[Badri-Rajendran]

Problem

main has failed CI on every push since PR #25 merged (confirmed via gh run list --branch main
— green through PR #24, red on every merge since). Only the "Backend / tests + coverage floor" job
fails; migrations, SAST, secret scanning, and Docker builds all stay green.

Root cause (reproduced deterministically, not guessed)

Spun up a throwaway Postgres 16 + Redis container on separate ports, ran docker/postgres/init.sql
against it, and ran uv run pytest --cov=app --cov-report=term-missing — CI's exact command — to
get a genuinely clean environment matching CI precisely (my own local dev DB had accumulated
unrelated cross-session state this session and was not a reliable baseline).

Reproduced the exact CI failure (2 failed, 930 passed, 31 errors) from a fresh environment,
then bisected it down to two files: tests/api/test_orders.py + tests/api/test_portfolios_api.py
run together in one pytest invocation.

test_orders.py's _order_tables fixture was scope="session", autouse=True — the only
session-scoped table fixture in the entire backend test suite. Every other API test file
(test_portfolios_api.py, test_portfolios_holdings.py, test_valuation_api.py,
test_funding.py, ...) uses a function-scoped fixture: create tables before each test, drop them
after. Session scope meant test_orders.py's 16 tables — critically security, which nearly
every other file also manages independently — stayed alive for the rest of the pytest process,
not just for test_orders.py's own tests.

Any file that ran afterward in the same process silently reused this still-alive security table
instead of getting a fresh one. When that file's own per-test teardown ran its usual non-CASCADE
DROP TABLE "security", it failed with DependentObjectsStillExist — test_orders.py's
tax_lot (also still alive) still referenced it. That one failed DROP rolled back its whole
teardown transaction, so every table in that file's list survived with its data into the next file
too — explaining both CI symptoms: uq_security_symbol duplicate-key errors, and a leftover
"Growth" model_portfolio row (from test_orders.py's session-scoped seed) bleeding into an
unrelated assertion in test_portfolios_api.py.

Why this never showed up locally all session: confirmed it requires both files' fixtures alive
in the same pytest process — running them as two separate uv run pytest invocations against
the identical database state does not reproduce it. Every local check this session ran scoped
files or small combos as separate invocations (by design, to avoid exactly the shared-DB
contention problem this session hit repeatedly with concurrent agents) — which is precisely the
shape that never triggers this bug.

Fix

Made _order_tables function-scoped, matching every other file's own established convention.
Folded in the now-redundant _clean_order_tables TRUNCATE-based fixture (a full create/drop per
test already resets everything a TRUNCATE would have). Costs more CREATE/DROP churn across
this file's ~50 tests — the same cost every other file already pays for correct isolation.

Validation evidence

• uv run ruff check, uv run mypy --strict app (pre-existing baseline noise only, confirmed via
  the identical pattern already present in every other test file this session), uv run lint-imports — clean.
• Full suite, CI's exact command, fresh isolated environment: uv run pytest --cov=app --cov-report=term-missing → 932 passed, 7 skipped, 2 xpassed, 0 failed, 0 errors, 84.52%
  coverage (floor 77%).

Security / DB / API impact

None. Test-only change — no application code touched.

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.