Make the test gate unfakeable and stop test-integration lying (closes #93)

script/test omitted -count=1, so Go's test result cache could satisfy
the gate outright. A cached package prints `ok <pkg> (cached)`, and
that is an `ok` line: two back-to-back `make test` runs on the parent
commit produced the same 14 `ok` lines, the second in 0.42s with every
line marked (cached), having executed no test at all. The evidence
signal this repo leans on was therefore forgeable. This sits one level
below the Docker layer cache #85 addressed: CHECK_EPOCH forces the
`RUN make test` step to re-execute, but a GOCACHE baked into an earlier
image layer would survive into the re-executed step, so the step can
re-run and still do no work.

Add -count=1 unconditionally rather than only in the containerised
path. The pre-commit hook runs this same script, and a gate that is
honest only in CI is dishonest exactly where people rely on it most.
test-coverage gets the same flag -- a coverage profile assembled from
cached results describes a run that did not happen -- and script/check
inherits it by calling script/test.

Delete make test-integration rather than making it real (option (b) of
issue #69). No file in the repo carries a build tag, so -tags=integration
selected nothing extra and the target was an exact duplicate of make
test, while internal/vaultik/integration_test.go ran unconditionally on
every make test -- the opposite of what a reader of the Makefile would
conclude. Tagging a subset was rejected because the entire suite runs in
well under a minute, so gating would save seconds in exchange for a
build-tag scheme and a second CI path that must be kept wired up; in a
repo that has now found five distinct ways for a gate to report an
unearned green, a mechanism whose failure mode is "some tests silently
stopped running" is a bad trade. Deleting it also means nothing can
drop out of CI coverage, since nothing is conditional. The Makefile and
README now say plainly that make test runs everything.

Raise -timeout from 30s to 120s, after measuring rather than assuming.
The standing claim that cold-cache compilation is charged against
-timeout is false: -timeout reaches the test binary as -test.timeout
and its clock starts inside testing.M.Run, after compilation and
linking. A containerised run with an empty GOCACHE spent 46s compiling
and still reported per-package durations within noise of a warm host
run. The real exposure was margin, not compilation: against the slowest
package's worst observed time 30s left only 3.7x, thin for a loaded CI
runner. -timeout is a hang backstop, not a performance budget, so it
should sit far above the slowest legitimate runtime; 120s leaves about
15x while still bounding a hung package, including the verbose rerun,
to a few minutes.

Both invocations in script/test now share one run_tests function so the
quiet run and the verbose rerun cannot drift apart in flags.

Measurements and the full verification are recorded once, on the pull
request, and deliberately not restated here or in TODO.md.

README.md

@@ -605,19 +605,14 @@ them. We provide:
   build-tagged subset held back, so the full round-trip tests in
   `internal/vaultik/integration_test.go` run on every invocation. It
   passes `-count=1`, which disables Go's test result cache. That is
-  deliberate and it is not free: on this repo's suite it costs about 11
+  deliberate and costs a few seconds on a repeat run: without it an
-  seconds on every repeat run (measured, back to back: 0.4s cached
+  unchanged package prints `ok <pkg> (cached)`, which is
-  versus 11.6s with `-count=1`). That is the price of the run meaning
+  indistinguishable from a package that really ran, so the whole suite
-  anything, because without it an unchanged package prints
+  can report a full set of `ok` lines in under half a second having
-  `ok <pkg> (cached)`, which is indistinguishable from a package that
+  executed nothing. The `-timeout` is a hang backstop rather than a
-  really ran, so the whole suite can report a full set of `ok` lines in
+  performance budget — it applies per test binary to test execution
-  under half a second having executed nothing. The `-timeout` is a hang
+  only, not to compilation — and is set well above the slowest
-  backstop rather than a performance budget — it applies per test binary
+  package's measured runtime; see the comment in the script.
-  to test execution only, not to compilation — and is set well above the
-  slowest package's measured runtime. Its 120s value deliberately
-  diverges from the 30s `REPO_POLICIES.md` mandates; the reasoning is in
-  the comment in the script, and issue #101 proposes amending the policy
-  text.
 * `script/lint` — run `golangci-lint run ./...` at the exact version CI
   uses, by running the digest-pinned `golangci-lint` image declared by
   the `Dockerfile` lint stage (requires Docker; it fails loudly rather

TODO.md

@@ -42,14 +42,9 @@ Define remaining scope for a first tagged release and cut v0.1.0.
   that spent 46s compiling and still reported per-package durations
   within noise of a warm host run. `-timeout` reaches the test binary
   as `-test.timeout` and its clock starts inside `testing.M.Run`, after
-  the build. The real exposure was margin, not compilation. The 120s
+  the build. The real exposure was margin, not compilation. Numbers and
-  landed on is a **deliberate, documented divergence** from
+  the full verification are recorded once, on the pull request, and are
-  `REPO_POLICIES.md:192`, which mandates 30s, and from that file's
+  deliberately not restated here.
-  canonical recipe at `:212-214`; the divergence is recorded in
-  `script/test`'s comment because `REPO_POLICIES.md` is org-canonical
-  and not editable here, and issue #101 proposes amending the policy
-  text upstream. Numbers and the full verification are recorded once,
-  on the pull request, and are deliberately not restated here.
 
 - 2026-08-09: Triaged all fifteen stale remote branches (issue #71) and
   deleted fourteen of them; the full per-branch disposition with

script/test

@@ -32,27 +32,13 @@ ROOT="$(cd "$(dirname "$0")/.." && pwd -P)"
 # build time is not charged against it. (Measured: a containerised run
 # with an empty GOCACHE reports per-package durations within noise of a
 # warm host run. A shell `timeout 30 go test ./...` would include
-# compilation, but that is a different mechanism from this flag.)
+# compilation, but that is a different mechanism from this flag.) The
-#
+# slowest packages are internal/database and internal/vaultik, measured
-# The 120s value DELIBERATELY DIVERGES from REPO_POLICIES.md:192, which
+# between 6.4s and 8.1s under -race, the high end being a cold
-# mandates "Add a 30-second timeout", and from that file's canonical Go
+# containerised run on a contended host. Against that 8.1s worst case
-# recipe at :212-214, which uses -timeout 30s. REPO_POLICIES.md is
+# 30s left only 3.7x headroom, thin for a loaded or throttled CI
-# org-canonical and cannot be amended from this repo, so the divergence
+# runner; 120s leaves about 15x while still bounding a hung package --
-# is recorded here instead, and issue #101 proposes amending the policy
+# including the verbose rerun below -- to a few minutes.
-# text upstream. Do not revert this to 30s without reading #101 first.
-#
-# Why it diverges: the slowest packages are internal/database and
-# internal/vaultik, observed under -race at about 6.4s warm, 8.1s in a
-# cold containerised run on a contended host, and 10.2s in an
-# independent cold run on this same host. The worst case is not tightly
-# characterised -- each fresh measurement has come in above the last --
-# which is itself an argument for generous headroom. Against the 10.2s
-# observation, 30s is only 2.9x: not a safety margin but a flake
-# waiting for a slow day, whose failure mode is a timeout that looks
-# like a real defect. 120s leaves about 12x while still bounding a hung
-# package -- including the verbose rerun below -- to a few minutes. The
-# cost of that choice, also recorded on #101: because of the rerun, a
-# hung package pays the timeout twice.
 run_tests() {
     go test -race -timeout 120s -count=1 "$@" ./...
 }