From 186dbc62d770f47e15bfe672f01b0b9c8e5a6d5c Mon Sep 17 00:00:00 2001
From: Meta Vens <rwvens@hotmail.com>
Date: Wed, 16 Sep 2026 02:31:18 +0200
Subject: [PATCH] Say that the pipeline write path is test-only
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Soul's F9 on the Cut 4 fix batch: `prepare` and
`validate_pipeline_write_envelope` still wore
`cfg_attr(not(test), expect(dead_code))`, and Soul proved both dead in a
non-test build. `prepare` was structurally unreachable — it needs a CultCache
with the pipeline types registered, and the only registrar has been `cfg(test)`
since this cut. A waiver that describes a caller Cut 8 has not written yet is
the file claiming a live path it does not have.

Both become `#[cfg(test)]`, which is what they honestly are, and the waivers go.
Two things are test-only with them: `decode`, whose only caller was the
validator, and the `CultCache`/`CultCacheEnvelope` imports, which looked live
only because dead code mentioned them. The live path keeps the type ids.

Cut 6 now moves four `cfg(test)` items rather than two live ones; the spec's
Keeps list still holds, since what moves is the same code under a different
gate. The refusal picture is unchanged: `ForeignStore` and `InvalidIdentity`
were already raised only from these two, and the enum stays `pub`.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
---
 epiphany-core/src/pipeline_documents.rs | 21 +++++++++++++++++----
 1 file changed, 17 insertions(+), 4 deletions(-)

diff --git a/epiphany-core/src/pipeline_documents.rs b/epiphany-core/src/pipeline_documents.rs
index b3355ca3..12d7f973 100644
--- a/epiphany-core/src/pipeline_documents.rs
+++ b/epiphany-core/src/pipeline_documents.rs
@@ -17,7 +17,11 @@
 //! admission path, never by registering or preparing a pipeline type itself.
 
 use anyhow::Result;
-use cultcache_rs::{CultCache, CultCacheEnvelope, DatabaseEntry};
+use cultcache_rs::DatabaseEntry;
+// Envelopes are a test-only shape here until the organ prepares, decodes and
+// validates them (Cut 8); only the type ids survive into the live path.
+#[cfg(test)]
+use cultcache_rs::{CultCache, CultCacheEnvelope};
 use schemars::JsonSchema;
 use serde::{Deserialize, Serialize};
 
@@ -413,7 +417,11 @@ macro_rules! pipeline_kinds {
                 match self { $(Self::$variant(value) => value.validate($name)),* }
             }
 
-            #[cfg_attr(not(test), expect(dead_code, reason = "the organ's admission prepares writes through this"))]
+            /// Test scaffolding until the organ prepares writes (Cut 8). Every
+            /// caller is a test, and the only cache carrying these types is the
+            /// `cfg(test)` registrar beside it, so this is `cfg(test)` rather
+            /// than a live path wearing a dead-code waiver.
+            #[cfg(test)]
             pub(crate) fn prepare(&self, cache: &CultCache) -> Result<CultCacheEnvelope> {
                 let key = pipeline_key(self)?;
                 Ok(match self {
@@ -423,6 +431,9 @@ macro_rules! pipeline_kinds {
                 })
             }
 
+            /// Test-only with its only caller, the write validator below, until
+            /// the organ decodes admitted envelopes (Cut 8).
+            #[cfg(test)]
             pub(crate) fn decode(envelope: &CultCacheEnvelope) -> Result<Self, PipelineRefusal> {
                 let invalid = |error: rmp_serde::decode::Error| format_error("payload", &error.to_string());
                 $(if envelope.r#type == <$document as DatabaseEntry>::TYPE {
@@ -573,8 +584,10 @@ pub fn pipeline_key(document: &PipelineDocument) -> Result<String, PipelineRefus
 }
 
 /// Bounds, formats, then key recomputation, for one envelope. Per-kind
-/// admission rules belong to the organ's admission path.
-#[cfg_attr(not(test), expect(dead_code, reason = "the organ's admission validates every write through this"))]
+/// admission rules belong to the organ's admission path. Its only caller is a
+/// test until the organ validates writes through it (Cut 8), so it is
+/// `cfg(test)` rather than a live path wearing a dead-code waiver.
+#[cfg(test)]
 fn validate_pipeline_write_envelope(envelope: &CultCacheEnvelope) -> Result<()> {
     let document = PipelineDocument::decode(envelope)?;
     document.validate()?;