Tests whose assertions do not pin the behaviour they name

Problem

The suite is green, so this is not about failures. It is about assertions that would still hold if the behaviour they are written to protect broke: bounds that pass for the value they exist to reject, counts where identity is what matters, and setups that pre-satisfy the assertion. Each finding names the change to production code that would leave the test green.

25 findings: 13 med, 12 low.

The rest

One line each: what it is, and where. The change that would stay green is recorded per finding and carried by its own commit.

• med All three retention previews are seeded so they report the same number, so no form's scope wiring is pinned: swapping one form's scope for another stays green while every tenant's page reports a cross-tenant count. tests/src/Functional/RetentionUiTest.php:74-104
• med The timeout join's configured duration is never asserted, because the test overwrites the deadline it should be checking. Arming a one-second deadline instead of the configured hour stays green, and every timeout join then tears down live branches on the first cron run after the first arrival. tests/src/Kernel/DiscriminatorTimeoutTest.php:70-76
• med CurrentStepResolver's non-timer filter is named in the class docblock and asserted nowhere in the repository, so deleting the filter stays green and leaks timer nodes into the Views current-step column. tests/src/Kernel/CurrentStepResolverTest.php:19-21
• med The delete hook's incident cleanup is asserted by no test. tests/src/Kernel/InstanceCleanupTest.php:70-77
• med The failed leg of the instance-ended event is claimed by the docblock and dispatched by production, but asserted nowhere, so payment's stored-card cleanup could silently stop running for failed runs. tests/src/Kernel/InstanceEndedEventTest.php:18-23
• med An audit test's method docblock states the opposite of its own assertion about whether a variable's value is carried. tests/src/Kernel/AuditEventsTest.php:192-198 against :225-227
• med The dead-end test asserts the opt-out path is quiet but never that it is logged, which the production comment says it must be. tests/src/Kernel/DeadEndBranchTest.php:161-178
• med The runtime index test claims to assert "each declared index" and leaves three declared indexes unasserted, so deleting any of them stays green and full-scans a growing table. tests/src/Kernel/RuntimeEntityIndexTest.php:46-82, schemas at src/ProcessInstanceStorageSchema.php:28-92 and src/TokenStorageSchema.php:25-55
• med The comparison test's equality case does not test the loose comparison it names: all four assertions are same-type string comparisons, so tightening the operator stays green while an integer literal against a stored boolean stops routing. tests/src/Unit/ComparisonTest.php:66-74, production at src/Plugin/FlowCondition/Comparison.php:99-101
• med The purge command's deleting branch is never exercised, and the dry-run test does not assert the report it names, so pinning the command to dry-run for ever stays green. tests/src/Kernel/OrchestraDrushCommandsTest.php:68-122, production at src/Drush/Commands/OrchestraRetentionCommands.php:44-58
• med The status-history ordering assertion cannot fail, because it compares two timestamps that are always equal within one request, and the milestone timestamp the UI renders is asserted nowhere. tests/src/Kernel/StatusHistoryTest.php:132, production at src/StatusHistory.php:73-79
• med "Cancels the running instances first" is asserted by neither deletion test, so that step is indistinguishable from delete-only under every assertion in either. tests/src/Kernel/WorkflowDeletionTest.php:58-109, tests/src/Kernel/TenantDeletionTest.php:55-139
• med The duration test never asserts the negative-duration rejection both its docblocks promise. tests/src/Unit/DurationTest.php:11-55
• low A resolver test names a method that does not exist. tests/src/Kernel/CurrentStepResolverTest.php:83
• low An audit test's class docblock claims resource and correlation id for three lifecycle events; only one has them. tests/src/Kernel/AuditEventsTest.php:19-21
• low Two of the three branches of the retention preview are asserted nowhere. src/Form/RetentionPreviewTrait.php:38-46
• low A join-cancellation docblock names the parked branch as asserted; it is not. tests/src/Kernel/JoinCancellationTest.php:74-79
• low A helper's docblock says "open incidents" while its query has no state condition. tests/src/Kernel/EngineOutcomeTest.php:264-277
• low "Removing any declared index fails the build" is false in the engine index test too, and the true gap is wider than the three above. Counting every index name the storage schemas declare against every name any test asserts, seven are asserted nowhere: orchestra_token__instance_created, orchestra_instance__initiator, orchestra_instance__initiator_status, orchestra_incident__instance_state, orchestra_work_item__completer_completed, and both of orchestra_delegation, which has no index test at all. tests/src/Kernel/EngineIndexTest.php:20-21
• low The bounded-drain test never observes how many items the drain processed. tests/src/Kernel/AdvanceQueueDrainerTest.php:84-103
• low A teardown query-count budget has no non-zero guard, so a harness that observes nothing passes. tests/src/Kernel/TokenCancellationTest.php:142-192
• low A test says "every token consumed" but asserts only "none active, none parked". tests/src/Kernel/WorkflowEngineTest.php:90-145
• low A dependency test names the tenant dependency; nothing asserts it. tests/src/Kernel/WorkflowStatusDependencyTest.php:14-22,92-113
• low One half of a resume-outcome test can pass with zero assertions, and the other only ever checks a fixture that cannot drift. tests/src/Kernel/ResumeOutcomeDeclarationTest.php:80-90,101-130
• low A variables test checks only that a token key exists, so the wrong token is invisible. tests/src/Kernel/VariablesTaskTest.php:70-89

This issue summary was drafted with the assistance of an AI agent (Claude). The analysis and the wording were reviewed by me before posting, and accountability for the content is mine.