[bitbiter-dev]

Closes #277. Closes #278. Part of #276; #279, #280 and #281 build on it.

What changes

PostgreSQL integration tests (#277). A new Anichron.Tests.Integration project runs one postgres:17-alpine container per test run through Testcontainers, and gives each test its own database, either empty or with the real migrations applied. A test keeps the image in step with src/docker-compose.yml. Its first callers are code that only real PostgreSQL can exercise and that had no tests:

• DeleteExpiredAsync;
• MigrateWithAdvisoryLockAsync: two concurrent migrators both finish, the lock is released afterwards, and with the lock held elsewhere the migrator gives up without migrating.

Test suites by name. Directory.Build.props classifies projects ending in .Tests.Unit and .Tests.Integration. A TestSuite property (Unit by default, Integration or All) decides which of them are test projects. Plain dotnet test and Stryker therefore never run the integration suite.

• Directory.Build.targets sets IsTestProject for projects in the selected suite.
• For projects outside it, it also sets IsTestingPlatformApplication=false. Microsoft.NET.Test.Sdk and xUnit v3 set both properties to true after Directory.Build.props, and Stryker treats IsTestingPlatformApplication=true as a test project whatever IsTestProject says. Before this fix the scoped Stryker run found 1,303 tests, the 6 integration tests included; now it finds only the unit tests.
• A new CI job, Integration tests, runs dotnet test src/ -p:TestSuite=Integration and is added to the gate's needs.

Work queue core (#278). A hand-rolled, durable queue in WorkItems (ADR 0008 records why not a library, citing #273). Refresh-token cleanup is its first caller.

• Inserting: IWorkQueue.EnqueueAsync (EfWorkQueue, Core) is the only insert. A payload with a DedupKey coalesces: while an item with that key is Queued, enqueueing again returns that item. A partial unique index absorbs racing inserts.
• Store: EfWorkItemStore (Worker).
  • A claim takes the oldest queued item of a kind this Worker knows, using FOR UPDATE SKIP LOCKED, and increments Attempt.
  • Heartbeat, succeed, fail and release are all fenced by (Id, Attempt), so an attempt that lost its lease changes nothing.
  • Lease recovery counts a stall each time; the third stall fails the item as stalled.
  • An item handed back while another with its key is queued ends Cancelled as superseded.
• Executor: runs one item at a time under a lease of 60 s, with a heartbeat every 2 s that carries the progress snapshot.
  • A fenced heartbeat cancels the handler, and nothing more is written.
  • A shutdown releases the item without counting a stall.
  • A handler exception fails the item with its error; there is no retry.
• Scheduler: every Worker polls every 5 s. It recovers expired leases, then enqueues each periodic kind that is due: nothing queued or running with its key, and nothing finished within its interval. No host keeps timer state, so overdue work runs right after downtime.
• Kinds: TokenCleanup replaces TokenCleanupService and its timer. WorkItemRetention deletes items that finished more than 30 days ago. WorkHandlerRegistry dispatches by kind through registrations made in DI, never a switch. It fails startup unless every WorkKind has exactly one payload type in Core and exactly one handler for it.
• Settings: Worker:WorkPollIntervalSeconds, WorkHeartbeatSeconds, WorkLeaseSeconds (must be longer than the heartbeat), WorkMaxStalls, WorkItemRetentionDays and WorkItemRetentionIntervalHours, with spec: Work queue — durable API/Worker work items with scope routing, leases and a live admin view #276's defaults.
• Architecture rules, each shown failing on a deliberate violation:

  rule 'only-work-queue-inserts-work-items' is broken by these types ... {"Anichron.Worker.ViolationInsert"}
  rule 'work-handlers-live-in-worker' is broken by these types ... {"Anichron.API.ViolationHandler"}
  

Decisions made with the maintainer

• StorageConfigId and CancelRequestedAt are not in this migration. They arrive with their first callers, feat(worker): Crawl as a work item per storage config, with scope routing #281 and feat: Cancel queued and running work items #280.
• When an item goes back to the queue while another with the same key is queued, it is absorbed into the queued one (Cancelled, superseded). spec: Work queue — durable API/Worker work items with scope routing, leases and a live admin view #276's rule that only queued items coalesce stays.

Deliberately not here

• Scope routing (feat(worker): Crawl as a work item per storage config, with scope routing #281), cancel (feat: Cancel queued and running work items #280), and the admin list, detail and SSE endpoints (feat(api): Admin work-item list, detail and live SSE stream #279).
• For feat(api): Admin work-item list, detail and live SSE stream #279: EF cannot load a row whose Kind this build does not know. Nothing here loads a WorkItem (the claim reads raw columns and skips unknown kinds), but the list and detail endpoints will.
• RevokeAllActiveByUserIdAsync and ExecuteInTransactionAsync are PostgreSQL-only too, but still have no integration tests; test: PostgreSQL integration test project (Testcontainers) for PostgreSQL-only code #277 did not ask for them.

Verification

• dotnet test -p:TestSuite=All after merging master: 1,416 unit and 31 integration tests, all passing.
• Each contract test was shown failing with the code it guards broken:
  • the Attempt fence removed;
  • SKIP LOCKED removed (the claim then blocks until the command timeout);
  • the advisory lock bypassed, or its release made a no-op;
  • < changed to <= in the expired-token delete;
  • the store as it was before the review fixes.
• Mutation testing: one scripts/mutation-changed.sh run over every changed production file reached 100.00%. The PostgreSQL-only members carry // Stryker disable all, with ADR 0005 rows.
  • The full local sweep did not finish. Both attempts stalled in per-test coverage capture while another sweep ran on the same machine, at a load average near 100. The scoped runs on this code logged no coverage timeouts, so CI's mutation job is the first full run.
• mutation-guard.sh, derive-db-docs.sh --check and dotnet format --verify-no-changes pass.

🤖 Generated with Claude Code