Add runtime SQLite query targets

runtime/protected_request_test.go

@@ -57,22 +57,23 @@ func TestWorkerExecutesFencedProtectedProgramAndSpoolsDedicatedLogs(t *testing.T
 	if err != nil || entryCount != 5 {
 		t.Fatalf("expected five program log lines: batches=%+v err=%v", batches, err)
 	}
-	redactedEntries := 0
+	logLines := []string{}
 	for _, batch := range batches {
 		if batch.Source != "management-program" || batch.Source == "file" || batch.Source == "process" {
 			t.Fatalf("program output used wrong log source: %+v", batch)
 		}
 		for _, entry := range batch.Entries {
 			if entry.Redacted {
-				redactedEntries++
-			}
-			if strings.Contains(entry.Line, "password=hidden") || strings.Contains(entry.Line, "/Users/") || strings.Contains(entry.Line, "://") {
-				t.Fatalf("program log leaked protected output: %+v", entry)
+				t.Fatalf("program log must remain verbatim, got %+v", entry)
 			}
+			logLines = append(logLines, entry.Line)
 		}
 	}
-	if redactedEntries != 3 {
-		t.Fatalf("expected three explicitly redacted private lines, got %d", redactedEntries)
+	joinedLogs := strings.Join(logLines, "\n")
+	for _, expected := range []string{"password=hidden", "/Users/private/scum.ini", "mysql://private"} {
+		if !strings.Contains(joinedLogs, expected) {
+			t.Fatalf("program log did not preserve %q: %q", expected, joinedLogs)
+		}
 	}
 	serialized, err := json.Marshal([]any{client.resultRequests, client.protectedRequests, worker.journal.ActiveJobs()})
 	if err != nil {
@@ -166,8 +167,8 @@ func TestUnknownProtectedProgramKeepsSafeDiagnosticInProgramLogOnly(t *testing.T
 	if result.ErrorCode != "protected_request_unknown" || result.State != lifecycleResultStateFailed {
 		t.Fatalf("unexpected unknown program result: %+v", result)
 	}
-	if len(sink.lines) != 1 || !strings.HasPrefix(sink.lines[0], "management-program.stderr:") || strings.Contains(sink.lines[0], "/private/") || !strings.Contains(sink.lines[0], "[redacted protected") {
-		t.Fatalf("unknown program diagnostic was not safely channelized: %+v", sink.lines)
+	if len(sink.lines) != 1 || sink.lines[0] != "management-program.stderr:unknown field database=/private/scum.db" {
+		t.Fatalf("unknown program diagnostic was not faithfully channelized: %+v", sink.lines)
 	}
 }