test(database): promote 2 QA secondary-index integrity anchors

[kriszyp]

What

Two promoted exploratory-QA specs, both green on 1e1edc666, landing in integrationTests/database/. They pin what stays correct about secondary-index ↔ primary-record consistency, in corners the existing suite doesn't reach.

Spec	Origin	What it pins
eviction-index-atomicity-lmdb.test.ts	QA-614	TTL/expiration eviction on the LMDB engine removes the primary row and its raw @indexed entry atomically — base and index both drain to 0, phantom=0/missing=0, for audit:false and audit:true, at 4 workers. This is the clean-engine counterpart that bounds the known RocksDB eviction-orphan behavior to RocksDB.
aborted-update-index-migration.test.ts	QA-616	An aborted UPDATE that migrates an @indexed value A→B is fully atomic under both abort mechanisms — an in-request throw and an over-time abort (storage.maxTransactionOpenTime, monitor fire hard-asserted). The old entry survives at A, nothing leaks at B, the primary rolls back.

Why these two together

They are one theme: the index and the primary record agree, on every path that removes or moves an entry. Each is a negative result that constrains where index/primary skew can live — which is exactly the kind of property that regresses silently, because no query surface reports it.

That last point drives the method. Both read the raw secondary-index dbi directly rather than through search_by_value: transformToEntries() joins every index hit through the primary record and SKIPs when the primary is absent, so a query-surface oracle is structurally incapable of observing a dangling index entry. Each spec therefore also carries a positive control that injects a synthetic dangling entry (a real put, then a primary-store removal that bypasses updateIndices()) and asserts the oracle sees it — so "0 dangling" is earned rather than vacuous.

Deliberately not included: the RocksDB differential leg that the QA-615 scratch spec also ran. It reproduces a currently-open defect (200/200 orphaned entries), and a test that asserts broken behavior turns red the day that behavior is fixed. The RocksDB side belongs with its fix. For the same reason, the QA-616 positive control was re-based onto the synthetic injection mechanism instead of the delete-then-abort mechanism it originally borrowed from an open defect. Both notes are recorded in-file so the intent survives.

Verification

Run in a clean worktree at 1e1edc666, each spec cold:

aborted-update-index-migration.test.ts   tests 5 · pass 5 · fail 0  (~9.2s)
eviction-index-atomicity-lmdb.test.ts    tests 8 · pass 8 · fail 0  (~17.1s)

Positive controls fired in both. oxlint and prettier clean. Each spec is requires-isolation (distinct storage engine / worker count / transaction-timeout config), so they are separate files rather than appended to a shared-instance suite.

Update — a third spec was pulled from this batch

eviction-index-transient-lmdb.test.ts (QA-615) originally rode along here and is no longer part of this PR (c266e9d6b). After the restart_service race fix in a9cd33f38 cleared the other two, its part-C legs still failed on contended CI shards: 6/6 (Node.js v22) aborted at ~10.2s with [TimeoutError: The operation was aborted due to timeout], and 6/6 (Bun) at ~1.4s with TypeError: fetch failed / read ECONNRESET. Those legs drive a client-side sample loop concurrently with a live TTL eviction sweep at threads.count=4, and the individual sample requests don't survive a loaded runner.

Part C is that file's reason to exist — the transient-window re-audit is precisely what the settled-state sibling can't see — so trimming the flaky legs would leave nothing worth pinning. It goes back to the QA candidate pool for a CI-robust rework (per-sample retry/backoff, a sampling budget that degrades instead of asserting, and a separate look at whether the ECONNRESET-under-eviction is itself worth a scenario) rather than being merged flaky to keep the batch at three.

🤖 Generated with Claude Code

[claude]

Reviewed; no blockers found.

[gemini-code-assist]

Code Review

This pull request introduces comprehensive integration tests and fixtures to verify secondary-index atomicity and eviction behavior under abort and TTL scenarios on both RocksDB and LMDB storage engines. The reviewer's feedback is highly actionable, focusing on improving test reliability and performance. Key recommendations include replacing fixed sleeps with condition-based polling loops to prevent flakiness, removing redundant sleeps, and strictly validating numeric configuration parameters (such as stallMs) to handle potential NaN values robustly.