Add unit tests closing coverage gaps in pure-logic modules

[willronchetti]

Summary

Adds 138 direct unit tests across 8 new files (initial audit), plus a follow-up
round of ~50 more tests across 4 new files + 2 extended files closing the gaps the
initial audit had explicitly deferred. No production code was changed; the new tests
run without ElasticSearch or Postgres. Also folds in a known CI-flakiness fix
(flaky-rerun decorators in test_indexing.py) and repairs a version/changelog mismatch
introduced by the master merge.

What I audited (round 1)

I mapped the 30 existing test_*.py files against the 60 top-level snovault/*.py
modules, ran a targeted read of the pure-logic candidates, and checked each for
(a) testability without live services, (b) correctness-sensitivity, and (c) current
coverage. I confirmed gaps by grepping the whole test tree for each target function
and by exercising actual runtime behavior before pinning it in assertions.

Gaps found and closed (round 1 — 8 new files, 138 tests)

New test file	Module under test	Why it mattered
test_typedsheets.py	typedsheets.py	Zero coverage. Deterministic CSV/insert value casting used at load time. Pins the null/empty-string asymmetry, right-to-left cast ordering, array/object parsing, and row generators.
test_authorization.py	authorization.py	Security-critical groupfinder had only indirect coverage. Covers all synthetic remoteuser.* results, user + access-key lookup branches, _create_principals, and is_admin_request.
test_etag.py	etag.py	Caching-correctness decorators with no test. Covers the HTTP 304 short-circuit, ETag setting, private/no-cache headers, and per-principal ETag distinctness.
test_schema_formats.py	schema_formats.py	is_uuid / is_accession identity validators, untested; documents the known re.match laxness.
test_server_defaults_misc.py	server_defaults_misc.py	All 5 add_last_modified branches covered via mocked get_userid/get_now.
test_predicates.py	predicates.py	View predicates (route matching) untested; covers int→tuple normalization, text/phash, and __call__ matching.
test_typeinfo.py	typeinfo.extract_schema_links	Pure recursive schema-walk generator; empty/top-level/nested/array linkTo cases plus the KeyError edge.
test_util_helpers.py	util.py (pure helpers)	deduplicate_list, ensurelist, gunzip_content, simple_path_ids, recursively_process_field, merge_calculated_into_properties edge branches, and more.

Round 2 — follow-up gaps implemented (4 new files, 2 extended)

These are the items round 1 listed under "deliberately left as follow-up", now done:

Test file	Module under test	What it locks
test_local_roles.py (new)	local_roles.py	Security-sensitive principal expansion: local_principals (lineage accumulation, callable roles, string-role normalization, __ac_local_roles_block__ stopping ancestors but keeping the blocking node's own roles, identity-return when nothing matches), merged_local_principals (reverse role→principal mapping), and LocalRolesAuthorizationPolicy.permits / principals_allowed_by_permission end-to-end against a real ACL.
test_calculated_registry.py (new)	calculated.py	CalculatedProperty schema default guard (ValueError), schema copy + calculatedProperty: True marking, condition gating, attr dispatch to context methods, fn-arg resolution from the namespace; ItemNamespace per-fn memoization and string-name resolution; CalculatedProperties.props_for MRO ordering (subclass overrides base), instance-or-class input, and category isolation.
test_json_renderer.py (new)	json_renderer.py	UUID/set/frozenset/datetime adapters, dumps() working outside any request (the indexer calls it that way), JSONResult.serializer → BinaryFromJSON UTF-8 chunk encoding.
test_manager_lru_cache.py (new)	cache.py	ManagerLRUCache degrading to a no-op with no threadlocal stack, capacity resolution from registry settings vs. default, and the afterCompletion transaction flush (stale-entry protection for retried transactions).
test_edw_hash.py (extended)	edw_hash.py	Previously hash-only golden values; adds verify() round-trip, bytes/str secret equivalence, and the exact "Password too long" boundary (454-char max secret, computed from the salt layout).

CI flakiness fix folded in (test-only, known issue)

• Re-enabled @pytest.mark.flaky(max_runs=3, rerun_filter=delay_rerun) on
  test_aggregated_items (was commented out).
• Added the same decorator to test_indexer_namespacing and
  test_indexer_queue_adds_telemetry_id, which use the same SQS/ES polling pattern as
  their already-protected neighbors but never had it.
• Documented the convention in AGENTS.md.

Post-merge repair

The master merge (6b7ef67c9) resolved pyproject.toml to 11.31.7 but left this PR's
CHANGELOG entry headed 11.31.1, which failed the changelog checker in both the
Static Checks and UNIT CI jobs. Fixed the heading, then bumped to 11.31.8 for the new
work (checked open PRs for collisions: #321 is at 11.30.8, #308 at 11.24.0 — none).

Notes / observations (no action taken)

• ItemNamespace.__getattr__ sharp edge (not a production bug): if an
  ItemNamespace is constructed with request=None (or a request lacking .registry),
  looking up an unknown attribute recurses to RecursionError instead of raising a clean
  AttributeError, because the reify-based registry/_properties properties raise
  AttributeError inside __getattr__ and re-enter it. Unreachable in production
  (calculate_properties always passes a real request); documented in AGENTS.md for
  future test authors.
• PR Fix self-registration privilege-escalation in create_unauthorized_user #321 also adds a root AGENTS.md/CLAUDE.md; since master now has them (via Add per-type track_revisions opt-out for Postgres revision history #319),
  Fix self-registration privilege-escalation in create_unauthorized_user #321 will need conflict resolution on those files when it takes a master merge — noted
  here because this PR's merge already integrated master's copies.

Testing

• All new tests pass locally.
• Full non-ES suite: pytest -m "not es and not indexing and not performance" →
  790 passed, 28 skipped, with the single pre-existing environment-specific failure
  (test_postgresql_fixture.py::test_snovault_db_test_port), which fails identically on
  a clean baseline.
• test_indexing.py (ES-marked, not runnable locally) collects cleanly with the new
  decorators; delay_rerun was already imported in that file.

🤖 Generated with Claude Code