[IAmJSD]

Part B of #35. It covers the internal/api test files whose names sort after handler_config_test.go, plus all of internal/auth, internal/scheduler, internal/server and internal/email. Part A (the internal/api files up to and including handler_config_test.go) is a separate branch. This PR does not edit any part A file or any non-test file.

Refs #35

Problem

Many tests in these packages register testify expectations with .On(...) but never call AssertExpectations. If the code under test stopped calling a collaborator, these tests would still pass. A file-level grep undercounts the problem, because many files assert some of their mocks and not others, and some build their mocks in helpers. So I measured it per test at runtime instead. I ran each package against a temporary copy of testify that logs every On, Maybe, Times, matched call and AssertExpectations. This instrumentation lives outside the repository and is not committed. The audit then lists every test that leaves a mock with a required (non-Maybe) expectation unasserted.

Fix

Every test in scope that registers a required expectation now verifies it. In most cases this is t.Cleanup(func() { m.AssertExpectations(t) }) right where the mock is built. Where a helper builds the mock, the cleanup goes in the helper.

• Helpers that build mocks and are called only from part B files now take t and register the cleanup themselves. Examples: adminHistoryReq, adminDashboardReq, adminInventoryReq, scopedAuthMock, buildSession{Retry,Cancel}Handler, cancelRouteHandler, adminSession, newRecProvider (scheduler) and newCompensationAuth.
• Helpers that part A files also call keep their signatures (setupDirectExecMocks, expectStoredRecs, newCreateConcurrencyFixture, and part A's own setupAdminAuth and sharedNameHandler). The cleanup goes at the part B call sites instead.
• Two helpers live in part B files but part A tests call them. They now assert, and the part A tests that use them pass: historyScopeIDs (used by account_scope_shared_name_test.go) and newTokenApprove (used by claimed_row_check_test.go). newTokenApprove now registers its session and global-config stubs in approve(), because only that path reads them. These two helpers can't conflict textually with part A, but please re-check them on the combined tree.

Turning the assertions on made 93 tests fail on expectations that never fired. I decided each case on its own:

Stale or over-broad stubs, removed or made .Maybe(), each with a comment explaining why. Where a refusal path must make no call, the call is left unregistered (an unexpected call fails the test) or pinned with AssertNotCalled.

• An admin X-API-Key request never validates the bearer session (17 handler_test.go tests, plus putPlan and postPlannedPurchaseAt).
• A session or CSRF check now runs before the row lookup (sec(api): unauthenticated cancel/revoke distinguish missing (404) from existing (401) executions #435, sec(api): authenticated callers can still tell a missing execution from an existing one on approve, cancel and revoke #597). This applies to the approve/cancel/revoke missing-session tests, the RequiresCSRF tests and the oracle fixtures, which now also assert GetExecutionByID is not called.
• An RI exchange record with no region fails at the region guard before ReserveApprovedRIExchange. The four-eyes RI fixture now takes the auth path and the outcome, so each case expects exactly its own calls.
• Validation refuses a request before the store reads. This covers the SP multistep PATCH, the start-date guard, upcoming filters, the ladder cap and the paginated/unpaginated reads of the recommendations page.
• Smaller cases: getHistory resolves the approver email only for pending rows, getPublicInfo never consults the rate limiter, the scope check runs before the approve-any/retry-any grant, a plain reader never resolves the stale TTL (TestScheduler_ListRecommendations now asserts GetGlobalConfig is not called), and a few copy-pasted stubs in internal/auth and internal/email.

Tests that passed for the wrong reason. These now reach the path their names describe:

• TestHandler_patchPlan_UpdateError failed plan validation ("plan must have at least one service") and never reached the UpdatePurchasePlan error it is named for. It now uses a valid plan and asserts the mapped 500.
• TestHandler_approvePurchase_RejectsCreatorWithoutApprovePermission was refused by the CSRF check before the permission check ran. With a valid CSRF token it now asserts the permission denial, which is concealed as a missing execution (sec(api): authenticated callers can still tell a missing execution from an existing one on approve, cancel and revoke #597).
• TestHandler_runPlannedPurchase_NilExecution was refused because admin:* does not grant execute (test(auth): fail when an API adapter drops a request field #923). It now holds the purchaser verbs and reaches RunPlannedPurchaseNow.
• TestHandler_deleteUser_Error and TestHandler_deleteGroup_DeleteFailed used IDs that are not UUIDs, so they failed validation before reaching the store. They now assert that the store error comes through.
• TestUpdateRIExchangeConfig_PermissionGate ("with update:config") sent a body that no longer decodes, so it passed with a 400. It now sends a valid body and saves.

I found no production bug. Every missing call was a stale test stub, or a test whose setup stopped it from reaching the path it targets.

Per-package counts

The .On( vs AssertExpectations grep metric from #35 counts in-scope files with .On( but no AssertExpectations text:

package	before	after
internal/api (files after handler_config_test.go)	78	18
internal/auth	6	1
internal/scheduler	6	1
internal/server	2	1
internal/email	2	1

The 22 remaining files are not gaps. Each one holds only .Maybe() stubs, or is a helper whose mocks are asserted by the code that builds them. Examples: mocks_test.go grant helpers, newSelfScopeHarness, newPartialSweepScheduler, adminSession, and the integration fixtures, which are all .Maybe(). The runtime audit is the authoritative measure:

package	tests with an unasserted required expectation, before	after
internal/api (part B tests)	739	0
internal/auth	40	0
internal/scheduler	51	0
internal/server	24	0
internal/email	14	0

The same audit over the in-scope -tags integration tests in internal/api and internal/scheduler also reports 0 after the change. After this PR, the same audit still finds 316 such tests in the part A internal/api files. Part A covers those, so #35 can close once both parts merge.

Verification

This evidence comes from unit tests, mocks, and integration tests run on real Postgres in testcontainers. The repo's go-test hook and the race run were done per package on this branch only.

export AWS_CONFIG_FILE=/dev/null AWS_SHARED_CREDENTIALS_FILE=/dev/null AWS_EC2_METADATA_DISABLED=true
go build ./... && go vet ./... && go vet -tags integration ./...          # ok
go test -count=1 ./internal/mocks/                                      # ok (incl. TestNoUnfailableMockAssertions)
go test -count=1 -race ./internal/{email,server,scheduler,auth,api}/    # all ok (api 81s)
go test -count=4 ./internal/{email,server,scheduler,auth,api}/          # all ok (async cleanup flakiness check)
go test -tags integration -count=1 -timeout 20m -run '^(<the 48 tests in the in-scope api *_integration_test.go files and handler_marketplace_recover_integration_test.go>)$' ./internal/api/   # ok, 67s
go test -tags integration -count=1 -run '^TestAWSRecommendationCompletenessPersistence$' ./internal/scheduler/   # ok
golangci-lint run --allow-parallel-runners ./internal/{api,auth,scheduler,server,email}/...                       # 0 issues
golangci-lint run --allow-parallel-runners --build-tags integration ./internal/api/... ./internal/scheduler/...   # 0 issues
gofmt -l internal/   # clean

Mutation probes, fail-before/pass-after. Each one temporarily breaks production code so that it skips a collaborator call, runs the named test against the origin/main snapshot and against this branch, then restores the file:

mutation (temporary)	test	origin/main	this branch
getPublicInfo stops calling CheckAdminExists	TestHandler_getPublicInfo/with_auth_service_and_no_admin	PASS (not caught)	FAIL
patchPlan skips UpdatePurchasePlan	TestHandler_patchPlan_UpdateError	PASS (not caught)	FAIL
authorizeSessionApprove allows every session	TestHandler_approvePurchase_RejectsCreatorWithoutApprovePermission	PASS (not caught)	FAIL
authServiceAdapter.Logout skips the service	TestAuthServiceAdapter_Logout	PASS (not caught)	FAIL
Login skips RecordSuccessfulLogin	TestLogin_WithMFA	PASS (not caught)	FAIL
isInSandbox skips GetAccount	TestSender_SendToEmail_Error	PASS (not caught)	FAIL

Combined-tree verification. Tested on a local, never-pushed tree: queue/platform @ 594ac3ec = origin/main ae6854b3 plus:

Branch	Tested head
fix/issue-357-delete-cleanup-lambda	56989d8
fix/issue-36-archera-gate	2d22986
fix/issue-35-assert-api-a	f793689
fix/issue-35-assert-api-b	fac72f3
fix/issue-120-stale-rec-sweep	07c2e9c
fix/issue-981-summary-sql	7056746

Linux, Go 1.26.9, AWS_CONFIG_FILE=/dev/null AWS_SHARED_CREDENTIALS_FILE=/dev/null AWS_EC2_METADATA_DISABLED=true; Docker Postgres via testcontainers.

• Passed: go build ./..., go vet ./..., go vet -tags integration ./... and the full go test -race -short -count=1 ./....
• Static checks: golangci-lint v2.10.1 found 0 issues on every changed package, with and without --build-tags integration. gocyclo -over 10 is silent on the changed non-test files.
• Integration tests (-tags integration -count=1, one package at a time): internal/api, internal/auth, internal/config, internal/scheduler, internal/server and internal/testutil pass.
• Secrets: git-secrets on the changed files found nothing, and a planted fake key was flagged; scripts/test-git-secrets-allowlist.sh passes.

Out of scope / notes

• Part A's internal/api files are untouched, apart from the two shared helpers named above, which live in part B files.
• I noticed two things in passing and changed neither, because both look intentional:
  • getPublicInfo (/api/info, AuthPublic) is not rate limited by the handler.
  • The RI exchange email-token approve path validates no CSRF token even when a session is attached for attribution. The token is what authorizes the request.
• No migrations, Terraform, workflows or frontend changes.

Could a maintainer mirror #35's triage labels onto this PR: impact/internal, type/chore, triaged, priority/p3, severity/low, urgency/eventually, effort/s.

🤖 Generated with Claude Code

[coderabbitai]

Important

Review skipped

Too many files!

This PR contains 132 files, which is 32 over the limit of 100.

To get a review, reduce the PR to 100 files or fewer by splitting it into smaller PRs or changing its base branch.

Upgrade to a paid plan to raise the limit.

This review couldn't start because sufficient usage credits or metered capacity aren't available. Add credits or update usage-based reviews in the billing tab, then retry.

Check out review usage here.

Run configuration

• Source mode: Auto
• Repository: LeanerCloud/cloud-commitments-platform
• Branch: main
• File: .coderabbit.yaml
• Commit: ae6854b
• Layers: Repository YAML
• Review profile: CHILL
• Plan: Advanced
• Run ID: ded70c83-8e40-42d3-9271-615be60fe975

Commits

Reviewing files that changed from the base of the PR and between ae6854b and fac72f3.

Files selected for processing: 132

• internal/api/handler_coverage_test.go
• internal/api/handler_dashboard_test.go
• internal/api/handler_dashboard_upcoming_filter_test.go
• internal/api/handler_federation_azure_escape_test.go
• internal/api/handler_federation_test.go
• internal/api/handler_forgot_password_ratelimit_test.go
• internal/api/handler_groups_account_binding_test.go
• internal/api/handler_groups_test.go
• internal/api/handler_history_actionable_starvation_test.go
• internal/api/handler_history_actionable_test.go
• internal/api/handler_history_page_test.go
• internal/api/handler_history_plan_filter_test.go
• internal/api/handler_history_scope_provider_test.go
• internal/api/handler_history_summary_test.go
• internal/api/handler_history_test.go
• internal/api/handler_history_truncation_test.go
• internal/api/handler_insurance_comparison_test.go
• internal/api/handler_insurance_test.go
• internal/api/handler_inventory_scope_provider_test.go
• internal/api/handler_inventory_test.go
• internal/api/handler_ladder_test.go
• internal/api/handler_ladder_timeline_test.go
• internal/api/handler_marketplace_attempt_test.go
• internal/api/handler_marketplace_compensation_integration_test.go
• internal/api/handler_marketplace_credentials_test.go
• internal/api/handler_marketplace_poller_test.go
• internal/api/handler_marketplace_recover_integration_test.go
• internal/api/handler_marketplace_recover_test.go
• internal/api/handler_marketplace_test.go
• internal/api/handler_not_found_mapping_test.go
• internal/api/handler_override_audit_integration_test.go
• internal/api/handler_override_audit_test.go
• internal/api/handler_override_import_integration_test.go
• internal/api/handler_override_import_test.go
• internal/api/handler_override_transfer_test.go
• internal/api/handler_per_account_perms_test.go
• internal/api/handler_plans_concurrency_integration_test.go
• internal/api/handler_plans_managed_guard_integration_test.go
• internal/api/handler_plans_ramp_shape_test.go
• internal/api/handler_plans_services_merge_test.go
• internal/api/handler_plans_sp_multistep_test.go
• internal/api/handler_plans_start_date_test.go
• internal/api/handler_plans_step_cap_test.go
• internal/api/handler_plans_test.go
• internal/api/handler_purchase_action_test.go
• internal/api/handler_purchases_apikey_scope_test.go
• internal/api/handler_purchases_cancel_constraints_test.go
• internal/api/handler_purchases_delay_token_test.go
• internal/api/handler_purchases_finalize_test.go
• internal/api/handler_purchases_grace_config_test.go
• internal/api/handler_purchases_notified_test.go
• internal/api/handler_purchases_owner_key_probe_helpers_test.go
• internal/api/handler_purchases_owner_key_probe_test.go
• internal/api/handler_purchases_pause_resume_constraints_test.go
• internal/api/handler_purchases_pause_resume_key_test.go
• internal/api/handler_purchases_plan_step_approve_test.go
• internal/api/handler_purchases_planned_update_any_test.go
• internal/api/handler_purchases_retry_dedupe_test.go
• internal/api/handler_purchases_retry_redrive_test.go
• internal/api/handler_purchases_revoke_actor_integration_test.go
• internal/api/handler_purchases_revoke_constraints_test.go
• internal/api/handler_purchases_revoke_quote_test.go
• internal/api/handler_purchases_revoke_uncertain_test.go
• internal/api/handler_purchases_run_update_any_test.go
• internal/api/handler_purchases_test.go
• internal/api/handler_purchases_token_errors_test.go
• internal/api/handler_purchases_token_oracle_test.go
• internal/api/handler_query_param_validation_test.go
• internal/api/handler_recommendations_page_test.go
• internal/api/handler_recommendations_scan_test.go
• internal/api/handler_recommendations_test.go
• internal/api/handler_registrations_approve_test.go
• internal/api/handler_registrations_credentials_test.go
• internal/api/handler_registrations_recipients_test.go
• internal/api/handler_registrations_submit_test.go
• internal/api/handler_registrations_token_test.go
• internal/api/handler_ri_exchange_azure_test.go
• internal/api/handler_ri_exchange_history_scope_test.go
• internal/api/handler_ri_exchange_test.go
• internal/api/handler_ri_utilization_scope_test.go
• internal/api/handler_router_test.go
• internal/api/handler_test.go
• internal/api/handler_users_test.go
• internal/api/health_test.go
• internal/api/ladder_arming_grant_test.go
• internal/api/middleware_test.go
• internal/api/nullable_purchase_cost_test.go
• internal/api/patch_csrf_test.go
• internal/api/plan_mutation_scope_test.go
• internal/api/plan_step_no_recs_test.go
• internal/api/purchase_currency_test.go
• internal/api/purchase_pricing_test.go
• internal/api/recommendations_background_collection_scope_test.go
• internal/api/recommendations_next_collection_test.go
• internal/api/refresh_recommendations_scope_test.go
• internal/api/reshape_offered_types_test.go
• internal/api/retry_carveout_test.go
• internal/api/ri_exchange_approve_reject_status_test.go
• internal/api/ri_exchange_audit_test.go
• internal/api/router_660_permission_flips_test.go
• internal/api/router_authuser_test.go
• internal/api/router_handlers_test.go
• internal/api/service_config_scope_test.go
• internal/api/session_denial_final_test.go
• internal/api/tenant_scope_sweep_test.go
• internal/auth/explicit_zero_cap_test.go
• internal/auth/group_combination_test.go
• internal/auth/group_permission_change_test.go
• internal/auth/negative_purchase_cap_test.go
• internal/auth/not_found_sentinels_test.go
• internal/auth/service_api_fields_test.go
• internal/auth/service_api_test.go
• internal/auth/service_apikeys_effective_test.go
• internal/auth/service_apikeys_test.go
• internal/auth/service_group_only_authz_test.go
• internal/auth/service_mfa_login_token_test.go
• internal/auth/service_mfa_test.go
• internal/auth/service_test.go
• internal/auth/service_user_lookup_test.go
• internal/email/log_redaction_test.go
• internal/email/mute_test.go
• internal/email/sender_test.go
• internal/email/templates_test.go
• internal/scheduler/aws_payment_test.go
• internal/scheduler/background_collection_test.go
• internal/scheduler/bastion_resolve_test.go
• internal/scheduler/list_accounts_error_test.go
• internal/scheduler/recommendation_identity_test.go
• internal/scheduler/scheduler_test.go
• internal/scheduler/zonal_recs_test.go
• internal/server/adapter_not_found_test.go
• internal/server/adapter_test.go

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE fac72f3acd47c610b0e9f20086819f9a2519d529

Blocking:

• none

Non-blocking:

• Of the roughly 20 .Maybe() stubs added, 7 are on GetExecutionByID in shared fixtures (handler_purchases_test.go, handler_purchases_token_oracle_test.go, middleware_test.go). Where a whole case should never reach the lookup, a per-case AssertNotCalled would pin that more tightly than an optional stub. This is not a regression, because before this PR these stubs were never asserted at all.
• recommendations_background_collection_scope_test.go: the fail-closed scope test now relies on an unregistered MockScheduler method panicking instead of on the old captured-read assertion. It still fails if a read happens: ListRecommendations is pinned with AssertNotCalled, and ScanRecommendations panics on an unexpected call. Explicit AssertNotCalled for ScanRecommendations (and for PageRecommendations once perf(api): page recommendations with every list filter in SQL and an aggregate summary #1596 lands) would read more clearly.
• This is a partial fix, and the PR correctly says Refs #35. TEST-03: 19 Go test files register .On() expectations without mock.AssertExpectations, incl. money-path regression suite #35 closes only when test(api): assert mock expectations in the first half of the api tests #1593 has merged too.

Attacked:

• Read the diff (132 test files, no non-test file). Checked that it touches no part-A file: no internal/api file sorting at or before handler_config_test.go is changed, and none overlaps with test(api): assert mock expectations in the first half of the api tests #1593. Read every removed assert/require line. Each one is replaced by a stronger check: deleteUser/deleteGroup now use valid UUIDs and assert the store error, patchPlan_UpdateError asserts the mapped 500 and its message, RejectsCreatorWithoutApprovePermission sends a CSRF token so it reaches the permission check and asserts the concealed denial, and runPlannedPurchase_NilExecution asserts the error text.
• Fail-before (mutation): I made authServiceAdapter.Logout skip the service. TestAuthServiceAdapter_Logout PASSES on origin/main (ae6854b) and FAILS here. I also made getPublicInfo skip CheckAdminExists: TestHandler_getPublicInfo/with_auth_service_and_no_admin PASSES on main and FAILS here. Restored afterwards.
• Ran: go build ./..., go vet ./..., go vet -tags integration ./... (clean); go test -race -short -count=1 on internal/{api,auth,scheduler,server,email,mocks} (all ok). Grep counts for files with .On( but no AssertExpectations match the body's "after" column (auth/scheduler/server/email at 1 each, and 18 in the part-B api files).
• Combined tree (my own local merge of test(api): assert mock expectations in the first half of the api tests #1593 + test(api,auth,scheduler,server,email): assert mock expectations in the remaining tests #1594 + perf(api): page recommendations with every list filter in SQL and an aggregate summary #1596 onto ae6854b): build/vet clean; go test -race -short ./internal/... all ok; -tags integration for internal/api, internal/scheduler, internal/auth and internal/server all ok. So the two shared helpers that part-A tests call (historyScopeIDs, newTokenApprove) hold up together with part A.

Body-stale:

• none

_{Reviewer: rQ4. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

[IAmJSD]

Independent review (IAmJSD's agent, fresh context, given only the diff, the issue and the PR text): VERDICT: APPROVE fac72f3acd47c610b0e9f20086819f9a2519d529

Blocking:

• none

Non-blocking:

• internal/api/handler_ri_exchange_test.go:663 The approved path of fourEyesRIExchangeFixture now ends at the region guard (FailRIExchange), and the dead ReserveApprovedRIExchange stub is gone. The stub was correct to remove. The four-eyes cases never exercised the spend-ceiling reservation, and other RI tests cover it (ri_exchange_approve_reject_status_test.go, ri_exchange_detached_test.go). Giving the fixture a region later would let these cases go through the reservation too.
• (From an earlier review, which I agree with.) Several shared fixtures now carry .Maybe() on GetExecutionByID. For cases that must never reach the lookup, a per-case AssertNotCalled would pin that more tightly. This is not a regression.
• One commit of about 2,100 changed lines, over the team's 400-line commit guideline. It is mechanical and test-only, so this does not matter if the PR is squash-merged.

Attacked:

• Read the full three-dot diff, looking at every removed assertion or stub. Each removed .On now makes an unexpected call panic, and HandleRequest has no global recover, so the test fails. The rewritten assertions all got stronger:
  • deleteUser_Error and deleteGroup_DeleteFailed now use valid UUIDs and check the store error with EqualError.
  • RejectsCreatorWithoutApprovePermission now passes a valid CSRF token and checks the concealed 404 with requireConcealedDenial, which matches sec(api): authenticated callers can still tell a missing execution from an existing one on approve, cancel and revoke #597.
  • UpdateRIExchangeConfig_PermissionGate changed from assertNotForbidden to NoError plus a required save.
  • The token-oracle test now registers no lookup for unauthenticated callers and still asserts 401 and identical bodies.
  • The name-only AssertNotCalled(t, "GetGlobalConfig") in the scheduler package goes through MockConfigStore's shadowed AssertNotCalled, so it is not vacuous. The internal/mocks guard passes.
  • The per-package file counts in the body match git show on both refs (api 78→18, auth 6→1, scheduler 6→1, server 2→1, email 2→1).
• Fail-before:
  • The PR's own getPublicInfo probe, reproduced: skipping CheckAdminExists makes with_auth_service_and_no_admin and auth_service_check_error_still_returns_response fail on this head, while both pass on main.
  • My own probes, which turned out not to discriminate: auth Logout skipping DeleteSession, the scheduler skipping ClearCollectionStarted, and inventory dropping filterPurchaseHistoryByAllowedAccounts. Each fails the same tests on main and on this head, so those paths were already covered.
  • All files were restored afterwards.
• On the head: go build ./..., go vet ./internal/... with and without -tags integration, go test -race -short -count=1 on api/auth/email/scheduler/server ok, -tags integration -count=1 on api/scheduler/auth/server/email ok, go test ./internal/mocks ok, golangci-lint v2.10.1 with and without --build-tags integration: 0 issues.
• Combined with test(api): assert mock expectations in the first half of the api tests #1593: the files do not overlap and the merge is clean. Both shared helpers (historyScopeIDs, newTokenApprove) pass in the combined tree under -race -short and -tags integration.

Body-stale:

• none. "Refs TEST-03: 19 Go test files register .On() expectations without mock.AssertExpectations, incl. money-path regression suite #35" is correct, since TEST-03: 19 Go test files register .On() expectations without mock.AssertExpectations, incl. money-path regression suite #35 closes only after test(api): assert mock expectations in the first half of the api tests #1593 merges too.

_{Reviewer: rQ3. Bar while the maintainers are away (set by IAmJSD as acting owner): one approving independent review on the head, two for money, auth and security paths.}

[IAmJSD]

Local verification at fac72f3acd47c610b0e9f20086819f9a2519d529 merged onto main (ae6854b3), together with #1593, #1594 in that order (combined tree f666a447, Linux, Go 1.26.10): go build ./..., go vet with and without -tags integration, the full go test -race -short -count=1 ./..., and go test -race -tags integration -count=1 on every changed package, against Docker Postgres. All pass. CI Success and pre-commit are green on this head, with 2 approving independent review(s) on it. Nothing was run against any cloud.

[IAmJSD]

Merged by IAmJSD's agent at IAmJSD's request (IAmJSD is acting owner while the maintainers are away), under the bar IAmJSD set: 2 approving independent review(s) on fac72f3a (two required: money, auth or security path), green CI, and the combined-tree verification above. Squash-merged at exactly fac72f3acd47c610b0e9f20086819f9a2519d529.