test(api): retain guarded planned purchase execution proof

[cristim]

Follow-up replacement for #878, addressing its nullable-date assertion finding. Keep the combined planned-purchase regression in the repository and require a non-nil next date before comparing it in the over-cap case. This produces a clear assertion failure if that invariant regresses. It is a test diagnostic improvement, not a demonstrated production nil-clock bug.

One 375-line integration test file, with no production changes. Four cases exercise actual routed plan/root creation, stored recommendations, strict resolution and attachment through manual approval with global purchasing OFF or scheduled execution with it ON. A recording-only Azure provider verifies 20 units, monthly payment, one-year term, frozen $2,400 term commitment, durable root/child completion, next-step dates and immediate replay without another purchase. Other assertions cover creator four-eyes, approval limits, exact/over-cap behavior and real GET planned-purchase fields.

Refs #631. Supersedes #878 while preserving its commit, branch, worktree and evidence. The existing UI date-default correction is #877. Immediate replay assertions do not claim long-term execution-retention coverage.

Verification at 7eabecfc55bf6df5c1f7f90ac5eef9c12caab99b, tree 5415898b2bbe365ea6f22927d1c61a5f948bbcc2, PR base 9da13c6cefee4dbbdb9515c483ed92acaf5ae81a:

• Two retained non-author source/staged passes and two passes over the entire PR by the same fresh independent GPT-6.1 Sol medium verifier. No actionable findings.
• Native PostgreSQL 119 execution at the committed revision passed all four cases with race detection in 5.501s. A scratch test with a nil date failed with the expected assertion in 2.424s, without a panic or setup/compiler failure.
• Original historical creator control produced actual HTTP 409; historical projection control failed quantity/type/region while the existing GET control passed. Their selected functions, fixtures and production sources were verified unchanged after the one-line guard, preserving those controls' validity.
• New affected API race suite passed in 42.922s and native four-case execution passed in 5.583s. Pinned integration lint reported zero issues; build and all normal commit hooks passed.

The sole difference from the preserved #878 source is require.NotNil(t, plan.NextExecutionDate) before the existing date equality assertion. New CI must cover this head before merge.

Handlers, store, resolver, manager and PostgreSQL are real. Authentication, credentials, email, settings/clock and the recording-only provider are fixtures. The factory refuses unexpected provider/service/region tuples and has no cloud fallback. No live purchase, browser transport or manual deployment occurred.

[coderabbitai]

Warning

Review limit reached

• Run on-demand review

_{This review includes 1 billable file and costs up to $0.25.}

• Ask an admin to make reviews automatic

Open in CodeRabbit

Reviews can continue after your included limit without a manual trigger. An admin must approve usage-based billing.

Or wait 32 minutes for your next included review.

Check out review usage here.

View limit details

Limit details: You’ve used the included review currently available. Your 64 included PR review attempts over the past 7 days set your current allowance at 1 review per hour.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository: LeanerCloud/cloud-commitments-platform/.coderabbit.yaml
• Review profile: CHILL
• Plan: Essentials
• Run ID: db53d432-525b-41c7-817b-9d5756d6f104

📥 Commits

Reviewing files that changed from the base of the PR and between 9da13c6 and 7eabecf.

📒 Files selected for processing: 1

• internal/api/combined_plan_purchase_integration_test.go

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[cristim]

Exact-head verification: 7eabecf, tree 5415898b2bbe365ea6f22927d1c61a5f948bbcc2. Two independent full-diff adversarial passes and two staged passes are clean. The retained fresh verifier reviewed the complete 375-line change through this fix round: all four real handler/Postgres/resolver/manager cases passed with the explicit recording-only provider (5.501s); a scratch nil-clock probe produced the intended fatal NotNil assertion (2.424s), without a panic. Author API race, build, pinned lint and normal commit hooks passed. Historical creator-409 and projection assertion controls transfer by exact original-byte restoration; they were not rerun under new timings. Authentication, credentials, email, provider, settings and due-clock boundaries are fixtures; no live purchase occurred. Immediate replay coverage does not establish long-term execution-retention safety. CodeRabbit reports an exhausted included-review allowance, not a completed review; its green status is not review evidence. The authorized complete independent-review path covers this SHA, with no paid review or quota wait. Required exact-head CI remains pending and watched. PR #878 is closed as superseded, with its actual finding linked to this fix and all history preserved.

[cristim]

Normally squash-merged as f038e2d at the reviewed head 7eabecf after full CI and pre-commit completed SUCCESS, current main compatibility and required protections were checked, and actual reviewer findings were addressed. No checks were bypassed. The permanent 375-line test covers the real local handler/store/resolver/manager path with a recording-only provider and the documented fixtures; it adds no production behavior. All four automatically triggered post-merge workflows have individual background watchers. Their terminal results remain pending; merge alone is not a deployment or live-purchase acceptance claim. Original PR #878, branches, worktrees and evidence are preserved.