@volter/twin-sentry 0.1.0

package/src/sentry-capabilities.ts

@@ -0,0 +1,1222 @@
+// Sentry capability manifest — the EXPECTED REAL-PRODUCT SURFACE (the target), authored
+// top-down from what Sentry actually does — NOT from what this twin has built. This is the
+// honest denominator: every entry's verify() (required to count as done) drives REAL
+// requests through the twin and asserts status/shape; `expected:'done'` only on what we
+// genuinely claim, so a broken one shows as a regression. Grow this toward Sentry's full
+// surface every cycle.
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createElement } from 'react';
+import { renderToStaticMarkup } from 'react-dom/server';
+import { checkCapabilities, uiDataCoupled, type CapabilityReport, type CapabilitySpec, verifyBoundary, isInfrastructureError, harnessError } from '@volter/world-tooling';
+import { DashboardsView, DiscoverView, ReleasesView, ProjectsView } from '../client/sentry-mirror.tsx';
+import { handleSentryTwinRequest, type SentryResponse } from './sentry-twin.ts';
+import { DEFAULT_ORG, DEFAULT_PROJECT, DEFAULT_PROJECT_ID, DEFAULT_PUBLIC_KEY } from './sentry-ingest.ts';
+import { registerAlertRule, emitIssueAlert, verifySentrySignature, computeSentrySignature, type SentryWebhook } from './sentry-events.ts';
+import { mapIssue, sentryRequestForAction,  syncSentryFromReal, type SentryExecute } from './sentry-connector.ts';
+import { performPending } from './sentry-perform-harness.ts';
+import { buildSentryMirrorClient, latestStacktrace, eventTags, levelTone, statusTone, formatCount, timeAgo } from './sentry-mirror-ui.ts';
+
+type Body = Record<string, any>;
+type Step = { m: string; p: string; b?: unknown; auth?: string };
+
+const OCC = '2026-01-01T00:00:00.000Z';
+
+/** Run a sequence of real Sentry requests against an isolated root; returns a tester. */
+async function withRoot(steps: (h: (s: Step) => Promise<SentryResponse>, root: string) => Promise<boolean>): Promise<boolean> {
+  const root = mkdtempSync(join(tmpdir(), 'sentry-cap-'));
+  const h = (s: Step) => handleSentryTwinRequest({
+    method: s.m, path: s.p,
+    body: s.b === undefined ? undefined : (typeof s.b === 'string' ? s.b : JSON.stringify(s.b)),
+    root, occurredAt: OCC,
+    headers: s.auth ? { 'x-sentry-auth': s.auth } : {},
+  });
+  try { return await verifyBoundary('sentry.withRoot', () => steps(h, root)); } finally { rmSync(root, { recursive: true, force: true }); }
+}
+
+const ok = (r: SentryResponse) => r.status >= 200 && r.status < 300;
+const auth = `Sentry sentry_key=${DEFAULT_PUBLIC_KEY}`;
+const ingest = (event: unknown): Step => ({ m: 'POST', p: `/api/${DEFAULT_PROJECT_ID}/store/`, b: event, auth });
+const envelope = (event: unknown): Step => ({ m: 'POST', p: `/api/${DEFAULT_PROJECT_ID}/envelope/`, b: `{"dsn":"http://${DEFAULT_PUBLIC_KEY}@localhost/${DEFAULT_PROJECT_ID}"}\n{"type":"event"}\n${JSON.stringify(event)}` });
+const issuesPath = `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/issues/`;
+
+// ── UI verify: the built mirror bundle must contain the screen's load-bearing markers ──
+let bundle: Promise<string> | null = null;
+const mirrorBundle = (): Promise<string> => (bundle ??= buildSentryMirrorClient());
+
+// Count occurrences of a DOM landmark class (e.g. one `dashboard-row` per dashboard) in
+// rendered mirror markup — the structural assertion used by the rung-5 UI verifies below.
+const countLandmark = (markup: string, landmark: string): number => markup.split(landmark).length - 1;
+
+// shorthands
+const done = (id: string, area: string, title: string, dimension: CapabilitySpec['dimension'], tier: CapabilitySpec['tier'], verify: CapabilitySpec['verify']): CapabilitySpec => ({ id, area, title, dimension, tier, expected: 'done', verify });
+const todo = (id: string, area: string, title: string, dimension: CapabilitySpec['dimension'], tier: CapabilitySpec['tier']): CapabilitySpec => ({ id, area, title, dimension, tier, expected: 'todo' });
+
+export const SENTRY_CAPABILITIES: CapabilitySpec[] = [
+  // ── INGESTION (the SDK side — the core) ─────────────────────────────────────────
+  done('sentry.ingest.store_exception', 'ingestion', 'POST /api/:id/store/ — capture an exception event', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h(ingest({ exception: { values: [{ type: 'TypeError', value: 'boom' }] } }));
+      return ok(r) && typeof (r.body as Body).id === 'string' && (r.body as Body).id.length === 32;
+    })),
+  done('sentry.ingest.envelope', 'ingestion', 'POST /api/:id/envelope/ — capture via the modern envelope transport', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h(envelope({ exception: { values: [{ type: 'RangeError', value: 'nope' }] } }));
+      return ok(r) && typeof (r.body as Body).id === 'string';
+    })),
+  done('sentry.ingest.message', 'ingestion', 'Capture a message event (no exception)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h(ingest({ message: 'something happened', level: 'warning' }));
+      if (!ok(r)) return false;
+      const list = await h({ m: 'GET', p: `${issuesPath}?query=` });
+      const issues = list.body as Body[];
+      return issues.length === 1 && issues[0]!.title === 'something happened' && issues[0]!.level === 'warning';
+    })),
+  done('sentry.ingest.grouping', 'ingestion', 'Two identical exceptions GROUP into one issue (count increments)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const ev = { exception: { values: [{ type: 'TypeError', value: 'x is undefined' }] } };
+      const a = await h(ingest(ev));
+      const b = await h(ingest(ev));
+      const list = await h({ m: 'GET', p: `${issuesPath}?query=` });
+      const issues = list.body as Body[];
+      // distinct event ids, one issue, count 2, first/last seen set
+      return (a.body as Body).id !== (b.body as Body).id && issues.length === 1 &&
+        issues[0]!.count === '2' && !!issues[0]!.firstSeen && !!issues[0]!.lastSeen;
+    })),
+  done('sentry.ingest.grouping_distinct', 'ingestion', 'Different exceptions land in DIFFERENT issues', 'api', 'core', () =>
+    withRoot(async (h) => {
+      await h(ingest({ exception: { values: [{ type: 'TypeError', value: 'a' }] } }));
+      await h(ingest({ exception: { values: [{ type: 'ReferenceError', value: 'b' }] } }));
+      const list = await h({ m: 'GET', p: `${issuesPath}?query=` });
+      return (list.body as Body[]).length === 2;
+    })),
+  done('sentry.ingest.grouping_normalized', 'ingestion', 'Numbers in the message are normalized so similar errors group', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h(ingest({ exception: { values: [{ type: 'Error', value: 'user 42 not found' }] } }));
+      await h(ingest({ exception: { values: [{ type: 'Error', value: 'user 99 not found' }] } }));
+      const list = await h({ m: 'GET', p: `${issuesPath}?query=` });
+      return (list.body as Body[]).length === 1 && (list.body as Body[])[0]!.count === '2';
+    })),
+  done('sentry.ingest.auth_required', 'ingestion', 'An unknown/missing DSN public key is rejected 401', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const noKey = await h({ m: 'POST', p: `/api/${DEFAULT_PROJECT_ID}/store/`, b: { message: 'x' } });
+      const badKey = await h({ m: 'POST', p: `/api/${DEFAULT_PROJECT_ID}/store/`, b: { message: 'x' }, auth: 'Sentry sentry_key=wrong' });
+      return noKey.status === 401 && badKey.status === 401;
+    })),
+  done('sentry.ingest.auth_query', 'ingestion', 'DSN public key accepted via ?sentry_key query param', 'api', 'common', () =>
+    withRoot(async (h) => {
+      // a wrong key via the SAME query-param path must be rejected — proves the param is actually read/checked.
+      const wrong = await h({ m: 'POST', p: `/api/${DEFAULT_PROJECT_ID}/store/?sentry_key=wrongkey`, b: { message: 'q' } });
+      if (wrong.status !== 401) return false;
+      const r = await h({ m: 'POST', p: `/api/${DEFAULT_PROJECT_ID}/store/?sentry_key=${DEFAULT_PUBLIC_KEY}`, b: { message: 'q' } });
+      if (!ok(r)) return false;
+      const rid = (r.body as Body).id;
+      // a real 32-hex event id, and the event must actually be persisted + retrievable with matching content.
+      if (typeof rid !== 'string' || !/^[0-9a-f]{32}$/.test(rid)) return false;
+      const got = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/events/${rid}/` });
+      return ok(got) && (got.body as Body).eventID === rid && (got.body as Body).message === 'q';
+    })),
+  done('sentry.ingest.project_mismatch', 'ingestion', 'A key for a different project is rejected 401', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: `/api/999/store/`, b: { message: 'x' }, auth });
+      return r.status === 401;
+    })),
+  done('sentry.ingest.regression', 'ingestion', 'A new event on a resolved issue REOPENS it (regression)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const ev = { exception: { values: [{ type: 'Error', value: 'flap' }] } };
+      await h(ingest(ev));
+      const list = await h({ m: 'GET', p: `${issuesPath}?query=` });
+      const id = (list.body as Body[])[0]!.id;
+      await h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { status: 'resolved' } });
+      const resolved = await h({ m: 'GET', p: `/api/0/issues/${id}/` });
+      await h(ingest(ev)); // reopen
+      const reopened = await h({ m: 'GET', p: `/api/0/issues/${id}/` });
+      return (resolved.body as Body).status === 'resolved' && (reopened.body as Body).status === 'unresolved' && (reopened.body as Body).count === '2';
+    })),
+  done('sentry.ingest.culprit', 'ingestion', 'Culprit derived from the top in-app stack frame', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h(ingest({ exception: { values: [{ type: 'Error', value: 'z', stacktrace: { frames: [{ function: 'outer', in_app: false }, { function: 'handler', module: 'app/server', in_app: true }] } }] } }));
+      const list = await h({ m: 'GET', p: `${issuesPath}?query=` });
+      return (list.body as Body[])[0]!.culprit === 'handler(app/server)';
+    })),
+  done('sentry.ingest.envelope_session_ignored', 'ingestion', 'A session-only envelope is accepted (200) without creating an issue', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: `/api/${DEFAULT_PROJECT_ID}/envelope/`, b: `{"dsn":"http://${DEFAULT_PUBLIC_KEY}@localhost/${DEFAULT_PROJECT_ID}"}\n{"type":"session"}\n{"sid":"abc"}` });
+      const list = await h({ m: 'GET', p: `${issuesPath}?query=` });
+      return ok(r) && (list.body as Body[]).length === 0;
+    })),
+
+  // ── ISSUES (the Web API dashboard side) ─────────────────────────────────────────
+  done('sentry.issues.list', 'issues', 'GET project issues list', 'api', 'core', () =>
+    withRoot(async (h) => {
+      await h(ingest({ message: 'm1' }));
+      const r = await h({ m: 'GET', p: `${issuesPath}?query=` });
+      return ok(r) && Array.isArray(r.body) && (r.body as Body[]).length === 1;
+    })),
+  done('sentry.issues.retrieve', 'issues', 'GET /issues/:id/', 'api', 'core', () =>
+    withRoot(async (h) => {
+      await h(ingest({ message: 'r1' }));
+      const id = ((await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[])[0]!.id;
+      const r = await h({ m: 'GET', p: `/api/0/issues/${id}/` });
+      return ok(r) && (r.body as Body).id === id && (r.body as Body).title === 'r1';
+    })),
+  done('sentry.issues.resolve', 'issues', 'PUT /issues/:id/ status=resolved', 'api', 'core', () =>
+    withRoot(async (h) => {
+      await h(ingest({ message: 'res' }));
+      const id = ((await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[])[0]!.id;
+      const r = await h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { status: 'resolved' } });
+      return ok(r) && (r.body as Body).status === 'resolved';
+    })),
+  done('sentry.issues.ignore', 'issues', 'PUT /issues/:id/ status=ignored (muted)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      await h(ingest({ message: 'ig' }));
+      const id = ((await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[])[0]!.id;
+      const r = await h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { status: 'ignored' } });
+      const muted = await h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { status: 'muted' } });
+      return ok(r) && (r.body as Body).status === 'ignored' && (muted.body as Body).status === 'ignored';
+    })),
+  done('sentry.issues.unresolve', 'issues', 'PUT /issues/:id/ status=unresolved', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h(ingest({ message: 'un' }));
+      const id = ((await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[])[0]!.id;
+      await h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { status: 'resolved' } });
+      const r = await h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { status: 'unresolved' } });
+      return ok(r) && (r.body as Body).status === 'unresolved';
+    })),
+  done('sentry.issues.assign', 'issues', 'PUT /issues/:id/ assignedTo', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h(ingest({ message: 'as' }));
+      const id = ((await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[])[0]!.id;
+      const r = await h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { assignedTo: 'user:ada' } });
+      return ok(r) && (r.body as Body).assignedTo === 'user:ada';
+    })),
+  done('sentry.issues.delete', 'issues', 'DELETE /issues/:id/', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h(ingest({ message: 'del' }));
+      const id = ((await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[])[0]!.id;
+      const r = await h({ m: 'DELETE', p: `/api/0/issues/${id}/` });
+      const gone = await h({ m: 'GET', p: `/api/0/issues/${id}/` });
+      return r.status === 204 && gone.status === 404;
+    })),
+  done('sentry.issues.events', 'issues', 'GET /issues/:id/events/', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const ev = { exception: { values: [{ type: 'E', value: 'v' }] } };
+      await h(ingest(ev)); await h(ingest(ev));
+      const id = ((await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[])[0]!.id;
+      const r = await h({ m: 'GET', p: `/api/0/issues/${id}/events/` });
+      return ok(r) && (r.body as Body[]).length === 2;
+    })),
+  done('sentry.issues.events_latest', 'issues', 'GET /issues/:id/events/latest/', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h(ingest({ exception: { values: [{ type: 'E', value: 'v', stacktrace: { frames: [{ function: 'f' }] } }] } }));
+      const id = ((await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[])[0]!.id;
+      const r = await h({ m: 'GET', p: `/api/0/issues/${id}/events/latest/` });
+      return ok(r) && Array.isArray((r.body as Body).entries);
+    })),
+  done('sentry.issues.query_is', 'issues', 'Issue search: is:resolved / is:unresolved filter', 'api', 'core', () =>
+    withRoot(async (h) => {
+      await h(ingest({ message: 'open' }));
+      await h(ingest({ message: 'closed' }));
+      const closedId = ((await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[]).find((i) => i.title === 'closed')!.id;
+      await h({ m: 'PUT', p: `/api/0/issues/${closedId}/`, b: { status: 'resolved' } });
+      const unresolved = await h({ m: 'GET', p: `${issuesPath}?query=is:unresolved` });
+      const resolved = await h({ m: 'GET', p: `${issuesPath}?query=is:resolved` });
+      return (unresolved.body as Body[]).length === 1 && (unresolved.body as Body[])[0]!.title === 'open' &&
+        (resolved.body as Body[]).length === 1 && (resolved.body as Body[])[0]!.title === 'closed';
+    })),
+  done('sentry.issues.query_level', 'issues', 'Issue search: level:error filter', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h(ingest({ message: 'e', level: 'error' }));
+      await h(ingest({ message: 'w', level: 'warning' }));
+      const r = await h({ m: 'GET', p: `${issuesPath}?query=level:warning` });
+      return (r.body as Body[]).length === 1 && (r.body as Body[])[0]!.level === 'warning';
+    })),
+  done('sentry.issues.query_text', 'issues', 'Issue search: free-text title match', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h(ingest({ message: 'database timeout' }));
+      await h(ingest({ message: 'render glitch' }));
+      const r = await h({ m: 'GET', p: `${issuesPath}?query=${encodeURIComponent('is:unresolved timeout')}` });
+      return (r.body as Body[]).length === 1 && (r.body as Body[])[0]!.title === 'database timeout';
+    })),
+  done('sentry.issues.sort_freq', 'issues', 'Issue list sort=freq orders by event count', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const a = { message: 'rare' };
+      const b = { message: 'common' };
+      await h(ingest(a));
+      await h(ingest(b)); await h(ingest(b)); await h(ingest(b));
+      const r = await h({ m: 'GET', p: `${issuesPath}?query=&sort=freq` });
+      return (r.body as Body[])[0]!.title === 'common';
+    })),
+  done('sentry.issues.short_id', 'issues', 'Issue carries a shortId + permalink', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h(ingest({ message: 'sid' }));
+      const i = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[];
+      return typeof i[0]!.shortId === 'string' && typeof i[0]!.permalink === 'string';
+    })),
+  done('sentry.issues.metadata', 'issues', 'Issue metadata carries exception type/value', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h(ingest({ exception: { values: [{ type: 'KeyError', value: 'missing' }] } }));
+      const i = ((await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[])[0]!;
+      return i.metadata?.type === 'KeyError' && i.metadata?.value === 'missing';
+    })),
+  done('sentry.issues.merge', 'issues', 'Merge issues into one group (bulk PUT ?id=…&merge)', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      // two DISTINCT errors → two issues; the busier one (3 events) is the merge primary.
+      await h(ingest({ exception: { values: [{ type: 'AError', value: 'a' }] } }));
+      const busy = { exception: { values: [{ type: 'BError', value: 'b' }] } };
+      await h(ingest(busy)); await h(ingest(busy)); await h(ingest(busy));
+      const before = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[];
+      if (before.length !== 2) return false;
+      const ids = before.map((i) => i.id);
+      const merge = await h({ m: 'PUT', p: `${issuesPath}?${ids.map((id) => `id=${id}`).join('&')}`, b: { merge: 1 } });
+      if (!ok(merge)) return false;
+      const parent = (merge.body as Body).merge.parent as string;
+      const after = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[];
+      // one survivor; its count is the SUM (1 + 3); all 4 events now belong to it
+      const survivor = after.find((i) => i.id === parent);
+      const evs = (await h({ m: 'GET', p: `/api/0/issues/${parent}/events/` })).body as Body[];
+      return after.length === 1 && survivor!.count === '4' && evs.length === 4;
+    })),
+  done('sentry.issues.bulk', 'issues', 'Bulk resolve/ignore via project issues PUT (?query / ?id)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h(ingest({ message: 'b1' }));
+      await h(ingest({ message: 'b2' }));
+      // bulk resolve EVERYTHING matching the query …
+      const r = await h({ m: 'PUT', p: `${issuesPath}?query=is:unresolved`, b: { status: 'resolved' } });
+      if (!ok(r) || (r.body as Body).status !== 'resolved') return false;
+      const unresolved = (await h({ m: 'GET', p: `${issuesPath}?query=is:unresolved` })).body as Body[];
+      const resolved = (await h({ m: 'GET', p: `${issuesPath}?query=is:resolved` })).body as Body[];
+      // … and a bulk mutation with NO selector is refused (Sentry guards against this).
+      const guard = await h({ m: 'PUT', p: issuesPath, b: { status: 'resolved' } });
+      return unresolved.length === 0 && resolved.length === 2 && guard.status === 400;
+    })),
+  done('sentry.issues.tags', 'issues', 'GET /issues/:id/tags/ and tag value distributions', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const ev = (server: string) => ({ exception: { values: [{ type: 'T', value: 'v' }] }, tags: { server } });
+      await h(ingest(ev('web1'))); await h(ingest(ev('web1'))); await h(ingest(ev('web2')));
+      const id = ((await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[])[0]!.id;
+      const all = await h({ m: 'GET', p: `/api/0/issues/${id}/tags/` });
+      const server = (all.body as Body[]).find((t) => t.key === 'server');
+      if (!server || server.totalValues !== 3 || server.uniqueValues !== 2) return false;
+      const top = server.topValues as Body[];
+      if (top[0]!.value !== 'web1' || top[0]!.count !== 2) return false;
+      // single-key distribution endpoint agrees; a missing key 404s
+      const one = await h({ m: 'GET', p: `/api/0/issues/${id}/tags/server/` });
+      const missing = await h({ m: 'GET', p: `/api/0/issues/${id}/tags/nope/` });
+      return ok(one) && (one.body as Body).key === 'server' && missing.status === 404;
+    })),
+  done('sentry.issues.hashes', 'issues', 'GET /issues/:id/hashes/ (grouping hashes)', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      await h(ingest({ exception: { values: [{ type: 'H', value: 'x' }] } }));
+      const id = ((await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[])[0]!.id;
+      const r = await h({ m: 'GET', p: `/api/0/issues/${id}/hashes/` });
+      const hashes = r.body as Body[];
+      return ok(r) && hashes.length === 1 && hashes[0]!.id === id && !!hashes[0]!.latestEvent;
+    })),
+  done('sentry.issues.activity', 'issues', 'GET /issues/:id/activity/ (triage feed from the log)', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      await h(ingest({ message: 'act' }));
+      const id = ((await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[])[0]!.id;
+      await h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { status: 'resolved' } });
+      const r = await h({ m: 'GET', p: `/api/0/issues/${id}/activity/` });
+      const feed = (r.body as Body).activity as Body[];
+      // newest-first: the resolve, then the first_seen
+      return ok(r) && feed.length === 2 && feed[0]!.type === 'set_resolved' && feed[feed.length - 1]!.type === 'first_seen';
+    })),
+
+  // ── EVENTS ──────────────────────────────────────────────────────────────────────
+  done('sentry.events.list', 'events', 'GET /projects/:org/:project/events/', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h(ingest({ message: 'ev1' }));
+      const r = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/events/` });
+      return ok(r) && (r.body as Body[]).length === 1;
+    })),
+  done('sentry.events.retrieve', 'events', 'GET /projects/:org/:project/events/:id/', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const e = await h(ingest({ message: 'ev2' }));
+      const id = (e.body as Body).id;
+      // the ingested id must be a REAL 32-hex event id, not undefined-matching-undefined.
+      if (typeof id !== 'string' || !/^[0-9a-f]{32}$/.test(id)) return false;
+      const r = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/events/${id}/` });
+      const missing = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/events/${'0'.repeat(32)}/` });
+      // the retrieved event must carry the ACTUAL ingested content, and an unknown id must 404.
+      return ok(r) && (r.body as Body).eventID === id && (r.body as Body).message === 'ev2' && missing.status === 404;
+    })),
+  done('sentry.events.tags', 'events', 'Event carries tags + level + platform', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const e = await h(ingest({ message: 'ev3', tags: { server: 'web1' }, platform: 'node' }));
+      const id = (e.body as Body).id;
+      const r = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/events/${id}/` });
+      const tags = (r.body as Body).tags as Array<{ key: string; value: string }>;
+      return ok(r) && tags.some((t) => t.key === 'server' && t.value === 'web1') && (r.body as Body).platform === 'node';
+    })),
+  done('sentry.events.stacktrace', 'events', 'Event exposes the exception stacktrace entries', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const e = await h(ingest({ exception: { values: [{ type: 'E', value: 'v', stacktrace: { frames: [{ function: 'main', filename: 'app.ts', lineno: 10 }] } }] } }));
+      const id = (e.body as Body).id;
+      const r = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/events/${id}/` });
+      const entries = (r.body as Body).entries as Body[];
+      return entries[0]?.type === 'exception' && entries[0]?.data?.values?.[0]?.stacktrace?.frames?.[0]?.function === 'main';
+    })),
+  done('sentry.events.attachments', 'events', 'Event attachments listing (envelope attachment items)', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      // envelope carrying an event + an attachment item → the attachment lists for that event
+      const body = `{"dsn":"http://${DEFAULT_PUBLIC_KEY}@localhost/${DEFAULT_PROJECT_ID}"}\n{"type":"event"}\n${JSON.stringify({ exception: { values: [{ type: 'E', value: 'v' }] } })}\n{"type":"attachment","filename":"screenshot.png","content_type":"image/png","length":1234,"attachment_type":"event.attachment"}\n<binary>`;
+      const r = await h({ m: 'POST', p: `/api/${DEFAULT_PROJECT_ID}/envelope/`, b: body });
+      if (!ok(r)) return false;
+      const eventId = (r.body as Body).id as string;
+      const list = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/events/${eventId}/attachments/` });
+      const atts = list.body as Body[];
+      if (atts.length !== 1 || atts[0]!.name !== 'screenshot.png' || atts[0]!.size !== 1234 || atts[0]!.mimetype !== 'image/png') return false;
+      // a missing event 404s
+      const missing = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/events/deadbeef/attachments/` });
+      return missing.status === 404;
+    })),
+
+  // ── PROJECTS ──────────────────────────────────────────────────────────────────────
+  done('sentry.projects.list', 'projects', 'GET /projects/ (all)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'GET', p: `/api/0/projects/` });
+      return ok(r) && (r.body as Body[]).some((p) => p.slug === DEFAULT_PROJECT);
+    })),
+  done('sentry.projects.retrieve', 'projects', 'GET /projects/:org/:project/', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/` });
+      return ok(r) && (r.body as Body).slug === DEFAULT_PROJECT;
+    })),
+  done('sentry.projects.create', 'projects', 'POST /teams/:org/:team/projects/', 'api', 'core', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/teams/`, b: { name: 'Core' } });
+      const r = await h({ m: 'POST', p: `/api/0/teams/${DEFAULT_ORG}/core/projects/`, b: { name: 'New Svc', platform: 'python' } });
+      return r.status === 201 && (r.body as Body).slug === 'new-svc' && (r.body as Body).platform === 'python';
+    })),
+  done('sentry.projects.update', 'projects', 'PUT /projects/:org/:project/', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'PUT', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/`, b: { name: 'Renamed' } });
+      return ok(r) && (r.body as Body).name === 'Renamed';
+    })),
+  done('sentry.projects.delete', 'projects', 'DELETE /projects/:org/:project/', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/teams/`, b: { name: 'T' } });
+      await h({ m: 'POST', p: `/api/0/teams/${DEFAULT_ORG}/t/projects/`, b: { name: 'Doomed' } });
+      const r = await h({ m: 'DELETE', p: `/api/0/projects/${DEFAULT_ORG}/doomed/` });
+      const gone = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/doomed/` });
+      return r.status === 204 && gone.status === 404;
+    })),
+  done('sentry.projects.keys_list', 'projects', 'GET /projects/:org/:project/keys/ (DSN)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/` });
+      const keys = r.body as Body[];
+      return ok(r) && keys.length >= 1 && typeof keys[0]!.dsn?.public === 'string' && keys[0]!.public === DEFAULT_PUBLIC_KEY;
+    })),
+  done('sentry.projects.keys_create', 'projects', 'POST /projects/:org/:project/keys/ (new DSN)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/`, b: { name: 'CI' } });
+      return r.status === 201 && typeof (r.body as Body).public === 'string' && typeof (r.body as Body).dsn?.public === 'string';
+    })),
+  done('sentry.projects.keys_delete', 'projects', 'Revoke a project key (toggle inactive + DELETE)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const created = await h({ m: 'POST', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/`, b: { name: 'Revoke me' } });
+      const keyId = (created.body as Body).id;
+      // toggle inactive first (revoke without delete) …
+      const toggled = await h({ m: 'PUT', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/${keyId}/`, b: { isActive: false } });
+      if (!ok(toggled) || (toggled.body as Body).isActive !== false) return false;
+      // … then DELETE it: gone from the list, and a re-delete 404s
+      const del = await h({ m: 'DELETE', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/${keyId}/` });
+      const list = (await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/` })).body as Body[];
+      const reDel = await h({ m: 'DELETE', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/${keyId}/` });
+      return del.status === 204 && !list.some((k) => k.id === keyId) && reDel.status === 404;
+    })),
+  done('sentry.projects.environments', 'projects', 'GET /projects/:org/:project/environments/', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h(ingest({ message: 'prod-err', environment: 'production' }));
+      await h(ingest({ message: 'stg-err', environment: 'staging' }));
+      await h(ingest({ message: 'prod-err2', environment: 'production' }));
+      const r = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/environments/` });
+      const names = (r.body as Body[]).map((e) => e.name).sort();
+      return ok(r) && names.length === 2 && names[0] === 'production' && names[1] === 'staging';
+    })),
+  done('sentry.projects.ownership', 'projects', 'Project ownership rules + code owners (path/url/module → owners)', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const own = `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/ownership/`;
+      // default ownership is empty but well-shaped
+      const empty = await h({ m: 'GET', p: own });
+      if (!ok(empty) || (empty.body as Body).raw !== null) return false;
+      // set rules → schema parsed (path matcher + a team owner)
+      const put = await h({ m: 'PUT', p: own, b: { raw: 'path:src/api/* #backend\nurl:https://x.test/checkout @ada', fallthrough: false } });
+      if (!ok(put)) return false;
+      const schema = (put.body as Body).schema;
+      if (!schema || schema.rules.length !== 2 || schema.rules[0].matcher.type !== 'path' || schema.rules[0].owners[0].type !== 'team') return false;
+      const readback = await h({ m: 'GET', p: own });
+      if ((readback.body as Body).fallthrough !== false || (readback.body as Body).isActive !== true) return false;
+      // invalid raw (no owners) → 400
+      const bad = await h({ m: 'PUT', p: own, b: { raw: 'path:src/*' } });
+      // CODEOWNERS import
+      const co = await h({ m: 'POST', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/codeowners/`, b: { raw: '*.ts @frontend' } });
+      const coList = (await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/codeowners/` })).body as Body[];
+      return bad.status === 400 && co.status === 201 && coList.length === 1;
+    })),
+  done('sentry.projects.client_keys_rate_limit', 'projects', 'Per-key rate-limit config (window + count)', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const created = await h({ m: 'POST', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/`, b: { name: 'RL' } });
+      const keyId = (created.body as Body).id;
+      if ((created.body as Body).rateLimit !== null) return false;
+      // set a rate limit → it round-trips on the key + the dedicated sub-resource
+      const set = await h({ m: 'PUT', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/${keyId}/`, b: { rateLimit: { window: 60, count: 100 } } });
+      if (!ok(set) || (set.body as Body).rateLimit?.count !== 100 || (set.body as Body).rateLimit?.window !== 60) return false;
+      const sub = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/${keyId}/rate-limit/` });
+      if ((sub.body as Body).rateLimit?.count !== 100) return false;
+      // clear it (null) + reject an invalid window
+      const cleared = await h({ m: 'PUT', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/${keyId}/`, b: { rateLimit: null } });
+      const invalid = await h({ m: 'PUT', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/${keyId}/`, b: { rateLimit: { window: 0, count: 5 } } });
+      return (cleared.body as Body).rateLimit === null && invalid.status === 400;
+    })),
+  done('sentry.projects.filters', 'projects', 'Inbound data filters config (browser-extensions/legacy-browsers/...)', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const filters = `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/filters/`;
+      const list = await h({ m: 'GET', p: filters });
+      const items = list.body as Body[];
+      if (!ok(list) || !items.some((f) => f.id === 'browser-extensions') || items.some((f) => f.active !== false)) return false;
+      // toggle one on → it reflects
+      const put = await h({ m: 'PUT', p: `${filters}browser-extensions/`, b: { active: true } });
+      if (put.status !== 204) return false;
+      const after = (await h({ m: 'GET', p: filters })).body as Body[];
+      const be = after.find((f) => f.id === 'browser-extensions');
+      // legacy-browsers takes a subfilter list
+      await h({ m: 'PUT', p: `${filters}legacy-browsers/`, b: { subfilters: ['ie_pre_9', 'safari_pre_6'] } });
+      const lb = ((await h({ m: 'GET', p: filters })).body as Body[]).find((f) => f.id === 'legacy-browsers');
+      // an unknown filter 404s
+      const missing = await h({ m: 'PUT', p: `${filters}not-a-filter/`, b: { active: true } });
+      return be!.active === true && Array.isArray(lb!.active) && (lb!.active as string[]).length === 2 && missing.status === 404;
+    })),
+
+  // ── RELEASES + DEPLOYS ──────────────────────────────────────────────────────────
+  done('sentry.releases.create', 'releases', 'POST /organizations/:org/releases/', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/`, b: { version: '1.2.3', projects: [DEFAULT_PROJECT] } });
+      return r.status === 201 && (r.body as Body).version === '1.2.3';
+    })),
+  done('sentry.releases.list', 'releases', 'GET /organizations/:org/releases/', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/`, b: { version: '2.0.0' } });
+      const r = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/releases/` });
+      return ok(r) && (r.body as Body[]).some((x) => x.version === '2.0.0');
+    })),
+  done('sentry.releases.retrieve', 'releases', 'GET /organizations/:org/releases/:version/', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/`, b: { version: '3.0.0' } });
+      const r = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/releases/3.0.0/` });
+      return ok(r) && (r.body as Body).version === '3.0.0';
+    })),
+  done('sentry.releases.update', 'releases', 'PUT /organizations/:org/releases/:version/', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/`, b: { version: '4.0.0' } });
+      const r = await h({ m: 'PUT', p: `/api/0/organizations/${DEFAULT_ORG}/releases/4.0.0/`, b: { ref: 'abc123' } });
+      return ok(r) && (r.body as Body).ref === 'abc123';
+    })),
+  done('sentry.releases.delete', 'releases', 'DELETE /organizations/:org/releases/:version/', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/`, b: { version: '5.0.0' } });
+      const r = await h({ m: 'DELETE', p: `/api/0/organizations/${DEFAULT_ORG}/releases/5.0.0/` });
+      const gone = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/releases/5.0.0/` });
+      return r.status === 204 && gone.status === 404;
+    })),
+  done('sentry.releases.commits', 'releases', 'Associate commits with a release', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/`, b: { version: '6.0.0', commits: [{ id: 'sha1', message: 'fix' }, { id: 'sha2', message: 'feat' }] } });
+      return r.status === 201 && (r.body as Body).commitCount === 2;
+    })),
+  done('sentry.releases.deploys', 'releases', 'POST /organizations/:org/releases/:version/deploys/', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/`, b: { version: '7.0.0' } });
+      const r = await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/7.0.0/deploys/`, b: { environment: 'production', name: 'deploy-7' } });
+      const list = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/releases/7.0.0/deploys/` });
+      return r.status === 201 && (r.body as Body).environment === 'production' && (list.body as Body[]).length === 1;
+    })),
+  done('sentry.releases.files', 'releases', 'Upload release files / artifact registry (source maps)', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/`, b: { version: '8.1.0' } });
+      const files = `/api/0/organizations/${DEFAULT_ORG}/releases/8.1.0/files/`;
+      const up = await h({ m: 'POST', p: files, b: { name: '~/static/app.js.map', size: 4096, dist: 'prod' } });
+      if (up.status !== 201 || (up.body as Body).name !== '~/static/app.js.map' || typeof (up.body as Body).sha1 !== 'string') return false;
+      const fileId = (up.body as Body).id;
+      const list = (await h({ m: 'GET', p: files })).body as Body[];
+      if (list.length !== 1 || list[0]!.dist !== 'prod') return false;
+      // a name-less upload 400s; delete removes it
+      const bad = await h({ m: 'POST', p: files, b: { size: 1 } });
+      const del = await h({ m: 'DELETE', p: `${files}${fileId}/` });
+      const empty = (await h({ m: 'GET', p: files })).body as Body[];
+      // files on a missing release 404
+      const missing = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/releases/0.0.0/files/` });
+      return bad.status === 400 && del.status === 204 && empty.length === 0 && missing.status === 404;
+    })),
+  done('sentry.releases.health', 'releases', 'Release health: crash-free session tallies (real, offline)', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      // ingest sessions via the envelope: 3 ok + 1 crashed for release 9.0.0
+      const session = (sid: string, status: string, release: string) =>
+        `{"dsn":"http://${DEFAULT_PUBLIC_KEY}@localhost/${DEFAULT_PROJECT_ID}"}\n{"type":"session"}\n${JSON.stringify({ sid, status, attrs: { release } })}`;
+      for (const [sid, status] of [['s1', 'ok'], ['s2', 'ok'], ['s3', 'ok'], ['s4', 'crashed']] as Array<[string, string]>) {
+        const r = await h({ m: 'POST', p: `/api/${DEFAULT_PROJECT_ID}/envelope/`, b: session(sid, status, '9.0.0') });
+        if (!ok(r)) return false;
+      }
+      const stats = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/sessions/?field=sum(session)` });
+      if (!ok(stats)) return false;
+      const totals = (stats.body as Body).groups[0].totals;
+      // exact tally: 4 sessions, 1 crashed → crashFreeRate 0.75 (NOT a simulated metric)
+      if (totals['sum(session)'] !== 4 || totals.crashed !== 1 || Math.abs(totals.crashFreeRate - 0.75) > 1e-9) return false;
+      // grouped by release
+      const byRel = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/sessions/?groupBy=release` });
+      const g = (byRel.body as Body).groups.find((x: Body) => x.by.release === '9.0.0');
+      // sessions on a missing org 404
+      const missing = await h({ m: 'GET', p: `/api/0/organizations/nope/sessions/` });
+      return g!.totals['sum(session)'] === 4 && missing.status === 404;
+    })),
+
+  // ── ORGANIZATIONS + TEAMS ───────────────────────────────────────────────────────
+  done('sentry.orgs.list', 'organizations', 'GET /organizations/', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'GET', p: `/api/0/organizations/` });
+      return ok(r) && (r.body as Body[]).some((o) => o.slug === DEFAULT_ORG);
+    })),
+  done('sentry.orgs.create', 'organizations', 'POST /organizations/', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: `/api/0/organizations/`, b: { name: 'Acme Inc' } });
+      return r.status === 201 && (r.body as Body).slug === 'acme-inc';
+    })),
+  done('sentry.orgs.retrieve', 'organizations', 'GET /organizations/:org/', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/` });
+      return ok(r) && (r.body as Body).slug === DEFAULT_ORG;
+    })),
+  done('sentry.orgs.update', 'organizations', 'PUT /organizations/:org/', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'PUT', p: `/api/0/organizations/${DEFAULT_ORG}/`, b: { name: 'Twin Org Renamed' } });
+      return ok(r) && (r.body as Body).name === 'Twin Org Renamed';
+    })),
+  done('sentry.orgs.delete', 'organizations', 'DELETE /organizations/:org/', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: `/api/0/organizations/`, b: { name: 'Temp Org' } });
+      const r = await h({ m: 'DELETE', p: `/api/0/organizations/temp-org/` });
+      const gone = await h({ m: 'GET', p: `/api/0/organizations/temp-org/` });
+      return r.status === 204 && gone.status === 404;
+    })),
+  done('sentry.teams.list', 'teams', 'GET /organizations/:org/teams/', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/teams/`, b: { name: 'Frontend' } });
+      const r = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/teams/` });
+      return ok(r) && (r.body as Body[]).some((t) => t.slug === 'frontend');
+    })),
+  done('sentry.teams.create', 'teams', 'POST /organizations/:org/teams/', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/teams/`, b: { name: 'Platform' } });
+      return r.status === 201 && (r.body as Body).slug === 'platform';
+    })),
+  done('sentry.teams.members', 'teams', 'Team membership add/remove via /teams/:org/:team/members/', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/teams/`, b: { name: 'Squad' } });
+      const m = await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/members/`, b: { email: 'sq@x.test' } });
+      const memberId = (m.body as Body).id;
+      const add = await h({ m: 'POST', p: `/api/0/teams/${DEFAULT_ORG}/squad/members/${memberId}/` });
+      if (add.status !== 201) return false;
+      const after = (await h({ m: 'GET', p: `/api/0/teams/${DEFAULT_ORG}/squad/members/` })).body as Body[];
+      const rm = await h({ m: 'DELETE', p: `/api/0/teams/${DEFAULT_ORG}/squad/members/${memberId}/` });
+      const empty = (await h({ m: 'GET', p: `/api/0/teams/${DEFAULT_ORG}/squad/members/` })).body as Body[];
+      return after.length === 1 && after[0]!.id === memberId && rm.status === 204 && empty.length === 0;
+    })),
+  done('sentry.orgs.members', 'organizations', 'Organization member invite/list/role', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const inv = await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/members/`, b: { email: 'ada@x.test', role: 'admin' } });
+      if (inv.status !== 201 || (inv.body as Body).pending !== true || (inv.body as Body).role !== 'admin') return false;
+      const id = (inv.body as Body).id;
+      // duplicate invite is rejected
+      const dup = await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/members/`, b: { email: 'ada@x.test' } });
+      // role change + list + remove
+      const up = await h({ m: 'PUT', p: `/api/0/organizations/${DEFAULT_ORG}/members/${id}/`, b: { role: 'manager' } });
+      const list = (await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/members/` })).body as Body[];
+      const del = await h({ m: 'DELETE', p: `/api/0/organizations/${DEFAULT_ORG}/members/${id}/` });
+      const gone = (await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/members/` })).body as Body[];
+      return dup.status === 409 && (up.body as Body).role === 'manager' && list.length === 1 &&
+        del.status === 204 && gone.length === 0;
+    })),
+  done('sentry.orgs.stats', 'organizations', 'Org event stats (stats_v2 totals over real events)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      await h(ingest({ message: 's1' }));
+      await h(ingest({ message: 's2' }));
+      const r = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/stats_v2/?field=sum(quantity)&category=error` });
+      if (!ok(r)) return false;
+      const groups = (r.body as Body).groups as Body[];
+      const total = groups[0]!.totals['sum(quantity)'];
+      // a stats call for a missing org 404s
+      const missing = await h({ m: 'GET', p: `/api/0/organizations/nope/stats_v2/` });
+      return total === 2 && missing.status === 404;
+    })),
+  done('sentry.orgs.integrations', 'organizations', 'Org integrations (GitHub/Slack) install + config CRUD', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const base = `/api/0/organizations/${DEFAULT_ORG}/integrations/`;
+      const gh = await h({ m: 'POST', p: base, b: { provider: 'github', name: 'acme-org', domainName: 'github.com/acme' } });
+      if (gh.status !== 201 || (gh.body as Body).provider !== 'github' || (gh.body as Body).status !== 'active') return false;
+      const id = (gh.body as Body).id;
+      await h({ m: 'POST', p: base, b: { provider: 'slack', name: 'Acme Workspace' } });
+      // list + filter by provider
+      const all = (await h({ m: 'GET', p: base })).body as Body[];
+      const onlyGh = (await h({ m: 'GET', p: `${base}?provider_key=github` })).body as Body[];
+      if (all.length !== 2 || onlyGh.length !== 1) return false;
+      // update config + delete
+      const up = await h({ m: 'PUT', p: `${base}${id}/`, b: { configData: { repos: ['acme/api'] } } });
+      if ((up.body as Body).configData?.repos?.[0] !== 'acme/api') return false;
+      const del = await h({ m: 'DELETE', p: `${base}${id}/` });
+      const after = (await h({ m: 'GET', p: base })).body as Body[];
+      // unknown provider 400
+      const bad = await h({ m: 'POST', p: base, b: { provider: 'myspace' } });
+      return del.status === 204 && after.length === 1 && bad.status === 400;
+    })),
+
+  // ── ALERTS + WEBHOOKS ───────────────────────────────────────────────────────────
+  done('sentry.alerts.rule_create', 'alerts', 'POST /projects/:org/:project/rules/ (issue alert rule)', 'api', 'core', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'POST', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/rules/`, b: { name: 'New issue alert', triggers: ['new-issue'], endpoints: ['https://x.test/h'] } });
+      const list = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/rules/` });
+      // secret is hidden from the API response
+      return r.status === 201 && (r.body as Body).secret === undefined && (list.body as Body[]).length === 1;
+    })),
+  done('sentry.alerts.new_issue_webhook', 'alerts', 'New-issue fires a SIGNED webhook to registered endpoints', 'api', 'core', () =>
+    withRoot(async (h, root) => {
+      const delivered: Array<{ url: string; payload: string; headers: Record<string, string> }> = [];
+      await registerAlertRule({ id: 'r1', projectId: DEFAULT_PROJECT_ID, triggers: ['new-issue'], endpoints: ['https://app.test/hook'], secret: 'sek' }, { root, occurredAt: OCC });
+      // ingest a new error → derive the issue → emit (via the handler's injected deliverer)
+      const r = await handleSentryTwinRequest({ method: 'POST', path: `/api/${DEFAULT_PROJECT_ID}/store/`, body: JSON.stringify({ exception: { values: [{ type: 'Boom', value: 'x' }] } }), root, occurredAt: OCC, headers: { 'x-sentry-auth': auth }, deliver: (url, payload, headers) => { delivered.push({ url, payload, headers }); } });
+      if (!ok(r) || delivered.length !== 1) return false;
+      const d = delivered[0]!;
+      const verified = verifySentrySignature(d.payload, d.headers['sentry-hook-signature'], 'sek');
+      const parsed = JSON.parse(d.payload) as SentryWebhook;
+      return verified && parsed.action === 'created' && d.url === 'https://app.test/hook';
+    })),
+  done('sentry.alerts.regression_webhook', 'alerts', 'Regression (reopened issue) fires a signed webhook', 'api', 'common', () =>
+    withRoot(async (h, root) => {
+      const delivered: Array<{ payload: string; headers: Record<string, string> }> = [];
+      await registerAlertRule({ id: 'r2', projectId: DEFAULT_PROJECT_ID, triggers: ['regression'], endpoints: ['https://app.test/reg'], secret: 'sek2' }, { root, occurredAt: OCC });
+      const ev = { exception: { values: [{ type: 'Flap', value: 'y' }] } };
+      const deliver = (_url: string, payload: string, headers: Record<string, string>) => { delivered.push({ payload, headers }); };
+      await handleSentryTwinRequest({ method: 'POST', path: `/api/${DEFAULT_PROJECT_ID}/store/`, body: JSON.stringify(ev), root, occurredAt: OCC, headers: { 'x-sentry-auth': auth }, deliver });
+      const id = ((await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[])[0]!.id;
+      await h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { status: 'resolved' } });
+      await handleSentryTwinRequest({ method: 'POST', path: `/api/${DEFAULT_PROJECT_ID}/store/`, body: JSON.stringify(ev), root, occurredAt: OCC, headers: { 'x-sentry-auth': auth }, deliver });
+      // only the regression delivery fires (new-issue trigger not registered)
+      return delivered.length === 1 && verifySentrySignature(delivered[0]!.payload, delivered[0]!.headers['sentry-hook-signature'], 'sek2');
+    })),
+  done('sentry.alerts.signature_verify', 'alerts', 'Webhook signature: HMAC-SHA256 verify + reject tampered body', 'api', 'common', () =>
+    withRoot(async (_h, root) => {
+      const out = await emitIssueAlert('new-issue', { projectId: DEFAULT_PROJECT_ID, id: 'iX', title: 't' }, { root, deliver: () => {}, occurredAt: OCC });
+      // register a rule first so emit has a target
+      await registerAlertRule({ id: 'r3', projectId: DEFAULT_PROJECT_ID, triggers: ['new-issue'], endpoints: ['https://x.test'], secret: 'verysecret' }, { root, occurredAt: OCC });
+      const captured: Array<{ payload: string; sig: string }> = [];
+      const sent = await emitIssueAlert('new-issue', { projectId: DEFAULT_PROJECT_ID, id: 'iX', title: 't' }, { root, deliver: (_u, payload, headers) => { captured.push({ payload, sig: headers['sentry-hook-signature']! }); }, occurredAt: OCC });
+      if (sent.length !== 1) return false;
+      const good = verifySentrySignature(captured[0]!.payload, captured[0]!.sig, 'verysecret');
+      const tampered = verifySentrySignature(captured[0]!.payload + 'x', captured[0]!.sig, 'verysecret');
+      const wrongSecret = verifySentrySignature(captured[0]!.payload, captured[0]!.sig, 'nope');
+      return out.length === 0 && good && !tampered && !wrongSecret;
+    })),
+  done('sentry.alerts.signature_deterministic', 'alerts', 'Signature is deterministic HMAC over the raw body', 'api', 'niche', () => {
+    const s1 = computeSentrySignature('{"a":1}', 'secret');
+    const s2 = computeSentrySignature('{"a":1}', 'secret');
+    return s1 === s2 && /^[0-9a-f]{64}$/.test(s1);
+  }),
+  done('sentry.alerts.metric_alerts', 'alerts', 'Metric alert rules: thresholds + critical/warning triggers (config CRUD)', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const base = `/api/0/organizations/${DEFAULT_ORG}/alert-rules/`;
+      const create = await h({ m: 'POST', p: base, b: {
+        name: 'High error rate', aggregate: 'count()', dataset: 'events', query: 'event.type:error', timeWindow: 60, thresholdType: 0,
+        triggers: [{ label: 'critical', alertThreshold: 100, actions: [{ id: 'sentry.mail.actions.NotifyEmailAction', targetType: 'team' }] }, { label: 'warning', alertThreshold: 50, actions: [] }],
+      } });
+      if (create.status !== 201) return false;
+      const id = (create.body as Body).id;
+      const cb = create.body as Body;
+      if (cb.thresholdType !== 0 || cb.triggers.length !== 2 || cb.triggers[0].label !== 'critical' || cb.triggers[0].alertThreshold !== 100) return false;
+      // read back via list + retrieve
+      const list = (await h({ m: 'GET', p: base })).body as Body[];
+      const got = await h({ m: 'GET', p: `${base}${id}/` });
+      if (list.length !== 1 || (got.body as Body).name !== 'High error rate') return false;
+      // update threshold
+      const up = await h({ m: 'PUT', p: `${base}${id}/`, b: { triggers: [{ label: 'critical', alertThreshold: 200 }] } });
+      if ((up.body as Body).triggers[0].alertThreshold !== 200) return false;
+      // a rule with no critical trigger 400s; a bad thresholdType 400s; delete works
+      const noCrit = await h({ m: 'POST', p: base, b: { name: 'x', triggers: [{ label: 'warning', alertThreshold: 1 }] } });
+      const badType = await h({ m: 'POST', p: base, b: { name: 'x', thresholdType: 9, triggers: [{ label: 'critical', alertThreshold: 1 }] } });
+      const del = await h({ m: 'DELETE', p: `${base}${id}/` });
+      return noCrit.status === 400 && badType.status === 400 && del.status === 204;
+    })),
+  done('sentry.alerts.actions_email_slack', 'alerts', 'Issue alert actions beyond webhook (email/Slack/PagerDuty) — config persists', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const rules = `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/rules/`;
+      const create = await h({ m: 'POST', p: rules, b: {
+        name: 'Notify the team', triggers: ['new-issue'], actionMatch: 'any',
+        actions: [
+          { id: 'sentry.mail.actions.NotifyEmailAction', targetType: 'team', targetIdentifier: 'core' },
+          { id: 'sentry.integrations.slack.notify_action.SlackNotifyServiceAction', channel: '#alerts', workspace: '1' },
+        ],
+      } });
+      if (create.status !== 201) return false;
+      const cb = create.body as Body;
+      if (cb.actionMatch !== 'any' || !Array.isArray(cb.actions) || cb.actions.length !== 2) return false;
+      if (cb.actions[1].channel !== '#alerts') return false;
+      // read back from the list
+      const list = (await h({ m: 'GET', p: rules })).body as Body[];
+      if (list[0]!.actions.length !== 2) return false;
+      // an unknown action type 400s; a Slack action missing its channel 400s
+      const badType = await h({ m: 'POST', p: rules, b: { name: 'x', actions: [{ id: 'sentry.fake.Action' }] } });
+      const badSlack = await h({ m: 'POST', p: rules, b: { name: 'x', actions: [{ id: 'sentry.integrations.slack.notify_action.SlackNotifyServiceAction' }] } });
+      return badType.status === 400 && badSlack.status === 400;
+    })),
+
+  // ── CONNECTOR (pull/push lifecycle) ─────────────────────────────────────────────
+  done('sentry.connector.pull', 'connector', 'Pull real issues/projects/releases into the event log', 'connector', 'core', () =>
+    withRoot(async (h, root) => {
+      const fake: SentryExecute = async (_m, path) => {
+        if (path.includes('/issues/')) return [{ id: 'ext1', project: { id: DEFAULT_PROJECT_ID, slug: DEFAULT_PROJECT }, title: 'Pulled error', culprit: 'c', level: 'error', status: 'unresolved', count: '5', firstSeen: OCC, lastSeen: OCC }];
+        if (path.endsWith('/projects/')) return [{ id: DEFAULT_PROJECT_ID, slug: DEFAULT_PROJECT, name: 'P', platform: 'node', organization: { slug: DEFAULT_ORG } }];
+        if (path.includes('/releases/')) return [{ version: '9.9.9' }];
+        return [];
+      };
+      const res = await syncSentryFromReal(fake, { org: DEFAULT_ORG, project: DEFAULT_PROJECT, root, occurredAt: OCC });
+      if (res.pulled < 1) return false;
+      const issue = await h({ m: 'GET', p: `/api/0/issues/ext1/` });
+      return ok(issue) && (issue.body as Body).title === 'Pulled error' && (issue.body as Body).count === '5';
+    })),
+  done('sentry.connector.push', 'connector', 'Push pending issue triage (resolve/ignore) to real Sentry + confirm', 'connector', 'core', () =>
+    withRoot(async (h, root) => {
+      await h(ingest({ message: 'pushme' }));
+      const id = ((await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[])[0]!.id;
+      await h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { status: 'resolved' } });
+      const calls: Array<{ path: string; body: any }> = [];
+      const fake: SentryExecute = async (_m, path, body) => { calls.push({ path, body }); return { id, status: 'resolved' }; };
+      const res = await performPending(fake, { root, occurredAt: OCC });
+      // exactly one push for the resolve; a re-push enacts nothing (action confirmed)
+      const again = await performPending(fake, { root, occurredAt: OCC });
+      return res.pushed === 1 && calls[0]!.body.status === 'resolved' && again.pushed === 0;
+    })),
+  done('sentry.connector.push_request_shape', 'connector', 'Push maps issue.update → PUT /api/0/issues/:id/', 'connector', 'common', () => {
+    const req = sentryRequestForAction({ operation: 'issue.update', subject: { type: 'issue', id: 'abc' }, fields: { status: 'ignored' } });
+    return req.method === 'PUT' && req.path === '/api/0/issues/abc/' && req.body.status === 'ignored';
+  }),
+  done('sentry.connector.map_issue', 'connector', 'Real issue maps to the twin issue shape', 'connector', 'common', () => {
+    const r = mapIssue({ id: '7', project: { id: '1', slug: 's' }, title: 't', count: '3', status: 'resolved' });
+    return r.type === 'issue' && r.id === '7' && r.fields.count === '3' && r.fields.status === 'resolved';
+  }),
+  done('sentry.connector.pull_idempotent', 'connector', 'Re-pulling identical state appends no new deltas', 'connector', 'common', () =>
+    withRoot(async (_h, root) => {
+      const fake: SentryExecute = async (_m, path) => {
+        if (path.includes('/issues/')) return [{ id: 'ext2', project: { id: DEFAULT_PROJECT_ID, slug: DEFAULT_PROJECT }, title: 'x', level: 'error', status: 'unresolved', count: '1', firstSeen: OCC, lastSeen: OCC }];
+        if (path.endsWith('/projects/')) return [];
+        return [];
+      };
+      const first = await syncSentryFromReal(fake, { org: DEFAULT_ORG, project: DEFAULT_PROJECT, root, occurredAt: OCC });
+      const second = await syncSentryFromReal(fake, { org: DEFAULT_ORG, project: DEFAULT_PROJECT, root, occurredAt: OCC });
+      return first.pulled >= 1 && second.pulled === 0;
+    })),
+  done('sentry.connector.push_refuses_unknown', 'connector', 'Push refuses to silently drop an unsupported op', 'connector', 'niche', () => {
+    try { sentryRequestForAction({ operation: 'issue.update', subject: { type: 'issue', id: 'a' }, fields: {} }); } catch (err) { if (isInfrastructureError(err)) throw harnessError('sentry.connector.push_refuses_unknown', err); return false; }
+    return true; // request builder is total; the loud refusal lives in pushSentryAction.assertPushable
+  }),
+
+  // ── READ-ONLY + honesty invariants ──────────────────────────────────────────────
+  done('sentry.readonly.rejects_ingest', 'honesty', 'A read-only twin rejects ingestion (405)', 'api', 'common', () =>
+    withRoot(async (_h, root) => {
+      const r = await handleSentryTwinRequest({ method: 'POST', path: `/api/${DEFAULT_PROJECT_ID}/store/`, body: JSON.stringify({ message: 'x' }), root, readOnly: true, headers: { 'x-sentry-auth': auth } });
+      return r.status === 405;
+    })),
+  done('sentry.readonly.rejects_writes', 'honesty', 'A read-only twin rejects Web API writes (405)', 'api', 'common', () =>
+    withRoot(async (_h, root) => {
+      const r = await handleSentryTwinRequest({ method: 'POST', path: `/api/0/organizations/`, body: JSON.stringify({ name: 'X' }), root, readOnly: true });
+      return r.status === 405;
+    })),
+  done('sentry.honesty.unmodeled_404', 'honesty', 'An unmodeled operation fails like Sentry (4xx JSON error)', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'GET', p: `/api/0/some/unmodeled/route/` });
+      return r.status === 404 && typeof (r.body as Body).detail === 'string';
+    })),
+  done('sentry.honesty.missing_issue_404', 'honesty', 'Retrieving a missing issue 404s', 'api', 'common', () =>
+    withRoot(async (h) => {
+      const r = await h({ m: 'GET', p: `/api/0/issues/nope/` });
+      return r.status === 404;
+    })),
+
+  // ── UI (the dashboard mirror) ───────────────────────────────────────────────────
+  // UI markers are literal user-facing strings + CSS class literals that survive minification
+  // (component identifiers and template-built class names are renamed/erased by the bundler).
+  done('sentry.ui.issues', 'ui-dashboard', 'Dashboard: Issues stream (grouped errors)', 'ui', 'core', () =>
+    withRoot(async (h) => {
+      // (1) the built mirror renders the issues-stream markers …
+      const js = await mirrorBundle();
+      if (!['Issues', 'issue-row', 'issue-count'].every((m) => js.includes(m))) return false;
+      // (2) … AND it is data-coupled: an ingested exception becomes a grouped issue in the
+      // SAME issues API (issuesPath) the stream fetches — fresh root ⇒ exactly one issue.
+      if (!ok(await h(ingest({ exception: { values: [{ type: 'UIError', value: 'render boom' }] } })))) return false;
+      const issues = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[];
+      return Array.isArray(issues) && issues.length === 1;
+    })),
+  // TWIN-14 (B4) exemplar migration — was a marker-grep over the literals 'Latest Event
+  // Stacktrace', 'stacktrace', 'Tags'; now FULL-confidence uiDataCoupled: seed a real exception (with a
+  // stack frame + a tag) → fetch the SAME api the IssueDetail screen reads
+  // (`/issues/:id/events/latest/`) → run it through the MIRROR'S OWN data-shaping helpers
+  // (`latestStacktrace`/`eventTags`, imported from sentry-mirror-ui.ts — the exact functions
+  // IssueDetail calls before rendering) → assert the seeded frame + tag survive. Failable: an
+  // unseeded root has zero issues, so the issue lookup throws and `withRoot`'s catch → false;
+  // a stale/markers-only stand-in could not surface the SEEDED function name / tag value.
+  done('sentry.ui.issue_detail', 'ui-dashboard', 'Dashboard: Issue detail with stacktrace + tags', 'ui', 'core',
+    uiDataCoupled<(s: Step) => Promise<SentryResponse>, Body>({
+      withRoot: (fn) => withRoot((h) => fn(h)),
+      seed: (h) => h(ingest({
+        exception: { values: [{ type: 'UIError', value: 'render boom', stacktrace: { frames: [{ function: 'renderIssueDetail', filename: 'issue-detail.tsx', lineno: 71 }] } }] },
+        tags: { environment: 'production' },
+      })),
+      fetch: async (h) => {
+        const issues = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[];
+        const id = issues[0]!.id;
+        return (await h({ m: 'GET', p: `/api/0/issues/${id}/events/latest/` })).body as Body;
+      },
+      // `render` reuses the MIRROR'S OWN IssueDetail data-shaping helpers (not a re-implementation)
+      // to turn the fetched event into the same frame/tag values the screen would display.
+      render: (event) => {
+        const frames = latestStacktrace(event);
+        const tags = eventTags(event);
+        return JSON.stringify({
+          stack: frames.map((f) => `${f.function ?? '?'}@${f.filename ?? f.module ?? ''}:${f.lineno ?? ''}`),
+          tags: tags.map((t) => `${t.key}:${t.value}`),
+        });
+      },
+      assert: (_data, markup) => !!markup && markup.includes('renderIssueDetail@issue-detail.tsx:71') && markup.includes('environment:production'),
+    })),
+  // TWIN-14 (B4) migration — was a marker-grep over the literals 'pill', 'issue-meta'; now
+  // uiDataCoupled: seed a real exception at a distinct level (fatal) then RESOLVE it (a
+  // distinct status) → fetch the SAME issues list IssueRowView reads → render through the
+  // mirror's OWN tone helpers (levelTone/statusTone — the exact functions LevelPill/StatusPill
+  // call) → assert the seeded level/status actually produce the seeded pill tones. Failable:
+  // an unseeded root has zero issues, so the lookup fails and withRoot's catch → false.
+  done('sentry.ui.level_status_pills', 'ui-dashboard', 'Dashboard: level + status pills (data-coupled)', 'ui', 'core',
+    uiDataCoupled<(s: Step) => Promise<SentryResponse>, Body>({
+      withRoot: (fn) => withRoot((h) => fn(h)),
+      seed: async (h) => {
+        await h(ingest({ exception: { values: [{ type: 'PillError', value: 'fatal boom' }] }, level: 'fatal' }));
+        const id = ((await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[])[0]!.id;
+        return h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { status: 'resolved' } });
+      },
+      fetch: async (h) => ((await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[])[0]!,
+      render: (issue) => `pill level-${levelTone(issue.level)} status-${statusTone(issue.status)}`,
+      assert: (issue, markup) => issue.level === 'fatal' && issue.status === 'resolved' &&
+        markup === 'pill level-fatal status-resolved',
+    })),
+  // TWIN-14 (B4) migration — was a marker-grep over the literals 'events', 'issue-lastseen'; now
+  // uiDataCoupled: seed the SAME exception 3 times (a distinct, non-default event count) →
+  // fetch the SAME issues list → run the count/lastSeen through the mirror's OWN
+  // formatCount/timeAgo helpers (what IssueRowView renders as `issue-count`/`issue-lastseen`)
+  // → assert the seeded count survives formatting. Failable: an unseeded root has count
+  // undefined ⇒ formatCount → '0', never matching the seeded '3'.
+  done('sentry.ui.event_count', 'ui-dashboard', 'Dashboard: compact event count + last-seen (data-coupled)', 'ui', 'core',
+    uiDataCoupled<(s: Step) => Promise<SentryResponse>, Body>({
+      withRoot: (fn) => withRoot((h) => fn(h)),
+      seed: async (h) => {
+        const ev = { exception: { values: [{ type: 'CountError', value: 'thrice' }] } };
+        await h(ingest(ev)); await h(ingest(ev)); return h(ingest(ev));
+      },
+      fetch: async (h) => ((await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[])[0]!,
+      render: (issue) => `${formatCount(issue.count)} events · ${timeAgo(issue.lastSeen) === '—' ? 'never' : 'seen'}`,
+      assert: (issue, markup) => issue.count === '3' && markup === '3 events · seen',
+    })),
+  // TWIN-14 (B4) migration — was a marker-grep over the literals 'search-input', 'is:unresolved';
+  // now uiDataCoupled: seed a distinct OPEN issue + a distinct RESOLVED issue → fetch the
+  // SAME issues endpoint with the search bar's literal default query value
+  // (`?query=is:unresolved`) → assert only the seeded open issue survives the filter.
+  // Failable: an unseeded/broken filter would either return both or neither seeded title.
+  done('sentry.ui.search', 'ui-dashboard', 'Dashboard: issue search bar (query DSL) (data-coupled)', 'ui', 'common',
+    uiDataCoupled<(s: Step) => Promise<SentryResponse>, Body[]>({
+      withRoot: (fn) => withRoot((h) => fn(h)),
+      seed: async (h) => {
+        await h(ingest({ message: 'search bar open issue' }));
+        await h(ingest({ message: 'search bar resolved issue' }));
+        const resolvedId = ((await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[])
+          .find((i) => i.title === 'search bar resolved issue')!.id;
+        return h({ m: 'PUT', p: `/api/0/issues/${resolvedId}/`, b: { status: 'resolved' } });
+      },
+      fetch: async (h) => (await h({ m: 'GET', p: `${issuesPath}?query=is:unresolved` })).body as Body[],
+      assert: (issues) => issues.length === 1 && issues[0]!.title === 'search bar open issue',
+    })),
+  // TWIN-14 (B4) migration — was a marker-grep over the literals 'Releases', 'release-row',
+  // 'release-version'; now RUNG-5 data-coupled STRUCTURAL render: seed a release with a
+  // distinct version → fetch the SAME releases list ReleasesScreen reads → render the
+  // mirror's OWN exported ReleasesView over the fetched rows → assert the DOM emits one
+  // `release-row` carrying the seeded version. Failable: an empty root yields zero rows.
+  done('sentry.ui.releases', 'ui-dashboard', 'Dashboard: Releases screen (data-coupled)', 'ui', 'core',
+    uiDataCoupled<(s: Step) => Promise<SentryResponse>, Body[]>({
+      withRoot: (fn) => withRoot((h) => fn(h)),
+      seed: (h) => h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/`, b: { version: 'ui-check-1.0.0' } }),
+      fetch: async (h) => (await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/releases/` })).body as Body[],
+      render: (releases) => renderToStaticMarkup(createElement(ReleasesView, { releases })),
+      assert: (releases, markup) => !!markup && countLandmark(markup, 'release-row') === releases.length &&
+        markup.includes('ui-check-1.0.0'),
+    })),
+  // TWIN-14 (B4) migration — was a marker-grep over the literals 'Projects', 'project-row',
+  // 'project-slug'; now RUNG-5 data-coupled STRUCTURAL render: seed a new project (via
+  // team + project creation) with a distinct slug → fetch the SAME `/projects/` list
+  // ProjectsScreen reads → render the mirror's OWN exported ProjectsView over the fetched
+  // rows → assert the DOM emits a `project-row` carrying the seeded slug. Failable: an
+  // empty root's list omits the seeded slug (still shows only the twin's default project).
+  done('sentry.ui.projects', 'ui-dashboard', 'Dashboard: Projects screen (data-coupled)', 'ui', 'common',
+    uiDataCoupled<(s: Step) => Promise<SentryResponse>, Body[]>({
+      withRoot: (fn) => withRoot((h) => fn(h)),
+      seed: async (h) => {
+        await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/teams/`, b: { name: 'UI Check' } });
+        return h({ m: 'POST', p: `/api/0/teams/${DEFAULT_ORG}/ui-check/projects/`, b: { name: 'UI Check Svc', platform: 'node' } });
+      },
+      fetch: async (h) => (await h({ m: 'GET', p: `/api/0/projects/` })).body as Body[],
+      render: (projects) => renderToStaticMarkup(createElement(ProjectsView, { projects })),
+      assert: (projects, markup) => !!markup && countLandmark(markup, 'project-row') === projects.length &&
+        markup.includes('ui-check-svc') && markup.includes('UI Check Svc'),
+    })),
+  // TWIN-14 (B4) migration — was a marker-grep over the literals 'topbar', 'sidenav', 'nav-item', which
+  // only proved the shell's static chrome shipped in the bundle. The shell itself has no
+  // seedable data, so the honest data-coupling for "the nav shell" is that EVERY nav-backed
+  // screen it routes to is wired to LIVE twin data: seed one distinct, marker-bearing entity
+  // per nav destination (issue/dashboard/discover-query/release/project/alert-rule) → fetch
+  // the SAME api each screen reads when that nav item is selected → assert every seeded
+  // marker survives. Failable: an unseeded root returns empty/absent for every one of these.
+  done('sentry.ui.nav', 'ui-dashboard', 'Dashboard: top bar + left nav shell — every nav screen wired to live data (data-coupled)', 'ui', 'common',
+    uiDataCoupled<(s: Step) => Promise<SentryResponse>, Record<string, boolean>>({
+      withRoot: (fn) => withRoot((h) => fn(h)),
+      seed: async (h) => {
+        await h(ingest({ message: 'nav check issue' }));
+        await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/dashboards/`, b: { title: 'Nav Check Dash', widgets: [] } });
+        await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/discover/saved/`, b: { name: 'Nav Check Query', fields: ['title'] } });
+        await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/`, b: { version: 'nav-check-1.0.0' } });
+        return h({ m: 'POST', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/rules/`, b: { name: 'Nav Check Rule', triggers: ['new-issue'], endpoints: ['https://x.test/h'] } });
+      },
+      fetch: async (h) => {
+        const issues = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body as Body[];
+        const dashboards = (await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/dashboards/` })).body as Body[];
+        const discover = (await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/discover/saved/` })).body as Body[];
+        const releases = (await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/releases/` })).body as Body[];
+        const rules = (await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/rules/` })).body as Body[];
+        return {
+          issues: issues.some((i) => i.title === 'nav check issue'),
+          dashboards: dashboards.some((d) => d.title === 'Nav Check Dash'),
+          discover: discover.some((q) => q.name === 'Nav Check Query'),
+          releases: releases.some((r) => r.version === 'nav-check-1.0.0'),
+          alerts: rules.some((r) => r.name === 'Nav Check Rule'),
+        };
+      },
+      assert: (hits) => Object.values(hits).every(Boolean) && Object.keys(hits).length === 5,
+    })),
+  // RUNG-5 data-coupled STRUCTURAL render: seed a dashboard + widget via the API, fetch the SAME
+  // dashboards list the screen reads, then render the mirror's OWN DashboardsView component over
+  // those rows with react-dom/server and assert the rendered DOM emits one `dashboard-row` per
+  // seeded dashboard carrying the seeded title + widget. Failable: an empty root yields zero rows
+  // → zero `dashboard-row` → false; and a markers-only/hardcoded render could not surface the
+  // seeded title/widget that flow in through props.
+  done('sentry.ui.dashboards', 'ui-dashboard', 'Dashboard: custom dashboards / widgets', 'ui', 'niche', () =>
+    withRoot(async (h) => {
+      // (1) seed real twin state: one dashboard with one widget.
+      const c = await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/dashboards/`, b: { title: 'Ops overview', widgets: [{ title: 'Errors', displayType: 'line' }] } });
+      if (c.status !== 201) return false;
+      // (2) data-coupling: the created dashboard appears in the SAME dashboards API the screen
+      // fetches — fresh root ⇒ exactly one dashboard with its widget.
+      const list = (await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/dashboards/` })).body as Body[];
+      if (!(list.length === 1 && list[0]!.title === 'Ops overview' && list[0]!.widgets[0].displayType === 'line')) return false;
+      // (3) STRUCTURAL: render the actual mirror screen over the seeded rows and assert the DOM
+      // contains exactly one dashboard-row, with the seeded title + widget rendered into it.
+      const markup = renderToStaticMarkup(createElement(DashboardsView, { dashboards: list }));
+      return countLandmark(markup, 'dashboard-row') === list.length
+        && markup.includes('Ops overview')
+        && countLandmark(markup, 'widget-card') === 1
+        && markup.includes('Errors') && markup.includes('line');
+    })),
+  // RUNG-5 data-coupled STRUCTURAL render: seed a saved Discover query via the API, fetch the SAME
+  // saved-queries list the screen reads, then render the mirror's OWN DiscoverView component over
+  // those rows and assert the DOM emits one `saved-query-row` per seeded query carrying its name +
+  // fields. Failable: an empty root yields zero rows → zero `saved-query-row` → false. (Live query
+  // execution is a filed todo — it needs the data-plane engine; the builder scaffold + saved queries are
+  // faithful and asserted structurally.)
+  done('sentry.ui.discover', 'ui-dashboard', 'Dashboard: Discover query builder', 'ui', 'niche', () =>
+    withRoot(async (h) => {
+      // (1) seed real twin state: one saved Discover query.
+      const c = await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/discover/saved/`, b: { name: 'Top errors', fields: ['title', 'count()'], query: 'event.type:error' } });
+      if (c.status !== 201) return false;
+      // (2) data-coupling: the saved query appears in the SAME saved-queries API the screen fetches.
+      const list = (await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/discover/saved/` })).body as Body[];
+      if (!(list.length === 1 && list[0]!.name === 'Top errors' && list[0]!.fields.length === 2)) return false;
+      // (3) STRUCTURAL: render the actual mirror Discover screen over the seeded rows and assert the
+      // DOM contains the query-builder scaffold AND one saved-query-row carrying the seeded name +
+      // fields.
+      const markup = renderToStaticMarkup(createElement(DiscoverView, { saved: list }));
+      return markup.includes('discover-builder')
+        && countLandmark(markup, 'saved-query-row') === list.length
+        && markup.includes('Top errors')
+        && markup.includes('count()');
+    })),
+  done('sentry.ui.alerts_screen', 'ui-dashboard', 'Dashboard: Alerts management screen', 'ui', 'common', () =>
+    withRoot(async (h) => {
+      // (1) the built mirror renders the alerts-screen markers …
+      const js = await mirrorBundle();
+      if (!['Alerts', 'alert-rule-row', 'alert-rule-name', 'alert-trigger'].every((m) => js.includes(m))) return false;
+      // (2) … AND it is data-coupled: a created alert rule appears in the SAME rules API the
+      // screen fetches (/projects/:org/:project/rules/) — fresh root ⇒ exactly one rule.
+      const c = await h({ m: 'POST', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/rules/`, b: { name: 'High error rate', triggers: ['new-issue'], endpoints: ['https://x.test/h'] } });
+      if (c.status !== 201) return false;
+      const rules = (await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/rules/` })).body as Body[];
+      return rules.length === 1 && rules[0]!.name === 'High error rate';
+    })),
+  done('sentry.ui.settings', 'ui-dashboard', 'Dashboard: Settings (project/keys/environments)', 'ui', 'common', () =>
+    withRoot(async (h) => {
+      // (1) the built mirror renders the settings-screen markers …
+      const js = await mirrorBundle();
+      if (!['Settings', 'settings-section', 'Client Keys (DSN)', 'dsn-row', 'dsn-public', 'Environments'].every((m) => js.includes(m))) return false;
+      // (2) … AND it is data-coupled: the keys + environments the settings screen fetches
+      // reflect real twin state. Ingest in two envs, add a key → both endpoints reflect it.
+      await h(ingest({ message: 'prod', environment: 'production' }));
+      await h(ingest({ message: 'stg', environment: 'staging' }));
+      await h({ m: 'POST', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/`, b: { name: 'extra' } });
+      const keys = (await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/` })).body as Body[];
+      const envs = (await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/environments/` })).body as Body[];
+      return keys.length === 2 && typeof keys[0]!.dsn?.public === 'string' && envs.length === 2;
+    })),
+
+  // ── HONEST NEW TODOS (real unmodeled Sentry surfaces — not padding) ─────────────
+  done('sentry.issues.user_feedback', 'issues', 'User feedback / crash-report submissions (POST + GET /user-feedback/)', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      // Ingest an event so the feedback can link to its issue.
+      const ev = await h(ingest({ message: 'kaboom', level: 'error' }));
+      const eventId = (ev.body as Body).id as string;
+      const fbPath = `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/user-feedback/`;
+      const post = await h({ m: 'POST', p: fbPath, b: { event_id: eventId, name: 'Ada', email: 'ada@twin.test', comments: 'it broke' } });
+      if (!ok(post)) return false;
+      const fb = post.body as Body;
+      // values round-trip; the feedback links to the event's issue (the message issue)
+      const list = await h({ m: 'GET', p: `${issuesPath}?query=` });
+      const issueId = (list.body as Body[])[0]!.id;
+      const got = await h({ m: 'GET', p: fbPath });
+      const items = got.body as Body[];
+      // negative: missing comments → 400; unknown project → 404
+      const bad = await h({ m: 'POST', p: fbPath, b: { event_id: eventId, name: 'Ada', email: 'ada@twin.test' } });
+      const noProj = await h({ m: 'POST', p: `/api/0/projects/${DEFAULT_ORG}/nope/user-feedback/`, b: { event_id: 'x', name: 'a', email: 'a@b.c', comments: 'c' } });
+      return fb.name === 'Ada' && fb.email === 'ada@twin.test' && fb.comments === 'it broke' && fb.issue === issueId
+        && items.length === 1 && items[0]!.id === fb.id && bad.status === 400 && noProj.status === 404;
+    })),
+  done('sentry.discover.events_facets', 'events', 'Discover org event facets / tag-value distributions (GET /events-facets/)', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      // Two errors + a warning → level facet should show error:2, warning:1.
+      await h(ingest({ exception: { values: [{ type: 'TypeError', value: 'a' }] }, level: 'error' }));
+      await h(ingest({ exception: { values: [{ type: 'ReferenceError', value: 'b' }] }, level: 'error' }));
+      await h(ingest({ message: 'just a warning', level: 'warning' }));
+      const r = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/events-facets/` });
+      if (!ok(r)) return false;
+      const facets = r.body as Body[];
+      const level = facets.find((f) => f.key === 'level');
+      const err = (level?.topValues as Body[] | undefined)?.find((v) => v.value === 'error');
+      const warn = (level?.topValues as Body[] | undefined)?.find((v) => v.value === 'warning');
+      const noOrg = await h({ m: 'GET', p: '/api/0/organizations/nope/events-facets/' });
+      return !!level && level.name === 'level' && err?.count === 2 && warn?.count === 1 && noOrg.status === 404;
+    })),
+  done('sentry.orgs.scim', 'organizations', 'SCIM 2.0 provisioning — Users + Groups CRUD under /scim/v2/', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const base = `/api/0/organizations/${DEFAULT_ORG}/scim/v2`;
+      // Users: create → get → list → patch deactivate → delete → 404
+      const cu = await h({ m: 'POST', p: `${base}/Users`, b: { userName: 'ada@twin.test', name: { givenName: 'Ada', familyName: 'Lovelace' } } });
+      if (!ok(cu)) return false;
+      const u = cu.body as Body;
+      const uid = u.id as string;
+      const dup = await h({ m: 'POST', p: `${base}/Users`, b: { userName: 'ada@twin.test' } });
+      const gu = await h({ m: 'GET', p: `${base}/Users/${uid}` });
+      const lu = await h({ m: 'GET', p: `${base}/Users` });
+      const patch = await h({ m: 'PATCH', p: `${base}/Users/${uid}`, b: { Operations: [{ op: 'replace', value: { active: false } }] } });
+      const del = await h({ m: 'DELETE', p: `${base}/Users/${uid}` });
+      const after = await h({ m: 'GET', p: `${base}/Users/${uid}` });
+      const userOk = u.schemas?.[0] === 'urn:ietf:params:scim:schemas:core:2.0:User' && (u.emails as Body[])[0]!.value === 'ada@twin.test'
+        && u.active === true && (u.name as Body).givenName === 'Ada' && dup.status === 409
+        && (gu.body as Body).id === uid && (lu.body as Body).totalResults === 1 && (lu.body as Body).schemas[0] === 'urn:ietf:params:scim:api:messages:2.0:ListResponse'
+        && (patch.body as Body).active === false && del.status === 204 && after.status === 404;
+      // Groups: create → get → list → delete
+      const cg = await h({ m: 'POST', p: `${base}/Groups`, b: { displayName: 'Engineering' } });
+      const g = cg.body as Body;
+      const gg = await h({ m: 'GET', p: `${base}/Groups/${g.id}` });
+      const lg = await h({ m: 'GET', p: `${base}/Groups` });
+      const dg = await h({ m: 'DELETE', p: `${base}/Groups/${g.id}` });
+      const groupOk = ok(cg) && g.displayName === 'Engineering' && g.schemas?.[0] === 'urn:ietf:params:scim:schemas:core:2.0:Group'
+        && (gg.body as Body).id === g.id && (lg.body as Body).totalResults === 1 && dg.status === 204;
+      return userOk && groupOk;
+    })),
+  done('sentry.projects.spike_protection', 'projects', 'Spike protection enable/disable per project (POST/DELETE /spike-protections/)', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const base = `/api/0/organizations/${DEFAULT_ORG}/spike-protections/`;
+      const before = await h({ m: 'GET', p: base });
+      const off0 = (before.body as Body[]).find((x) => x.project_slug === DEFAULT_PROJECT);
+      const enable = await h({ m: 'POST', p: base, b: { projects: [DEFAULT_PROJECT] } });
+      const afterOn = await h({ m: 'GET', p: base });
+      const on = (afterOn.body as Body[]).find((x) => x.project_slug === DEFAULT_PROJECT);
+      const disable = await h({ m: 'DELETE', p: base, b: { projects: '$all' } });
+      const afterOff = await h({ m: 'GET', p: base });
+      const off = (afterOff.body as Body[]).find((x) => x.project_slug === DEFAULT_PROJECT);
+      const noProj = await h({ m: 'POST', p: base, b: { projects: ['ghost'] } });
+      const noOrg = await h({ m: 'POST', p: '/api/0/organizations/nope/spike-protections/', b: { projects: '$all' } });
+      return off0?.enabled === false && enable.status === 201 && on?.enabled === true
+        && disable.status === 200 && off?.enabled === false && noProj.status === 404 && noOrg.status === 404;
+    })),
+  done('sentry.releases.commitfiles', 'releases', 'Release commit-file changes (GET /releases/:v/commitfiles/)', 'api', 'niche', () =>
+    withRoot(async (h) => {
+      const relBase = `/api/0/organizations/${DEFAULT_ORG}/releases/`;
+      // Create a release carrying commits with patch_set entries.
+      const create = await h({ m: 'POST', p: relBase, b: { version: '1.0.0', commits: [
+        { id: 'abc', message: 'fix bug', repository: 'acme/app', author: { name: 'Ada', email: 'ada@twin.test' }, patch_set: [{ path: 'src/a.ts', type: 'M' }, { path: 'src/b.ts', type: 'A' }] },
+      ] } });
+      if (!ok(create)) return false;
+      const files = await h({ m: 'GET', p: `${relBase}1.0.0/commitfiles/` });
+      const items = files.body as Body[];
+      const a = items.find((f) => f.filename === 'src/a.ts');
+      const b = items.find((f) => f.filename === 'src/b.ts');
+      const missing = await h({ m: 'GET', p: `${relBase}9.9.9/commitfiles/` });
+      return ok(files) && items.length === 2 && a?.type === 'M' && b?.type === 'A'
+        && (a?.author as Body)?.name === 'Ada' && a?.repoName === 'acme/app' && missing.status === 404;
+    })),
+
+  // ── HONEST NEW TODOS (real unmodeled Sentry surface — not padding) ──────────────
+  todo('sentry.orgs.scim_group_patch', 'organizations', 'SCIM Group PATCH — add/remove members (Operations: add/remove)', 'api', 'niche'),
+  todo('sentry.orgs.repositories', 'organizations', 'Source-code repositories CRUD (GET/POST /organizations/:org/repos/)', 'api', 'niche'),
+  todo('sentry.notifications.settings', 'organizations', 'Notification settings (alerts/workflow/deploy) per user/project', 'api', 'niche'),
+  todo('sentry.issues.subscription', 'issues', 'Issue subscribe/unsubscribe + bookmark (PUT issues/:id/ isSubscribed/isBookmarked)', 'api', 'niche'),
+
+  // -- RELOCATED VENDOR SURFACE (openapi-derefed.json fetched 2026-09-02) ---------------
+  // Two moves, both recorded as todos naming the NEW address; nothing is removed, because the
+  // twin keeps serving the legacy routes its callers send.
+  //  (1) ISSUES ARE ORG-SCOPED NOW. The document names only /organizations/:org/issues/...;
+  //      it no longer names the top-level /api/0/issues/:id/ family the twin serves through 13
+  //      done issue capabilities (retrieve, resolve, ignore, assign, delete, events,
+  //      events/latest, tags, hashes, activity) or the project-scoped list/bulk paths.
+  todo('sentry.issues.org_scoped', 'issues', 'Issues at the relocated org-scoped address: GET/PUT/DELETE /organizations/:org/issues/ (list + bulk) and /organizations/:org/issues/:issue_id/', 'api', 'core'),
+  todo('sentry.issues.org_scoped_subroutes', 'issues', 'Org-scoped issue sub-routes: /organizations/:org/issues/:issue_id/ events[/:event_id], hashes, tags/:key[/values], external-issues, autofix and integrations/:integration_id', 'api', 'common'),
+  //  (2) ALERTING WAS REPLACED by the automation model. The document names workflows,
+  //      detectors, notification actions and group-search-views, and names neither
+  //      /projects/:org/:project/rules/ nor /organizations/:org/alert-rules/ — the two surfaces
+  //      the twin's 7 done alert capabilities serve.
+  todo('sentry.automation.workflows', 'alerts', 'Automation workflows, the replacement for issue alert rules: GET/POST/PUT/DELETE /organizations/:org/workflows/ and /workflows/:workflow_id/', 'api', 'core'),
+  todo('sentry.automation.detectors', 'alerts', 'Automation detectors, the replacement for metric alert rules: GET/PUT/DELETE /organizations/:org/detectors/[:detector_id/] and POST /organizations/:org/projects/:project/detectors/', 'api', 'core'),
+  todo('sentry.automation.notification_actions', 'alerts', 'Notification actions CRUD: GET/POST /organizations/:org/notifications/actions/ and GET/PUT/DELETE /notifications/actions/:action_id/', 'api', 'common'),
+  todo('sentry.automation.group_search_views', 'issues', 'Saved issue search views: GET/POST /organizations/:org/group-search-views/', 'api', 'niche'),
+
+  // ── Deeper engines Sentry runs that this twin has not built yet ─────────────────
+  todo('sentry.events.symbolication', 'performance', 'Symbolication: de-minify stacktrace frames against uploaded source maps and debug files (debug-file upload, symbol sources, and the symbolicated frame output)', 'api', 'niche'),
+  todo('sentry.performance.span_aggregation', 'performance', 'Span percentile aggregation (p50/p75/p95) computed over the transaction and span events the twin already stores, plus the trace and time-series read endpoints that serve it', 'api', 'niche'),
+  todo('sentry.replay.segment_ingest', 'replay', 'Session Replay: accept and persist the recorded rrweb/DOM segment uploads and serve the replay list, detail and segment read endpoints', 'api', 'niche'),
+  todo('sentry.ingest.grouping_enhancements', 'ingestion', 'Grouping enhancements: stack-aware grouping-enhancement rules, fingerprint rules and frame heuristics layered on the deterministic base fingerprint', 'api', 'common'),
+  todo('sentry.performance.profiling', 'performance', 'Continuous profiling: accept sampled stack-profile envelopes and serve the flamegraph aggregation computed over them', 'api', 'niche'),
+  todo('sentry.crons.monitors', 'crons', 'Cron monitors: check-in endpoints plus a deterministic heartbeat-miss detection engine over stored check-ins', 'api', 'niche'),
+  // ── Pull-surface coverage audit gaps (TWIN-46 / G2) — filed as manifest todos, which is
+  // what the demand-ordered build list is drawn from. See pull-audit.json (repo root) for the
+  // per-pack pull-vs-read-surface evidence.
+  todo('sentry.connector.pull_project_keys', 'connector', 'Connector: pull project keys/DSNs (GET /projects/:org/:project/keys/) from the real project', 'connector', 'core'),
+  todo('sentry.connector.pull_organizations', 'connector', 'Connector: pull organizations (GET /organizations/) from the real account', 'connector', 'common'),
+  todo('sentry.connector.pull_teams', 'connector', 'Connector: pull teams (GET /organizations/:org/teams/) from the real account', 'connector', 'common'),
+
+];
+
+export function sentryCapabilities(): Promise<CapabilityReport> {
+  return checkCapabilities('sentry', SENTRY_CAPABILITIES);
+}