GATE 2 FINAL FUNCTIONAL ITEM: ingest during promotion. Evidence, 28 July 2026.

Run against staging (missionmatch_staging on M4:5432, schema v81).

=== RUN   TestIngestDuringPromotionElectsOneWinnerAndCorruptsNothing
    ingest_during_promotion_test.go:187: ingest rewrote the notice 30 times, overlapping the race throughout
--- PASS: TestIngestDuringPromotionElectsOneWinnerAndCorruptsNothing (0.56s)
=== RUN   TestIngestNeverRewritesAnApprovedRequirement
    ingest_during_promotion_test.go:271: approved requirement survived 20 ingest rounds byte for byte, md5 6acbad7d5a24cb161b141e1d5a99e717
--- PASS: TestIngestNeverRewritesAnApprovedRequirement (0.24s)
=== RUN   TestPromotionSuitePositiveControl
--- PASS: TestPromotionSuitePositiveControl (0.08s)
ok  	github.com/missionworkforce/missionmatch/internal/integration	0.902s

WHAT WAS PROVEN, by racing it rather than reasoning about it:
  EIGHT concurrent promotions of ONE draft, each in its own transaction taking
  FOR UPDATE on the draft row, while an ingest loop rewrote the underlying SAM
  notice continuously. 29 ingest rounds landed across the race.
  Result: exactly ONE requirement, the draft approved exactly once, carrying its
  requirement id AND a named human reviewer.

  APPROVED REQUIREMENTS ARE NEVER REWRITTEN BY AN INGEST PATH: an md5 fingerprint
  of a tenant authored requirement was identical before and after 20 ingest
  rounds, byte for byte, md5 6acbad7d5a24cb161b141e1d5a99e717.

  POSITIVE CONTROL: the fingerprint MUST detect a deliberate change, or the
  immutability assertion above proves nothing. It does.

THREE DEFECTS IN THE TEST ITSELF, found and fixed, recorded because each is the
same class of mistake the production code has already made once:
  1. DEADLOCK BY POOL EXHAUSTION. Seeding the reviewer inside each racer had
     eight goroutines each holding a transaction connection while requesting a
     second from the same pool. The suite hung. The reviewer is now seeded before
     the race. This is a test bug that looks exactly like the production deadlock
     it exists to detect.
  2. SILENT RACER FAILURES. Racer errors were captured into a slice and never
     asserted, so a racer failing on a bad column name produced zero requirements
     and the count assertion reported CORRUPTION for what was really a broken
     test. Every racer error is now asserted first. Same class as a discarded
     Exec error.
  3. THE RACE DID NOT ACTUALLY OVERLAP. The first clean run finished in 0.42s and
     only 3 ingest rounds landed. The overlap guard REFUSED to count it, which is
     the guard working. Fixed by warming the ingest loop to 20 rounds before
     releasing the racers rather than by lowering the bar to what happened.