chore(skills): add event sourcing test patterns (#20)

## Summary

- `model-based-testing`: Add Event Replay Testing (Given-When-Then)
section + 2 violations
- `zod-contract-testing`: Add 2 violations for schema versioning and
boundary contracts

### New violations

| Skill | Violation | Severity |
|-------|-----------|----------|
| `model-based-testing` | `missing_event_replay_test` | must-fail |
| `model-based-testing` | `missing_given_when_then_coverage` |
should-fail |
| `zod-contract-testing` | `missing_schema_version_test` | must-fail |
| `zod-contract-testing` | `missing_boundary_contract_test` |
should-fail |

Companion to apankov1/ai-balls#3885.

## Test plan

- [ ] Review Given-When-Then examples for correctness
- [ ] Verify violation severity levels are appropriate

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>

Author: apankov1

skills/model-based-testing/SKILL.md

@@ -174,6 +174,62 @@ assert.deepEqual(terminals, ['published']);
 
 ---
 
+## Event Replay Testing (Given-When-Then)
+
+For event-sourced aggregates, state machines are driven by event replay. The Given-When-Then pattern tests the full cycle:
+
+```
+Given: [list of historical events]  → establishes state
+When:  [command]                     → triggers decision
+Then:  [list of new events]          → asserts outcome
+```
+
+### Pattern
+
+```typescript
+describe('Game aggregate', () => {
+  function givenEvents(events: GameEvent[]): GameState {
+    return events.reduce(evolve, initialState);
+  }
+
+  it('rejects move on completed game', () => {
+    // Given: game completed
+    const state = givenEvents([
+      { type: 'game_started', payload: { players: ['p1', 'p2'] } },
+      { type: 'move_executed', payload: { player: 'p1', row: 0, col: 0 } },
+      { type: 'game_won', payload: { winner: 'p1' } },
+    ]);
+
+    // When: another move attempted
+    // Then: should throw
+    expect(() => decide(state, { type: 'MAKE_MOVE', player: 'p2', row: 1, col: 1 }))
+      .toThrow('Game is already completed');
+  });
+
+  it('produces correct events for valid move', () => {
+    // Given: game in progress
+    const state = givenEvents([
+      { type: 'game_started', payload: { players: ['p1', 'p2'] } },
+    ]);
+
+    // When: valid move
+    const newEvents = decide(state, { type: 'MAKE_MOVE', player: 'p1', row: 0, col: 0 });
+
+    // Then: move event produced
+    expect(newEvents).toEqual([
+      { type: 'move_executed', payload: { player: 'p1', row: 0, col: 0 } },
+    ]);
+  });
+});
+```
+
+### Why This Matters
+
+- **Decoupled from persistence**: Tests don't need databases, storage, or mocks
+- **Replay safety**: Proves that historical events produce correct state
+- **Schema evolution**: Add upcasted events to `Given` to verify migration
+- **Deterministic**: Pure functions — no async, no side effects
+
 ## Violation Rules
 
 ### missing_transition_coverage
@@ -192,6 +248,14 @@ Transitions that modify context MUST have assertions verifying exact changes and
 Terminal states (no outgoing transitions) MUST be explicitly identified and tested.
 **Severity**: should-fail
 
+### missing_event_replay_test
+Event-sourced aggregates MUST have tests that replay historical events and verify resulting state. Without replay tests, schema evolution and upcasters can silently corrupt state.
+**Severity**: must-fail
+
+### missing_given_when_then_coverage
+Event-sourced command handlers MUST have Given-When-Then tests covering: (1) valid commands producing correct events, (2) invalid commands on valid state, (3) valid commands on invalid/terminal state.
+**Severity**: should-fail
+
 ---
 
 ## Companion Skills
@@ -213,5 +277,6 @@ This skill provides **testing utilities** for state machines, not state machine
 | Guard truth table | Boolean guard functions | 2^N rows for N boolean inputs |
 | Context mutation | Transitions with side effects | `assertContextMutation(before, after, expected)` |
 | Terminal states | Lifecycle endpoints | `getTerminalStates(machine)` |
+| Given-When-Then | Event-sourced aggregates | `givenEvents([...]) → decide(state, cmd) → assertEvents(result)` |
 
 See [patterns.md](./references/patterns.md) for XState integration, complex guard examples, and hibernation safety testing.

skills/zod-contract-testing/SKILL.md

@@ -245,6 +245,14 @@ Zod parsing MUST happen at system boundaries (API handlers, WebSocket messages,
 Use `Schema.parse()` or `Schema.safeParse()`, NEVER `as Type` casts for external data.
 **Severity**: must-fail
 
+### missing_schema_version_test
+Event schemas with `schemaVersion` field MUST have contract tests verifying that each version parses correctly and upcasters produce valid output for the target version.
+**Severity**: must-fail
+
+### missing_boundary_contract_test
+Typed RPC interfaces used for cross-service or cross-DO communication MUST have contract tests verifying request/response schemas parse correctly at both caller and callee boundaries.
+**Severity**: should-fail
+
 ---
 
 ## Companion Skills