[codeasier]

Scope

Partial test-system implementation for #280. No runtime/product changes, executable fixture additions, parser-v3 decisions, live-provider calls or acceptance weakening. Adds Hypothesis only to the dev extra.

• Real SQLite/packaged event+block pagination uses independently sorted generated records: sparse IDs, ties, empty inputs, ASC/DESC, offset/limit/max_rows and completeness metadata. Bounded page concatenation is compared with the full query and independent oracle.
• Generated YAML schema/parameter validation rejects invalid declared values and unknown fields; registry-level malformed-file handling must warn/skip the invalid file and retain a valid neighbor.
• Import-metadata mapping and actual SQLite service inspection cover valid round-trips, absent fields, wrong types including bool, negative values, empty strings, malformed digests and non-UTC times; reads must not mutate the database.
• Trusted in-memory snapshot numeric failures use the real importer/conversion/cleanup boundary with only the representation loader replaced. No pickle is deserialized.

Each property has bounded examples, deterministic generation for a fixed Hypothesis version, shrinking/reproduction blobs and no machine-speed deadline. No assume/filter escape, broad-exception pass, xfail or health-check suppression.

Known remaining #280 gap — not closed by this PR

Static source inspection (not a claimed executed reproducer) shows the stronger arbitrary-malformed-input invariant is not currently true:

• QueryConfig.load_yaml_from_string("queries: []") / "- item" reach unchecked .items() / .get() in src/pt_snap_cli/query/config.py:439-444; the direct loader can leak AttributeError. The registry's documented warning-and-skip boundary is a different contract.
• Missing action / size=None in trusted in-memory snapshot events lead to KeyError / TypeError in snapshot/base/entities.py:89-91; SnapshotImportBackend currently normalizes ValueError but not these types.

Runtime hardening is outside the user's tests-only authorization. These cases are not silently xfailed or redefined as correct behavior. Refs #280. This is a partial delivery; the tracking issue must remain open until the separate runtime follow-up and its complete acceptance are finished. This PR does not claim all malformed YAML/pickle structures are controlled.

Verification

Independent source/diff review completed before publication. Scoped Ruff/Black, AST, TOML and diff checks passed. Normal tests/build were not duplicated locally. Exact head 9da523d0417b198c4ee6a21dfa2a40faa526f3f0 passed all 12 applicable checks: Linux Python 3.10–3.13 (full coverage and installed-wheel acceptance included), lint, provenance, real Chromium, four Windows shards and macOS. Evidence: Test run 41283575652 and Platform run 41283575650. Nightly/manual dataset acceptance was skipped by event policy and is not claimed as executed.

[codeasier]

#280 remains partial: structural-input domain errors need separate runtime authorization

The issue body explicitly requests controlled errors for malformed YAML, missing fields and wrong metadata types. The tests-only scope cannot truthfully complete those points by accepting raw implementation exceptions or silently xfail/skip them. This PR therefore does not close #280.

Source-inspected minimal cases (not executed as passing CI acceptance):

from pt_snap_cli.query.config import QueryConfig
QueryConfig.load_yaml_from_string("queries: []")  # unchecked .items(): AttributeError
QueryConfig.load_yaml_from_string("- item")      # unchecked .get(): AttributeError

Both file/string loaders in src/pt_snap_cli/query/config.py need shape validation with the agreed controlled validation/domain error, rather than these incidental attribute errors.

For the snapshot boundary, start with trusted in-memory data, not an untrusted pickle:

missing_action = {"addr": 4096, "size": 1, "stream": 0, "frames": []}
wrong_type = {"action": "alloc", "addr": 4096, "size": None, "stream": 0, "frames": []}
representation = {"segments": [], "device_traces": [[missing_action]]}
# Repeat with wrong_type. Replace only the current snapshot2db
# load_snapshot_representation seam to return representation, then call
# SnapshotImportBackend().dump_to_db(source, output, device=0).

Source conversion directly indexes action / converts numeric values; missing action and size=None can escape as KeyError / TypeError rather than ImportExecutionError. A minimal separately authorized runtime change must validate those structures or normalize those expected validation failures at the boundary, while retaining cause, destination preservation and temporary-file cleanup. No parser-v3 or compatibility decision is involved.

The mergeable property-test portion retains deterministic real SQLite pagination, YAML schema/registry behavior, metadata contracts and existing numeric-ValueError normalization. Its first CI run exposed a test isolation error: an older lazy-import test removes snapshot2db from sys.modules, making a collection-time patch target stale. Commit 9da523d0417b198c4ee6a21dfa2a40faa526f3f0 resolves the current module inside each example and preserves every error/cause/load-count/input/destination/cleanup assertion; exact-head CI is running. It creates only inert placeholder bytes, never a pickle to deserialize.

[codeasier]

Integration sequencing note: this branch will include the unchanged, independently reviewed PR281 test changes so CI can validate the intended combined tree before serial merging. This is a temporary integration-stack ordering, not a functional dependency of the property tests. PR281 must be accepted first; the final main/head comparison, all required checks and branch protection still apply. No code/test assertions or runtime scope is weakened, and issue280 remains partial.

[codeasier]

Updated to 914847bb71754f70323bb20428c9c40cad16af1c by a normal two-parent fast-forward merge of actual main efd24f8d840e8da5393585b13299e758883dc1a7. This is a verified zero-file-delta update: the tree remains 49bca2cbd08f558536060616e707b2f78ab0b230. The earlier combined head passed all 12 applicable checks, but fresh exact-head checks are required before merge; tree equality is not being used to bypass them.

The runtime gaps documented in the original description are now addressed by separately authorized PR #286, not folded into this tests-only delta. The issue's compatibility boundary has been clarified in #280: retain valid defaults and existing loader compatibility, reject illegal shapes/types/missing required fields, and retain rejection of unknown runtime arguments/output-schema fields. #280 remains open until the combined acceptance matrix and post-merge validation succeed.

[codeasier]

Final actual-main head 914847bb71754f70323bb20428c9c40cad16af1c passed all 12 applicable checks in Test 41319999919 and Platform 41320000051. After independent review and latest head/base/review/check rechecks, normal squash merge is e347be302632b328f29da212d65b062ec3f457ae, whose tree exactly matches the validated head. Post-merge CI is pending. This remains the partial tests-only portion of #280; the issue stays open for separate #286 runtime validation and its required acceptance evidence.

[codeasier]

Post-merge validation is now complete and successful at main e347be302632b328f29da212d65b062ec3f457ae: Test 41322852130 and Platform 41322852057, all 12 applicable checks. This completes the tests-only PR's delivery. #280 remains open for the separately reviewed runtime candidate #286, its final actual-main integration, ordinary CI and required manual dataset/differential acceptance; the scheduled-only skip is not claimed as executed.