From eae179b99b5fd34924547632aa8f8025c405aa53 Mon Sep 17 00:00:00 2001
From: MeshCore Bot <bot@meshcore.local>
Date: Tue, 19 May 2026 06:41:08 +0000
Subject: [PATCH] =?UTF-8?q?test(#1287):=20RED=20=E2=80=94=20cmd/server/=20?=
 =?UTF-8?q?must=20contain=20ZERO=20cachedRW/mode=3Drw=20writer=20call=20si?=
 =?UTF-8?q?tes?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 cmd/server/readonly_invariant_test.go | 51 +++++++++++++++++++++++++++
 1 file changed, 51 insertions(+)

diff --git a/cmd/server/readonly_invariant_test.go b/cmd/server/readonly_invariant_test.go
index 629009d8..33ceabab 100644
--- a/cmd/server/readonly_invariant_test.go
+++ b/cmd/server/readonly_invariant_test.go
@@ -3,12 +3,63 @@ package main
 import (
 	"database/sql"
 	"fmt"
+	"os"
+	"path/filepath"
 	"reflect"
+	"regexp"
+	"strings"
 	"testing"
 
 	_ "modernc.org/sqlite"
 )
 
+// TestServerSourceHasNoCachedRWCalls enforces issue #1287: after the
+// follow-up to #1283, cmd/server/ must contain ZERO writer call sites.
+// Specifically, no `cachedRW(`, no `mode=rw`, and no `sql.Open(...rw...)`
+// in non-test source files. All schema migrations, backfills, and
+// neighbor-edge persistence must live in cmd/ingestor or a shared
+// package — the server is the read path.
+func TestServerSourceHasNoCachedRWCalls(t *testing.T) {
+	entries, err := os.ReadDir(".")
+	if err != nil {
+		t.Fatalf("read cmd/server dir: %v", err)
+	}
+	// Patterns that indicate write-side DB usage on the server.
+	patterns := []*regexp.Regexp{
+		regexp.MustCompile(`\bcachedRW\s*\(`),
+		regexp.MustCompile(`mode=rw`),
+		regexp.MustCompile(`sql\.Open\([^)]*\?[^)]*_journal_mode=WAL[^)]*\)`),
+	}
+	violations := []string{}
+	for _, e := range entries {
+		name := e.Name()
+		if e.IsDir() {
+			continue
+		}
+		if !strings.HasSuffix(name, ".go") {
+			continue
+		}
+		if strings.HasSuffix(name, "_test.go") {
+			continue
+		}
+		b, err := os.ReadFile(filepath.Join(".", name))
+		if err != nil {
+			t.Fatalf("read %s: %v", name, err)
+		}
+		for _, p := range patterns {
+			if loc := p.FindIndex(b); loc != nil {
+				// Get line number
+				line := 1 + strings.Count(string(b[:loc[0]]), "\n")
+				violations = append(violations, fmt.Sprintf("%s:%d: %s", name, line, p.String()))
+			}
+		}
+	}
+	if len(violations) > 0 {
+		t.Errorf("cmd/server/ contains forbidden writer call sites (#1287):\n  %s",
+			strings.Join(violations, "\n  "))
+	}
+}
+
 // TestServerDBHasNoWriteMethods enforces the architectural invariant from
 // issue #1283: cmd/server is the read path. All write/maintenance methods
 // (PruneOldPackets, PruneOldMetrics, RemoveStaleObservers) MUST live on