test: edge-case + property suites for 10 key backend modules (/edge-cases 2026-10-06)

[trinity-ability]

Summary

This PR adds edge-case and property-based tests for 10 high-risk backend modules, from the /edge-cases sweep run on 2026-10-06. It is tests only: no product code changes.

For each module the sweep listed boundary cases (boundary values plus the Trinity bug-class checklist), wrote parametrized pytest cases for the gaps and Hypothesis properties for the invariants, and classified every failing test as a wrong test, a wrong property, or a real bug. Each module was then checked with branch coverage and a scoped, hand-applied mutation pass.

Module(s)	Branch cov before → after	Mutants killed	Bugs pinned
capacity_manager + slot_service	slot 62→96, cap 83→89	24/24	#3318, #3319
idempotency_service (+ db/idempotency)	86→100	22/22	#3320
dispatch_breaker + redelivery_governor	60→100, 85→100	26/27 (with lupa)	— (see #3326)
loop_service	90→100	22/24 (2 equivalent)	#3316, #3317
credential_encryption + secret_settings	70→99	24/25 (1 equivalent)	#3325
url_validation	95→98	20/22 (2 equivalent)	#3322, #3323
safe_yaml + credential_paths + credential_sanitizer	96→98, 97→100, 86→96	31/34	#3311, #3312, #3324
backlog_service + dispatch_admission_service	68→97, 96→100	23/23	—
operator_queue_service (+ operator_queue_choices)	82→84, 98→100	22/22	#3313, #3314, #3315
pull_coordination_service + pull_pilot	92→98, 94→97	22/22	#3321

All 22 real bugs are xfail(strict=True), and each reason names its issue. So when a fix lands, its xfail turns into an XPASS and fails the run, which forces the marker to be removed in the fixing PR.

Test plan

• pytest tests/unit/test_ec_*.py: 1306 passed, 30 skipped, 49 xfailed. The 30 skips are the Lua-tier breaker tests, which need lupa (test: run the dispatch-breaker Lua state machine in unit CI (add lupa) #3326).
• pytest tests/unit/test_ec_*.py --runxfail: all 49 xfails fail, each for the stated bug.
• Full tests/unit in a fixed order (-p no:randomly), with and without these files: identical failure sets. Local failures that already exist (ent666, ent477, ent679, retention_floor, route_census) are environment-only and unchanged.
• tests/lint_sys_modules.py and tests/lint_root_test_placement.py are clean.
• All tests use only synthetic keys and tokens, and touch no Docker, network or Redis (fakeredis and temp SQLite only).

Also adds 20 tests/registry.json entries.

🤖 Generated with Claude Code

[vybe]

merge-train (2026-10-07): pushed 574ca0c36 to this branch — mechanical, our own PR.

Two Hypothesis properties were not derandomised and found real counterexamples on roughly 1 in 4 and 3 in 4 local runs, so they would have flipped the unit job red on unrelated PRs:

• test_sanitize_text_is_idempotent: sanitize_text("PASSWORD='0'0") is not idempotent. Filed as credential_sanitizer.sanitize_text is not idempotent on a quoted KEY= value with a glued suffix #3328; the PASSWORD=' glue is out of the property alphabet and the counterexample is pinned as a strict xfail on credential_sanitizer.sanitize_text is not idempotent on a quoted KEY= value with a glued suffix #3328.
• test_marker_apply_converges_and_is_idempotent: the property was wrong — a file that already carries a string since for the same reason keeps it (operator_queue_service._apply_ingestion_marker), so the continuing-hold assertion now compares against the since after the first apply, not the literal T1.

Not changed, worth a follow-up: S11 ({"PASSWORD": ...} passes through), S13 (token as dict key survives) and the breaker Retry-After: 0 case pin current gaps as correct behaviour rather than as xfail-with-issue.

[vybe]

merge-train: batch validated on train/20261007-0858 (train #3329, green)

[vybe]

merge-train (2026-10-07): merged as part of train #3329 (green). Before the squash, dev was merged into this branch because an earlier sibling had appended to the same files (tests/registry.json and/or docs/memory/feature-flows*.md). Both sides were kept, nothing else was changed.