refactor(auditlog+sitecallaudit): delete the _injectedRepository test ctors — register row 61

AuditLogIngestActor and SiteCallAuditActor each exposed constructors taking a scoped repository and caching it on a field for the actor's lifetime. Safe only because no production call site picked those overloads — i.e. one call site away from re-introducing the row-45 captive-dependency bug — which is why CaptiveDependencyGuard had to allowlist both fields. Preferred fix applied: the test fixtures fold onto the IServiceProvider overload with a stub provider, and the constructors are gone. Product deletions: - AuditLogIngestActor: the (IAuditLogRepository, ILogger) ctor, the _injectedRepository field and its branch in OnIngestAsync, and OnCachedTelemetryWithoutDualWriteAsync (the "this ctor cannot dual-write" fallback handler that only that ctor installed). _serviceProvider is now non-nullable and the null-forgiving operators are gone. - SiteCallAuditActor: both test ctors (repo-only, and repo + reconciliation collaborators), the _injectedRepository field and its four branches, and the private SerializedRepository class. _backgroundTimersEnabled went with them: only the deleted repo-only ctor ever set it false, so it was a constant and its two guards are removed. The reconciliation tick is still gated — on the collaborators being resolvable, which is how production reaches the same state. Test fixtures (12 call sites): two small TestSupport helpers build the stub providers. SiteCallAuditActor's production wiring resolves a FRESH repository per scope, so the serializing decorator existed only to protect fixtures that share one DbContext-backed instance across every scope — it moves into the test project as SerializingSiteCallAuditRepository, which is where the hazard is actually created. Fixtures that relied on it keep it. The relay test's ICentralAuditWriter now arrives via the provider, exactly as production resolves it. Behaviour is preserved on the paths under test: the deleted audit ctor passed redactor:null / failureCounter:null, and a provider registering neither resolves both to null, so the SafeDefaultAuditRedactor fallback and counter-free logging are unchanged. No fixture on the folded sites sends IngestCachedTelemetryCommand, so swapping to the real dual-write handler is inert. The SiteCallAudit purge timer now arms in fixtures that previously had timers off, but every one of them uses default purge settings whose first tick is 5 minutes out — nothing fires inside a test. One reconciliation test was renamed and rewritten rather than deleted: TestCtor_RepositoryOnly_DoesNotStartReconciliationTick became NoReconciliationCollaboratorsRegistered_DoesNotStartReconciliationTick — the same guarantee, expressed the way production actually reaches it. Guard: the allowlist is now EMPTY. The staleness self-test (every entry must still match a flagged field) is replaced by two stronger pins — Allowlist_IsEmpty asserts nothing is exempt at all, and FormerlyAllowlistedActors_NowScanClean scans both actors with the allowlist DISABLED, so the empty allowlist is evidence the fields are gone rather than evidence the scan stopped looking. Negative control: re-adding an ISiteCallAuditRepository field to SiteCallAuditActor fails both FormerlyAllowlistedActors_NowScanClean and the real Central_NoActorHoldsCaptiveScopedState scan. Verification: solution builds clean. AuditLog.Tests 3/3 (383), SiteCallAudit.Tests 3/3 (66), Host.Tests 2/2 (505), IntegrationTests 2/2 (115), Communication.Tests 2/2 (717).
2026-08-15 17:49:39 -04:00
parent 7a7d345b89
commit 92fe5acca7
15 changed files with 474 additions and 452 deletions
@@ -238,13 +238,18 @@ public class SiteCallAuditReconciliationTests : TestKit
        ISiteEnumerator sites,
        IPullSiteCallsClient client,
        ISiteCallAuditRepository repo,
-        SiteCallAuditOptions options) =>
-        Sys.ActorOf(Props.Create(() => new SiteCallAuditActor(
-            repo,
-            sites,
-            client,
-            NullLogger<SiteCallAuditActor>.Instance,
-            options)));
+        SiteCallAuditOptions options)
+    {
+        // Register row 61: the actor's repository+collaborators test ctor is gone. The
+        // collaborators now reach it the way production supplies them — resolved from the
+        // provider — and the repository comes out of a scope, serialized because this fixture
+        // deliberately shares one instance across every scope.
+        var provider = TestSupport.StubRepositoryProvider.Build(repo, sites, client);
+        return Sys.ActorOf(Props.Create(() => new SiteCallAuditActor(
+            provider,
+            options,
+            NullLogger<SiteCallAuditActor>.Instance)));
+    }

    // ---------------------------------------------------------------------
    // 1. AbsentRow_PulledFromSite_IsUpserted
@@ -348,28 +353,30 @@ public class SiteCallAuditReconciliationTests : TestKit
    }

    // ---------------------------------------------------------------------
-    // 4. RepoOnly test ctor does NOT start the reconciliation tick
+    // 4. A composition root without the reconciliation collaborators does NOT
+    //    start the reconciliation tick
    // ---------------------------------------------------------------------

    [Fact]
-    public void TestCtor_RepositoryOnly_DoesNotStartReconciliationTick()
+    public void NoReconciliationCollaboratorsRegistered_DoesNotStartReconciliationTick()
    {
-        // The repo-only test ctor (used by the MSSQL-backed actor tests) injects
-        // no client/enumerator, so the tick must be gated OFF — otherwise those
-        // tests would fire phantom pulls. Build the actor via that ctor and
-        // confirm no pull ever happens. We can't observe a non-event directly,
-        // so we share a ScriptedPullClient with an isolated actor that DOES run
-        // the tick to bound the wait, then assert the repo-only actor's client
-        // (a separate instance) recorded nothing.
+        // Register row 61: this used to be phrased as "the repo-only test ctor gates the tick
+        // off". With that ctor deleted, the same guarantee is expressed the way production
+        // actually reaches it — a composition root that registers NEITHER IPullSiteCallsClient
+        // NOR ISiteEnumerator leaves the tick disarmed (GetService returns null for both), so
+        // the MSSQL-backed actor tests fire no phantom pulls. We can't observe a non-event
+        // directly, so we run an isolated actor that DOES tick to bound the wait, then assert
+        // this actor upserted nothing on its own.
        var repo = new RecordingRepo();
+        var bareProvider = TestSupport.StubRepositoryProvider.Build(repo);
        Sys.ActorOf(Props.Create(() => new SiteCallAuditActor(
-            repo,
-            NullLogger<SiteCallAuditActor>.Instance,
-            FastTickOptions())));
+            bareProvider,
+            FastTickOptions(),
+            NullLogger<SiteCallAuditActor>.Instance)));

-        // Run a parallel actor with the full reconciliation ctor and a fast
+        // Run a parallel actor whose provider DOES carry the collaborators, with a fast
        // tick; once IT has pulled we know enough wall-clock elapsed that the
-        // repo-only actor would have ticked too, had it been wired.
+        // collaborator-less actor would have ticked too, had it been wired.
        var liveClient = new ScriptedPullClient();
        var liveRepo = new RecordingRepo();
        CreateActor(
@@ -383,8 +390,8 @@ public class SiteCallAuditReconciliationTests : TestKit
            duration: TimeSpan.FromSeconds(3),
            interval: TimeSpan.FromMilliseconds(50));

-        // The repo-only actor never reconciles: it has no client to pull with,
-        // so it upserts nothing on its own.
+        // The collaborator-less actor never reconciles: it has no client to pull
+        // with, so it upserts nothing on its own.
        Assert.Equal(0, repo.UpsertCallCount);
    }