#1007 INCIDENT 2026-10-20 ~02:29Z: engine tests/unit/db ran against live highway_db_v2 and called jumper.cleanup_events('highway_default', 60, 1000)

WHAT: a security-batch agent ran the full engine tests/unit inside highway-api; tests/unit/db/test_cleanup_events.py inserted+deleted its own rows in jumper.e_/w_highway_default and called jumper.cleanup_events('highway_default', 60, 1000), which deletes up to 1000 events older than 60 s with no waiter (production TTL 24 h). The count deleted was not captured. IMPACT ASSESSMENT (forensic read-only, 2026-10-20 ~02:50Z): jumper.e_highway_default holds 13 events (oldest 2026-06-25); the 8 rows in jumper.w_highway_default are all stale waiters from 2026-06-25..07-05 with timeouts long past (pre-existing leftovers, separate defect). No current run waits for an event that could have been deleted. Residual risk: a run that emits an event and waits for it more than 60 s later, emitted before 02:29Z and not yet waited, would now wait until timeout; tonight's runs on highway_default all completed. FIX: both tests/unit/db conftests now skip unless HIGHWAY_DB_TESTS=1 and pytest.exit(4) when config or DB_NAME names highway_db_v2 (core 6885750, highway ddc886e). Proven with a marker-file probe: no opt-in -> skipped, untouched; opt-in on prod config -> refused, untouched; control with guard disabled -> touched. CI sets the opt-in for its job-local database. FOLLOW-UP: stale waiters with expired timeouts are not swept.