Epic: tests exercise the code paths production runs #2540

Outcome

Every test that claims to cover a behaviour drives the code path production runs for that behaviour. No suite passes against a component, helper or wiring that the shipped app does not use, and no test re-types production logic by hand in place of calling it.

Why now

A repository review on 2026-10-22 (main dcf5341aa) found suites that stay green whatever production does, because they exercise a sibling of the real path. These give false confidence: a regression in the shipped path cannot turn them red, which contradicts the repo's rule that "a green test is evidence only if it could have been red" (docs/process/testing.md). This epic closes those findings: #2522, #2523, #2524, #2525, #2526, #2758. The related dispatch-gate test gap (#2527) lives under #51, which owns that gate.

Shared context

Patterns the review found, with examples:

• A test-only twin of a production component (ui-react: nine test files exercise ToolCallTimeline, which production never renders #2524). Production renders ToolCallTimelineCell (packages/ui-react/src/components/chat/message-bubble.tsx:16,425). ToolCallTimeline (packages/ui-react/src/components/chat/tool-call-timeline.tsx:43) has its own collapse state, and only tests render it: render-smoke, approval-effect, copy-control, registration-on-mount and four browser layout suites.
• Production logic re-typed in the test (ui-server: the governance-policy tests record policy with their own copy of createApp's INSERT #2758). packages/ui-server/src/app.ts:604-608 records turn governance policy with an inline INSERT INTO turn_governance_policy. packages/ui-server/tests/governance-policy.test.ts:42-43 writes its own copy of that statement, so a change in app.ts cannot fail the test.
• A retired path kept alive by its test (ui-react: helpers that only tests call are shipped in src #2525). inlineRenderedFences (packages/ui-react/src/lib/mermaid.ts:223) has been replaced in production by content-renderer-share.ts, but tests/mermaid-fences.test.ts still tests the old budget path.
  Supporting observation, not committed work in this epic: registerStaticRenderers is called only in tests (packages/ui-server/tests/render-routes.test.ts:70-85), while the render route consumes the registry through staticRendererFor (packages/ui-server/src/routes/render.ts:62). registerStaticRenderers is a public @schlessera/brain-ui-sdk/render export (packages/ui-sdk/src/render.ts:43), so a test registering through it may be exercising the supported host-registration path rather than a false twin. Whether in-tree production should populate that registry is a host-registration contract question that has to be stated first; it is not a finding of this epic and none of its children resolves it.

The fix pattern is the same in each case: point the test at the shipped entry (the component the app renders, the function createApp calls, the registry production populates), then delete the twin or move it out of src.

Constraints and non-goals

• Do not lower assertion strength or delete a unique assertion. Each moved assertion must still be able to fail, proven by a mutation of the production path recorded in the PR (docs/process/testing.md, "Required proof for a PR").
• Keyless and offline as always. No test may need an API key or the network.
• Out: test speed and redundancy (Epic: tests give faster feedback with less redundant work #1849 owns those), and new coverage for untested behaviour that has no false twin.

Breakdown

One child per committed finding. Each names the production path, the test that misses it, and the mutation that proves the retargeted test can fail:

• backends: pi's sessionFactory test seam runs a second backend mode, so the package tests skip production's permission gate #2522 — pi's sessionFactory seam and in-process permission gate.
• backends: pi keeps in-process copies of core's brain writers that production never runs #2523 — pi's in-process brain writers (also unblocks backends: the pi backend still reads the brain through core's internal entry #1398).
• ui-react: nine test files exercise ToolCallTimeline, which production never renders #2524 — ToolCallTimeline, the test-only twin.
• ui-react: helpers that only tests call are shipped in src #2525 — test-only helpers shipped in src, including inlineRenderedFences.
• ui-server: the tested budget-settlement path is never called in production and writes fewer columns than the real one #2526 — the tested budget-settlement path.
• ui-server: the governance-policy tests record policy with their own copy of createApp's INSERT #2758 — the copied governance-policy INSERT.

They are independent.

Definition of done

• Each child's PR records a mutation to the production path that turns the retargeted test red, and the restore that turns it green.
• No src export remains whose only importers are tests and whose production counterpart is a different symbol (re-checked with the grep each child names).

Found by a repository review on 2026-10-22.

2026-10-24: gave the copied governance-policy INSERT its own child (#2758), recorded static-renderer registration as a supporting observation outside this epic's committed work, named each child's finding, and moved the source-navigation notes to the comments (already recorded there).

2026-10-24 continued triage at main dc5d3c73282c29a3f0098306d398743ee18ec791: Verified the production/test governance INSERT copies and static-renderer lookup and refreshed their moved anchors. The six committed false-twin findings retain their children; the supporting host-registration observation stays explicitly outside committed scope. No test or public renderer behavior changed.

2026-10-24 triage at main af6300478a07379178bd30221a31c0b917df2283: Refreshed moved current-source pointers by inspecting their named anchors. Historical receipts retain their source identities; scope, rulings, priorities and outstanding prerequisites are preserved. No runtime result or readiness is inferred from this navigation repair.

2026-10-24 triage at main 77f35ef1ba34e4fab7092ada5362ae799852ea24: Verified moved current-source anchors and refreshed their pointers after the reference-tool delivery. Historical failed receipts retain their source identities; scope, rulings and unresolved needs are unchanged. No runtime result or readiness is inferred.

2026-10-24 triage at main e1ab485669565554ca6cb61ce5d130303647230f: Verified the test-side copied governance INSERT anchor moved by two lines after the peer-wait coverage. Refreshed that current-source pointer only; no false-twin finding, prerequisite or proof result is changed.

2026-10-25 triage at main 827861e1fa71cd4a26b52f1ef0f96b849381acdf: Verified moved current-source anchors and refreshed navigation; historical receipts and unresolved prerequisites retain their identities. No new runtime proof is claimed.

2026-10-25 triage at main 541b8d98328a760290ac6dd4a7f065af76153408: Verified the moved current-source anchors after the off-loop writer slices and refreshed their pointers; historical failed-source receipts, scope and unresolved prerequisites remain unchanged. No new runtime qualification is claimed.