Guides image + draft gating, audit retention, ADR-015 gate, backup credential redaction

tests/test_plugin_migrations.py

@@ -282,18 +282,21 @@ def test_upgrade_all_on_fresh_db_is_clean_and_idempotent(tmp_path, monkeypatch):
 
 
 
-# Plugins whose whole chain is a single baseline. Their tables existing already
-# is the ONLY divergence possible between schema and stamp, so upgrade-all must
-# handle it end to end. A longer chain can also meet an ALTER whose column is
-# already present, which no amount of guarding a create_table fixes - see the
-# test below for why that is a different problem.
-SINGLE_BASELINE_PLUGINS = tuple(
-    plugin for plugin in POST_CUTOVER_PLUGINS
-    if len(list((PLUGINS_DIR / plugin / 'migrations' / 'versions').glob('0*.py'))) == 1
-)
+# EVERY post-cutover chain, not just the single-baseline ones. This was once
+# restricted to plugins whose whole chain is one baseline, on the reasoning that
+# a longer chain meets a second problem - an ALTER whose column is already
+# present - that guarding a create_table does not fix. True, but the conclusion
+# was wrong: the answer is to guard the ALTERs too, not to stop testing the
+# chains that have them. While this was narrowed, printedparts 0003 sat
+# unguarded for a month and would fail upgrade-all on any create-all-built
+# database, taking 0004 down with it, with no test able to see it.
+#
+# The invariant is now the whole one: a post-cutover chain must run to its head
+# against a database whose tables were built from the models and stamped
+# nowhere, and must do it twice.
 
 
-@pytest.mark.parametrize('plugin', SINGLE_BASELINE_PLUGINS)
+@pytest.mark.parametrize('plugin', POST_CUTOVER_PLUGINS)
 def test_baseline_skips_tables_that_already_exist(plugin, tmp_path, monkeypatch):
     """A baseline must stamp, not fail, when its table is already there.