@ngocsangairvds/vsaf 3.2.13 → 3.2.15

package/tools/vds-scripts/audit_orchestrator/tests/unit/state/test_store.py

@@ -1,1435 +0,0 @@
-from __future__ import annotations
-
-from contextlib import contextmanager
-from datetime import UTC, datetime
-from pathlib import Path
-from unittest.mock import MagicMock, patch
-
-from psycopg.rows import dict_row
-from psycopg.types.json import Jsonb
-from vds_audit_orchestrator.state import store as state_store_module
-from vds_audit_orchestrator.state.store import PostgresStateStore
-
-# P4 / TSK-4.1.8: BOOTSTRAP_SQL constants + init_schema() were retired when
-# schema bootstrap moved to Alembic.  Schema CONTENT tests now read the squash
-# migration source.
-_SQUASH_PATH = Path(__file__).resolve().parents[3] / "alembic" / "versions" / "0001_initial_audit_state_schema.py"
-_SQUASH_SOURCE = _SQUASH_PATH.read_text(encoding="utf-8")
-
-
-@contextmanager
-def _null_context():
-    yield None
-
-
-def test_constructor_uses_autocommit_and_dict_row() -> None:
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        mock_connect.return_value = conn
-
-        PostgresStateStore("postgresql://user:pass@localhost:5432/state")
-        mock_connect.assert_called_once_with(
-            "postgresql://user:pass@localhost:5432/state",
-            autocommit=True,
-            row_factory=dict_row,
-        )
-
-
-def test_constructor_rejects_sqlite_dsn() -> None:
-    """PostgresStateStore must reject non-PostgreSQL DSNs (strict enforcement)."""
-    import pytest
-
-    with pytest.raises(ValueError, match="requires a PostgreSQL DSN"):
-        PostgresStateStore("sqlite:///tmp/state.db")
-
-
-def test_constructor_rejects_empty_dsn() -> None:
-    """PostgresStateStore must reject empty DSN strings."""
-    import pytest
-
-    with pytest.raises(ValueError, match="requires a PostgreSQL DSN"):
-        PostgresStateStore("")
-
-
-def test_constructor_rejects_mysql_dsn() -> None:
-    """PostgresStateStore must reject MySQL DSNs."""
-    import pytest
-
-    with pytest.raises(ValueError, match="requires a PostgreSQL DSN"):
-        PostgresStateStore("mysql://user:pass@localhost/db")
-
-
-def test_constructor_accepts_postgres_scheme() -> None:
-    """PostgresStateStore must accept both postgresql:// and postgres:// schemes."""
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        mock_connect.return_value = conn
-
-        PostgresStateStore("postgres://user:pass@localhost:5432/state")
-        mock_connect.assert_called_once_with(
-            "postgres://user:pass@localhost:5432/state",
-            autocommit=True,
-            row_factory=dict_row,
-        )
-
-
-def test_squash_migration_subsumes_bootstrap_sql_content() -> None:
-    """The Alembic squash subsumes every BOOTSTRAP_SQL artifact that
-    init_schema() previously emitted at runtime.
-
-    P4 / TSK-4.1.8 successor of test_init_schema_executes_bootstrap_sql_in_transaction.
-    init_schema() is retired (raises RuntimeError); schema bootstrap is now
-    Alembic-owned.  The structural guarantees that the old test enforced via
-    SQL-execute interception are now enforced against the squash migration
-    source — operators run the same SQL via `alembic upgrade head`.
-    """
-    sql = _SQUASH_SOURCE
-    assert "CREATE EXTENSION IF NOT EXISTS vector" in sql
-    assert "CREATE EXTENSION IF NOT EXISTS unaccent" in sql
-    assert "CREATE SCHEMA IF NOT EXISTS audit_state" in sql
-    assert "CREATE TABLE IF NOT EXISTS audit_state.schema_version" in sql
-    assert "CREATE TABLE IF NOT EXISTS audit_state.departments" in sql
-    assert "CREATE TABLE IF NOT EXISTS audit_state.bitbucket_projects" in sql
-    assert "CREATE TABLE IF NOT EXISTS audit_state.projects" in sql
-    assert "CREATE TABLE IF NOT EXISTS audit_state.repos" in sql
-    assert "head_commit_sha TEXT NOT NULL DEFAULT ''" in sql
-    assert "CREATE TABLE IF NOT EXISTS audit_state.artifacts" in sql
-    assert "CREATE TABLE IF NOT EXISTS audit_state.project_links" in sql
-    assert "CREATE TABLE IF NOT EXISTS audit_state.repo_links" in sql
-    assert "link_role TEXT NOT NULL DEFAULT ''" in sql
-    assert "normalized_url TEXT NOT NULL" in sql
-    assert "raw_url TEXT NOT NULL" in sql
-    assert "source_page_id TEXT NOT NULL DEFAULT ''" in sql
-    assert "source_page_url TEXT NOT NULL DEFAULT ''" in sql
-    assert "source_context TEXT NOT NULL DEFAULT ''" in sql
-    assert "last_seen_at TIMESTAMPTZ NOT NULL DEFAULT NOW()" in sql
-    assert "CREATE TABLE IF NOT EXISTS audit_state.project_preparation" in sql
-    assert "CREATE TABLE IF NOT EXISTS audit_state.repo_preparation" in sql
-    assert "sync_metadata JSONB NOT NULL DEFAULT '{}'::jsonb" in sql
-    assert "readiness TEXT" in sql
-    assert "CREATE TABLE IF NOT EXISTS audit_state.corpus_documents" in sql
-    assert "CREATE TABLE IF NOT EXISTS audit_state.corpus_chunks" in sql
-    assert "CREATE TABLE IF NOT EXISTS audit_state.corpus_embeddings" in sql
-    assert "content_hash TEXT NOT NULL DEFAULT ''" in sql
-    # corpus_documents blueprint columns
-    assert "source_uri TEXT NOT NULL DEFAULT ''" in sql, "corpus_documents.source_uri must be NOT NULL with default"
-    assert "doc_class TEXT" in sql, "corpus_documents should have doc_class column"
-    assert "version_tag TEXT NOT NULL DEFAULT ''" in sql, "corpus_documents.version_tag must be NOT NULL with default"
-    assert "title TEXT" in sql, "corpus_documents should have title column"
-    assert "page_title TEXT NOT NULL DEFAULT ''" in sql, "corpus_documents.page_title must be NOT NULL with default"
-    assert "space_key TEXT NOT NULL DEFAULT ''" in sql, "corpus_documents.space_key must be NOT NULL with default"
-    assert "parent_document_id BIGINT REFERENCES audit_state.corpus_documents(id) ON DELETE CASCADE" in sql
-    assert "ck_audit_state_corpus_documents_confluence_metadata_not_blank" in sql
-    # corpus_chunks blueprint columns
-    assert "chunk_order INTEGER" in sql, "corpus_chunks should have chunk_order column"
-    assert "start_line INTEGER" in sql, "corpus_chunks should have start_line column"
-    assert "end_line INTEGER" in sql, "corpus_chunks should have end_line column"
-    assert "embedding_vector vector" in sql
-    assert "ck_audit_state_corpus_embeddings_vector_dimensions_match" in sql
-    assert "department_id BIGINT REFERENCES audit_state.departments(id) ON DELETE SET NULL" in sql
-    assert "bitbucket_project_id BIGINT REFERENCES audit_state.bitbucket_projects(id) ON DELETE SET NULL" in sql
-    assert "project_id BIGINT NOT NULL REFERENCES audit_state.projects(id) ON DELETE CASCADE" in sql
-    assert "repo_id BIGINT REFERENCES audit_state.repos(id) ON DELETE CASCADE" in sql
-    assert (
-        "source_type IN ('confluence_page', 'confluence_attachment', 'code_file', 'ops_repo_file', 'code_evidence_pack', 'bitbucket_readme')"
-        in sql
-    )
-    assert "CHECK (length(content_text) <= 500000)" in sql
-    assert "to_tsvector('simple', COALESCE(content_text, ''))" in sql
-    assert "CREATE TABLE IF NOT EXISTS audit_state.chunk_embeddings" not in sql
-    assert "idx_audit_state_corpus_documents_project_source_uri" in sql
-    assert "idx_audit_state_corpus_documents_project_space_key" in sql
-    assert "idx_audit_state_corpus_documents_parent_document_id" in sql
-    assert "INSERT INTO audit_state.schema_version" in sql
-    assert str(state_store_module._PHASE47_SCHEMA_VERSION) in sql
-    # Note: the legacy init_schema() path emitted runtime UPDATE/ALTER COLUMN
-    # statements (e.g. "SET page_title = COALESCE(...)", "ALTER COLUMN ... SET
-    # NOT NULL") and named FK constraints
-    # (fk_audit_state_corpus_documents_parent_document_id) for in-place
-    # column reconciliation against pre-Phase-50 databases.  Those statements
-    # were intentionally NOT carried into the alembic squash (they're
-    # operator data-backfill, not schema; the FK exists as an inline
-    # ``REFERENCES audit_state.corpus_documents(id)`` in the squash CREATE
-    # TABLE), so we no longer assert their presence here.
-
-
-def test_validate_schema_returns_true_when_all_objects_exist() -> None:
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        cur.fetchone.return_value = {
-            "schema_exists": True,
-            "projects_exists": True,
-            "repos_exists": True,
-            "artifacts_exists": True,
-            "runs_exists": True,
-            "run_events_exists": True,
-            "checklist_runs_exists": True,
-            "checklist_row_results_exists": True,
-            "checklist_artifacts_exists": True,
-            "checklist_templates_exists": True,
-            "evidence_snapshots_exists": True,
-            "retrieval_snapshots_exists": True,
-        }
-        cur.fetchall.side_effect = [
-            [{"tablename": "projects"}],
-            [{"indexname": "idx_audit_state_project_links_project_id"}],
-        ]
-        conn.cursor.return_value.__enter__.return_value = cur
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        with patch.object(
-            store,
-            "_phase47_schema_diagnostics",
-            return_value={
-                "schema_exists": True,
-                "phase47_tables_ready": True,
-                "phase47_indexes_ready": True,
-                "phase47_constraints_ready": True,
-                "schema_version_ready": True,
-                "legacy_chunk_embeddings_absent": True,
-                "legacy_corpus_documents_project_key_signature_absent": True,
-                "phase47_ready": True,
-            },
-        ):
-            assert store.validate_schema() is True
-
-
-def test_ensure_checklist_schema_ready_bootstraps_when_tables_missing() -> None:
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        # Phase 170: _ensure_runtime_schema_compatibility() now uses fetchall() for the
-        # information_schema queries, so the old {"repos_table_exists": False} fetchone
-        # sentinel is no longer consumed during __init__.  Only checklist-schema fetchone
-        # results are required here.
-        cur.fetchall.return_value = []  # all dispatch tables absent → compat check proceeds
-        cur.fetchone.side_effect = [
-            {
-                "checklist_runs_exists": False,
-                "checklist_row_results_exists": False,
-                "checklist_artifacts_exists": False,
-                "checklist_templates_exists": False,
-            },
-            {
-                "checklist_runs_exists": True,
-                "checklist_row_results_exists": True,
-                "checklist_artifacts_exists": True,
-                "checklist_templates_exists": True,
-            },
-        ]
-        conn.cursor.return_value.__enter__.return_value = cur
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        store._ensure_checklist_schema_ready()
-
-    executed_sql = "\n".join(str(call.args[0]) for call in cur.execute.call_args_list if call.args)
-    assert "CREATE TABLE IF NOT EXISTS audit_state.checklist_runs" in executed_sql
-    assert "CREATE TABLE IF NOT EXISTS audit_state.checklist_row_results" in executed_sql
-    assert "CREATE TABLE IF NOT EXISTS audit_state.checklist_artifacts" in executed_sql
-    assert "CREATE TABLE IF NOT EXISTS audit_state.checklist_templates" in executed_sql
-
-
-def test_ensure_checklist_schema_ready_skips_bootstrap_when_tables_exist() -> None:
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        cur.fetchone.return_value = {
-            "checklist_runs_exists": True,
-            "checklist_row_results_exists": True,
-            "checklist_artifacts_exists": True,
-            "checklist_templates_exists": True,
-        }
-        conn.cursor.return_value.__enter__.return_value = cur
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        store._ensure_checklist_schema_ready()
-
-    executed_sql = "\n".join(str(call.args[0]) for call in cur.execute.call_args_list if call.args)
-    assert "CREATE TABLE IF NOT EXISTS audit_state.checklist_runs" not in executed_sql
-
-
-def test_validate_schema_rejects_when_schema_version_not_ready() -> None:
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        conn.cursor.return_value.__enter__.return_value = cur
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        with patch.object(
-            store,
-            "_phase47_schema_diagnostics",
-            return_value={
-                "schema_exists": True,
-                "phase47_tables_ready": True,
-                "phase47_indexes_ready": True,
-                "phase47_constraints_ready": True,
-                "schema_version_ready": False,
-                "legacy_chunk_embeddings_absent": True,
-                "legacy_corpus_documents_project_key_signature_absent": True,
-                "phase47_ready": False,
-            },
-        ):
-            assert store.validate_schema() is False
-
-
-def test_validate_schema_rejects_legacy_corpus_documents_signature() -> None:
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        conn.cursor.return_value.__enter__.return_value = cur
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        with patch.object(
-            store,
-            "_phase47_schema_diagnostics",
-            return_value={
-                "schema_exists": True,
-                "phase47_tables_ready": True,
-                "phase47_indexes_ready": True,
-                "phase47_constraints_ready": True,
-                "schema_version_ready": True,
-                "legacy_chunk_embeddings_absent": True,
-                "legacy_corpus_documents_project_key_signature_absent": False,
-                "phase47_ready": False,
-            },
-        ):
-            assert store.validate_schema() is False
-
-
-def test_phase47_schema_diagnostics_ready_for_fresh_hard_cut_schema() -> None:
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        cur.fetchone.return_value = {"repos_table_exists": False}
-        conn.cursor.return_value.__enter__.return_value = cur
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        cur.reset_mock()
-        cur.fetchone.side_effect = [
-            {"schema_exists": True},
-            {"schema_version_table_exists": True},
-            {"version": state_store_module._PHASE47_SCHEMA_VERSION},
-            {"corpus_chunks_search_vector_ready": True},
-            {"has_embedding_dimensions": True},
-            {"has_embedding_vector": True},
-            {"dimensions_constraint_ready": True},
-            {"vector_dimensions_constraint_ready": True},
-            {"source_type_constraint_ready": True},
-            {
-                "confluence_page_id_numeric_constraint_ready": True,
-                "confluence_attachment_page_id_constraint_ready": True,
-            },
-            {"confluence_metadata_constraint_ready": True},
-            {"content_text_length_constraint_ready": True},
-            {
-                "has_project_key_column": False,
-                "has_repo_key_column": False,
-                "has_project_id_fk_column": True,
-                "has_repo_id_fk_column": True,
-                "has_page_title_not_null": True,
-                "has_space_key_not_null": True,
-            },
-            {
-                "has_projects_department_fk_column": True,
-                "has_repos_bitbucket_project_fk_column": True,
-            },
-            {
-                "projects_department_fk_constraint_ready": True,
-                "repos_bitbucket_project_fk_constraint_ready": True,
-            },
-            {"legacy_embedding_values_present": False},
-        ]
-        cur.fetchall.side_effect = [
-            [{"tablename": name} for name in state_store_module._PHASE47_REQUIRED_TABLES],
-            [
-                {
-                    "indexname": name[: state_store_module._POSTGRES_IDENTIFIER_MAX_LENGTH]
-                    if len(name) > state_store_module._POSTGRES_IDENTIFIER_MAX_LENGTH
-                    else name
-                }
-                for name in state_store_module._PHASE47_REQUIRED_INDEXES
-            ],
-        ]
-        diagnostics = store._phase47_schema_diagnostics()
-
-    assert diagnostics["phase47_ready"] is True
-    assert diagnostics["legacy_corpus_documents_key_columns_absent"] is True
-    assert diagnostics["corpus_documents_project_fk_column_ready"] is True
-    assert diagnostics["corpus_documents_repo_fk_column_ready"] is True
-    assert diagnostics["corpus_documents_page_title_not_null_ready"] is True
-    assert diagnostics["corpus_documents_space_key_not_null_ready"] is True
-    assert diagnostics["confluence_page_id_constraint_ready"] is True
-    assert diagnostics["confluence_metadata_constraint_ready"] is True
-    assert diagnostics["projects_department_fk_column_ready"] is True
-    assert diagnostics["repos_bitbucket_project_fk_column_ready"] is True
-    assert diagnostics["projects_department_fk_constraint_ready"] is True
-    assert diagnostics["repos_bitbucket_project_fk_constraint_ready"] is True
-
-
-def test_upsert_project_uses_conflict_update_and_state_version_increment() -> None:
-    now = datetime.now(UTC)
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        cur.fetchone.return_value = {
-            "id": 1,
-            "project_key": "insurance",
-            "display_name": "Insurance",
-            "metadata": {"tier": "gold"},
-            "state_version": 2,
-            "created_at": now,
-            "updated_at": now,
-        }
-        conn.cursor.return_value.__enter__.return_value = cur
-        tx = MagicMock()
-        conn.transaction.return_value = tx
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        row = store.upsert_project(
-            project_key="insurance",
-            display_name="Insurance",
-            checklist_page_id="88722450",
-            metadata={"tier": "gold"},
-        )
-
-    conn.transaction.assert_called_once()
-    sql, params = cur.execute.call_args[0]
-    assert "ON CONFLICT (project_key) DO UPDATE" in sql
-    assert "state_version = audit_state.projects.state_version + 1" in sql
-    assert params[0] == "insurance"
-    assert params[1] == "Insurance"
-    assert params[2] == "88722450"
-    assert isinstance(params[3], Jsonb)
-    assert params[3].obj == {"tier": "gold"}
-    assert row["state_version"] == 2
-
-
-def test_query_departments_excludes_project_summary_repo_counts() -> None:
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        cur.fetchall.return_value = []
-        conn.cursor.return_value.__enter__.return_value = cur
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        cur.reset_mock()
-
-        store.query_departments()
-
-    executed_sql = str(cur.execute.call_args.args[0])
-    assert "WHERE r.repo_key NOT LIKE '%%:project'" in executed_sql
-
-
-def test_query_projects_excludes_project_summary_repo_counts() -> None:
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        cur.fetchall.return_value = []
-        conn.cursor.return_value.__enter__.return_value = cur
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        cur.reset_mock()
-
-        store.query_projects()
-
-    executed_sql = str(cur.execute.call_args.args[0])
-    assert "WHERE r.repo_key NOT LIKE '%%:project'" in executed_sql
-
-
-def test_query_repos_excludes_project_summary_rows_by_default() -> None:
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        cur.fetchone.return_value = {"id": 7}
-        cur.fetchall.return_value = []
-        conn.cursor.return_value.__enter__.return_value = cur
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        cur.reset_mock()
-        cur.fetchone.return_value = {"id": 7}
-
-        store.query_repos(project_key="proj", repo_key=None)
-
-    executed_sql = str(cur.execute.call_args.args[0])
-    assert "AND r.repo_key NOT LIKE '%%:project'" in executed_sql
-
-
-def test_query_repos_keeps_explicit_project_summary_selector() -> None:
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        cur.fetchone.return_value = {"id": 7}
-        cur.fetchall.return_value = []
-        conn.cursor.return_value.__enter__.return_value = cur
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        cur.reset_mock()
-        cur.fetchone.return_value = {"id": 7}
-
-        store.query_repos(project_key="proj", repo_key="proj:project")
-
-    executed_sql = str(cur.execute.call_args.args[0])
-    assert "AND r.repo_key = %s" in executed_sql
-    assert "AND r.repo_key NOT LIKE '%%:project'" not in executed_sql
-
-
-def test_upsert_repo_and_artifact_use_conflict_update_version_increment() -> None:
-    now = datetime.now(UTC)
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        cur.fetchone.return_value = {"repos_table_exists": False}
-        conn.cursor.return_value.__enter__.return_value = cur
-        conn.transaction.side_effect = _null_context
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        # Reset mock to clear HNSW session defaults calls from __init__
-        cur.reset_mock()
-        cur.fetchone.side_effect = [
-            {
-                "id": 10,
-                "project_id": 1,
-                "repo_key": "insurance/service-a",
-                "repo_url": "https://example/repo.git",
-                "default_branch": "main",
-                "head_commit_sha": "sha-1",
-                "metadata": {},
-                "state_version": 3,
-                "created_at": now,
-                "updated_at": now,
-            },
-            {
-                "id": 20,
-                "repo_id": 10,
-                "artifact_key": "artifact-1",
-                "artifact_type": "report",
-                "status": "pending",
-                "payload": {},
-                "claimed_by": None,
-                "claimed_at": None,
-                "claim_expires_at": None,
-                "state_version": 5,
-                "created_at": now,
-                "updated_at": now,
-            },
-        ]
-        repo = store.upsert_repo(
-            project_id=1,
-            repo_key="insurance/service-a",
-            repo_url="https://example/repo.git",
-            head_commit_sha="sha-1",
-            metadata={},
-        )
-        artifact = store.upsert_artifact(
-            repo_id=repo["id"],
-            artifact_key="artifact-1",
-            artifact_type="report",
-            payload={},
-        )
-
-    repo_sql = cur.execute.call_args_list[0][0][0]
-    artifact_sql = cur.execute.call_args_list[1][0][0]
-    assert "ON CONFLICT (repo_key) DO UPDATE" in repo_sql
-    assert "head_commit_sha = COALESCE(" in repo_sql
-    assert "jsonb_strip_nulls(EXCLUDED.metadata)" in repo_sql
-    assert "state_version = audit_state.repos.state_version + 1" in repo_sql
-    assert "ON CONFLICT (artifact_key) DO UPDATE" in artifact_sql
-    assert "state_version = audit_state.artifacts.state_version + 1" in artifact_sql
-    assert repo["state_version"] == 3
-    assert artifact["state_version"] == 5
-
-
-def test_set_repo_analysis_exclusion_updates_canonical_columns() -> None:
-    now = datetime.now(UTC)
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        cur.fetchone.return_value = {
-            "id": 10,
-            "project_id": 1,
-            "repo_key": "cpm:campaign-sdk-service",
-            "repo_url": "https://bitbucket.example/projects/CPM/repos/campaign-sdk-service",
-            "default_branch": "main",
-            "head_commit_sha": "sha-1",
-            "repo_type": "primary",
-            "analysis_excluded": True,
-            "analysis_exclusion_reason": "unsupported branch",
-            "analysis_exclusion_updated_at": now,
-            "metadata": {},
-            "state_version": 7,
-            "created_at": now,
-            "updated_at": now,
-        }
-        conn.cursor.return_value.__enter__.return_value = cur
-        conn.transaction.side_effect = _null_context
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        cur.reset_mock()
-        updated = store.set_repo_analysis_exclusion(
-            project_key="88718940",
-            repo_key="cpm:campaign-sdk-service",
-            analysis_excluded=True,
-            analysis_exclusion_reason="unsupported branch",
-        )
-
-    sql, params = cur.execute.call_args[0]
-    assert "analysis_excluded = %s" in sql
-    assert "analysis_exclusion_reason = %s" in sql
-    assert "analysis_exclusion_updated_at = %s" in sql
-    assert params[0] is True
-    assert params[1] == "unsupported branch"
-    assert params[3] == "88718940"
-    assert params[4] == "cpm:campaign-sdk-service"
-    assert updated["analysis_excluded"] is True
-    assert updated["analysis_exclusion_reason"] == "unsupported branch"
-
-
-def test_set_repo_analysis_exclusion_requires_reason_when_excluding() -> None:
-    import pytest
-
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        conn.cursor.return_value.__enter__.return_value = cur
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        with pytest.raises(ValueError, match="analysis_exclusion_reason is required"):
-            store.set_repo_analysis_exclusion(
-                project_key="88718940",
-                repo_key="cpm:campaign-sdk-service",
-                analysis_excluded=True,
-                analysis_exclusion_reason="",
-            )
-
-
-def test_upsert_normalized_phase47_entities_uses_conflict_update() -> None:
-    now = datetime.now(UTC)
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        cur.fetchone.return_value = {"repos_table_exists": False}
-        conn.cursor.return_value.__enter__.return_value = cur
-        conn.transaction.side_effect = _null_context
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        # Reset mock to clear HNSW session defaults calls from __init__
-        cur.reset_mock()
-        cur.fetchone.side_effect = [
-            {
-                "id": 11,
-                "project_id": 1,
-                "link_type": "confluence",
-                "link_role": "canonical",
-                "normalized_url": "https://wiki.example/x/1",
-                "raw_url": "https://wiki.example/x/1?focusedCommentId=5",
-                "source_page_id": "101",
-                "source_page_url": "https://wiki.example/pages/101",
-                "source_context": "record_discovery",
-                "last_seen_at": now,
-                "metadata": {"source": "record_discovery"},
-                "created_at": now,
-                "updated_at": now,
-            },
-            {
-                "id": 12,
-                "repo_id": 2,
-                "link_type": "repo_url",
-                "link_role": "origin",
-                "normalized_url": "https://bitbucket.example/projects/A/repos/service-a",
-                "raw_url": "https://bitbucket.example/projects/A/repos/service-a",
-                "source_page_id": "service-a",
-                "last_seen_at": now,
-                "metadata": {"source": "record_artifacts"},
-                "created_at": now,
-                "updated_at": now,
-            },
-            {
-                "id": 13,
-                "project_id": 1,
-                "status": "prepared",
-                "source": "record_artifacts",
-                "payload_kind": "project_artifacts",
-                "project_storage_key": "project-a",
-                "page_id": "101",
-                "project_status": "active",
-                "fetch_policy": "if-changed",
-                "sync_metadata": {"source": "sync"},
-                "prepared_at": now,
-                "created_at": now,
-                "updated_at": now,
-            },
-            {
-                "id": 14,
-                "repo_id": 2,
-                "status": "ready",
-                "source": "record_artifacts",
-                "payload_kind": "repo_sync",
-                "project_storage_key": "project-a",
-                "repo_storage_key": "project-a:service-a",
-                "repo_slug": "service-a",
-                "repo_url": "https://bitbucket.example/projects/A/repos/service-a",
-                "local_code_path": "/tmp/service-a",
-                "sync_status": "success",
-                "sync_decision": "not_modified",
-                "readiness": "ready",
-                "prepared_at": now,
-                "created_at": now,
-                "updated_at": now,
-            },
-        ]
-        project_link = store.upsert_project_link(
-            project_id=1,
-            link_type="confluence",
-            link_role="canonical",
-            normalized_url="https://wiki.example/x/1",
-            raw_url="https://wiki.example/x/1?focusedCommentId=5",
-            source_page_id="101",
-            source_page_url="https://wiki.example/pages/101",
-            source_context="record_discovery",
-            last_seen_at=now,
-            metadata={"source": "record_discovery"},
-        )
-        repo_link = store.upsert_repo_link(
-            repo_id=2,
-            link_type="repo_url",
-            link_role="origin",
-            normalized_url="https://bitbucket.example/projects/A/repos/service-a",
-            raw_url="https://bitbucket.example/projects/A/repos/service-a",
-            source_page_id="service-a",
-            last_seen_at=now,
-            metadata={"source": "record_artifacts"},
-        )
-        project_preparation = store.upsert_project_preparation(
-            project_id=1,
-            status="prepared",
-            source="record_artifacts",
-            payload_kind="project_artifacts",
-            project_storage_key="project-a",
-            page_id="101",
-            project_status="active",
-            fetch_policy="if-changed",
-            sync_metadata={"source": "sync"},
-            prepared_at=now,
-        )
-        repo_preparation = store.upsert_repo_preparation(
-            repo_id=2,
-            status="ready",
-            source="record_artifacts",
-            payload_kind="repo_sync",
-            project_storage_key="project-a",
-            repo_storage_key="project-a:service-a",
-            repo_slug="service-a",
-            repo_url="https://bitbucket.example/projects/A/repos/service-a",
-            local_code_path="/tmp/service-a",
-            sync_status="success",
-            sync_decision="not_modified",
-            readiness="ready",
-            prepared_at=now,
-        )
-
-    project_link_sql = cur.execute.call_args_list[0][0][0]
-    repo_link_sql = cur.execute.call_args_list[1][0][0]
-    project_preparation_sql = cur.execute.call_args_list[2][0][0]
-    repo_preparation_sql = cur.execute.call_args_list[3][0][0]
-    assert "ON CONFLICT (" in project_link_sql
-    assert "project_id," in project_link_sql
-    assert "link_type," in project_link_sql
-    assert "link_role," in project_link_sql
-    assert "normalized_url," in project_link_sql
-    assert "source_page_id," in project_link_sql
-    assert "source_page_url," in project_link_sql
-    assert "source_context" in project_link_sql
-    assert "ON CONFLICT (repo_id, link_type, link_role, normalized_url, source_page_id) DO UPDATE" in repo_link_sql
-    assert "ON CONFLICT (project_id) DO UPDATE" in project_preparation_sql
-    assert "ON CONFLICT (repo_id) DO UPDATE" in repo_preparation_sql
-    assert "audit_state.repo_preparation.readiness = 'ready'" in repo_preparation_sql
-    assert (
-        "COALESCE(NULLIF(EXCLUDED.local_code_path, ''), audit_state.repo_preparation.local_code_path)"
-        in repo_preparation_sql
-    )
-    assert "details" not in project_preparation_sql
-    assert "details" not in repo_preparation_sql
-    assert project_link["link_type"] == "confluence"
-    assert repo_link["link_type"] == "repo_url"
-    assert project_preparation["status"] == "prepared"
-    assert repo_preparation["status"] == "ready"
-
-
-def test_link_hierarchy_entities_updates_project_and_repo_fk_columns() -> None:
-    now = datetime.now(UTC)
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        cur.fetchone.return_value = {"repos_table_exists": False}
-        conn.cursor.return_value.__enter__.return_value = cur
-        conn.transaction.side_effect = _null_context
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        cur.reset_mock()
-        cur.fetchone.side_effect = [
-            {
-                "id": 101,
-                "department_key": "claims",
-                "display_name": "Claims",
-                "is_quarantined": False,
-                "quarantine_reason": None,
-                "metadata": {},
-                "created_at": now,
-                "updated_at": now,
-            },
-            {
-                "id": 202,
-                "project_key": "aaa",
-                "display_name": "AAA",
-                "is_quarantined": True,
-                "quarantine_reason": "ambiguous_bitbucket_project_key_mapping",
-                "metadata": {},
-                "created_at": now,
-                "updated_at": now,
-            },
-        ]
-        project_result = store.link_project_hierarchy(
-            project_id=1,
-            project_key="project-a",
-            metadata={"department": "Claims"},
-        )
-        repo_result = store.link_repo_hierarchy(
-            repo_id=2,
-            repo_key="project-a:service-a",
-            repo_url="https://bitbucket.example/projects/BBB/repos/service-a",
-            metadata={"bitbucket_project_key": "AAA"},
-        )
-
-    assert project_result["resolved"] is True
-    assert repo_result["resolved"] is True
-    assert repo_result["quarantined"] is True
-    project_fk_sql = cur.execute.call_args_list[1][0][0]
-    repo_fk_sql = cur.execute.call_args_list[3][0][0]
-    assert "UPDATE audit_state.projects" in project_fk_sql
-    assert "department_id = %s" in project_fk_sql
-    assert "UPDATE audit_state.repos" in repo_fk_sql
-    assert "bitbucket_project_id = %s" in repo_fk_sql
-
-
-def test_repo_bitbucket_project_mapping_ignores_project_storage_key_candidate() -> None:
-    mapping = PostgresStateStore._repo_bitbucket_project_mapping(
-        repo_key="",
-        repo_url="https://bitbucket.example.com/projects/MAP/repos/app-center-fe",
-        metadata={
-            "project_storage_key": "3-2-1-4-mini-app",
-        },
-    )
-
-    assert mapping["bitbucket_project_key"] == "map"
-    assert mapping["mapping_candidates"] == ["map"]
-    assert mapping["is_quarantined"] is False
-    assert mapping["quarantine_reason"] is None
-
-
-def test_upsert_bitbucket_project_sql_allows_quarantine_clear() -> None:
-    now = datetime.now(UTC)
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        cur.fetchone.return_value = {
-            "id": 202,
-            "project_key": "map",
-            "display_name": "MAP",
-            "is_quarantined": False,
-            "quarantine_reason": None,
-            "metadata": {},
-            "created_at": now,
-            "updated_at": now,
-        }
-        conn.cursor.return_value.__enter__.return_value = cur
-        conn.transaction.side_effect = _null_context
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        cur.reset_mock()
-        row = store.upsert_bitbucket_project(
-            project_key="map",
-            display_name="MAP",
-            is_quarantined=False,
-            quarantine_reason=None,
-            metadata={},
-        )
-
-    sql = cur.execute.call_args_list[0][0][0]
-    assert "is_quarantined = EXCLUDED.is_quarantined" in sql
-    assert "WHEN EXCLUDED.is_quarantined" in sql
-    assert "ELSE NULL" in sql
-    assert row["is_quarantined"] is False
-    assert row["quarantine_reason"] is None
-
-
-def test_backfill_hierarchy_entities_returns_resolution_counts() -> None:
-    now = datetime.now(UTC)
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        cur.fetchall.side_effect = [
-            [],  # tables — compatibility check (constructor)
-            [],  # columns — compatibility check (constructor)
-            [
-                {"id": 1, "project_key": "project-a", "metadata": {"department": "Claims"}},
-                {"id": 2, "project_key": "project-b", "metadata": {}},
-            ],
-            [
-                {
-                    "id": 10,
-                    "repo_key": "project-a:service-a",
-                    "repo_url": "https://bitbucket.example/projects/AAA/repos/service-a",
-                    "metadata": {},
-                },
-                {
-                    "id": 11,
-                    "repo_key": "project-summary",
-                    "repo_url": "",
-                    "metadata": {},
-                },
-            ],
-        ]
-        cur.fetchone.return_value = {"repos_table_exists": False}
-        conn.cursor.return_value.__enter__.return_value = cur
-        conn.transaction.side_effect = _null_context
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        store.backfill_project_bitbucket_links = MagicMock(return_value={"links_inserted": 0})  # type: ignore[method-assign]
-        store.cleanup_spurious_project_bitbucket_links = MagicMock(return_value={"links_removed": 0})  # type: ignore[method-assign]
-        store.normalize_existing_repo_keys = MagicMock(return_value={"normalized": 0})  # type: ignore[method-assign]
-        cur.reset_mock()
-        cur.fetchone.side_effect = [
-            {
-                "id": 101,
-                "department_key": "claims",
-                "display_name": "Claims",
-                "is_quarantined": False,
-                "quarantine_reason": None,
-                "metadata": {},
-                "created_at": now,
-                "updated_at": now,
-            },
-            {
-                "id": 202,
-                "project_key": "aaa",
-                "display_name": "AAA",
-                "is_quarantined": False,
-                "quarantine_reason": None,
-                "metadata": {},
-                "created_at": now,
-                "updated_at": now,
-            },
-        ]
-        result = store.backfill_hierarchy_entities()
-
-    assert result == {
-        "projects_linked": 1,
-        "projects_unresolved": 1,
-        "repos_linked": 1,
-        "repos_unresolved": 1,
-        "repos_quarantined": 1,
-        "junction_links_inserted": 0,
-        "junction_links_removed": 0,
-        "repo_keys_normalized": 0,
-    }
-
-
-def test_cleanup_spurious_project_bitbucket_links_removes_storage_key_like_equal_keys() -> None:
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        cur.rowcount = 2
-        conn.cursor.return_value.__enter__.return_value = cur
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        result = store.cleanup_spurious_project_bitbucket_links()
-
-    assert result == {"links_removed": 2}
-    sql, params = cur.execute.call_args[0]
-    assert "DELETE FROM audit_state.project_bitbucket_links" in sql
-    assert "AND p.project_key = bp.project_key" in sql
-    assert "AND p.project_key ~ %s" in sql
-    assert params == (r"^[0-9]+(?:-[0-9]+)+-[a-z0-9-]+$",)
-
-
-def test_cleanup_spurious_project_bitbucket_links_is_idempotent() -> None:
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        conn.cursor.return_value.__enter__.return_value = cur
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-
-        cur.rowcount = 1
-        first = store.cleanup_spurious_project_bitbucket_links()
-
-        cur.rowcount = 0
-        second = store.cleanup_spurious_project_bitbucket_links()
-
-    assert first == {"links_removed": 1}
-    assert second == {"links_removed": 0}
-
-
-def test_cleanup_polluted_registry_project_rows_removes_invalid_hierarchy_rows() -> None:
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        cur.rowcount = 3
-        conn.cursor.return_value.__enter__.return_value = cur
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        result = store.cleanup_polluted_registry_project_rows(registry_page_id="88716675")
-
-    assert result == {"projects_removed": 3}
-    sql, params = cur.execute.call_args[0]
-    assert "DELETE FROM audit_state.projects p" in sql
-    assert "metadata->>'registry_page_id'" in sql
-    assert params == ("88716675",)
-
-
-def test_cleanup_missing_artifact_paths_prunes_dead_payload_fields() -> None:
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        store.export_snapshot = MagicMock(
-            return_value={
-                "artifacts": [
-                    {
-                        "id": 1,
-                        "repo_id": 41,
-                        "artifact_key": "legacy:extract_docs",
-                        "artifact_type": "extract_docs_summary",
-                        "status": "ready",
-                        "payload": {
-                            "corpus_path": "/tmp/does-not-exist/corpus.jsonl",
-                            "materialized_content_root": "/tmp/does-not-exist",
-                            "project_storage_key": "legacy",
-                        },
-                    }
-                ]
-            }
-        )  # type: ignore[method-assign]
-        store.upsert_artifact = MagicMock()  # type: ignore[method-assign]
-
-        result = store.cleanup_missing_artifact_paths()
-
-    assert result == {"artifacts_updated": 1, "fields_cleared": 2}
-    call = store.upsert_artifact.call_args
-    assert call.kwargs["artifact_key"] == "legacy:extract_docs"
-    assert call.kwargs["payload"] == {"project_storage_key": "legacy"}
-
-
-def test_upsert_project_bitbucket_link_by_keys_reuses_existing_entities_without_upsert() -> None:
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        store._resolve_project_id_if_exists = MagicMock(return_value=11)  # type: ignore[method-assign]
-        store._resolve_bitbucket_project_id_if_exists = MagicMock(return_value=22)  # type: ignore[method-assign]
-        store.upsert_project = MagicMock(side_effect=AssertionError("unexpected project upsert"))  # type: ignore[method-assign]
-        store.upsert_bitbucket_project = MagicMock(  # type: ignore[method-assign]
-            side_effect=AssertionError("unexpected bitbucket upsert")
-        )
-        store.upsert_project_bitbucket_link = MagicMock(  # type: ignore[method-assign]
-            return_value={
-                "id": 1,
-                "project_id": 11,
-                "bitbucket_project_id": 22,
-                "source": "sync_repos",
-                "metadata": {},
-                "created_at": datetime.now(UTC),
-            }
-        )
-
-        row = store.upsert_project_bitbucket_link_by_keys(
-            project_key="88718940",
-            bitbucket_project_key="CPM",
-            source="sync_repos",
-        )
-
-    assert row["project_id"] == 11
-    assert row["bitbucket_project_id"] == 22
-    store.upsert_project_bitbucket_link.assert_called_once_with(
-        project_id=11,
-        bitbucket_project_id=22,
-        source="sync_repos",
-        repo_filter=None,
-        metadata=None,
-    )
-
-
-def test_upsert_project_bitbucket_link_by_keys_creates_missing_entities() -> None:
-    now = datetime.now(UTC)
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        store._resolve_project_id_if_exists = MagicMock(return_value=None)  # type: ignore[method-assign]
-        store._resolve_bitbucket_project_id_if_exists = MagicMock(return_value=None)  # type: ignore[method-assign]
-        store.upsert_project = MagicMock(  # type: ignore[method-assign]
-            return_value={
-                "id": 101,
-                "project_key": "88718940",
-                "display_name": "88718940",
-                "metadata": {},
-                "state_version": 1,
-                "created_at": now,
-                "updated_at": now,
-            }
-        )
-        store.upsert_bitbucket_project = MagicMock(  # type: ignore[method-assign]
-            return_value={
-                "id": 202,
-                "project_key": "CPM",
-                "display_name": "CPM",
-                "is_quarantined": False,
-                "quarantine_reason": None,
-                "metadata": {},
-                "created_at": now,
-                "updated_at": now,
-            }
-        )
-        store.upsert_project_bitbucket_link = MagicMock(  # type: ignore[method-assign]
-            return_value={
-                "id": 2,
-                "project_id": 101,
-                "bitbucket_project_id": 202,
-                "source": "sync_repos",
-                "metadata": {"k": "v"},
-                "created_at": now,
-            }
-        )
-
-        row = store.upsert_project_bitbucket_link_by_keys(
-            project_key="88718940",
-            bitbucket_project_key="CPM",
-            source="sync_repos",
-            metadata={"k": "v"},
-        )
-
-    assert row["project_id"] == 101
-    assert row["bitbucket_project_id"] == 202
-    store.upsert_project.assert_called_once_with(project_key="88718940", display_name="88718940")
-    store.upsert_bitbucket_project.assert_called_once_with(project_key="CPM", display_name="CPM")
-    store.upsert_project_bitbucket_link.assert_called_once_with(
-        project_id=101,
-        bitbucket_project_id=202,
-        source="sync_repos",
-        repo_filter=None,
-        metadata={"k": "v"},
-    )
-
-
-def test_refresh_project_identifiers_rekeys_legacy_project_and_rewrites_references() -> None:
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        conn.cursor.return_value.__enter__.return_value = cur
-        conn.transaction.side_effect = _null_context
-        mock_connect.return_value = conn
-
-        def _execute(sql: str, params: tuple[object, ...] | None = None) -> None:
-            del params
-            # psycopg.sql.Composed.as_string() produces quoted identifiers
-            # (e.g. "audit_state"."runs"); strip quotes for simple matching.
-            sql_text = (sql.as_string(None) if hasattr(sql, "as_string") else str(sql)).replace('"', "")
-            if (
-                "UPDATE audit_state.projects" in sql_text
-                and "project_key = %s" in sql_text
-                and "WHERE id = %s" in sql_text
-            ):
-                cur.rowcount = 1
-                return
-            if "UPDATE audit_state.runs SET project_key = %s WHERE project_key = %s" in sql_text:
-                cur.rowcount = 3
-                return
-            cur.rowcount = 0
-
-        store = PostgresStateStore("postgresql://test")
-        cur.reset_mock()
-        project_rows = [{"id": 11, "project_key": "legacy-mini-app", "page_id": "88718877"}]
-        key_columns = [{"table_name": "runs", "column_name": "project_key"}]
-        cur.fetchall.side_effect = [project_rows, key_columns]
-        cur.fetchone.return_value = None
-        cur.execute.side_effect = _execute
-        with patch.object(store, "_acquire_session_advisory_lock", return_value=True) as mock_lock:
-            with patch.object(store, "_release_session_advisory_lock", return_value=True) as mock_unlock:
-                result = store.refresh_project_identifiers()
-
-    assert result["projects_total"] == 1
-    assert result["projects_rekeyed"] == 1
-    assert result["projects_merged"] == 0
-    assert result["projects_already_canonical"] == 0
-    assert result["projects_missing_page_id"] == 0
-    assert result["projects_invalid_page_id"] == 0
-    assert result["project_reference_rows_rewritten"] == 3
-    assert result["repo_metadata_normalized"] == 0
-    assert result["project_reference_updates"] == [{"column": "runs.project_key", "rows": 3}]
-    assert result["unresolved_projects"] == []
-    mock_lock.assert_called_once()
-    mock_unlock.assert_called_once()
-
-
-def test_refresh_project_identifiers_skips_bitbucket_project_key_column_rewrites() -> None:
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        conn.cursor.return_value.__enter__.return_value = cur
-        conn.transaction.side_effect = _null_context
-        mock_connect.return_value = conn
-
-        def _execute(sql: str, params: tuple[object, ...] | None = None) -> None:
-            del params
-            # psycopg.sql.Composed.as_string() produces quoted identifiers
-            # (e.g. "audit_state"."runs"); strip quotes for simple matching.
-            sql_text = (sql.as_string(None) if hasattr(sql, "as_string") else str(sql)).replace('"', "")
-            if "UPDATE audit_state.bitbucket_projects" in sql_text:
-                raise AssertionError("refresh must not rewrite bitbucket_projects.project_key")
-            if (
-                "UPDATE audit_state.projects" in sql_text
-                and "project_key = %s" in sql_text
-                and "WHERE id = %s" in sql_text
-            ):
-                cur.rowcount = 1
-                return
-            if "UPDATE audit_state.runs SET project_key = %s WHERE project_key = %s" in sql_text:
-                cur.rowcount = 2
-                return
-            cur.rowcount = 0
-
-        store = PostgresStateStore("postgresql://test")
-        cur.reset_mock()
-        project_rows = [{"id": 19, "project_key": "legacy-key", "page_id": "88716677"}]
-        key_columns = [
-            {"table_name": "bitbucket_projects", "column_name": "project_key"},
-            {"table_name": "runs", "column_name": "project_key"},
-        ]
-        cur.fetchall.side_effect = [project_rows, key_columns]
-        cur.fetchone.return_value = None
-        cur.execute.side_effect = _execute
-
-        with patch.object(store, "_acquire_session_advisory_lock", return_value=True):
-            with patch.object(store, "_release_session_advisory_lock", return_value=True):
-                result = store.refresh_project_identifiers()
-
-    assert result["projects_rekeyed"] == 1
-    assert result["repo_metadata_normalized"] == 0
-    assert result["project_reference_updates"] == [{"column": "runs.project_key", "rows": 2}]
-
-
-def test_claim_artifacts_uses_skip_locked_order_and_limit() -> None:
-    now = datetime.now(UTC)
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        cur.fetchall.return_value = [
-            {
-                "id": 20,
-                "repo_id": 10,
-                "artifact_key": "artifact-1",
-                "artifact_type": "report",
-                "status": "claimed",
-                "payload": {},
-                "claimed_by": "worker-a",
-                "claimed_at": now,
-                "claim_expires_at": now,
-                "state_version": 6,
-                "created_at": now,
-                "updated_at": now,
-            }
-        ]
-        conn.cursor.return_value.__enter__.return_value = cur
-        conn.transaction.side_effect = _null_context
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        rows = store.claim_artifacts(worker_id="worker-a", limit=3, lease_seconds=90)
-
-    sql, params = cur.execute.call_args[0]
-    assert "ORDER BY updated_at ASC, id ASC" in sql
-    assert "FOR UPDATE SKIP LOCKED" in sql
-    assert "LIMIT %s" in sql
-    assert params[0] == 3
-    assert params[1] == "worker-a"
-    assert params[-1] == 90
-    assert len(rows) == 1
-    assert rows[0]["status"] == "claimed"
-
-
-def test_export_snapshot_reads_all_tables() -> None:
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        cur.fetchall.side_effect = [
-            [],  # tables — compatibility check (constructor)
-            [],  # columns — compatibility check (constructor)
-            [{"id": 10, "department_key": "claims"}],
-            [{"id": 11, "project_key": "ins"}],
-            [{"id": 1, "project_key": "insurance"}],
-            [{"id": 2, "repo_key": "insurance/service-a"}],
-            [{"id": 3, "artifact_key": "artifact-1"}],
-            [{"id": 4, "project_id": 1, "status": "prepared"}],
-            [],  # project_links
-            [],  # repo_links
-            [{"id": 4, "repo_id": 2, "readiness": "ready"}],
-        ]
-        conn.cursor.return_value.__enter__.return_value = cur
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        # Reset mock to clear HNSW session defaults calls from __init__
-        cur.reset_mock()
-        snapshot = store.export_snapshot()
-
-    assert snapshot == {
-        "departments": [{"id": 10, "department_key": "claims"}],
-        "bitbucket_projects": [{"id": 11, "project_key": "ins"}],
-        "projects": [{"id": 1, "project_key": "insurance"}],
-        "repos": [{"id": 2, "repo_key": "insurance/service-a"}],
-        "artifacts": [{"id": 3, "artifact_key": "artifact-1"}],
-        "project_preparation": [{"id": 4, "project_id": 1, "status": "prepared"}],
-        "project_links": [],
-        "repo_links": [],
-        "repo_preparation": [{"id": 4, "repo_id": 2, "readiness": "ready"}],
-    }
-    assert cur.execute.call_count == 9
-
-
-# P4 / TSK-4.1.8: tests for export_snapshot and hierarchy_entity_diagnostics
-# auto-repair via init_schema() removed — schema bootstrap is now Alembic-owned
-# (see audit_orchestrator/alembic/versions/0001_initial_audit_state_schema.py)
-# and the _run_with_schema_autorepair wrapper around these methods has been
-# deleted.  Missing-table errors now surface to the operator with a clear
-# remediation message in the logs.
-
-
-def test_reconcile_stale_runs_updates_rows_and_appends_events() -> None:
-    now = datetime.now(UTC)
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        cur.fetchall.return_value = [
-            {
-                "run_id": "run-1",
-                "run_type": "workflow",
-                "status": "running",
-                "started_at": now,
-            },
-            {
-                "run_id": "run-2",
-                "run_type": "workflow",
-                "status": "pending",
-                "started_at": now,
-            },
-        ]
-        cur.rowcount = 2
-        conn.cursor.return_value.__enter__.return_value = cur
-        conn.transaction.side_effect = _null_context
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        # Reset mock to clear HNSW session defaults calls from __init__
-        cur.reset_mock()
-        result = store.reconcile_stale_runs(
-            stale_after_minutes=60,
-            target_statuses=["running", "pending"],
-            dry_run=False,
-        )
-
-    assert result["candidate_count"] == 2
-    assert result["updated_count"] == 2
-    assert result["event_count"] == 2
-    assert result["target_statuses"] == ["running", "pending"]
-
-    assert cur.execute.call_count == 2
-    first_sql, first_params = cur.execute.call_args_list[0][0]
-    assert "FROM audit_state.runs" in first_sql
-    assert "status = ANY(%s)" in first_sql
-    assert first_params[0] == ["running", "pending"]
-
-    second_sql, second_params = cur.execute.call_args_list[1][0]
-    assert "WITH stale_rows AS" in second_sql
-    assert "UPDATE audit_state.runs AS runs" in second_sql
-    assert "INSERT INTO audit_state.run_events" in second_sql
-    assert second_params[2] == 60
-    assert second_params[3] == 60
-
-
-def test_checklist_template_store_round_trip() -> None:
-    now = datetime.now(UTC)
-    with patch("vds_audit_orchestrator.state.store.psycopg.connect") as mock_connect:
-        conn = MagicMock()
-        cur = MagicMock()
-        # Phase 170: _ensure_runtime_schema_compatibility() uses fetchall(), not fetchone(),
-        # so the old "repos_table_exists" / "checklist_schema" fetchone sentinel is gone.
-        # Only the three template round-trip fetchone results are needed here.
-        cur.fetchone.side_effect = [
-            {
-                "id": 1,
-                "page_id": "88722450",
-                "page_version": 3,
-                "content_hash": "abc",
-                "rows": [{"row_key": "default:88722450:x"}],
-                "fetched_at": now,
-            },
-            {
-                "id": 1,
-                "page_id": "88722450",
-                "page_version": 3,
-                "content_hash": "abc",
-                "rows": [{"row_key": "default:88722450:x"}],
-                "fetched_at": now,
-            },
-            {
-                "id": 1,
-                "page_id": "88722450",
-                "page_version": 3,
-                "content_hash": "abc",
-                "rows": [{"row_key": "default:88722450:x"}],
-                "fetched_at": now,
-            },
-        ]
-        conn.cursor.return_value.__enter__.return_value = cur
-        conn.transaction.side_effect = _null_context
-        mock_connect.return_value = conn
-
-        store = PostgresStateStore("postgresql://test")
-        store._checklist_schema_ready = True
-        row = store.upsert_checklist_template(
-            page_id="88722450",
-            page_version=3,
-            content_hash="abc",
-            rows=[{"row_key": "default:88722450:x"}],
-        )
-        latest = store.get_latest_checklist_template(page_id="88722450")
-        exact = store.get_checklist_template(page_id="88722450", page_version=3)
-
-    assert row["page_id"] == "88722450"
-    assert latest is not None and latest["content_hash"] == "abc"
-    assert exact is not None and exact["page_version"] == 3