---
id: TST-PFM-QRY-371
title: Platform analyze sql refusals
kind: unit
product_area: platform
module: queries
revision: 1
status: draft
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  rhythm-v2-docs: 99376625d3e7ac26936413cfc31a88fba6562464
repository: services-platform
files:
  - modules/queries/tests/unit/services/custom-tables/analyze-sql-refusals.spec.ts
implements:
  - ATS-PFM-QRY-005-16
environment: mock
implementation_state: implemented
latest_result: not-run
latest_run_at: null
latest_run_ref: null
conformance: not-verified
estimated_minutes: 1
isolation: A fresh test context and file-owned response fixtures.
evidence:
  - 'services-platform:modules/queries/tests/unit/services/custom-tables/analyze-sql-refusals.spec.ts'
assertion_bindings:
  - scenario: ATS-PFM-QRY-005-16
    source:
      - >-
        services-platform:modules/queries/tests/unit/services/custom-tables/analyze-sql-refusals.spec.ts#accepts
        a minimal one-relation SELECT, so the refusals below are not vacuous (the known positive)
      - >-
        services-platform:modules/queries/tests/unit/services/custom-tables/analyze-sql-refusals.spec.ts#refuses
        SELECT … INTO, naming the table it would write
      - >-
        services-platform:modules/queries/tests/unit/services/custom-tables/analyze-sql-refusals.spec.ts#refuses
        FOR UPDATE, naming the locking strength
      - >-
        services-platform:modules/queries/tests/unit/services/custom-tables/analyze-sql-refusals.spec.ts#refuses
        WITH RECURSIVE, which only an untagged field carries
      - >-
        services-platform:modules/queries/tests/unit/services/custom-tables/analyze-sql-refusals.spec.ts#refuses
        the platform schema, whatever the allowlist says
      - >-
        services-platform:modules/queries/tests/unit/services/custom-tables/analyze-sql-refusals.spec.ts#refuses
        set_config, which would move the statement into another tenant
    scope: assertions cited by the scenario
    provenance: test
fixture_seams: []
---

# Platform analyze sql refusals

## Verification Boundary

The file calls its named functions directly with controlled inputs and collaborator fixtures.

## What This Suite Proves

The assertions check analyze sql refusals at the function boundary. Bound specification examples inherit this boundary and do not become API or deployed workflow proofs.

## What It Does Not Prove

The file does not establish public-route authorization, real infrastructure behavior or a passing result at the pinned revision.

## Real Dependencies and Test Doubles

Direct function calls and file-owned collaborators define this unit boundary. The fixture seam references identify substitutions or configurable dependencies present in the source.

## Must Not Be Doubled

Keep the function whose output or effect is asserted real. Substituting that function would remove the behavior this suite exists to verify.