Backend-test — prove the API and the database, locally

Local stack only. Everything runs against the repo's local dev environment (docker compose / local services + local PostgreSQL). Never point a test at staging or production data — reading staging logs is control-deployment's territory. Bring the stack up per references/stacks.md (read it for compose commands, ports, migration commands per repo) — reuse a running stack, start what's missing, kill only what you started.

1. API pass (scoped to changed endpoints)

For each endpoint the diff touched:

• Happy path — realistic payload → assert status code, response shape (against the OpenAPI spec / generated DTOs where the repo has them), and content. Remember repo conventions: snake_case JSON, paginated responses use "data".
• Edge cases — empty/missing fields, wrong types, oversized values, invalid IDs, unauthorized where auth exists, double-submit where idempotency is claimed. The right answer is a clean 4xx with a structured error — a 500 on bad input is a finding.
• Logs open the whole time — tail the service logs during every call; any traceback, unexpected warning, or error-level line during a "passing" request is a finding too.

2. Database pass

• Migrations — apply cleanly on a clean database AND from the previous head (alembic upgrade head or the repo's equivalent). An autogenerated migration that diverges from the models is a finding.
• Rows — after exercising the API, check the affected tables: counts move as expected, values land in the right columns, timestamps/FKs populated.
• Constraints — actively try to violate what the schema claims (NULL into NOT NULL, duplicate into UNIQUE, orphan FK, CHECK breakers). The database must reject each one; an accepted violation means the constraint exists only in the model's imagination.

3. Fix loop

Same discipline as verify: full failure output, root cause in the named files, smallest fix, re-run the failing probe only, 3 attempts per issue then FAILED + diagnosis. Never fix a 500 by widening the accepted input; fix the handler. Forbidden suppressions apply.

Output

BACKEND-TEST — <PASS | FAIL>
Stack: <reused | started+killed: what>
<METHOD /path>: happy <ok> | edges <n ok, n fixed, n FAILED> | logs <clean | findings>
Migrations: <ok | FAILED> | Rows: <ok> | Constraints: <n enforced, n FAILED>