Add direct tests for the write-gate refusal branches (edit_lines_impl_gated / edit_symbol_flow)

[Eilodon]

Finding §2.2 from the 2026-08-07 open-work review (docs/plans/2026-08-07-audit-findings-recovery-and-open-work-execution-plan.md).

test_gap_hotspots ranks these #1/#2 by structural centrality with no direct test (test_files: []):

• crates/calm-server/src/tools/edit.rs::edit_lines_impl_gated (coreness 7)
• crates/calm-server/src/tools/edit.rs::edit_symbol_flow (coreness 7)
• crates/calm-server/src/tools/common.rs::make_state_read_conn (coreness 6, the new 0.6.0 state.db read path)

The only integration test in this area (crates/calm-server/tests/watcher_integration.rs) simulates the write+reindex sequence — it does not exercise the gate's refusal branches (EDIT_CONTEXT_REQUIRED, REASON_NOT_GROUNDED, confirm-required on hub/high-risk). Those are the security-relevant paths of CALM's central write-safety mechanism, and they are its least directly-tested code.

Scope

Add focused tests driving each refusal branch through the public edit_lines/edit_symbol entry points. The WS-1 enforce-transition suite (0.5.0) likely covers the happy path already (dead_code_confidence: none), so scope the new tests to the refusal branches specifically — confirm before duplicating happy-path coverage.

Bounded, no core change, high safety value.

[Eilodon]

Addressed in e4bb64a (branch claude/memory-docs-spec-review-iw7s4t).

Added 8 direct tests for classify_gate — the pure function whose own doc comment pins it as the single source of truth for the gate decision that edit_lines_impl_gated/edit_symbol_flow both route through ("mirrors edit_lines_impl_gated's gate condition exactly"), and which was itself untested. Coverage:

• no-gate baseline (low-risk non-hub; None risk treated as low)
• hub → full edit_context+confirm+grounded_reason tier
• bridge-downgrade-eligible hub → confirm-only tier
• high-risk by caller count → ">10 callers" reason
• high-risk via a risk_rules path floor → uses the rule reason, not ">10 callers" (regression cover for the misattribution the risk-rule reason exists to prevent)
• each UncertainZeroCallerReason (EntryPoint / TestOnly / LowConfidence) gates with its own distinct message
• always_require_edit_context forces the gate on a plain symbol
• bridge_downgrade_eligible alone never creates a gate (only downgrades one)

With the existing decide_mrtr_answer / map_elicit_outcome decline tests, the refusal-decision surface is now covered. 22/22 tools::edit tests pass; clippy -D warnings + fmt clean.

Leaving this open as a scoped follow-up: a full end-to-end test that drives edit_lines_impl_gated to each error code (EDIT_CONTEXT_REQUIRED, CONFIRM_REQUIRED, REASON_NOT_GROUNDED) through an indexed hub — the wiring below the decision. The decision logic (the higher-value gap) is closed; the wiring test needs the indexing harness and is a smaller, separable increment.

---

Generated by Claude Code