A `multi_relation` DEFAULT, and `required` on one (PLAN-2857 U4, codex round 1's P2 and P3). Both were the same defect in two places: a gate reading

Referent validation for relation values (PLAN-2857 U1 / TASK-2878). These are the STORE-level rules — does the value name a live item in the declared

watchNotificationVisible decides whether a Notification should be delivered to a caller holding the given watch map. Extracted from the handler so the

writeOutboxTx appends one canonical event to the outbox on the caller's transaction. Two rejections, both deliberately hard errors that fail the encl

CoerceFields converts STRING field values to the type the collection schema declares, so every write door stores the same native type for the same inp

DeleteCollection soft-deletes a collection by id. When expectedUpdatedAt is non-empty it opts into optimistic-concurrency control (BUG-2265): the row'

Listen builds the HTTP server and binds addr, returning the listener without accepting on it yet. A failure here is the "address already in use" case,

LoadStore reads the credentials file and returns a usable CredentialStore. Returns an empty (but non-nil) store if the file doesn't exist — that's not

SetWatchEventsBus attaches the watch/nudge notification bus consumed by GET /api/v1/events/stream (TASK-2533). Nil-checked by every producer and by th

UserCount returns the total number of registered users.

bodyDecodesNUL reports whether any string a handler could read out of this JSON body — an object key or a value, at any nesting depth, including insid

classifyExecError turns an exec.Cmd failure (err + stderr) into a structured envelope. lookup is optional — when supplied, no_workspace errors get ava

equalSlice is a small helper for stable []string comparison; kept here so test files across the package can share it. catalog_test.go has equalString

newLocalOnlyBus builds a RedisBus without starting its subscription, for the tests that exercise the local fan-out path directly. Constructing through

uniqueName returns a stub name that is unique per test and under the 15-character comm limit pgrep -x matches on. requireScriptDeps skips when the env

--- authorization: the four checks, in order -------------------------- restrictedEditor returns an editor in both workspaces whose membership in each

ExtractWikiLinks scans `content` for [[...]] occurrences OUTSIDE any fenced or inline code region, parses each into a WikiLinkRef, and returns them in

GetOAuthConnection fetches the connection row by request_id. Returns ErrOAuthConnectionNotFound if no row exists; any other error is a real I/O failur

GetReport computes the windowed project report for a workspace.

Put writes the blob from r into the backend, addressable by hash. The implementation MUST verify that the bytes streamed from r hash to the supplied h

Save writes the persisted Pad config to disk.

Unsubscribe removes a local subscriber and closes its channel. Cancels the Redis subscription if this was the last local subscriber for the workspace.

Unsubscribe removes a subscriber and closes its channel. Safe to call with an already-removed channel — no-op in that case.

clientIP extracts the client IP from RemoteAddr. This is safe because TrustedProxyRealIP runs earlier in the chain and — when a trusted proxy is confi

Connected-apps handler tests (PLAN-943 TASK-954). What's covered: - GET /api/v1/connected-apps requires cloud mode (404 outside). - List returns onl

copyOK issues the copy as the owner and requires a 201.

Tests for createItemTx — the tx-taking counterpart of CreateItem (PLAN-2357 / DR-9a). Each test below pins one line of the DR-9a parity checklist: slu

logAuditEventForUser logs an audit event with an explicit user ID. Use this when the user isn't (yet) in the request context, e.g. after a successful

--- Helpers ---

seedNeverAttached inserts a never-attached attachment row aged past any grace cutoff a test will use.

storedRelation reads owner_ref back out of the database. Deliberately not the response body: a handler that echoed the right thing while writing the w

ApplyExternalContent routes an external content update through a designated applier when an active room exists. Returns nil on success; one of the sen

GetItemIncludeDeleted finds an item by id including soft-deleted items. Used by code paths that need to act on records the user already owns even thou

RestoreItem un-archives a soft-deleted item and bumps the workspace-scoped seq so delta-sync clients re-materialize the row. Same lock + subquery shap

SetCloudSidecar installs the reverse pad → pad-cloud client. Called from cmd/pad/main.go when PAD_CLOUD_SIDECAR_URL + PAD_CLOUD_SECRET are set. When u

SetEventBus attaches an event bus for real-time SSE streaming.

SniffMIME detects the MIME type from the leading bytes of a payload using net/http's stdlib detector (the same RFC 6838 algorithm browsers use). The r

ValidateSession hashes the provided token, looks it up, checks expiry, and returns the session info including the associated user and binding metadata

acquireWorkspaceSeqLock takes a Postgres advisory transaction lock keyed on the workspace ID so concurrent seq-bumping mutations serialize. The lock a

actorNameFromRequest returns the authenticated user's display name, or empty string.

callAs is `call` with an explicit user and workspace role, for the legs that need someone other than the fixture owner.

createLink mints a share link for the fixture's item or collection.

doArtifactRequest posts a raw (non-JSON) body to an artifact-import endpoint.

newRequest creates an http.Request with auth and agent headers set.

readFixture loads one of the real encoder outputs described in testdata/README.md. Every ISO-BMFF acceptance assertion in this file runs on those byte

* Drop the lease. `released` is false on a repeat call (no-op). `stackEmpty` * reports whether any lease remains AFTER this release — the caller use

runReminderTick is one pass: fire every reminder whose instant has arrived. The store does the arbitration and writes each event in the same transact

seedParentAndChildren creates a plan + N child tasks with the given statuses (one per child), returning the parent and the slice of child refs in crea

setContent overwrites an item's markdown body.

testServerWithPresence gives a server both the watch bus and the presence registry — the production pairing (cmd_server.go wires them on adjacent line

Tests for the OAuth server constructor + audience strategy + storage adapter (PLAN-943 TASK-951 sub-PR B). Each layer is covered: - NewServer: requir

Add implements SessionPresence. Returns the generated id even when the Redis write fails. That is deliberate and it is the same posture the rest of t

============================================================ Access tokens (handler/oauth2/storage.go AccessTokenStorage) ============================

CreateReminder arms a reminder on an item. THE ITEM MUST BE A LIVE ITEM OF THIS WORKSPACE, and that is asserted by the INSERT itself rather than by a

CreateShareLink creates a new share link and returns it with the raw token. The raw token is only available in this response — it is not stored.

GetPlatformSetting returns a single platform setting value, or empty string if not set.

NewProcessor returns the Processor compiled into this binary. Pure-Go build → pureGoProcessor. libvips build → vipsProcessor (Phase 2). Constructed o

NewRedisSessionPresence returns a shared registry backed by client. The client is the SAME one the watch bus uses (cmd/pad/cmd_server.go dials once o

SetObserver attaches an Observer. Passing nil detaches. Safe to call after the bus is running; cmd/pad/cmd_server.go calls it at wiring time.

SetSessionPresence attaches the live-session registry read by GET /api/v1/sessions and written by GET /api/v1/events/stream (PLAN-2558 S1). Nil-checke

SetUserPlan updates a user's billing plan.

WithTokenAllowedWorkspaces returns ctx decorated with the OAuth token's workspace allow-list set at consent time (TASK-952). The list is either a set

contextWithWorkspaceRoleForTest / contextWithResolvedWorkspaceIDForTest stash the two values RequireWorkspaceAccess populates for the REQUEST's worksp

fanOutFromRedis is the receive path: a message that arrived on the subscription identified by gen, carrying the ID space it belongs to. A zero epoch

getAsset issues GET on the asset endpoint. rawQuery is appended verbatim (already URL-formed, no leading '?').

getOnlyAttachmentID returns the ID of the single live attachment row in a workspace — the test infrastructure uploads at most one blob per call, so th

setupPushTest mirrors setupItemOpenTest (item_open_test.go): points getClient()/getWorkspace() at a fake httptest server via the same urlFlag/workspac

writeItemResolveError distinguishes a soft-deleted (archived) item from a genuinely-missing one for mutation handlers. An archived item still appears

Add implements SessionPresence.

ClaimPendingOutboxEvents claims up to limit pending events for one drain pass and returns them, oldest first. WHY A CLAIM AT ALL. Pad Cloud runs N in

THE FIRE-PATH INVARIANT, stated once so the next change is measured against it rather than against the last bug: THE CANDIDATE SCAN IS A HINT AND MA

IsConfigured reports whether the client has an explicit global connection configuration, either from config.toml or an environment/flag override.

JSONExtractText returns SQL to extract a text value from a JSON column. SQLite: json_extract(col, '$.key') PostgreSQL: col->>'key'

MigrateFields maps field values from a source schema to a target schema. Fields with matching keys and compatible types are transferred. Incompatible

MoveItem moves an item to a different collection within the same workspace. It updates the collection_id and fields JSON. The item_number is preserved

SeedDefaultCollections rescues a workspace that ended up with zero collections by seeding it with the standard Software-shape Defaults(). It is intent

UpdateItemWithParentLink is UpdateItemWithPreCheck plus an OPTIONAL parent-link mutation applied inside the same transaction (BUG-2013). When parentLi