotPoisonReadinessAndAbsentConfigurationFailsClosed

history_test.go

• Knowledge before first assertion returns no facts — TestKnowledgeBeforeFirstAssertionReturnsNoFacts

idempotency_test.go

• Concurrent observation retries share one receipt and one formation — TestConcurrentObservationRetriesShareOneReceiptAndOneFormation
• Erasure and retention prevent stale retries from restoring content — TestErasureAndRetentionPreventStaleRetriesFromRestoringContent
• Invalid retry keys are refused before allocating an offset — TestInvalidRetryKeysAreRefusedBeforeAllocatingAnOffset
• Retry receipt failure rolls back the observation — TestRetryReceiptFailureRollsBackTheObservation
• Retry fingerprint is stable across domain refactors — TestRetryFingerprintIsStableAcrossDomainRefactors

ingestionbudget_test.go

• Backlog refusal is retryable and preserves the original receipt — TestBacklogRefusalIsRetryableAndPreservesTheOriginalReceipt

manage_test.go

• The management door opens for an operator credential and nothing else — TestTheManagementDoorOpensForAnOperatorCredentialAndNothingElse. The management door opens for an operator credential and nothing else, and the memory door does not open for an operator credential: two kinds, each refused at the other's door with the answer a stranger gets, and a revoked operator is a stranger.
• An operator runs the project and credential lifecycle over the API — TestAnOperatorRunsTheProjectAndCredentialLifecycleOverTheAPI. An operator creates a project, mints a credential for it that works on the memory routes, suspends the project so the credential stops working, resumes it, lists and revokes the credential; a project that does not exist mints nothing and a name that is not an identifier is refused before anything is touched.
• An operator reads what the instance refused erased and formed and every read is on the ledger — TestAnOperatorReadsWhatTheInstanceRefusedErasedAndFormedAndEveryReadIsOnTheLedger. An operator reads what the instance refused, erased and formed without a database connection and without reading a word of anybody's: counts, receipts, watermarks and parked turns; unparks one; seals and verifies the ledger.
• The management surface answers internal when the database cannot — TestTheManagementSurfaceAnswersInternalWhenTheDatabaseCannot. A database that cannot answer is an internal error from every management operation, never an empty answer that reads as "nothing to report": the tables are moved away one at a time under the running server, and each operation that reads them says so.

mcp_test.go

• MCP lists exactly the six tools and none deletes — TestMCPListsExactlyTheSixToolsAndNoneDeletes. The tool list is exactly the six, in the order declared, and none of them deletes: a host reads the list as a menu, and erasure, export and feedback promotion are deliberately absent from it.
• MCP observe freshness recall and citation are the same operations — TestMCPObserveFreshnessRecallAndCitationAreTheSameOperations. A turn observed through a tool is the same observation a REST caller makes: freshness sees it, recall answers from it, and a citation resolves to it, each through the same credential and the same ledger.
• MCP refuses without a credential before any tool runs — TestMCPRefusesWithoutACredentialBeforeAnyToolRuns. Without a credential the door is closed before the protocol is spoken, and a credential the deployment does not know is refused the same way: one answer, no distinction for a stranger.

messages_test.go

• Message windows resolve saved passages across generation changes — TestMessageWindowsResolveSavedPassagesAcrossGenerationChanges. A preview continues into its exact message, even when neighboring text plausibly matches.
• Message windows bound inputs and do not expose foreign or expired sources — TestMessageWindowsBoundInputsAndDoNotExposeForeignOrExpiredSources
• Message windows refuse oversized or unavailable authoritative storage — TestMessageWindowsRefuseOversizedOrUnavailableAuthoritativeStorage

notifications_test.go

• A formed scope tells its endpoint and the notification carries no memory — TestAFormedScopeTellsItsEndpointAndTheNotificationCarriesNoMemory. ── Notifications ───────────────────────────────────────────────────────────────────────────── A notification is delivered, carries no memory, is signed so a receiver can tell our call from anybody's, and can be discarded by offset when it arrives twice.
• A destination that keeps failing is retried then parked where an operator can see it — TestADestinationThatKeepsFailingIsRetriedThenParkedWhereAnOperatorCanSeeIt. A destination that keeps refusing is retried and then parked, visibly.
• A delivery failure can only be stored as a category — TestADeliveryFailureCanOnlyBeStoredAsACategory. A delivery's failure can be stored only as one of the categories the sender produces.
• A deployment with no permitted destination refuses every notification route — TestADeploymentWithNoPermittedDestinationRefusesEveryNotificationRoute. A deployment whose operator has named no destination refuses every notification route, rather than accepting a registration it will never honour.
• A destination that calls the request wrong is parked on the first attempt — TestADestinationThatCallsTheRequestWrongIsParkedOnTheFirstAttempt. A destination that says the request is wrong is not asked again.
• Disabling what is not there is refused and disabling twice is the same refusal — TestDisablingWhatIsNotThereIsRefusedAndDisablingTwiceIsTheSameRefusal. The refusals a customer meets when they get an identifier wrong, and the one they meet when they disable something twice.
• Notification routes answer internally without describing the database — TestNotificationRoutesAnswerInternallyWithoutDescribingTheDatabase. When the store cannot answer, every notification route says so without saying what went wrong.

operations_test.go

• The declared surface is one the ledger can account for — TestTheDeclaredSurfaceIsOneTheLedgerCanAccountFor. The surface this binary actually serves passes its own check.
• An operation the ledger cannot name is refused — TestAnOperationTheLedgerCannotNameIsRefused. An operation the ledger cannot name is refused, rather than served unaccounted for.
• Two routes under one name are refused — TestTwoRoutesUnderOneNameAreRefused. Two routes under one name are refused, because the ledger could not tell them apart afterwards.
• Operations reports the paths as sent — TestOperationsReportsThePathsAsSent. What Operations() hands out is what the mux serves: the version prefix, and nothing a caller could mutate.

passages_live_test.go

• Configured passage provider serves authenticated evidence — TestConfiguredPassageProviderServesAuthenticatedEvidence. Real provider vectors traverse the authenticated HTTP route, including query embedding.

passages_test.go

• Passage search returns authoritative message evidence without facts — TestPassageSearchReturnsAuthoritativeMessageEvidenceWithoutFacts
• Passage requests refuse before provider work and hide configuration details — TestPassageRequestsRefuseBeforeProviderWorkAndHideConfigurationDetails
• Passage search rechecks memory after provider returns — TestPassageSearchRechecksMemoryAfterProviderReturns. The provider runs outside a database transaction.
• Catch up passages expose new evidence and conservative coverage — TestCatchUpPassagesExposeNewEvidenceAndConservativeCoverage

plugin_test.go

• The plugin names this route and only tools that exist — TestThePluginNamesThisRouteAndOnlyToolsThatExist. The plugin's declarations agree with the server: the MCP server it configures is this route, with the credential as a bearer, and every command names only tools that exist.
• The plugin hooks run against a live deployment — TestThePluginHooksRunAgainstALiveDeployment. The hooks run against a live deployment with the plugin's settings in the environment: the session-start hook says how far behind memory is and never blocks; the capture hook records the user's message only when capture is on, under a key that makes a second firing a replay.

portal_test.go

• The portal shows nothing before an operator signs in and every panel is a table on the ledger — TestThePortalShowsNothingBeforeAnOperatorSignsInAndEveryPanelIsATableOnTheLedger. The portal serves nothing to a browser that has not signed in, opens for an operator credential and no other, shows every panel from the tables that exist with the numbers those tables hold, leaves every panel on the ledger, and signs a revoked operator out at the registry.
• The portal says when a table cannot answer and refuses what it cannot read — TestThePortalSaysWhenATableCannotAnswerAndRefusesWhatItCannotRead. A page whose table cannot answer is an error page, never an empty panel that reads as "nothing to report"; a sign-in whose form cannot be read is refused; a session the process no longer holds is sent to sign in.
• The portal loads nothing from outside its own origin — TestThePortalLoadsNothingFromOutsideItsOwnOrigin. ── The console loads nothing it does not carry ─────────────────────────────────────────────── Every page the portal renders references nothing outside its own origin: no script, no remote stylesheet or font, no image.
• The overview counts the ledger for the window and project asked — TestTheOverviewCountsTheLedgerForTheWindowAndProjectAsked. ── What the instance has been doing ────────────────────────────────────────────────────────── The overview counts the ledger for the window and the project the operator asks for, and only those: a window is one the page offers and a project is one the instance holds, anything else is the default.

portalactions_test.go

• The portal refuses an action that did not come from the portal — TestThePortalRefusesAnActionThatDidNotComeFromThePortal. ── A portal action must prove it came from the portal ──────────────────────────────────────── A request that changes something must prove it came from the page.
• Every portal action records the operator on the ledger — TestEveryPortalActionRecordsTheOperatorOnTheLedger. Every action is a management operation that already had a ledger name, and every one of them records the operator as principal.
• An irreversible portal action is refused without its typed confirmation — TestAnIrreversiblePortalActionIsRefusedWithoutItsTypedConfirmation. Revoking cannot be undone from the page, so it asks for the identifier to be typed back.
• The portal shows no memory and cannot reach it — TestThePortalShowsNoMemoryAndCannotReachIt. The ops centre is not for reading memory.
• The portal reports how the instance is running — TestThePortalReportsHowTheInstanceIsRunning. The panel an operator opens the page for.
• Every portal action refuses a target it cannot act on — TestEveryPortalActionRefusesATargetItCannotActOn. Every action checks what it was given before it touches a store.
• Retrying a turn that is not parked says so rather than claiming success — TestRetryingATurnThatIsNotParkedSaysSoRatherThanClaimingSuccess. Retrying a turn that is not parked is not an error — it was already retried, by another operator or by the driver — and saying so is more useful than a success message about work that did not happen.
• A refused portal action never writes the callers text into the ledger — TestARefusedPortalActionNeverWritesTheCallersTextIntoTheLedger. A refused action records a refusal, and the project it records is one that validated or none at all.

portalactivity_internal_test.go

• A trend says how a number moved and colours only refusals — TestATrendSaysHowANumberMovedAndColoursOnlyRefusals. A trend is a percentage against the window before, "new" when there was nothing before, and is coloured good or bad only where the direction means something: refusals.
• A window is one the page offers — TestAWindowIsOneThePageOffers. A window is one the page offers or the default; a query cannot name one of its own.
• The activity is shaped for the page from the ledgers counts — TestTheActivityIsShapedForThePageFromTheLedgersCounts. The chart draws in the window's own scale and names a bucket at the precision its width needs; the ranking within one project is its busiest operations, at most six, scaled to the busiest.
• The switcher marks the project shown — TestTheSwitcherMarksTheProjectShown. The switcher lists every project and all of them, marks the one shown, and says which it is.

portalshare_internal_test.go

• A meter is clamped and never divides by nothing — TestAMeterIsClampedAndNeverDividesByNothing. A meter never leaves its box and never divides by nothing: an empty ceiling is an empty bar, a count past its ceiling is a full one, and between them the share is truncated rather than rounded, so a bar never reads full before it is.

rebuildvisibility_test.go

• Freshness over HTTP says a project is being reinterpreted — TestFreshnessOverHTTPSaysAProjectIsBeingReinterpreted. A caller polling freshness learns that the project is being reinterpreted, and a caller asking a question does not pay for that.

recall_controls_test.go

• Recall control conformance over HTTP — TestRecallControlConformanceOverHTTP. This fixture is portable to SDK conformance runners.
• Recall controls preserve temporal subject erasure and project boundaries — TestRecallControlsPreserveTemporalSubjectErasureAndProjectBoundaries

recalllimits_test.go

• Recall admission limits are client refusals over HTTP — TestRecallAdmissionLimitsAreClientRefusalsOverHTTP

records_internal_test.go

• Unconfigured record inspection fails closed — TestUnconfiguredRecordInspectionFailsClosed

records_test.go

• Record inspection works over HTTP without cross project disclosure — TestRecordInspectionWorksOverHTTPWithoutCrossProjectDisclosure
• Record inspection reports storage failure without database details — TestRecordInspectionReportsStorageFailureWithoutDatabaseDetails

reportcandidates_test.go

• Report candidate search is authenticated bounded and thematic — TestReportCandidateSearchIsAuthenticatedBoundedAndThematic

request_test.go

• Ambiguous bodies cannot append or erase — TestAmbiguousBodiesCannotAppendOrErase

retractionlimits_test.go

• Retraction HTTP source limit refuses without changing records — TestRetractionHTTPSourceLimitRefusesWithoutChangingRecords

retractions_test.go

• Retraction HTTP preserves history and cannot be undone by formation — TestRetractionHTTPPreservesHistoryAndCannotBeUndoneByFormation
• Retraction HTTP rejects foreign i ds unknown fields and reader mutations — TestRetractionHTTPRejectsForeignIDsUnknownFieldsAndReaderMutations

sensitivity_test.go

• Separate projects enforce content access across the memory lifecycle — TestSeparateProjectsEnforceContentAccessAcrossTheMemoryLifecycle. Two sensitivity domains can share entity names and caller subject identifiers without sharing memory.

speaker_test.go

• Speakers stay separate through correction traversal export and erasure — TestSpeakersStaySeparateThroughCorrectionTraversalExportAndErasure
• Formation refuses unbound and reported speakers and binds arabic — TestFormationRefusesUnboundAndReportedSpeakersAndBindsArabic
• Speaker binding checks the stored source rather than caller arguments — TestSpeakerBindingChecksTheStoredSourceRatherThanCallerArguments
• Report material keeps opaque speaker references and shared organization identity — TestReportMaterialKeepsOpaqueSpeakerReferencesAndSharedOrganizationIdentity

subjects_internal_test.go

• Subject storage must be configured before serving its routes — TestSubjectStorageMustBeConfiguredBeforeServingItsRoutes

subjects_test.go

• Managed subject HTTP journey preserves speaker identity and keeps references out of recall — TestManagedSubjectHTTPJourneyPreservesSpeakerIdentityAndKeepsReferencesOutOfRecall
• Subject HTTP refusals do not write or expose storage diagnostics — TestSubjectHTTPRefusalsDoNotWriteOrExposeStorageDiagnostics