test(plans): fix tier-assumption tests for strict-80%-margin redesign

common #46 retired every unlimited (-1) resource limit to finite caps
(Team/Growth now finite). Four api handler tests still assumed the old
"team/growth = unlimited" reality and reded build-and-test, which broke
api master (every PR checks out common@master with the new numbers).

Fixes (TESTS only — the -1-handling production code is preserved as
correct defensive utilities, still reachable via provisions_per_day: -1
and future tiers):

- billing_usage_coverage: TestBillingUsage_UnlimitedTier_MbToBytesNegative
  routed the team tier (was -1) through the HTTP usage handler to hit
  mbToBytes(-1). No real tier carries -1 now, so the -1 path can't be
  reached via a tier. Moved to a direct internal test
  (mb_to_bytes_internal_test.go) that feeds synthetic -1/finite inputs —
  keeps the defensive "-1 -> ∞" branch covered.
- misc_routes_block_integration: the "team tier short-circuits to
  near_wall=false" subtest assumed the unlimited early-return. That
  early-return was removed (Team is finite -> walls apply); subtest now
  asserts near_wall=true with a seeded wall row.
- small_handlers_final: TestUsageWallFinal_DBError_503 used failAfter=1
  (team-tier pre-query #1 then audit query #2). With the early-return
  gone the audit query is the FIRST DB call -> failAfter=0.
- team_coverage_mock: TestTeamMembers_InviteMember_LegacyMemberSuccess
  assumed team_members=-1 so withinMemberLimit skipped the count query.
  Team is now 25 -> added the teamSeatTotal (members + pending) mock
  expectations; 1 seat < 25 -> within limit -> 201.

New rule-18 guard (strict_margin_finite_limits_test.go): iterates the
LIVE plans.yaml registry and fails if any tier ships a -1 on any costed
resource limit (only provisions_per_day may be -1). Re-introducing an
unlimited resource cap — or a new tier with one — now reds here instead
of silently shipping unbounded COGS.

Team stays GATED (no checkout change). Unblocks api master.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: mastermanas805

internal/handlers/billing_usage_coverage_test.go

@@ -6,8 +6,9 @@ package handlers_test
 //   - GetUsage with no team local → 401 unauthorized.
 //   - computeUsage tier-lookup error → 500 usage_failed (propagated through
 //     the cache GetOrSet loader).
-//   - mbToBytes unlimited (-1) path via the team tier whose storage limit is
-//     unlimited.
+//   - mbToBytes unlimited (-1) + finite paths: exercised directly in
+//     mb_to_bytes_internal_test.go (no real tier carries -1 post strict-margin
+//     redesign).
 
 import (
 	"database/sql"
@@ -27,7 +28,6 @@ import (
 	"github.com/stretchr/testify/require"
 
 	"instant.dev/internal/handlers"
-	"instant.dev/internal/middleware"
 	"instant.dev/internal/plans"
 )
 
@@ -112,55 +112,9 @@ func TestBillingUsage_StorageSumError_Returns500(t *testing.T) {
 	assert.Equal(t, http.StatusInternalServerError, resp.StatusCode)
 }
 
-// TestBillingUsage_UnlimitedTier_MbToBytesNegative covers mbToBytes(-1) → -1:
-// the team tier has unlimited storage, so each storage metric's limit_bytes
-// must render as -1 (the dashboard's "∞").
-func TestBillingUsage_UnlimitedTier_MbToBytesNegative(t *testing.T) {
-	db, mock, err := sqlmock.New()
-	require.NoError(t, err)
-	defer db.Close()
-	mr, err := miniredis.Run()
-	require.NoError(t, err)
-	defer mr.Close()
-	rdb := redis.NewClient(&redis.Options{Addr: mr.Addr()})
-	defer rdb.Close()
-
-	teamID := uuid.New()
-	// team tier → unlimited storage (-1) → mbToBytes(-1) path.
-	mock.ExpectQuery(`SELECT.*FROM teams WHERE id`).
-		WithArgs(teamID).
-		WillReturnRows(sqlmock.NewRows([]string{
-			"id", "name", "plan_tier", "stripe_customer_id", "created_at", "default_deployment_ttl_policy",
-		}).AddRow(teamID, sql.NullString{}, "team", sql.NullString{}, time.Now(), "auto_24h"))
-	for range []string{"postgres", "redis", "mongodb"} {
-		mock.ExpectQuery(`SELECT COALESCE\(SUM\(storage_bytes\)`).
-			WillReturnRows(sqlmock.NewRows([]string{"sum"}).AddRow(int64(0)))
-	}
-	mock.ExpectQuery(`(?i)SELECT count\(\*\)\s+FROM deployments`).
-		WithArgs(teamID).
-		WillReturnRows(sqlmock.NewRows([]string{"count"}).AddRow(0))
-	mock.ExpectQuery(`SELECT COUNT\(\*\)\s+FROM resources`).
-		WillReturnRows(sqlmock.NewRows([]string{"count"}).AddRow(0))
-	mock.ExpectQuery(`SELECT COUNT\(DISTINCT key\) FROM vault_secrets`).
-		WithArgs(teamID).
-		WillReturnRows(sqlmock.NewRows([]string{"count"}).AddRow(0))
-	mock.ExpectQuery(`SELECT COUNT\(\*\) FROM users WHERE team_id`).
-		WithArgs(teamID).
-		WillReturnRows(sqlmock.NewRows([]string{"count"}).AddRow(1))
-
-	app := newUsageApp(t, db, rdb, teamID)
-	req := httptest.NewRequest(http.MethodGet, "/api/v1/billing/usage", nil)
-	resp, err := app.Test(req, 5000)
-	require.NoError(t, err)
-	defer resp.Body.Close()
-	require.Equal(t, http.StatusOK, resp.StatusCode)
-
-	var body struct {
-		Usage map[string]struct {
-			LimitBytes int64 `json:"limit_bytes"`
-		} `json:"usage"`
-	}
-	require.NoError(t, json.NewDecoder(resp.Body).Decode(&body))
-	assert.Equal(t, int64(-1), body.Usage["postgres"].LimitBytes, "unlimited tier storage limit must serialise as -1")
-	_ = middleware.LocalKeyTeamID
-}
+// NOTE: the unlimited (mbToBytes(-1) → -1) path is exercised directly with
+// synthetic inputs in mb_to_bytes_internal_test.go (package handlers). Post
+// strict-80%-margin redesign no real tier carries an unlimited (-1) storage
+// limit, so the -1 path can no longer be reached via the team tier through
+// the HTTP usage handler; testing the helper directly keeps the defensive
+// "-1 → ∞" rendering covered.

internal/handlers/mb_to_bytes_internal_test.go

@@ -0,0 +1,33 @@
+package handlers
+
+// mb_to_bytes_internal_test.go — directly exercises the unexported mbToBytes
+// helper. Lives in package handlers (not handlers_test) because the symbol is
+// unexported.
+//
+// History: the unlimited (-1 → -1, "∞") path used to be covered by routing the
+// team tier (whose storage limit was -1) through the HTTP usage handler in
+// billing_usage_coverage_test.go. The strict-≥80%-margin tier redesign
+// (2026-06-05) retired every real -1 storage limit to a finite cap, so that
+// path can no longer be reached via any tier. The defensive "-1 → ∞" branch
+// still ships (a negative value may arrive from non-storage limits such as
+// provisions_per_day, or from a future tier), so it is exercised here with
+// synthetic inputs instead.
+
+import (
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func TestMbToBytes_UnlimitedAndFinite(t *testing.T) {
+	// Unlimited sentinel: any negative input renders -1 ("∞" on the dashboard).
+	assert.Equal(t, int64(-1), mbToBytes(-1), "unlimited (-1) limit must serialise as -1")
+	assert.Equal(t, int64(-1), mbToBytes(-9999), "any negative limit is treated as unlimited (-1)")
+
+	// Finite conversions: MB → bytes (×1024×1024).
+	assert.Equal(t, int64(0), mbToBytes(0))
+	assert.Equal(t, int64(1024*1024), mbToBytes(1))
+	// Team's new finite postgres cap (51200 MB = 50 GiB) — the value the
+	// retired HTTP test wrongly expected as -1 now serialises as real bytes.
+	assert.Equal(t, int64(51200)*1024*1024, mbToBytes(51200))
+}

internal/handlers/misc_routes_block_integration_test.go

@@ -277,19 +277,21 @@ func TestMiscBlock_UsageWall_RealDBContract(t *testing.T) {
 		assert.Equal(t, float64(87), body["percent_used"])
 	})
 
-	t.Run("team tier short-circuits to near_wall=false even with a wall row", func(t *testing.T) {
+	t.Run("team tier with a wall row returns near_wall=true (no unlimited short-circuit)", func(t *testing.T) {
 		teamID := testhelpers.MustCreateTeamDB(t, db, "team")
 		jwt := miscSeedUser(t, db, teamID)
-		// Even if a row somehow existed, the team-tier gate returns false
-		// before the audit query — assert the gate, not the absence of a row.
+		// strict-80%-margin redesign (2026-06-05): Team is no longer unlimited,
+		// so the prior team-tier early-return was removed. Team now falls through
+		// to the same audit-row query as every other finite tier — a seeded wall
+		// row therefore surfaces as near_wall=true.
 		miscSeedWallRow(t, db, teamID)
 
 		resp := miscBlockReq(t, app, http.MethodGet, "/api/v1/usage/wall", jwt)
 		require.Equal(t, http.StatusOK, resp.StatusCode)
 		body := miscDecode(t, resp)
 		assert.Equal(t, true, body["ok"])
-		assert.Equal(t, false, body["near_wall"],
-			"team tier is unlimited — no walls, short-circuit before the audit scan")
+		assert.Equal(t, true, body["near_wall"],
+			"Team is finite post strict-margin redesign — its wall row must surface")
 	})
 
 	t.Run("cross-team isolation: team A session never sees team B's wall", func(t *testing.T) {

internal/handlers/small_handlers_final_test.go

@@ -64,16 +64,16 @@ func TestWhoamiFinal_Enrichment(t *testing.T) {
 	assert.Equal(t, email, m["email"])
 }
 
-// usage_wall.GetWall: the usage query errors → db_failed (usage_wall.go:118).
-// team-tier check(1) errors-or-misses, then the usage query(2) errors. Use a
-// non-team tier so the early-return is skipped; failAfter=1 makes the usage
-// query error.
+// usage_wall.GetWall: the audit-row query errors → db_failed.
+// strict-80%-margin redesign (2026-06-05): the team-tier early-return was
+// removed, so the audit-row query is now the FIRST DB call in GetWall for
+// every tier — failAfter=0 makes that first query error.
 func TestUsageWallFinal_DBError_503(t *testing.T) {
 	seedDB, clean := testhelpers.SetupTestDB(t)
 	defer clean()
 	teamID := uuid.MustParse(testhelpers.MustCreateTeamDB(t, seedDB, "pro"))
 
-	app := newUsageWallApp(t, openFaultDB(t, 1), teamID)
+	app := newUsageWallApp(t, openFaultDB(t, 0), teamID)
 	resp, err := app.Test(httptest.NewRequest(http.MethodGet, "/api/v1/usage/wall", nil), 5000)
 	require.NoError(t, err)
 	defer resp.Body.Close()

internal/handlers/team_coverage_mock_test.go

@@ -230,20 +230,27 @@ func TestTeamMembers_InviteMember_LegacyMemberSuccess(t *testing.T) {
 	mock.ExpectQuery(`SELECT COALESCE\(role, 'member'\) FROM users WHERE id`).
 		WithArgs(userID, teamID).
 		WillReturnRows(sqlmock.NewRows([]string{"role"}).AddRow("owner"))
-	// 5. withinMemberLimit — team tier is unlimited (limit<0) so the model
-	//    skips the count query; but to be robust we allow an optional count.
-	//    The "team" tier member_limit is unlimited (-1) so withinMemberLimit
-	//    returns early without querying. Next is the existing-member COUNT.
+	// 5. withinMemberLimit — post strict-80%-margin redesign the "team" tier
+	//    member limit is FINITE (25, was -1/unlimited), so withinMemberLimit
+	//    now queries teamSeatTotal = CountTeamMembers + CountPendingInvitations.
+	//    1 member + 0 pending = 1 seat < 25 → within limit.
+	mock.ExpectQuery(`SELECT COUNT\(\*\) FROM users WHERE team_id = \$1$`).
+		WithArgs(teamID).
+		WillReturnRows(sqlmock.NewRows([]string{"count"}).AddRow(1))
+	mock.ExpectQuery(`SELECT COUNT\(\*\) FROM team_invitations WHERE team_id = \$1 AND status = 'pending'`).
+		WithArgs(teamID).
+		WillReturnRows(sqlmock.NewRows([]string{"count"}).AddRow(0))
+	// 6. existing-member COUNT (the email dedup check).
 	mock.ExpectQuery(`SELECT COUNT\(\*\) FROM users WHERE team_id = \$1 AND lower\(email\)`).
 		WithArgs(teamID, sqlmock.AnyArg()).
 		WillReturnRows(sqlmock.NewRows([]string{"count"}).AddRow(0))
-	// 6. INSERT ... RETURNING the invitation row
+	// 7. INSERT ... RETURNING the invitation row
 	invID := uuid.New()
 	mock.ExpectQuery(`INSERT INTO team_invitations`).
 		WillReturnRows(sqlmock.NewRows([]string{
 			"id", "team_id", "email", "role", "status", "invited_by", "created_at", "expires_at",
 		}).AddRow(invID, teamID, "x@y.com", "member", "pending", userID, time.Now(), time.Now().Add(7*24*time.Hour)))
-	// 7. best-effort audit insert — accept any exec.
+	// 8. best-effort audit insert — accept any exec.
 	mock.ExpectExec(`INSERT INTO audit_log`).WillReturnResult(sqlmock.NewResult(1, 1))
 
 	app := teamCoverageApp(t, db, nil, userID.String(), teamID.String())

internal/plans/strict_margin_finite_limits_test.go

@@ -0,0 +1,82 @@
+package plans_test
+
+// strict_margin_finite_limits_test.go — rule-18 registry-iterating guard for
+// the strict-≥80%-margin tier redesign (2026-06-05, PR #262 / common #46).
+//
+// The redesign retired every "unlimited" (-1) RESOURCE limit to a finite,
+// worst-case-costed cap so saturated COGS stays ≥80% margin. The ONLY limit
+// field intentionally left at -1 is ProvisionsPerDay (a per-day rate gate on
+// paid tiers, not a resource-cost dimension).
+//
+// This test iterates the LIVE plans.yaml registry (not a hand-typed tier
+// list) so that re-introducing a -1 on any costed limit — or adding a new
+// tier that ships an unlimited resource cap — fails here rather than silently
+// shipping an unbounded-COGS tier. Hand-typed slices would themselves be the
+// single-site fallacy rule 18 warns against.
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"instant.dev/internal/plans"
+)
+
+func TestStrictMargin_NoUnlimitedResourceLimits(t *testing.T) {
+	repoRoot := filepath.Join("..", "..", "plans.yaml")
+	if _, err := os.Stat(repoRoot); os.IsNotExist(err) {
+		t.Skip("plans.yaml not found in repo root — skipping finite-limit guard")
+	}
+	r, err := plans.Load(repoRoot)
+	if err != nil {
+		t.Fatalf("load plans.yaml: %v", err)
+	}
+
+	all := r.All()
+	if len(all) == 0 {
+		t.Fatal("registry is empty — plans.yaml failed to populate any tier")
+	}
+
+	for name, p := range all {
+		l := p.Limits
+		// Every integer RESOURCE limit must be finite (>= 0). -1 (unlimited)
+		// is forbidden post strict-margin redesign because an unbounded cap
+		// breaks the worst-case COGS / ≥80%-margin guarantee. (0 is allowed:
+		// it means "feature not available on this tier", e.g. deployments_apps
+		// on anonymous/free, vault on free.)
+		checks := map[string]int{
+			"postgres_storage_mb":     l.PostgresStorageMB,
+			"postgres_connections":    l.PostgresConnections,
+			"vector_storage_mb":       l.VectorStorageMB,
+			"vector_connections":      l.VectorConnections,
+			"redis_memory_mb":         l.RedisMemoryMB,
+			"redis_commands_per_day":  l.RedisCommandsPerDay,
+			"mongodb_storage_mb":      l.MongoStorageMB,
+			"mongodb_connections":     l.MongoConnections,
+			"mongodb_ops_per_minute":  l.MongoOpsPerMinute,
+			"queue_storage_mb":        l.QueueStorageMB,
+			"queue_count":             l.QueueCount,
+			"storage_storage_mb":      l.StorageStorageMB,
+			"webhook_requests_stored": l.WebhookRequestsStored,
+			"team_members":            l.TeamMembers,
+			"vault_max_entries":       l.VaultMaxEntries,
+			"deployments_apps":        l.DeploymentsApps,
+			"custom_domains_max":      l.CustomDomainsMax,
+			"manual_backups_per_day":  l.ManualBackupsPerDay,
+		}
+		for field, v := range checks {
+			if v < 0 {
+				t.Errorf("tier %q: %s = %d — unlimited (-1) resource limits were retired in the strict-80%%-margin redesign; every resource cap must be finite (>= 0)",
+					name, field, v)
+			}
+		}
+
+		// ProvisionsPerDay is the ONLY field intentionally allowed at -1
+		// (per-day rate gate, not a resource-cost dimension). Assert it is
+		// either finite (>= 0) or exactly -1 — never some other negative.
+		if l.ProvisionsPerDay < -1 {
+			t.Errorf("tier %q: provisions_per_day = %d — must be -1 (unlimited) or finite (>= 0)",
+				name, l.ProvisionsPerDay)
+		}
+	}
+}