chore(deps): re-pin llm-ingestion-okf to v0.3.1 + migrate tests to stable error codes

Pin dae0bd1a -> v0.3.1 (=692f2df) on the public Forgejo mirror; uv.lock pins
the exact commit behind the tag.

- Drop the mypy override: the library ships py.typed from v0.2.0, so strict
  mode now follows its real types instead of follow_untyped_imports.
- Migrate 8 library-error assertions from pytest.raises(match=...) to
  exc.value.code — message text is explicitly unstable from v0.3.0, the
  codes are the stability contract.
- Fix a real breakage the bump surfaced: IngestResult gained a required
  `stamp` field (d3a3bcc), which the delegation fake did not construct.
- The read-only SQL test loses resolution under the code contract
  (`sql_failed` is generic), so it now proves read-onlyness by effect —
  the write never lands — instead of by message wording.
- Correct the guard plan: G1's persist-gate anchor (ingest.py:372-387) died
  with the 2026-07-16 adoption. Door A is ungated by the library's own
  README, so gating stays our responsibility at the call site.

Verified: 426 tests green, golden output byte-exact unchanged, full gate
clean (ruff + format + mypy strict).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RmNAgbRXUgvoSKxVK4Bevv

tests/test_ingest.py

@@ -113,16 +113,18 @@ class TestSecurityFrame:
         manifest = _valid()
         manifest["extractions"][0]["max_rows"] = 1
         case = _write_case(tmp_path, manifest, {"e.csv": "col\n1\n2\n"})  # 2 data rows > 1
-        with pytest.raises(SourceError, match="max_rows"):
+        with pytest.raises(SourceError) as exc:
             materialize(case / "manifest.json", tmp_path / "bundle", INGESTED_AT)
+        assert exc.value.code == "max_rows_exceeded"
 
     def test_query_escaping_root_is_refused(self, tmp_path: Path) -> None:
         manifest = _valid()
         manifest["extractions"][0]["query"] = "../secret.csv"
         case = _write_case(tmp_path, manifest, {"e.csv": "col\n1\n"})
         (case / "secret.csv").write_text("col\nx\n", encoding="utf-8")
-        with pytest.raises(SourceError, match="escapes"):
+        with pytest.raises(SourceError) as exc:
             materialize(case / "manifest.json", tmp_path / "bundle", INGESTED_AT)
+        assert exc.value.code == "path_escape"
 
     def test_collision_with_non_ingest_file_fails(self, tmp_path: Path) -> None:
         case = _write_case(tmp_path, _valid(), {"e.csv": "col\n1\n"})
@@ -132,7 +134,8 @@ class TestSecurityFrame:
         (bundle / "ingest-e.md").write_text(
             "---\ntype: reference\ntitle: hand\n---\n\nCurated.\n", encoding="utf-8"
         )
-        with pytest.raises(MaterializationError, match="collides"):
+        with pytest.raises(MaterializationError) as exc:
             materialize(case / "manifest.json", bundle, INGESTED_AT)
+        assert exc.value.code == "collision_unstamped"
         # The curated file is untouched — never overwritten.
         assert "Curated." in (bundle / "ingest-e.md").read_text(encoding="utf-8")

tests/test_ingest_adoption.py

@@ -53,7 +53,9 @@ class TestDelegation:
         ) -> llm_ingestion_okf.IngestResult:
             calls["args"] = (manifest_path, bundle_dir, ingested_at)
             calls["kwargs"] = kwargs
-            return llm_ingestion_okf.IngestResult(written=(tmp_path / "ingest-e.md",))
+            return llm_ingestion_okf.IngestResult(
+                written=(tmp_path / "ingest-e.md",), stamp="e@0123456789abcdef"
+            )
 
         monkeypatch.setattr(ingest, "materialize_bundle", fake)
         out = ingest.materialize(tmp_path / "manifest.json", tmp_path / "bundle", INGESTED_AT)
@@ -153,6 +155,7 @@ class TestLibraryGuarantees:
         manifest_path = tmp_path / "manifest.json"
         manifest_path.write_text(json.dumps(manifest), encoding="utf-8")
         bundle = tmp_path / "bundle"
-        with pytest.raises(ingest.SourceError, match="returned no columns"):
+        with pytest.raises(ingest.SourceError) as exc:
             ingest.materialize(manifest_path, bundle, INGESTED_AT)
+        assert exc.value.code == "sql_no_columns"
         assert not bundle.exists()

tests/test_ingest_sql.py

@@ -85,8 +85,9 @@ class TestTypedCellFailFast:
         db = _db(tmp_path, [(1, 1.0, "x", b"\x00\x01")])
         manifest_path = _write_manifest(tmp_path, _sql_manifest("SELECT d FROM t"))
         monkeypatch.setenv("SRC_DSN", str(db))
-        with pytest.raises(RenderError, match="unsupported SQL cell type"):
+        with pytest.raises(RenderError) as exc:
             materialize(manifest_path, tmp_path / "bundle", INGESTED_AT)
+        assert exc.value.code == "unsupported_cell_type"
 
 
 class TestConnectorRuntime:
@@ -97,8 +98,9 @@ class TestConnectorRuntime:
     ) -> None:
         monkeypatch.delenv("SRC_DSN", raising=False)
         manifest_path = _write_manifest(tmp_path, _sql_manifest())
-        with pytest.raises(SourceError, match="not set in the environment"):
+        with pytest.raises(SourceError) as exc:
             materialize(manifest_path, tmp_path / "bundle", INGESTED_AT)
+        assert exc.value.code == "connection_ref_unset"
 
     def test_max_rows_cap_enforced_fail_fast(
         self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch
@@ -108,8 +110,9 @@ class TestConnectorRuntime:
         manifest["extractions"][0]["max_rows"] = 1  # 2 rows > 1
         manifest_path = _write_manifest(tmp_path, manifest)
         monkeypatch.setenv("SRC_DSN", str(db))
-        with pytest.raises(SourceError, match="max_rows"):
+        with pytest.raises(SourceError) as exc:
             materialize(manifest_path, tmp_path / "bundle", INGESTED_AT)
+        assert exc.value.code == "max_rows_exceeded"
 
     def test_connection_is_read_only(self, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
         db = _db(tmp_path, [(1, 1.0, "x", None)])
@@ -117,5 +120,13 @@ class TestConnectorRuntime:
         # database and surfaces as a typed SourceError.
         manifest_path = _write_manifest(tmp_path, _sql_manifest("UPDATE t SET a = 9"))
         monkeypatch.setenv("SRC_DSN", str(db))
-        with pytest.raises(SourceError, match="readonly"):
+        with pytest.raises(SourceError) as exc:
             materialize(manifest_path, tmp_path / "bundle", INGESTED_AT)
+        # `sql_failed` is the generic statement-failure code; read-onlyness is proven by
+        # the effect, not the message (message text is unstable from library v0.3.0).
+        assert exc.value.code == "sql_failed"
+        con = sqlite3.connect(db)
+        try:
+            assert con.execute("SELECT a FROM t").fetchall() == [(1,)]  # write never landed
+        finally:
+            con.close()