@volter/twin-sentry 0.1.0

package/dist/src/sentry-capabilities.js

@@ -0,0 +1,1180 @@
+// Sentry capability manifest — the EXPECTED REAL-PRODUCT SURFACE (the target), authored
+// top-down from what Sentry actually does — NOT from what this twin has built. This is the
+// honest denominator: every entry's verify() (required to count as done) drives REAL
+// requests through the twin and asserts status/shape; `expected:'done'` only on what we
+// genuinely claim, so a broken one shows as a regression. Grow this toward Sentry's full
+// surface every cycle.
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { createElement } from 'react';
+import { renderToStaticMarkup } from 'react-dom/server';
+import { checkCapabilities, uiDataCoupled, verifyBoundary, isInfrastructureError, harnessError } from '@volter/world-tooling';
+import { DashboardsView, DiscoverView, ReleasesView, ProjectsView } from "../client/sentry-mirror.js";
+import { handleSentryTwinRequest } from "./sentry-twin.js";
+import { DEFAULT_ORG, DEFAULT_PROJECT, DEFAULT_PROJECT_ID, DEFAULT_PUBLIC_KEY } from "./sentry-ingest.js";
+import { registerAlertRule, emitIssueAlert, verifySentrySignature, computeSentrySignature } from "./sentry-events.js";
+import { mapIssue, sentryRequestForAction, syncSentryFromReal } from "./sentry-connector.js";
+import { performPending } from "./sentry-perform-harness.js";
+import { buildSentryMirrorClient, latestStacktrace, eventTags, levelTone, statusTone, formatCount, timeAgo } from "./sentry-mirror-ui.js";
+const OCC = '2026-01-01T00:00:00.000Z';
+/** Run a sequence of real Sentry requests against an isolated root; returns a tester. */
+async function withRoot(steps) {
+    const root = mkdtempSync(join(tmpdir(), 'sentry-cap-'));
+    const h = (s) => handleSentryTwinRequest({
+        method: s.m, path: s.p,
+        body: s.b === undefined ? undefined : (typeof s.b === 'string' ? s.b : JSON.stringify(s.b)),
+        root, occurredAt: OCC,
+        headers: s.auth ? { 'x-sentry-auth': s.auth } : {},
+    });
+    try {
+        return await verifyBoundary('sentry.withRoot', () => steps(h, root));
+    }
+    finally {
+        rmSync(root, { recursive: true, force: true });
+    }
+}
+const ok = (r) => r.status >= 200 && r.status < 300;
+const auth = `Sentry sentry_key=${DEFAULT_PUBLIC_KEY}`;
+const ingest = (event) => ({ m: 'POST', p: `/api/${DEFAULT_PROJECT_ID}/store/`, b: event, auth });
+const envelope = (event) => ({ m: 'POST', p: `/api/${DEFAULT_PROJECT_ID}/envelope/`, b: `{"dsn":"http://${DEFAULT_PUBLIC_KEY}@localhost/${DEFAULT_PROJECT_ID}"}\n{"type":"event"}\n${JSON.stringify(event)}` });
+const issuesPath = `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/issues/`;
+// ── UI verify: the built mirror bundle must contain the screen's load-bearing markers ──
+let bundle = null;
+const mirrorBundle = () => (bundle ??= buildSentryMirrorClient());
+// Count occurrences of a DOM landmark class (e.g. one `dashboard-row` per dashboard) in
+// rendered mirror markup — the structural assertion used by the rung-5 UI verifies below.
+const countLandmark = (markup, landmark) => markup.split(landmark).length - 1;
+// shorthands
+const done = (id, area, title, dimension, tier, verify) => ({ id, area, title, dimension, tier, expected: 'done', verify });
+const todo = (id, area, title, dimension, tier) => ({ id, area, title, dimension, tier, expected: 'todo' });
+export const SENTRY_CAPABILITIES = [
+    // ── INGESTION (the SDK side — the core) ─────────────────────────────────────────
+    done('sentry.ingest.store_exception', 'ingestion', 'POST /api/:id/store/ — capture an exception event', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h(ingest({ exception: { values: [{ type: 'TypeError', value: 'boom' }] } }));
+        return ok(r) && typeof r.body.id === 'string' && r.body.id.length === 32;
+    })),
+    done('sentry.ingest.envelope', 'ingestion', 'POST /api/:id/envelope/ — capture via the modern envelope transport', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h(envelope({ exception: { values: [{ type: 'RangeError', value: 'nope' }] } }));
+        return ok(r) && typeof r.body.id === 'string';
+    })),
+    done('sentry.ingest.message', 'ingestion', 'Capture a message event (no exception)', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h(ingest({ message: 'something happened', level: 'warning' }));
+        if (!ok(r))
+            return false;
+        const list = await h({ m: 'GET', p: `${issuesPath}?query=` });
+        const issues = list.body;
+        return issues.length === 1 && issues[0].title === 'something happened' && issues[0].level === 'warning';
+    })),
+    done('sentry.ingest.grouping', 'ingestion', 'Two identical exceptions GROUP into one issue (count increments)', 'api', 'core', () => withRoot(async (h) => {
+        const ev = { exception: { values: [{ type: 'TypeError', value: 'x is undefined' }] } };
+        const a = await h(ingest(ev));
+        const b = await h(ingest(ev));
+        const list = await h({ m: 'GET', p: `${issuesPath}?query=` });
+        const issues = list.body;
+        // distinct event ids, one issue, count 2, first/last seen set
+        return a.body.id !== b.body.id && issues.length === 1 &&
+            issues[0].count === '2' && !!issues[0].firstSeen && !!issues[0].lastSeen;
+    })),
+    done('sentry.ingest.grouping_distinct', 'ingestion', 'Different exceptions land in DIFFERENT issues', 'api', 'core', () => withRoot(async (h) => {
+        await h(ingest({ exception: { values: [{ type: 'TypeError', value: 'a' }] } }));
+        await h(ingest({ exception: { values: [{ type: 'ReferenceError', value: 'b' }] } }));
+        const list = await h({ m: 'GET', p: `${issuesPath}?query=` });
+        return list.body.length === 2;
+    })),
+    done('sentry.ingest.grouping_normalized', 'ingestion', 'Numbers in the message are normalized so similar errors group', 'api', 'common', () => withRoot(async (h) => {
+        await h(ingest({ exception: { values: [{ type: 'Error', value: 'user 42 not found' }] } }));
+        await h(ingest({ exception: { values: [{ type: 'Error', value: 'user 99 not found' }] } }));
+        const list = await h({ m: 'GET', p: `${issuesPath}?query=` });
+        return list.body.length === 1 && list.body[0].count === '2';
+    })),
+    done('sentry.ingest.auth_required', 'ingestion', 'An unknown/missing DSN public key is rejected 401', 'api', 'core', () => withRoot(async (h) => {
+        const noKey = await h({ m: 'POST', p: `/api/${DEFAULT_PROJECT_ID}/store/`, b: { message: 'x' } });
+        const badKey = await h({ m: 'POST', p: `/api/${DEFAULT_PROJECT_ID}/store/`, b: { message: 'x' }, auth: 'Sentry sentry_key=wrong' });
+        return noKey.status === 401 && badKey.status === 401;
+    })),
+    done('sentry.ingest.auth_query', 'ingestion', 'DSN public key accepted via ?sentry_key query param', 'api', 'common', () => withRoot(async (h) => {
+        // a wrong key via the SAME query-param path must be rejected — proves the param is actually read/checked.
+        const wrong = await h({ m: 'POST', p: `/api/${DEFAULT_PROJECT_ID}/store/?sentry_key=wrongkey`, b: { message: 'q' } });
+        if (wrong.status !== 401)
+            return false;
+        const r = await h({ m: 'POST', p: `/api/${DEFAULT_PROJECT_ID}/store/?sentry_key=${DEFAULT_PUBLIC_KEY}`, b: { message: 'q' } });
+        if (!ok(r))
+            return false;
+        const rid = r.body.id;
+        // a real 32-hex event id, and the event must actually be persisted + retrievable with matching content.
+        if (typeof rid !== 'string' || !/^[0-9a-f]{32}$/.test(rid))
+            return false;
+        const got = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/events/${rid}/` });
+        return ok(got) && got.body.eventID === rid && got.body.message === 'q';
+    })),
+    done('sentry.ingest.project_mismatch', 'ingestion', 'A key for a different project is rejected 401', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: `/api/999/store/`, b: { message: 'x' }, auth });
+        return r.status === 401;
+    })),
+    done('sentry.ingest.regression', 'ingestion', 'A new event on a resolved issue REOPENS it (regression)', 'api', 'core', () => withRoot(async (h) => {
+        const ev = { exception: { values: [{ type: 'Error', value: 'flap' }] } };
+        await h(ingest(ev));
+        const list = await h({ m: 'GET', p: `${issuesPath}?query=` });
+        const id = list.body[0].id;
+        await h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { status: 'resolved' } });
+        const resolved = await h({ m: 'GET', p: `/api/0/issues/${id}/` });
+        await h(ingest(ev)); // reopen
+        const reopened = await h({ m: 'GET', p: `/api/0/issues/${id}/` });
+        return resolved.body.status === 'resolved' && reopened.body.status === 'unresolved' && reopened.body.count === '2';
+    })),
+    done('sentry.ingest.culprit', 'ingestion', 'Culprit derived from the top in-app stack frame', 'api', 'common', () => withRoot(async (h) => {
+        await h(ingest({ exception: { values: [{ type: 'Error', value: 'z', stacktrace: { frames: [{ function: 'outer', in_app: false }, { function: 'handler', module: 'app/server', in_app: true }] } }] } }));
+        const list = await h({ m: 'GET', p: `${issuesPath}?query=` });
+        return list.body[0].culprit === 'handler(app/server)';
+    })),
+    done('sentry.ingest.envelope_session_ignored', 'ingestion', 'A session-only envelope is accepted (200) without creating an issue', 'api', 'niche', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: `/api/${DEFAULT_PROJECT_ID}/envelope/`, b: `{"dsn":"http://${DEFAULT_PUBLIC_KEY}@localhost/${DEFAULT_PROJECT_ID}"}\n{"type":"session"}\n{"sid":"abc"}` });
+        const list = await h({ m: 'GET', p: `${issuesPath}?query=` });
+        return ok(r) && list.body.length === 0;
+    })),
+    // ── ISSUES (the Web API dashboard side) ─────────────────────────────────────────
+    done('sentry.issues.list', 'issues', 'GET project issues list', 'api', 'core', () => withRoot(async (h) => {
+        await h(ingest({ message: 'm1' }));
+        const r = await h({ m: 'GET', p: `${issuesPath}?query=` });
+        return ok(r) && Array.isArray(r.body) && r.body.length === 1;
+    })),
+    done('sentry.issues.retrieve', 'issues', 'GET /issues/:id/', 'api', 'core', () => withRoot(async (h) => {
+        await h(ingest({ message: 'r1' }));
+        const id = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body[0].id;
+        const r = await h({ m: 'GET', p: `/api/0/issues/${id}/` });
+        return ok(r) && r.body.id === id && r.body.title === 'r1';
+    })),
+    done('sentry.issues.resolve', 'issues', 'PUT /issues/:id/ status=resolved', 'api', 'core', () => withRoot(async (h) => {
+        await h(ingest({ message: 'res' }));
+        const id = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body[0].id;
+        const r = await h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { status: 'resolved' } });
+        return ok(r) && r.body.status === 'resolved';
+    })),
+    done('sentry.issues.ignore', 'issues', 'PUT /issues/:id/ status=ignored (muted)', 'api', 'core', () => withRoot(async (h) => {
+        await h(ingest({ message: 'ig' }));
+        const id = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body[0].id;
+        const r = await h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { status: 'ignored' } });
+        const muted = await h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { status: 'muted' } });
+        return ok(r) && r.body.status === 'ignored' && muted.body.status === 'ignored';
+    })),
+    done('sentry.issues.unresolve', 'issues', 'PUT /issues/:id/ status=unresolved', 'api', 'common', () => withRoot(async (h) => {
+        await h(ingest({ message: 'un' }));
+        const id = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body[0].id;
+        await h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { status: 'resolved' } });
+        const r = await h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { status: 'unresolved' } });
+        return ok(r) && r.body.status === 'unresolved';
+    })),
+    done('sentry.issues.assign', 'issues', 'PUT /issues/:id/ assignedTo', 'api', 'common', () => withRoot(async (h) => {
+        await h(ingest({ message: 'as' }));
+        const id = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body[0].id;
+        const r = await h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { assignedTo: 'user:ada' } });
+        return ok(r) && r.body.assignedTo === 'user:ada';
+    })),
+    done('sentry.issues.delete', 'issues', 'DELETE /issues/:id/', 'api', 'common', () => withRoot(async (h) => {
+        await h(ingest({ message: 'del' }));
+        const id = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body[0].id;
+        const r = await h({ m: 'DELETE', p: `/api/0/issues/${id}/` });
+        const gone = await h({ m: 'GET', p: `/api/0/issues/${id}/` });
+        return r.status === 204 && gone.status === 404;
+    })),
+    done('sentry.issues.events', 'issues', 'GET /issues/:id/events/', 'api', 'core', () => withRoot(async (h) => {
+        const ev = { exception: { values: [{ type: 'E', value: 'v' }] } };
+        await h(ingest(ev));
+        await h(ingest(ev));
+        const id = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body[0].id;
+        const r = await h({ m: 'GET', p: `/api/0/issues/${id}/events/` });
+        return ok(r) && r.body.length === 2;
+    })),
+    done('sentry.issues.events_latest', 'issues', 'GET /issues/:id/events/latest/', 'api', 'common', () => withRoot(async (h) => {
+        await h(ingest({ exception: { values: [{ type: 'E', value: 'v', stacktrace: { frames: [{ function: 'f' }] } }] } }));
+        const id = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body[0].id;
+        const r = await h({ m: 'GET', p: `/api/0/issues/${id}/events/latest/` });
+        return ok(r) && Array.isArray(r.body.entries);
+    })),
+    done('sentry.issues.query_is', 'issues', 'Issue search: is:resolved / is:unresolved filter', 'api', 'core', () => withRoot(async (h) => {
+        await h(ingest({ message: 'open' }));
+        await h(ingest({ message: 'closed' }));
+        const closedId = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body.find((i) => i.title === 'closed').id;
+        await h({ m: 'PUT', p: `/api/0/issues/${closedId}/`, b: { status: 'resolved' } });
+        const unresolved = await h({ m: 'GET', p: `${issuesPath}?query=is:unresolved` });
+        const resolved = await h({ m: 'GET', p: `${issuesPath}?query=is:resolved` });
+        return unresolved.body.length === 1 && unresolved.body[0].title === 'open' &&
+            resolved.body.length === 1 && resolved.body[0].title === 'closed';
+    })),
+    done('sentry.issues.query_level', 'issues', 'Issue search: level:error filter', 'api', 'common', () => withRoot(async (h) => {
+        await h(ingest({ message: 'e', level: 'error' }));
+        await h(ingest({ message: 'w', level: 'warning' }));
+        const r = await h({ m: 'GET', p: `${issuesPath}?query=level:warning` });
+        return r.body.length === 1 && r.body[0].level === 'warning';
+    })),
+    done('sentry.issues.query_text', 'issues', 'Issue search: free-text title match', 'api', 'common', () => withRoot(async (h) => {
+        await h(ingest({ message: 'database timeout' }));
+        await h(ingest({ message: 'render glitch' }));
+        const r = await h({ m: 'GET', p: `${issuesPath}?query=${encodeURIComponent('is:unresolved timeout')}` });
+        return r.body.length === 1 && r.body[0].title === 'database timeout';
+    })),
+    done('sentry.issues.sort_freq', 'issues', 'Issue list sort=freq orders by event count', 'api', 'common', () => withRoot(async (h) => {
+        const a = { message: 'rare' };
+        const b = { message: 'common' };
+        await h(ingest(a));
+        await h(ingest(b));
+        await h(ingest(b));
+        await h(ingest(b));
+        const r = await h({ m: 'GET', p: `${issuesPath}?query=&sort=freq` });
+        return r.body[0].title === 'common';
+    })),
+    done('sentry.issues.short_id', 'issues', 'Issue carries a shortId + permalink', 'api', 'common', () => withRoot(async (h) => {
+        await h(ingest({ message: 'sid' }));
+        const i = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body;
+        return typeof i[0].shortId === 'string' && typeof i[0].permalink === 'string';
+    })),
+    done('sentry.issues.metadata', 'issues', 'Issue metadata carries exception type/value', 'api', 'common', () => withRoot(async (h) => {
+        await h(ingest({ exception: { values: [{ type: 'KeyError', value: 'missing' }] } }));
+        const i = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body[0];
+        return i.metadata?.type === 'KeyError' && i.metadata?.value === 'missing';
+    })),
+    done('sentry.issues.merge', 'issues', 'Merge issues into one group (bulk PUT ?id=…&merge)', 'api', 'niche', () => withRoot(async (h) => {
+        // two DISTINCT errors → two issues; the busier one (3 events) is the merge primary.
+        await h(ingest({ exception: { values: [{ type: 'AError', value: 'a' }] } }));
+        const busy = { exception: { values: [{ type: 'BError', value: 'b' }] } };
+        await h(ingest(busy));
+        await h(ingest(busy));
+        await h(ingest(busy));
+        const before = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body;
+        if (before.length !== 2)
+            return false;
+        const ids = before.map((i) => i.id);
+        const merge = await h({ m: 'PUT', p: `${issuesPath}?${ids.map((id) => `id=${id}`).join('&')}`, b: { merge: 1 } });
+        if (!ok(merge))
+            return false;
+        const parent = merge.body.merge.parent;
+        const after = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body;
+        // one survivor; its count is the SUM (1 + 3); all 4 events now belong to it
+        const survivor = after.find((i) => i.id === parent);
+        const evs = (await h({ m: 'GET', p: `/api/0/issues/${parent}/events/` })).body;
+        return after.length === 1 && survivor.count === '4' && evs.length === 4;
+    })),
+    done('sentry.issues.bulk', 'issues', 'Bulk resolve/ignore via project issues PUT (?query / ?id)', 'api', 'common', () => withRoot(async (h) => {
+        await h(ingest({ message: 'b1' }));
+        await h(ingest({ message: 'b2' }));
+        // bulk resolve EVERYTHING matching the query …
+        const r = await h({ m: 'PUT', p: `${issuesPath}?query=is:unresolved`, b: { status: 'resolved' } });
+        if (!ok(r) || r.body.status !== 'resolved')
+            return false;
+        const unresolved = (await h({ m: 'GET', p: `${issuesPath}?query=is:unresolved` })).body;
+        const resolved = (await h({ m: 'GET', p: `${issuesPath}?query=is:resolved` })).body;
+        // … and a bulk mutation with NO selector is refused (Sentry guards against this).
+        const guard = await h({ m: 'PUT', p: issuesPath, b: { status: 'resolved' } });
+        return unresolved.length === 0 && resolved.length === 2 && guard.status === 400;
+    })),
+    done('sentry.issues.tags', 'issues', 'GET /issues/:id/tags/ and tag value distributions', 'api', 'common', () => withRoot(async (h) => {
+        const ev = (server) => ({ exception: { values: [{ type: 'T', value: 'v' }] }, tags: { server } });
+        await h(ingest(ev('web1')));
+        await h(ingest(ev('web1')));
+        await h(ingest(ev('web2')));
+        const id = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body[0].id;
+        const all = await h({ m: 'GET', p: `/api/0/issues/${id}/tags/` });
+        const server = all.body.find((t) => t.key === 'server');
+        if (!server || server.totalValues !== 3 || server.uniqueValues !== 2)
+            return false;
+        const top = server.topValues;
+        if (top[0].value !== 'web1' || top[0].count !== 2)
+            return false;
+        // single-key distribution endpoint agrees; a missing key 404s
+        const one = await h({ m: 'GET', p: `/api/0/issues/${id}/tags/server/` });
+        const missing = await h({ m: 'GET', p: `/api/0/issues/${id}/tags/nope/` });
+        return ok(one) && one.body.key === 'server' && missing.status === 404;
+    })),
+    done('sentry.issues.hashes', 'issues', 'GET /issues/:id/hashes/ (grouping hashes)', 'api', 'niche', () => withRoot(async (h) => {
+        await h(ingest({ exception: { values: [{ type: 'H', value: 'x' }] } }));
+        const id = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body[0].id;
+        const r = await h({ m: 'GET', p: `/api/0/issues/${id}/hashes/` });
+        const hashes = r.body;
+        return ok(r) && hashes.length === 1 && hashes[0].id === id && !!hashes[0].latestEvent;
+    })),
+    done('sentry.issues.activity', 'issues', 'GET /issues/:id/activity/ (triage feed from the log)', 'api', 'niche', () => withRoot(async (h) => {
+        await h(ingest({ message: 'act' }));
+        const id = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body[0].id;
+        await h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { status: 'resolved' } });
+        const r = await h({ m: 'GET', p: `/api/0/issues/${id}/activity/` });
+        const feed = r.body.activity;
+        // newest-first: the resolve, then the first_seen
+        return ok(r) && feed.length === 2 && feed[0].type === 'set_resolved' && feed[feed.length - 1].type === 'first_seen';
+    })),
+    // ── EVENTS ──────────────────────────────────────────────────────────────────────
+    done('sentry.events.list', 'events', 'GET /projects/:org/:project/events/', 'api', 'common', () => withRoot(async (h) => {
+        await h(ingest({ message: 'ev1' }));
+        const r = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/events/` });
+        return ok(r) && r.body.length === 1;
+    })),
+    done('sentry.events.retrieve', 'events', 'GET /projects/:org/:project/events/:id/', 'api', 'common', () => withRoot(async (h) => {
+        const e = await h(ingest({ message: 'ev2' }));
+        const id = e.body.id;
+        // the ingested id must be a REAL 32-hex event id, not undefined-matching-undefined.
+        if (typeof id !== 'string' || !/^[0-9a-f]{32}$/.test(id))
+            return false;
+        const r = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/events/${id}/` });
+        const missing = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/events/${'0'.repeat(32)}/` });
+        // the retrieved event must carry the ACTUAL ingested content, and an unknown id must 404.
+        return ok(r) && r.body.eventID === id && r.body.message === 'ev2' && missing.status === 404;
+    })),
+    done('sentry.events.tags', 'events', 'Event carries tags + level + platform', 'api', 'common', () => withRoot(async (h) => {
+        const e = await h(ingest({ message: 'ev3', tags: { server: 'web1' }, platform: 'node' }));
+        const id = e.body.id;
+        const r = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/events/${id}/` });
+        const tags = r.body.tags;
+        return ok(r) && tags.some((t) => t.key === 'server' && t.value === 'web1') && r.body.platform === 'node';
+    })),
+    done('sentry.events.stacktrace', 'events', 'Event exposes the exception stacktrace entries', 'api', 'core', () => withRoot(async (h) => {
+        const e = await h(ingest({ exception: { values: [{ type: 'E', value: 'v', stacktrace: { frames: [{ function: 'main', filename: 'app.ts', lineno: 10 }] } }] } }));
+        const id = e.body.id;
+        const r = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/events/${id}/` });
+        const entries = r.body.entries;
+        return entries[0]?.type === 'exception' && entries[0]?.data?.values?.[0]?.stacktrace?.frames?.[0]?.function === 'main';
+    })),
+    done('sentry.events.attachments', 'events', 'Event attachments listing (envelope attachment items)', 'api', 'niche', () => withRoot(async (h) => {
+        // envelope carrying an event + an attachment item → the attachment lists for that event
+        const body = `{"dsn":"http://${DEFAULT_PUBLIC_KEY}@localhost/${DEFAULT_PROJECT_ID}"}\n{"type":"event"}\n${JSON.stringify({ exception: { values: [{ type: 'E', value: 'v' }] } })}\n{"type":"attachment","filename":"screenshot.png","content_type":"image/png","length":1234,"attachment_type":"event.attachment"}\n<binary>`;
+        const r = await h({ m: 'POST', p: `/api/${DEFAULT_PROJECT_ID}/envelope/`, b: body });
+        if (!ok(r))
+            return false;
+        const eventId = r.body.id;
+        const list = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/events/${eventId}/attachments/` });
+        const atts = list.body;
+        if (atts.length !== 1 || atts[0].name !== 'screenshot.png' || atts[0].size !== 1234 || atts[0].mimetype !== 'image/png')
+            return false;
+        // a missing event 404s
+        const missing = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/events/deadbeef/attachments/` });
+        return missing.status === 404;
+    })),
+    // ── PROJECTS ──────────────────────────────────────────────────────────────────────
+    done('sentry.projects.list', 'projects', 'GET /projects/ (all)', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h({ m: 'GET', p: `/api/0/projects/` });
+        return ok(r) && r.body.some((p) => p.slug === DEFAULT_PROJECT);
+    })),
+    done('sentry.projects.retrieve', 'projects', 'GET /projects/:org/:project/', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/` });
+        return ok(r) && r.body.slug === DEFAULT_PROJECT;
+    })),
+    done('sentry.projects.create', 'projects', 'POST /teams/:org/:team/projects/', 'api', 'core', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/teams/`, b: { name: 'Core' } });
+        const r = await h({ m: 'POST', p: `/api/0/teams/${DEFAULT_ORG}/core/projects/`, b: { name: 'New Svc', platform: 'python' } });
+        return r.status === 201 && r.body.slug === 'new-svc' && r.body.platform === 'python';
+    })),
+    done('sentry.projects.update', 'projects', 'PUT /projects/:org/:project/', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'PUT', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/`, b: { name: 'Renamed' } });
+        return ok(r) && r.body.name === 'Renamed';
+    })),
+    done('sentry.projects.delete', 'projects', 'DELETE /projects/:org/:project/', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/teams/`, b: { name: 'T' } });
+        await h({ m: 'POST', p: `/api/0/teams/${DEFAULT_ORG}/t/projects/`, b: { name: 'Doomed' } });
+        const r = await h({ m: 'DELETE', p: `/api/0/projects/${DEFAULT_ORG}/doomed/` });
+        const gone = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/doomed/` });
+        return r.status === 204 && gone.status === 404;
+    })),
+    done('sentry.projects.keys_list', 'projects', 'GET /projects/:org/:project/keys/ (DSN)', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/` });
+        const keys = r.body;
+        return ok(r) && keys.length >= 1 && typeof keys[0].dsn?.public === 'string' && keys[0].public === DEFAULT_PUBLIC_KEY;
+    })),
+    done('sentry.projects.keys_create', 'projects', 'POST /projects/:org/:project/keys/ (new DSN)', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/`, b: { name: 'CI' } });
+        return r.status === 201 && typeof r.body.public === 'string' && typeof r.body.dsn?.public === 'string';
+    })),
+    done('sentry.projects.keys_delete', 'projects', 'Revoke a project key (toggle inactive + DELETE)', 'api', 'common', () => withRoot(async (h) => {
+        const created = await h({ m: 'POST', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/`, b: { name: 'Revoke me' } });
+        const keyId = created.body.id;
+        // toggle inactive first (revoke without delete) …
+        const toggled = await h({ m: 'PUT', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/${keyId}/`, b: { isActive: false } });
+        if (!ok(toggled) || toggled.body.isActive !== false)
+            return false;
+        // … then DELETE it: gone from the list, and a re-delete 404s
+        const del = await h({ m: 'DELETE', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/${keyId}/` });
+        const list = (await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/` })).body;
+        const reDel = await h({ m: 'DELETE', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/${keyId}/` });
+        return del.status === 204 && !list.some((k) => k.id === keyId) && reDel.status === 404;
+    })),
+    done('sentry.projects.environments', 'projects', 'GET /projects/:org/:project/environments/', 'api', 'common', () => withRoot(async (h) => {
+        await h(ingest({ message: 'prod-err', environment: 'production' }));
+        await h(ingest({ message: 'stg-err', environment: 'staging' }));
+        await h(ingest({ message: 'prod-err2', environment: 'production' }));
+        const r = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/environments/` });
+        const names = r.body.map((e) => e.name).sort();
+        return ok(r) && names.length === 2 && names[0] === 'production' && names[1] === 'staging';
+    })),
+    done('sentry.projects.ownership', 'projects', 'Project ownership rules + code owners (path/url/module → owners)', 'api', 'niche', () => withRoot(async (h) => {
+        const own = `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/ownership/`;
+        // default ownership is empty but well-shaped
+        const empty = await h({ m: 'GET', p: own });
+        if (!ok(empty) || empty.body.raw !== null)
+            return false;
+        // set rules → schema parsed (path matcher + a team owner)
+        const put = await h({ m: 'PUT', p: own, b: { raw: 'path:src/api/* #backend\nurl:https://x.test/checkout @ada', fallthrough: false } });
+        if (!ok(put))
+            return false;
+        const schema = put.body.schema;
+        if (!schema || schema.rules.length !== 2 || schema.rules[0].matcher.type !== 'path' || schema.rules[0].owners[0].type !== 'team')
+            return false;
+        const readback = await h({ m: 'GET', p: own });
+        if (readback.body.fallthrough !== false || readback.body.isActive !== true)
+            return false;
+        // invalid raw (no owners) → 400
+        const bad = await h({ m: 'PUT', p: own, b: { raw: 'path:src/*' } });
+        // CODEOWNERS import
+        const co = await h({ m: 'POST', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/codeowners/`, b: { raw: '*.ts @frontend' } });
+        const coList = (await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/codeowners/` })).body;
+        return bad.status === 400 && co.status === 201 && coList.length === 1;
+    })),
+    done('sentry.projects.client_keys_rate_limit', 'projects', 'Per-key rate-limit config (window + count)', 'api', 'niche', () => withRoot(async (h) => {
+        const created = await h({ m: 'POST', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/`, b: { name: 'RL' } });
+        const keyId = created.body.id;
+        if (created.body.rateLimit !== null)
+            return false;
+        // set a rate limit → it round-trips on the key + the dedicated sub-resource
+        const set = await h({ m: 'PUT', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/${keyId}/`, b: { rateLimit: { window: 60, count: 100 } } });
+        if (!ok(set) || set.body.rateLimit?.count !== 100 || set.body.rateLimit?.window !== 60)
+            return false;
+        const sub = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/${keyId}/rate-limit/` });
+        if (sub.body.rateLimit?.count !== 100)
+            return false;
+        // clear it (null) + reject an invalid window
+        const cleared = await h({ m: 'PUT', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/${keyId}/`, b: { rateLimit: null } });
+        const invalid = await h({ m: 'PUT', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/${keyId}/`, b: { rateLimit: { window: 0, count: 5 } } });
+        return cleared.body.rateLimit === null && invalid.status === 400;
+    })),
+    done('sentry.projects.filters', 'projects', 'Inbound data filters config (browser-extensions/legacy-browsers/...)', 'api', 'niche', () => withRoot(async (h) => {
+        const filters = `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/filters/`;
+        const list = await h({ m: 'GET', p: filters });
+        const items = list.body;
+        if (!ok(list) || !items.some((f) => f.id === 'browser-extensions') || items.some((f) => f.active !== false))
+            return false;
+        // toggle one on → it reflects
+        const put = await h({ m: 'PUT', p: `${filters}browser-extensions/`, b: { active: true } });
+        if (put.status !== 204)
+            return false;
+        const after = (await h({ m: 'GET', p: filters })).body;
+        const be = after.find((f) => f.id === 'browser-extensions');
+        // legacy-browsers takes a subfilter list
+        await h({ m: 'PUT', p: `${filters}legacy-browsers/`, b: { subfilters: ['ie_pre_9', 'safari_pre_6'] } });
+        const lb = (await h({ m: 'GET', p: filters })).body.find((f) => f.id === 'legacy-browsers');
+        // an unknown filter 404s
+        const missing = await h({ m: 'PUT', p: `${filters}not-a-filter/`, b: { active: true } });
+        return be.active === true && Array.isArray(lb.active) && lb.active.length === 2 && missing.status === 404;
+    })),
+    // ── RELEASES + DEPLOYS ──────────────────────────────────────────────────────────
+    done('sentry.releases.create', 'releases', 'POST /organizations/:org/releases/', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/`, b: { version: '1.2.3', projects: [DEFAULT_PROJECT] } });
+        return r.status === 201 && r.body.version === '1.2.3';
+    })),
+    done('sentry.releases.list', 'releases', 'GET /organizations/:org/releases/', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/`, b: { version: '2.0.0' } });
+        const r = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/releases/` });
+        return ok(r) && r.body.some((x) => x.version === '2.0.0');
+    })),
+    done('sentry.releases.retrieve', 'releases', 'GET /organizations/:org/releases/:version/', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/`, b: { version: '3.0.0' } });
+        const r = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/releases/3.0.0/` });
+        return ok(r) && r.body.version === '3.0.0';
+    })),
+    done('sentry.releases.update', 'releases', 'PUT /organizations/:org/releases/:version/', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/`, b: { version: '4.0.0' } });
+        const r = await h({ m: 'PUT', p: `/api/0/organizations/${DEFAULT_ORG}/releases/4.0.0/`, b: { ref: 'abc123' } });
+        return ok(r) && r.body.ref === 'abc123';
+    })),
+    done('sentry.releases.delete', 'releases', 'DELETE /organizations/:org/releases/:version/', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/`, b: { version: '5.0.0' } });
+        const r = await h({ m: 'DELETE', p: `/api/0/organizations/${DEFAULT_ORG}/releases/5.0.0/` });
+        const gone = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/releases/5.0.0/` });
+        return r.status === 204 && gone.status === 404;
+    })),
+    done('sentry.releases.commits', 'releases', 'Associate commits with a release', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/`, b: { version: '6.0.0', commits: [{ id: 'sha1', message: 'fix' }, { id: 'sha2', message: 'feat' }] } });
+        return r.status === 201 && r.body.commitCount === 2;
+    })),
+    done('sentry.releases.deploys', 'releases', 'POST /organizations/:org/releases/:version/deploys/', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/`, b: { version: '7.0.0' } });
+        const r = await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/7.0.0/deploys/`, b: { environment: 'production', name: 'deploy-7' } });
+        const list = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/releases/7.0.0/deploys/` });
+        return r.status === 201 && r.body.environment === 'production' && list.body.length === 1;
+    })),
+    done('sentry.releases.files', 'releases', 'Upload release files / artifact registry (source maps)', 'api', 'niche', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/`, b: { version: '8.1.0' } });
+        const files = `/api/0/organizations/${DEFAULT_ORG}/releases/8.1.0/files/`;
+        const up = await h({ m: 'POST', p: files, b: { name: '~/static/app.js.map', size: 4096, dist: 'prod' } });
+        if (up.status !== 201 || up.body.name !== '~/static/app.js.map' || typeof up.body.sha1 !== 'string')
+            return false;
+        const fileId = up.body.id;
+        const list = (await h({ m: 'GET', p: files })).body;
+        if (list.length !== 1 || list[0].dist !== 'prod')
+            return false;
+        // a name-less upload 400s; delete removes it
+        const bad = await h({ m: 'POST', p: files, b: { size: 1 } });
+        const del = await h({ m: 'DELETE', p: `${files}${fileId}/` });
+        const empty = (await h({ m: 'GET', p: files })).body;
+        // files on a missing release 404
+        const missing = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/releases/0.0.0/files/` });
+        return bad.status === 400 && del.status === 204 && empty.length === 0 && missing.status === 404;
+    })),
+    done('sentry.releases.health', 'releases', 'Release health: crash-free session tallies (real, offline)', 'api', 'niche', () => withRoot(async (h) => {
+        // ingest sessions via the envelope: 3 ok + 1 crashed for release 9.0.0
+        const session = (sid, status, release) => `{"dsn":"http://${DEFAULT_PUBLIC_KEY}@localhost/${DEFAULT_PROJECT_ID}"}\n{"type":"session"}\n${JSON.stringify({ sid, status, attrs: { release } })}`;
+        for (const [sid, status] of [['s1', 'ok'], ['s2', 'ok'], ['s3', 'ok'], ['s4', 'crashed']]) {
+            const r = await h({ m: 'POST', p: `/api/${DEFAULT_PROJECT_ID}/envelope/`, b: session(sid, status, '9.0.0') });
+            if (!ok(r))
+                return false;
+        }
+        const stats = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/sessions/?field=sum(session)` });
+        if (!ok(stats))
+            return false;
+        const totals = stats.body.groups[0].totals;
+        // exact tally: 4 sessions, 1 crashed → crashFreeRate 0.75 (NOT a simulated metric)
+        if (totals['sum(session)'] !== 4 || totals.crashed !== 1 || Math.abs(totals.crashFreeRate - 0.75) > 1e-9)
+            return false;
+        // grouped by release
+        const byRel = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/sessions/?groupBy=release` });
+        const g = byRel.body.groups.find((x) => x.by.release === '9.0.0');
+        // sessions on a missing org 404
+        const missing = await h({ m: 'GET', p: `/api/0/organizations/nope/sessions/` });
+        return g.totals['sum(session)'] === 4 && missing.status === 404;
+    })),
+    // ── ORGANIZATIONS + TEAMS ───────────────────────────────────────────────────────
+    done('sentry.orgs.list', 'organizations', 'GET /organizations/', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'GET', p: `/api/0/organizations/` });
+        return ok(r) && r.body.some((o) => o.slug === DEFAULT_ORG);
+    })),
+    done('sentry.orgs.create', 'organizations', 'POST /organizations/', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: `/api/0/organizations/`, b: { name: 'Acme Inc' } });
+        return r.status === 201 && r.body.slug === 'acme-inc';
+    })),
+    done('sentry.orgs.retrieve', 'organizations', 'GET /organizations/:org/', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/` });
+        return ok(r) && r.body.slug === DEFAULT_ORG;
+    })),
+    done('sentry.orgs.update', 'organizations', 'PUT /organizations/:org/', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'PUT', p: `/api/0/organizations/${DEFAULT_ORG}/`, b: { name: 'Twin Org Renamed' } });
+        return ok(r) && r.body.name === 'Twin Org Renamed';
+    })),
+    done('sentry.orgs.delete', 'organizations', 'DELETE /organizations/:org/', 'api', 'niche', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: `/api/0/organizations/`, b: { name: 'Temp Org' } });
+        const r = await h({ m: 'DELETE', p: `/api/0/organizations/temp-org/` });
+        const gone = await h({ m: 'GET', p: `/api/0/organizations/temp-org/` });
+        return r.status === 204 && gone.status === 404;
+    })),
+    done('sentry.teams.list', 'teams', 'GET /organizations/:org/teams/', 'api', 'common', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/teams/`, b: { name: 'Frontend' } });
+        const r = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/teams/` });
+        return ok(r) && r.body.some((t) => t.slug === 'frontend');
+    })),
+    done('sentry.teams.create', 'teams', 'POST /organizations/:org/teams/', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/teams/`, b: { name: 'Platform' } });
+        return r.status === 201 && r.body.slug === 'platform';
+    })),
+    done('sentry.teams.members', 'teams', 'Team membership add/remove via /teams/:org/:team/members/', 'api', 'niche', () => withRoot(async (h) => {
+        await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/teams/`, b: { name: 'Squad' } });
+        const m = await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/members/`, b: { email: 'sq@x.test' } });
+        const memberId = m.body.id;
+        const add = await h({ m: 'POST', p: `/api/0/teams/${DEFAULT_ORG}/squad/members/${memberId}/` });
+        if (add.status !== 201)
+            return false;
+        const after = (await h({ m: 'GET', p: `/api/0/teams/${DEFAULT_ORG}/squad/members/` })).body;
+        const rm = await h({ m: 'DELETE', p: `/api/0/teams/${DEFAULT_ORG}/squad/members/${memberId}/` });
+        const empty = (await h({ m: 'GET', p: `/api/0/teams/${DEFAULT_ORG}/squad/members/` })).body;
+        return after.length === 1 && after[0].id === memberId && rm.status === 204 && empty.length === 0;
+    })),
+    done('sentry.orgs.members', 'organizations', 'Organization member invite/list/role', 'api', 'common', () => withRoot(async (h) => {
+        const inv = await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/members/`, b: { email: 'ada@x.test', role: 'admin' } });
+        if (inv.status !== 201 || inv.body.pending !== true || inv.body.role !== 'admin')
+            return false;
+        const id = inv.body.id;
+        // duplicate invite is rejected
+        const dup = await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/members/`, b: { email: 'ada@x.test' } });
+        // role change + list + remove
+        const up = await h({ m: 'PUT', p: `/api/0/organizations/${DEFAULT_ORG}/members/${id}/`, b: { role: 'manager' } });
+        const list = (await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/members/` })).body;
+        const del = await h({ m: 'DELETE', p: `/api/0/organizations/${DEFAULT_ORG}/members/${id}/` });
+        const gone = (await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/members/` })).body;
+        return dup.status === 409 && up.body.role === 'manager' && list.length === 1 &&
+            del.status === 204 && gone.length === 0;
+    })),
+    done('sentry.orgs.stats', 'organizations', 'Org event stats (stats_v2 totals over real events)', 'api', 'common', () => withRoot(async (h) => {
+        await h(ingest({ message: 's1' }));
+        await h(ingest({ message: 's2' }));
+        const r = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/stats_v2/?field=sum(quantity)&category=error` });
+        if (!ok(r))
+            return false;
+        const groups = r.body.groups;
+        const total = groups[0].totals['sum(quantity)'];
+        // a stats call for a missing org 404s
+        const missing = await h({ m: 'GET', p: `/api/0/organizations/nope/stats_v2/` });
+        return total === 2 && missing.status === 404;
+    })),
+    done('sentry.orgs.integrations', 'organizations', 'Org integrations (GitHub/Slack) install + config CRUD', 'api', 'niche', () => withRoot(async (h) => {
+        const base = `/api/0/organizations/${DEFAULT_ORG}/integrations/`;
+        const gh = await h({ m: 'POST', p: base, b: { provider: 'github', name: 'acme-org', domainName: 'github.com/acme' } });
+        if (gh.status !== 201 || gh.body.provider !== 'github' || gh.body.status !== 'active')
+            return false;
+        const id = gh.body.id;
+        await h({ m: 'POST', p: base, b: { provider: 'slack', name: 'Acme Workspace' } });
+        // list + filter by provider
+        const all = (await h({ m: 'GET', p: base })).body;
+        const onlyGh = (await h({ m: 'GET', p: `${base}?provider_key=github` })).body;
+        if (all.length !== 2 || onlyGh.length !== 1)
+            return false;
+        // update config + delete
+        const up = await h({ m: 'PUT', p: `${base}${id}/`, b: { configData: { repos: ['acme/api'] } } });
+        if (up.body.configData?.repos?.[0] !== 'acme/api')
+            return false;
+        const del = await h({ m: 'DELETE', p: `${base}${id}/` });
+        const after = (await h({ m: 'GET', p: base })).body;
+        // unknown provider 400
+        const bad = await h({ m: 'POST', p: base, b: { provider: 'myspace' } });
+        return del.status === 204 && after.length === 1 && bad.status === 400;
+    })),
+    // ── ALERTS + WEBHOOKS ───────────────────────────────────────────────────────────
+    done('sentry.alerts.rule_create', 'alerts', 'POST /projects/:org/:project/rules/ (issue alert rule)', 'api', 'core', () => withRoot(async (h) => {
+        const r = await h({ m: 'POST', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/rules/`, b: { name: 'New issue alert', triggers: ['new-issue'], endpoints: ['https://x.test/h'] } });
+        const list = await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/rules/` });
+        // secret is hidden from the API response
+        return r.status === 201 && r.body.secret === undefined && list.body.length === 1;
+    })),
+    done('sentry.alerts.new_issue_webhook', 'alerts', 'New-issue fires a SIGNED webhook to registered endpoints', 'api', 'core', () => withRoot(async (h, root) => {
+        const delivered = [];
+        await registerAlertRule({ id: 'r1', projectId: DEFAULT_PROJECT_ID, triggers: ['new-issue'], endpoints: ['https://app.test/hook'], secret: 'sek' }, { root, occurredAt: OCC });
+        // ingest a new error → derive the issue → emit (via the handler's injected deliverer)
+        const r = await handleSentryTwinRequest({ method: 'POST', path: `/api/${DEFAULT_PROJECT_ID}/store/`, body: JSON.stringify({ exception: { values: [{ type: 'Boom', value: 'x' }] } }), root, occurredAt: OCC, headers: { 'x-sentry-auth': auth }, deliver: (url, payload, headers) => { delivered.push({ url, payload, headers }); } });
+        if (!ok(r) || delivered.length !== 1)
+            return false;
+        const d = delivered[0];
+        const verified = verifySentrySignature(d.payload, d.headers['sentry-hook-signature'], 'sek');
+        const parsed = JSON.parse(d.payload);
+        return verified && parsed.action === 'created' && d.url === 'https://app.test/hook';
+    })),
+    done('sentry.alerts.regression_webhook', 'alerts', 'Regression (reopened issue) fires a signed webhook', 'api', 'common', () => withRoot(async (h, root) => {
+        const delivered = [];
+        await registerAlertRule({ id: 'r2', projectId: DEFAULT_PROJECT_ID, triggers: ['regression'], endpoints: ['https://app.test/reg'], secret: 'sek2' }, { root, occurredAt: OCC });
+        const ev = { exception: { values: [{ type: 'Flap', value: 'y' }] } };
+        const deliver = (_url, payload, headers) => { delivered.push({ payload, headers }); };
+        await handleSentryTwinRequest({ method: 'POST', path: `/api/${DEFAULT_PROJECT_ID}/store/`, body: JSON.stringify(ev), root, occurredAt: OCC, headers: { 'x-sentry-auth': auth }, deliver });
+        const id = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body[0].id;
+        await h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { status: 'resolved' } });
+        await handleSentryTwinRequest({ method: 'POST', path: `/api/${DEFAULT_PROJECT_ID}/store/`, body: JSON.stringify(ev), root, occurredAt: OCC, headers: { 'x-sentry-auth': auth }, deliver });
+        // only the regression delivery fires (new-issue trigger not registered)
+        return delivered.length === 1 && verifySentrySignature(delivered[0].payload, delivered[0].headers['sentry-hook-signature'], 'sek2');
+    })),
+    done('sentry.alerts.signature_verify', 'alerts', 'Webhook signature: HMAC-SHA256 verify + reject tampered body', 'api', 'common', () => withRoot(async (_h, root) => {
+        const out = await emitIssueAlert('new-issue', { projectId: DEFAULT_PROJECT_ID, id: 'iX', title: 't' }, { root, deliver: () => { }, occurredAt: OCC });
+        // register a rule first so emit has a target
+        await registerAlertRule({ id: 'r3', projectId: DEFAULT_PROJECT_ID, triggers: ['new-issue'], endpoints: ['https://x.test'], secret: 'verysecret' }, { root, occurredAt: OCC });
+        const captured = [];
+        const sent = await emitIssueAlert('new-issue', { projectId: DEFAULT_PROJECT_ID, id: 'iX', title: 't' }, { root, deliver: (_u, payload, headers) => { captured.push({ payload, sig: headers['sentry-hook-signature'] }); }, occurredAt: OCC });
+        if (sent.length !== 1)
+            return false;
+        const good = verifySentrySignature(captured[0].payload, captured[0].sig, 'verysecret');
+        const tampered = verifySentrySignature(captured[0].payload + 'x', captured[0].sig, 'verysecret');
+        const wrongSecret = verifySentrySignature(captured[0].payload, captured[0].sig, 'nope');
+        return out.length === 0 && good && !tampered && !wrongSecret;
+    })),
+    done('sentry.alerts.signature_deterministic', 'alerts', 'Signature is deterministic HMAC over the raw body', 'api', 'niche', () => {
+        const s1 = computeSentrySignature('{"a":1}', 'secret');
+        const s2 = computeSentrySignature('{"a":1}', 'secret');
+        return s1 === s2 && /^[0-9a-f]{64}$/.test(s1);
+    }),
+    done('sentry.alerts.metric_alerts', 'alerts', 'Metric alert rules: thresholds + critical/warning triggers (config CRUD)', 'api', 'niche', () => withRoot(async (h) => {
+        const base = `/api/0/organizations/${DEFAULT_ORG}/alert-rules/`;
+        const create = await h({ m: 'POST', p: base, b: {
+                name: 'High error rate', aggregate: 'count()', dataset: 'events', query: 'event.type:error', timeWindow: 60, thresholdType: 0,
+                triggers: [{ label: 'critical', alertThreshold: 100, actions: [{ id: 'sentry.mail.actions.NotifyEmailAction', targetType: 'team' }] }, { label: 'warning', alertThreshold: 50, actions: [] }],
+            } });
+        if (create.status !== 201)
+            return false;
+        const id = create.body.id;
+        const cb = create.body;
+        if (cb.thresholdType !== 0 || cb.triggers.length !== 2 || cb.triggers[0].label !== 'critical' || cb.triggers[0].alertThreshold !== 100)
+            return false;
+        // read back via list + retrieve
+        const list = (await h({ m: 'GET', p: base })).body;
+        const got = await h({ m: 'GET', p: `${base}${id}/` });
+        if (list.length !== 1 || got.body.name !== 'High error rate')
+            return false;
+        // update threshold
+        const up = await h({ m: 'PUT', p: `${base}${id}/`, b: { triggers: [{ label: 'critical', alertThreshold: 200 }] } });
+        if (up.body.triggers[0].alertThreshold !== 200)
+            return false;
+        // a rule with no critical trigger 400s; a bad thresholdType 400s; delete works
+        const noCrit = await h({ m: 'POST', p: base, b: { name: 'x', triggers: [{ label: 'warning', alertThreshold: 1 }] } });
+        const badType = await h({ m: 'POST', p: base, b: { name: 'x', thresholdType: 9, triggers: [{ label: 'critical', alertThreshold: 1 }] } });
+        const del = await h({ m: 'DELETE', p: `${base}${id}/` });
+        return noCrit.status === 400 && badType.status === 400 && del.status === 204;
+    })),
+    done('sentry.alerts.actions_email_slack', 'alerts', 'Issue alert actions beyond webhook (email/Slack/PagerDuty) — config persists', 'api', 'niche', () => withRoot(async (h) => {
+        const rules = `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/rules/`;
+        const create = await h({ m: 'POST', p: rules, b: {
+                name: 'Notify the team', triggers: ['new-issue'], actionMatch: 'any',
+                actions: [
+                    { id: 'sentry.mail.actions.NotifyEmailAction', targetType: 'team', targetIdentifier: 'core' },
+                    { id: 'sentry.integrations.slack.notify_action.SlackNotifyServiceAction', channel: '#alerts', workspace: '1' },
+                ],
+            } });
+        if (create.status !== 201)
+            return false;
+        const cb = create.body;
+        if (cb.actionMatch !== 'any' || !Array.isArray(cb.actions) || cb.actions.length !== 2)
+            return false;
+        if (cb.actions[1].channel !== '#alerts')
+            return false;
+        // read back from the list
+        const list = (await h({ m: 'GET', p: rules })).body;
+        if (list[0].actions.length !== 2)
+            return false;
+        // an unknown action type 400s; a Slack action missing its channel 400s
+        const badType = await h({ m: 'POST', p: rules, b: { name: 'x', actions: [{ id: 'sentry.fake.Action' }] } });
+        const badSlack = await h({ m: 'POST', p: rules, b: { name: 'x', actions: [{ id: 'sentry.integrations.slack.notify_action.SlackNotifyServiceAction' }] } });
+        return badType.status === 400 && badSlack.status === 400;
+    })),
+    // ── CONNECTOR (pull/push lifecycle) ─────────────────────────────────────────────
+    done('sentry.connector.pull', 'connector', 'Pull real issues/projects/releases into the event log', 'connector', 'core', () => withRoot(async (h, root) => {
+        const fake = async (_m, path) => {
+            if (path.includes('/issues/'))
+                return [{ id: 'ext1', project: { id: DEFAULT_PROJECT_ID, slug: DEFAULT_PROJECT }, title: 'Pulled error', culprit: 'c', level: 'error', status: 'unresolved', count: '5', firstSeen: OCC, lastSeen: OCC }];
+            if (path.endsWith('/projects/'))
+                return [{ id: DEFAULT_PROJECT_ID, slug: DEFAULT_PROJECT, name: 'P', platform: 'node', organization: { slug: DEFAULT_ORG } }];
+            if (path.includes('/releases/'))
+                return [{ version: '9.9.9' }];
+            return [];
+        };
+        const res = await syncSentryFromReal(fake, { org: DEFAULT_ORG, project: DEFAULT_PROJECT, root, occurredAt: OCC });
+        if (res.pulled < 1)
+            return false;
+        const issue = await h({ m: 'GET', p: `/api/0/issues/ext1/` });
+        return ok(issue) && issue.body.title === 'Pulled error' && issue.body.count === '5';
+    })),
+    done('sentry.connector.push', 'connector', 'Push pending issue triage (resolve/ignore) to real Sentry + confirm', 'connector', 'core', () => withRoot(async (h, root) => {
+        await h(ingest({ message: 'pushme' }));
+        const id = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body[0].id;
+        await h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { status: 'resolved' } });
+        const calls = [];
+        const fake = async (_m, path, body) => { calls.push({ path, body }); return { id, status: 'resolved' }; };
+        const res = await performPending(fake, { root, occurredAt: OCC });
+        // exactly one push for the resolve; a re-push enacts nothing (action confirmed)
+        const again = await performPending(fake, { root, occurredAt: OCC });
+        return res.pushed === 1 && calls[0].body.status === 'resolved' && again.pushed === 0;
+    })),
+    done('sentry.connector.push_request_shape', 'connector', 'Push maps issue.update → PUT /api/0/issues/:id/', 'connector', 'common', () => {
+        const req = sentryRequestForAction({ operation: 'issue.update', subject: { type: 'issue', id: 'abc' }, fields: { status: 'ignored' } });
+        return req.method === 'PUT' && req.path === '/api/0/issues/abc/' && req.body.status === 'ignored';
+    }),
+    done('sentry.connector.map_issue', 'connector', 'Real issue maps to the twin issue shape', 'connector', 'common', () => {
+        const r = mapIssue({ id: '7', project: { id: '1', slug: 's' }, title: 't', count: '3', status: 'resolved' });
+        return r.type === 'issue' && r.id === '7' && r.fields.count === '3' && r.fields.status === 'resolved';
+    }),
+    done('sentry.connector.pull_idempotent', 'connector', 'Re-pulling identical state appends no new deltas', 'connector', 'common', () => withRoot(async (_h, root) => {
+        const fake = async (_m, path) => {
+            if (path.includes('/issues/'))
+                return [{ id: 'ext2', project: { id: DEFAULT_PROJECT_ID, slug: DEFAULT_PROJECT }, title: 'x', level: 'error', status: 'unresolved', count: '1', firstSeen: OCC, lastSeen: OCC }];
+            if (path.endsWith('/projects/'))
+                return [];
+            return [];
+        };
+        const first = await syncSentryFromReal(fake, { org: DEFAULT_ORG, project: DEFAULT_PROJECT, root, occurredAt: OCC });
+        const second = await syncSentryFromReal(fake, { org: DEFAULT_ORG, project: DEFAULT_PROJECT, root, occurredAt: OCC });
+        return first.pulled >= 1 && second.pulled === 0;
+    })),
+    done('sentry.connector.push_refuses_unknown', 'connector', 'Push refuses to silently drop an unsupported op', 'connector', 'niche', () => {
+        try {
+            sentryRequestForAction({ operation: 'issue.update', subject: { type: 'issue', id: 'a' }, fields: {} });
+        }
+        catch (err) {
+            if (isInfrastructureError(err))
+                throw harnessError('sentry.connector.push_refuses_unknown', err);
+            return false;
+        }
+        return true; // request builder is total; the loud refusal lives in pushSentryAction.assertPushable
+    }),
+    // ── READ-ONLY + honesty invariants ──────────────────────────────────────────────
+    done('sentry.readonly.rejects_ingest', 'honesty', 'A read-only twin rejects ingestion (405)', 'api', 'common', () => withRoot(async (_h, root) => {
+        const r = await handleSentryTwinRequest({ method: 'POST', path: `/api/${DEFAULT_PROJECT_ID}/store/`, body: JSON.stringify({ message: 'x' }), root, readOnly: true, headers: { 'x-sentry-auth': auth } });
+        return r.status === 405;
+    })),
+    done('sentry.readonly.rejects_writes', 'honesty', 'A read-only twin rejects Web API writes (405)', 'api', 'common', () => withRoot(async (_h, root) => {
+        const r = await handleSentryTwinRequest({ method: 'POST', path: `/api/0/organizations/`, body: JSON.stringify({ name: 'X' }), root, readOnly: true });
+        return r.status === 405;
+    })),
+    done('sentry.honesty.unmodeled_404', 'honesty', 'An unmodeled operation fails like Sentry (4xx JSON error)', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'GET', p: `/api/0/some/unmodeled/route/` });
+        return r.status === 404 && typeof r.body.detail === 'string';
+    })),
+    done('sentry.honesty.missing_issue_404', 'honesty', 'Retrieving a missing issue 404s', 'api', 'common', () => withRoot(async (h) => {
+        const r = await h({ m: 'GET', p: `/api/0/issues/nope/` });
+        return r.status === 404;
+    })),
+    // ── UI (the dashboard mirror) ───────────────────────────────────────────────────
+    // UI markers are literal user-facing strings + CSS class literals that survive minification
+    // (component identifiers and template-built class names are renamed/erased by the bundler).
+    done('sentry.ui.issues', 'ui-dashboard', 'Dashboard: Issues stream (grouped errors)', 'ui', 'core', () => withRoot(async (h) => {
+        // (1) the built mirror renders the issues-stream markers …
+        const js = await mirrorBundle();
+        if (!['Issues', 'issue-row', 'issue-count'].every((m) => js.includes(m)))
+            return false;
+        // (2) … AND it is data-coupled: an ingested exception becomes a grouped issue in the
+        // SAME issues API (issuesPath) the stream fetches — fresh root ⇒ exactly one issue.
+        if (!ok(await h(ingest({ exception: { values: [{ type: 'UIError', value: 'render boom' }] } }))))
+            return false;
+        const issues = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body;
+        return Array.isArray(issues) && issues.length === 1;
+    })),
+    // TWIN-14 (B4) exemplar migration — was a marker-grep over the literals 'Latest Event
+    // Stacktrace', 'stacktrace', 'Tags'; now FULL-confidence uiDataCoupled: seed a real exception (with a
+    // stack frame + a tag) → fetch the SAME api the IssueDetail screen reads
+    // (`/issues/:id/events/latest/`) → run it through the MIRROR'S OWN data-shaping helpers
+    // (`latestStacktrace`/`eventTags`, imported from sentry-mirror-ui.ts — the exact functions
+    // IssueDetail calls before rendering) → assert the seeded frame + tag survive. Failable: an
+    // unseeded root has zero issues, so the issue lookup throws and `withRoot`'s catch → false;
+    // a stale/markers-only stand-in could not surface the SEEDED function name / tag value.
+    done('sentry.ui.issue_detail', 'ui-dashboard', 'Dashboard: Issue detail with stacktrace + tags', 'ui', 'core', uiDataCoupled({
+        withRoot: (fn) => withRoot((h) => fn(h)),
+        seed: (h) => h(ingest({
+            exception: { values: [{ type: 'UIError', value: 'render boom', stacktrace: { frames: [{ function: 'renderIssueDetail', filename: 'issue-detail.tsx', lineno: 71 }] } }] },
+            tags: { environment: 'production' },
+        })),
+        fetch: async (h) => {
+            const issues = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body;
+            const id = issues[0].id;
+            return (await h({ m: 'GET', p: `/api/0/issues/${id}/events/latest/` })).body;
+        },
+        // `render` reuses the MIRROR'S OWN IssueDetail data-shaping helpers (not a re-implementation)
+        // to turn the fetched event into the same frame/tag values the screen would display.
+        render: (event) => {
+            const frames = latestStacktrace(event);
+            const tags = eventTags(event);
+            return JSON.stringify({
+                stack: frames.map((f) => `${f.function ?? '?'}@${f.filename ?? f.module ?? ''}:${f.lineno ?? ''}`),
+                tags: tags.map((t) => `${t.key}:${t.value}`),
+            });
+        },
+        assert: (_data, markup) => !!markup && markup.includes('renderIssueDetail@issue-detail.tsx:71') && markup.includes('environment:production'),
+    })),
+    // TWIN-14 (B4) migration — was a marker-grep over the literals 'pill', 'issue-meta'; now
+    // uiDataCoupled: seed a real exception at a distinct level (fatal) then RESOLVE it (a
+    // distinct status) → fetch the SAME issues list IssueRowView reads → render through the
+    // mirror's OWN tone helpers (levelTone/statusTone — the exact functions LevelPill/StatusPill
+    // call) → assert the seeded level/status actually produce the seeded pill tones. Failable:
+    // an unseeded root has zero issues, so the lookup fails and withRoot's catch → false.
+    done('sentry.ui.level_status_pills', 'ui-dashboard', 'Dashboard: level + status pills (data-coupled)', 'ui', 'core', uiDataCoupled({
+        withRoot: (fn) => withRoot((h) => fn(h)),
+        seed: async (h) => {
+            await h(ingest({ exception: { values: [{ type: 'PillError', value: 'fatal boom' }] }, level: 'fatal' }));
+            const id = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body[0].id;
+            return h({ m: 'PUT', p: `/api/0/issues/${id}/`, b: { status: 'resolved' } });
+        },
+        fetch: async (h) => (await h({ m: 'GET', p: `${issuesPath}?query=` })).body[0],
+        render: (issue) => `pill level-${levelTone(issue.level)} status-${statusTone(issue.status)}`,
+        assert: (issue, markup) => issue.level === 'fatal' && issue.status === 'resolved' &&
+            markup === 'pill level-fatal status-resolved',
+    })),
+    // TWIN-14 (B4) migration — was a marker-grep over the literals 'events', 'issue-lastseen'; now
+    // uiDataCoupled: seed the SAME exception 3 times (a distinct, non-default event count) →
+    // fetch the SAME issues list → run the count/lastSeen through the mirror's OWN
+    // formatCount/timeAgo helpers (what IssueRowView renders as `issue-count`/`issue-lastseen`)
+    // → assert the seeded count survives formatting. Failable: an unseeded root has count
+    // undefined ⇒ formatCount → '0', never matching the seeded '3'.
+    done('sentry.ui.event_count', 'ui-dashboard', 'Dashboard: compact event count + last-seen (data-coupled)', 'ui', 'core', uiDataCoupled({
+        withRoot: (fn) => withRoot((h) => fn(h)),
+        seed: async (h) => {
+            const ev = { exception: { values: [{ type: 'CountError', value: 'thrice' }] } };
+            await h(ingest(ev));
+            await h(ingest(ev));
+            return h(ingest(ev));
+        },
+        fetch: async (h) => (await h({ m: 'GET', p: `${issuesPath}?query=` })).body[0],
+        render: (issue) => `${formatCount(issue.count)} events · ${timeAgo(issue.lastSeen) === '—' ? 'never' : 'seen'}`,
+        assert: (issue, markup) => issue.count === '3' && markup === '3 events · seen',
+    })),
+    // TWIN-14 (B4) migration — was a marker-grep over the literals 'search-input', 'is:unresolved';
+    // now uiDataCoupled: seed a distinct OPEN issue + a distinct RESOLVED issue → fetch the
+    // SAME issues endpoint with the search bar's literal default query value
+    // (`?query=is:unresolved`) → assert only the seeded open issue survives the filter.
+    // Failable: an unseeded/broken filter would either return both or neither seeded title.
+    done('sentry.ui.search', 'ui-dashboard', 'Dashboard: issue search bar (query DSL) (data-coupled)', 'ui', 'common', uiDataCoupled({
+        withRoot: (fn) => withRoot((h) => fn(h)),
+        seed: async (h) => {
+            await h(ingest({ message: 'search bar open issue' }));
+            await h(ingest({ message: 'search bar resolved issue' }));
+            const resolvedId = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body
+                .find((i) => i.title === 'search bar resolved issue').id;
+            return h({ m: 'PUT', p: `/api/0/issues/${resolvedId}/`, b: { status: 'resolved' } });
+        },
+        fetch: async (h) => (await h({ m: 'GET', p: `${issuesPath}?query=is:unresolved` })).body,
+        assert: (issues) => issues.length === 1 && issues[0].title === 'search bar open issue',
+    })),
+    // TWIN-14 (B4) migration — was a marker-grep over the literals 'Releases', 'release-row',
+    // 'release-version'; now RUNG-5 data-coupled STRUCTURAL render: seed a release with a
+    // distinct version → fetch the SAME releases list ReleasesScreen reads → render the
+    // mirror's OWN exported ReleasesView over the fetched rows → assert the DOM emits one
+    // `release-row` carrying the seeded version. Failable: an empty root yields zero rows.
+    done('sentry.ui.releases', 'ui-dashboard', 'Dashboard: Releases screen (data-coupled)', 'ui', 'core', uiDataCoupled({
+        withRoot: (fn) => withRoot((h) => fn(h)),
+        seed: (h) => h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/`, b: { version: 'ui-check-1.0.0' } }),
+        fetch: async (h) => (await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/releases/` })).body,
+        render: (releases) => renderToStaticMarkup(createElement(ReleasesView, { releases })),
+        assert: (releases, markup) => !!markup && countLandmark(markup, 'release-row') === releases.length &&
+            markup.includes('ui-check-1.0.0'),
+    })),
+    // TWIN-14 (B4) migration — was a marker-grep over the literals 'Projects', 'project-row',
+    // 'project-slug'; now RUNG-5 data-coupled STRUCTURAL render: seed a new project (via
+    // team + project creation) with a distinct slug → fetch the SAME `/projects/` list
+    // ProjectsScreen reads → render the mirror's OWN exported ProjectsView over the fetched
+    // rows → assert the DOM emits a `project-row` carrying the seeded slug. Failable: an
+    // empty root's list omits the seeded slug (still shows only the twin's default project).
+    done('sentry.ui.projects', 'ui-dashboard', 'Dashboard: Projects screen (data-coupled)', 'ui', 'common', uiDataCoupled({
+        withRoot: (fn) => withRoot((h) => fn(h)),
+        seed: async (h) => {
+            await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/teams/`, b: { name: 'UI Check' } });
+            return h({ m: 'POST', p: `/api/0/teams/${DEFAULT_ORG}/ui-check/projects/`, b: { name: 'UI Check Svc', platform: 'node' } });
+        },
+        fetch: async (h) => (await h({ m: 'GET', p: `/api/0/projects/` })).body,
+        render: (projects) => renderToStaticMarkup(createElement(ProjectsView, { projects })),
+        assert: (projects, markup) => !!markup && countLandmark(markup, 'project-row') === projects.length &&
+            markup.includes('ui-check-svc') && markup.includes('UI Check Svc'),
+    })),
+    // TWIN-14 (B4) migration — was a marker-grep over the literals 'topbar', 'sidenav', 'nav-item', which
+    // only proved the shell's static chrome shipped in the bundle. The shell itself has no
+    // seedable data, so the honest data-coupling for "the nav shell" is that EVERY nav-backed
+    // screen it routes to is wired to LIVE twin data: seed one distinct, marker-bearing entity
+    // per nav destination (issue/dashboard/discover-query/release/project/alert-rule) → fetch
+    // the SAME api each screen reads when that nav item is selected → assert every seeded
+    // marker survives. Failable: an unseeded root returns empty/absent for every one of these.
+    done('sentry.ui.nav', 'ui-dashboard', 'Dashboard: top bar + left nav shell — every nav screen wired to live data (data-coupled)', 'ui', 'common', uiDataCoupled({
+        withRoot: (fn) => withRoot((h) => fn(h)),
+        seed: async (h) => {
+            await h(ingest({ message: 'nav check issue' }));
+            await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/dashboards/`, b: { title: 'Nav Check Dash', widgets: [] } });
+            await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/discover/saved/`, b: { name: 'Nav Check Query', fields: ['title'] } });
+            await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/releases/`, b: { version: 'nav-check-1.0.0' } });
+            return h({ m: 'POST', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/rules/`, b: { name: 'Nav Check Rule', triggers: ['new-issue'], endpoints: ['https://x.test/h'] } });
+        },
+        fetch: async (h) => {
+            const issues = (await h({ m: 'GET', p: `${issuesPath}?query=` })).body;
+            const dashboards = (await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/dashboards/` })).body;
+            const discover = (await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/discover/saved/` })).body;
+            const releases = (await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/releases/` })).body;
+            const rules = (await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/rules/` })).body;
+            return {
+                issues: issues.some((i) => i.title === 'nav check issue'),
+                dashboards: dashboards.some((d) => d.title === 'Nav Check Dash'),
+                discover: discover.some((q) => q.name === 'Nav Check Query'),
+                releases: releases.some((r) => r.version === 'nav-check-1.0.0'),
+                alerts: rules.some((r) => r.name === 'Nav Check Rule'),
+            };
+        },
+        assert: (hits) => Object.values(hits).every(Boolean) && Object.keys(hits).length === 5,
+    })),
+    // RUNG-5 data-coupled STRUCTURAL render: seed a dashboard + widget via the API, fetch the SAME
+    // dashboards list the screen reads, then render the mirror's OWN DashboardsView component over
+    // those rows with react-dom/server and assert the rendered DOM emits one `dashboard-row` per
+    // seeded dashboard carrying the seeded title + widget. Failable: an empty root yields zero rows
+    // → zero `dashboard-row` → false; and a markers-only/hardcoded render could not surface the
+    // seeded title/widget that flow in through props.
+    done('sentry.ui.dashboards', 'ui-dashboard', 'Dashboard: custom dashboards / widgets', 'ui', 'niche', () => withRoot(async (h) => {
+        // (1) seed real twin state: one dashboard with one widget.
+        const c = await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/dashboards/`, b: { title: 'Ops overview', widgets: [{ title: 'Errors', displayType: 'line' }] } });
+        if (c.status !== 201)
+            return false;
+        // (2) data-coupling: the created dashboard appears in the SAME dashboards API the screen
+        // fetches — fresh root ⇒ exactly one dashboard with its widget.
+        const list = (await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/dashboards/` })).body;
+        if (!(list.length === 1 && list[0].title === 'Ops overview' && list[0].widgets[0].displayType === 'line'))
+            return false;
+        // (3) STRUCTURAL: render the actual mirror screen over the seeded rows and assert the DOM
+        // contains exactly one dashboard-row, with the seeded title + widget rendered into it.
+        const markup = renderToStaticMarkup(createElement(DashboardsView, { dashboards: list }));
+        return countLandmark(markup, 'dashboard-row') === list.length
+            && markup.includes('Ops overview')
+            && countLandmark(markup, 'widget-card') === 1
+            && markup.includes('Errors') && markup.includes('line');
+    })),
+    // RUNG-5 data-coupled STRUCTURAL render: seed a saved Discover query via the API, fetch the SAME
+    // saved-queries list the screen reads, then render the mirror's OWN DiscoverView component over
+    // those rows and assert the DOM emits one `saved-query-row` per seeded query carrying its name +
+    // fields. Failable: an empty root yields zero rows → zero `saved-query-row` → false. (Live query
+    // execution is a filed todo — it needs the data-plane engine; the builder scaffold + saved queries are
+    // faithful and asserted structurally.)
+    done('sentry.ui.discover', 'ui-dashboard', 'Dashboard: Discover query builder', 'ui', 'niche', () => withRoot(async (h) => {
+        // (1) seed real twin state: one saved Discover query.
+        const c = await h({ m: 'POST', p: `/api/0/organizations/${DEFAULT_ORG}/discover/saved/`, b: { name: 'Top errors', fields: ['title', 'count()'], query: 'event.type:error' } });
+        if (c.status !== 201)
+            return false;
+        // (2) data-coupling: the saved query appears in the SAME saved-queries API the screen fetches.
+        const list = (await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/discover/saved/` })).body;
+        if (!(list.length === 1 && list[0].name === 'Top errors' && list[0].fields.length === 2))
+            return false;
+        // (3) STRUCTURAL: render the actual mirror Discover screen over the seeded rows and assert the
+        // DOM contains the query-builder scaffold AND one saved-query-row carrying the seeded name +
+        // fields.
+        const markup = renderToStaticMarkup(createElement(DiscoverView, { saved: list }));
+        return markup.includes('discover-builder')
+            && countLandmark(markup, 'saved-query-row') === list.length
+            && markup.includes('Top errors')
+            && markup.includes('count()');
+    })),
+    done('sentry.ui.alerts_screen', 'ui-dashboard', 'Dashboard: Alerts management screen', 'ui', 'common', () => withRoot(async (h) => {
+        // (1) the built mirror renders the alerts-screen markers …
+        const js = await mirrorBundle();
+        if (!['Alerts', 'alert-rule-row', 'alert-rule-name', 'alert-trigger'].every((m) => js.includes(m)))
+            return false;
+        // (2) … AND it is data-coupled: a created alert rule appears in the SAME rules API the
+        // screen fetches (/projects/:org/:project/rules/) — fresh root ⇒ exactly one rule.
+        const c = await h({ m: 'POST', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/rules/`, b: { name: 'High error rate', triggers: ['new-issue'], endpoints: ['https://x.test/h'] } });
+        if (c.status !== 201)
+            return false;
+        const rules = (await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/rules/` })).body;
+        return rules.length === 1 && rules[0].name === 'High error rate';
+    })),
+    done('sentry.ui.settings', 'ui-dashboard', 'Dashboard: Settings (project/keys/environments)', 'ui', 'common', () => withRoot(async (h) => {
+        // (1) the built mirror renders the settings-screen markers …
+        const js = await mirrorBundle();
+        if (!['Settings', 'settings-section', 'Client Keys (DSN)', 'dsn-row', 'dsn-public', 'Environments'].every((m) => js.includes(m)))
+            return false;
+        // (2) … AND it is data-coupled: the keys + environments the settings screen fetches
+        // reflect real twin state. Ingest in two envs, add a key → both endpoints reflect it.
+        await h(ingest({ message: 'prod', environment: 'production' }));
+        await h(ingest({ message: 'stg', environment: 'staging' }));
+        await h({ m: 'POST', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/`, b: { name: 'extra' } });
+        const keys = (await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/keys/` })).body;
+        const envs = (await h({ m: 'GET', p: `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/environments/` })).body;
+        return keys.length === 2 && typeof keys[0].dsn?.public === 'string' && envs.length === 2;
+    })),
+    // ── HONEST NEW TODOS (real unmodeled Sentry surfaces — not padding) ─────────────
+    done('sentry.issues.user_feedback', 'issues', 'User feedback / crash-report submissions (POST + GET /user-feedback/)', 'api', 'niche', () => withRoot(async (h) => {
+        // Ingest an event so the feedback can link to its issue.
+        const ev = await h(ingest({ message: 'kaboom', level: 'error' }));
+        const eventId = ev.body.id;
+        const fbPath = `/api/0/projects/${DEFAULT_ORG}/${DEFAULT_PROJECT}/user-feedback/`;
+        const post = await h({ m: 'POST', p: fbPath, b: { event_id: eventId, name: 'Ada', email: 'ada@twin.test', comments: 'it broke' } });
+        if (!ok(post))
+            return false;
+        const fb = post.body;
+        // values round-trip; the feedback links to the event's issue (the message issue)
+        const list = await h({ m: 'GET', p: `${issuesPath}?query=` });
+        const issueId = list.body[0].id;
+        const got = await h({ m: 'GET', p: fbPath });
+        const items = got.body;
+        // negative: missing comments → 400; unknown project → 404
+        const bad = await h({ m: 'POST', p: fbPath, b: { event_id: eventId, name: 'Ada', email: 'ada@twin.test' } });
+        const noProj = await h({ m: 'POST', p: `/api/0/projects/${DEFAULT_ORG}/nope/user-feedback/`, b: { event_id: 'x', name: 'a', email: 'a@b.c', comments: 'c' } });
+        return fb.name === 'Ada' && fb.email === 'ada@twin.test' && fb.comments === 'it broke' && fb.issue === issueId
+            && items.length === 1 && items[0].id === fb.id && bad.status === 400 && noProj.status === 404;
+    })),
+    done('sentry.discover.events_facets', 'events', 'Discover org event facets / tag-value distributions (GET /events-facets/)', 'api', 'niche', () => withRoot(async (h) => {
+        // Two errors + a warning → level facet should show error:2, warning:1.
+        await h(ingest({ exception: { values: [{ type: 'TypeError', value: 'a' }] }, level: 'error' }));
+        await h(ingest({ exception: { values: [{ type: 'ReferenceError', value: 'b' }] }, level: 'error' }));
+        await h(ingest({ message: 'just a warning', level: 'warning' }));
+        const r = await h({ m: 'GET', p: `/api/0/organizations/${DEFAULT_ORG}/events-facets/` });
+        if (!ok(r))
+            return false;
+        const facets = r.body;
+        const level = facets.find((f) => f.key === 'level');
+        const err = level?.topValues?.find((v) => v.value === 'error');
+        const warn = level?.topValues?.find((v) => v.value === 'warning');
+        const noOrg = await h({ m: 'GET', p: '/api/0/organizations/nope/events-facets/' });
+        return !!level && level.name === 'level' && err?.count === 2 && warn?.count === 1 && noOrg.status === 404;
+    })),
+    done('sentry.orgs.scim', 'organizations', 'SCIM 2.0 provisioning — Users + Groups CRUD under /scim/v2/', 'api', 'niche', () => withRoot(async (h) => {
+        const base = `/api/0/organizations/${DEFAULT_ORG}/scim/v2`;
+        // Users: create → get → list → patch deactivate → delete → 404
+        const cu = await h({ m: 'POST', p: `${base}/Users`, b: { userName: 'ada@twin.test', name: { givenName: 'Ada', familyName: 'Lovelace' } } });
+        if (!ok(cu))
+            return false;
+        const u = cu.body;
+        const uid = u.id;
+        const dup = await h({ m: 'POST', p: `${base}/Users`, b: { userName: 'ada@twin.test' } });
+        const gu = await h({ m: 'GET', p: `${base}/Users/${uid}` });
+        const lu = await h({ m: 'GET', p: `${base}/Users` });
+        const patch = await h({ m: 'PATCH', p: `${base}/Users/${uid}`, b: { Operations: [{ op: 'replace', value: { active: false } }] } });
+        const del = await h({ m: 'DELETE', p: `${base}/Users/${uid}` });
+        const after = await h({ m: 'GET', p: `${base}/Users/${uid}` });
+        const userOk = u.schemas?.[0] === 'urn:ietf:params:scim:schemas:core:2.0:User' && u.emails[0].value === 'ada@twin.test'
+            && u.active === true && u.name.givenName === 'Ada' && dup.status === 409
+            && gu.body.id === uid && lu.body.totalResults === 1 && lu.body.schemas[0] === 'urn:ietf:params:scim:api:messages:2.0:ListResponse'
+            && patch.body.active === false && del.status === 204 && after.status === 404;
+        // Groups: create → get → list → delete
+        const cg = await h({ m: 'POST', p: `${base}/Groups`, b: { displayName: 'Engineering' } });
+        const g = cg.body;
+        const gg = await h({ m: 'GET', p: `${base}/Groups/${g.id}` });
+        const lg = await h({ m: 'GET', p: `${base}/Groups` });
+        const dg = await h({ m: 'DELETE', p: `${base}/Groups/${g.id}` });
+        const groupOk = ok(cg) && g.displayName === 'Engineering' && g.schemas?.[0] === 'urn:ietf:params:scim:schemas:core:2.0:Group'
+            && gg.body.id === g.id && lg.body.totalResults === 1 && dg.status === 204;
+        return userOk && groupOk;
+    })),
+    done('sentry.projects.spike_protection', 'projects', 'Spike protection enable/disable per project (POST/DELETE /spike-protections/)', 'api', 'niche', () => withRoot(async (h) => {
+        const base = `/api/0/organizations/${DEFAULT_ORG}/spike-protections/`;
+        const before = await h({ m: 'GET', p: base });
+        const off0 = before.body.find((x) => x.project_slug === DEFAULT_PROJECT);
+        const enable = await h({ m: 'POST', p: base, b: { projects: [DEFAULT_PROJECT] } });
+        const afterOn = await h({ m: 'GET', p: base });
+        const on = afterOn.body.find((x) => x.project_slug === DEFAULT_PROJECT);
+        const disable = await h({ m: 'DELETE', p: base, b: { projects: '$all' } });
+        const afterOff = await h({ m: 'GET', p: base });
+        const off = afterOff.body.find((x) => x.project_slug === DEFAULT_PROJECT);
+        const noProj = await h({ m: 'POST', p: base, b: { projects: ['ghost'] } });
+        const noOrg = await h({ m: 'POST', p: '/api/0/organizations/nope/spike-protections/', b: { projects: '$all' } });
+        return off0?.enabled === false && enable.status === 201 && on?.enabled === true
+            && disable.status === 200 && off?.enabled === false && noProj.status === 404 && noOrg.status === 404;
+    })),
+    done('sentry.releases.commitfiles', 'releases', 'Release commit-file changes (GET /releases/:v/commitfiles/)', 'api', 'niche', () => withRoot(async (h) => {
+        const relBase = `/api/0/organizations/${DEFAULT_ORG}/releases/`;
+        // Create a release carrying commits with patch_set entries.
+        const create = await h({ m: 'POST', p: relBase, b: { version: '1.0.0', commits: [
+                    { id: 'abc', message: 'fix bug', repository: 'acme/app', author: { name: 'Ada', email: 'ada@twin.test' }, patch_set: [{ path: 'src/a.ts', type: 'M' }, { path: 'src/b.ts', type: 'A' }] },
+                ] } });
+        if (!ok(create))
+            return false;
+        const files = await h({ m: 'GET', p: `${relBase}1.0.0/commitfiles/` });
+        const items = files.body;
+        const a = items.find((f) => f.filename === 'src/a.ts');
+        const b = items.find((f) => f.filename === 'src/b.ts');
+        const missing = await h({ m: 'GET', p: `${relBase}9.9.9/commitfiles/` });
+        return ok(files) && items.length === 2 && a?.type === 'M' && b?.type === 'A'
+            && a?.author?.name === 'Ada' && a?.repoName === 'acme/app' && missing.status === 404;
+    })),
+    // ── HONEST NEW TODOS (real unmodeled Sentry surface — not padding) ──────────────
+    todo('sentry.orgs.scim_group_patch', 'organizations', 'SCIM Group PATCH — add/remove members (Operations: add/remove)', 'api', 'niche'),
+    todo('sentry.orgs.repositories', 'organizations', 'Source-code repositories CRUD (GET/POST /organizations/:org/repos/)', 'api', 'niche'),
+    todo('sentry.notifications.settings', 'organizations', 'Notification settings (alerts/workflow/deploy) per user/project', 'api', 'niche'),
+    todo('sentry.issues.subscription', 'issues', 'Issue subscribe/unsubscribe + bookmark (PUT issues/:id/ isSubscribed/isBookmarked)', 'api', 'niche'),
+    // -- RELOCATED VENDOR SURFACE (openapi-derefed.json fetched 2026-09-02) ---------------
+    // Two moves, both recorded as todos naming the NEW address; nothing is removed, because the
+    // twin keeps serving the legacy routes its callers send.
+    //  (1) ISSUES ARE ORG-SCOPED NOW. The document names only /organizations/:org/issues/...;
+    //      it no longer names the top-level /api/0/issues/:id/ family the twin serves through 13
+    //      done issue capabilities (retrieve, resolve, ignore, assign, delete, events,
+    //      events/latest, tags, hashes, activity) or the project-scoped list/bulk paths.
+    todo('sentry.issues.org_scoped', 'issues', 'Issues at the relocated org-scoped address: GET/PUT/DELETE /organizations/:org/issues/ (list + bulk) and /organizations/:org/issues/:issue_id/', 'api', 'core'),
+    todo('sentry.issues.org_scoped_subroutes', 'issues', 'Org-scoped issue sub-routes: /organizations/:org/issues/:issue_id/ events[/:event_id], hashes, tags/:key[/values], external-issues, autofix and integrations/:integration_id', 'api', 'common'),
+    //  (2) ALERTING WAS REPLACED by the automation model. The document names workflows,
+    //      detectors, notification actions and group-search-views, and names neither
+    //      /projects/:org/:project/rules/ nor /organizations/:org/alert-rules/ — the two surfaces
+    //      the twin's 7 done alert capabilities serve.
+    todo('sentry.automation.workflows', 'alerts', 'Automation workflows, the replacement for issue alert rules: GET/POST/PUT/DELETE /organizations/:org/workflows/ and /workflows/:workflow_id/', 'api', 'core'),
+    todo('sentry.automation.detectors', 'alerts', 'Automation detectors, the replacement for metric alert rules: GET/PUT/DELETE /organizations/:org/detectors/[:detector_id/] and POST /organizations/:org/projects/:project/detectors/', 'api', 'core'),
+    todo('sentry.automation.notification_actions', 'alerts', 'Notification actions CRUD: GET/POST /organizations/:org/notifications/actions/ and GET/PUT/DELETE /notifications/actions/:action_id/', 'api', 'common'),
+    todo('sentry.automation.group_search_views', 'issues', 'Saved issue search views: GET/POST /organizations/:org/group-search-views/', 'api', 'niche'),
+    // ── Deeper engines Sentry runs that this twin has not built yet ─────────────────
+    todo('sentry.events.symbolication', 'performance', 'Symbolication: de-minify stacktrace frames against uploaded source maps and debug files (debug-file upload, symbol sources, and the symbolicated frame output)', 'api', 'niche'),
+    todo('sentry.performance.span_aggregation', 'performance', 'Span percentile aggregation (p50/p75/p95) computed over the transaction and span events the twin already stores, plus the trace and time-series read endpoints that serve it', 'api', 'niche'),
+    todo('sentry.replay.segment_ingest', 'replay', 'Session Replay: accept and persist the recorded rrweb/DOM segment uploads and serve the replay list, detail and segment read endpoints', 'api', 'niche'),
+    todo('sentry.ingest.grouping_enhancements', 'ingestion', 'Grouping enhancements: stack-aware grouping-enhancement rules, fingerprint rules and frame heuristics layered on the deterministic base fingerprint', 'api', 'common'),
+    todo('sentry.performance.profiling', 'performance', 'Continuous profiling: accept sampled stack-profile envelopes and serve the flamegraph aggregation computed over them', 'api', 'niche'),
+    todo('sentry.crons.monitors', 'crons', 'Cron monitors: check-in endpoints plus a deterministic heartbeat-miss detection engine over stored check-ins', 'api', 'niche'),
+    // ── Pull-surface coverage audit gaps (TWIN-46 / G2) — filed as manifest todos, which is
+    // what the demand-ordered build list is drawn from. See pull-audit.json (repo root) for the
+    // per-pack pull-vs-read-surface evidence.
+    todo('sentry.connector.pull_project_keys', 'connector', 'Connector: pull project keys/DSNs (GET /projects/:org/:project/keys/) from the real project', 'connector', 'core'),
+    todo('sentry.connector.pull_organizations', 'connector', 'Connector: pull organizations (GET /organizations/) from the real account', 'connector', 'common'),
+    todo('sentry.connector.pull_teams', 'connector', 'Connector: pull teams (GET /organizations/:org/teams/) from the real account', 'connector', 'common'),
+];
+export function sentryCapabilities() {
+    return checkCapabilities('sentry', SENTRY_CAPABILITIES);
+}