polyc-query 2026.9.0

//! QRY-6's A2-seal compile-fail guard.
//!
//! `crate::authority`'s own module doc ("Pinning the seal") states the
//! sealed/public split this crate's design depends on — `engine`, `decode`,
//! `provider`, `session`, and `statement_gate` all stay `pub(crate)`, so the
//! only way anything outside this crate can reach a query session is through
//! [`polyc_query::authority::QueryAuthority::scope_for`], which accepts
//! nothing but an already-verified `Principal` — but until this test existed,
//! that split was enforced by convention plus manual review alone (see that
//! module's own doc for why a trybuild harness was originally judged "more
//! machinery than the invariant warrants"). A PR that widens one of those
//! modules back to `pub` passes every other test and `just arch` cleanly;
//! this is the one check that catches it directly, by proving a snippet
//! compiled as an EXTERNAL crate (this integration test binary, which only
//! ever sees `polyc_query`'s own public surface, the same as any other
//! downstream crate) fails to name any of them.
//!
//! This guards two vectors, both exercised by the same fixture: a QUALIFIED
//! path into a sealed module (`polyc_query::engine::QueryEngine`, ...), and a
//! future CRATE-ROOT RE-EXPORT of a sealed item (`polyc_query::QueryEngine`,
//! ...) — `lib.rs` already does `pub use engine::QueryLimits;` for its one
//! legitimately root-exported item, so a qualified-path check alone would
//! stay green even if a later PR added e.g. `pub use engine::QueryEngine;`
//! next to it, defeating the seal while every qualified-path line kept
//! failing exactly as before.
//!
//! `crates/query/tests/compile-fail/sealed_modules.rs` is the fixture;
//! `sealed_modules.stderr` pins the expected rustc output. Regenerate the
//! `.stderr` after a deliberate wording change with `TRYBUILD=overwrite
//! cargo test -p polyc-query --test compile_fail`, then review the diff.

#[test]
fn sealed_query_surface_is_unreachable_from_outside_the_crate() {
    let t = trybuild::TestCases::new();
    t.compile_fail("tests/compile-fail/sealed_modules.rs");

    // A workspace-wide test build legitimately unifies `test-util` onto this
    // crate through Control's dev-dependency, making the retired constructor
    // visible to compatibility fixtures. `just test-all` therefore also runs
    // this test target in an isolated package graph, where `test-util` is off;
    // that is the release-shaped feature selection this assertion protects.
    #[cfg(not(feature = "test-util"))]
    t.compile_fail("tests/compile-fail/legacy_query_authority.rs");
}