fix/tariff-cov

divisionsFailed counter inflated: ZONE_SKIPPED failures duplicate across rate types

domains/utility/src/tariff-job/tariff-job.decisions.ts:197

decideFinalizeJob sets divisionsFailed = input.failures.length. Each Map branch runs its own persist Lambda for one rate type. aggregatePersistResults flatMaps all branches' failures. A zone ZONE_SKIPPED under all 9 rate types appears 9x in the final array, so divisionsFailed is stored as 9 instead of 1. Status determination unaffected, but the job result misleads operators.

failTariffJobShell alreadyFailed path returns event.id = '' violating ShellResult contract

domains/utility/src/tariff-job/tariff-job.shells.ts:244

Empty string is not a valid outbox event id. No current caller breaks, but a future caller inspecting event.id could treat '' as real. A null event or discriminated return type would be structurally unambiguous.

resolveCronYearMonth uses UTC month — Mexico calendar alignment is by accident

services/utility/tariffs/cfe/src/handlers/tariff-transition.lambda.ts:40

Not a bug with 14:00 UTC schedule, but if rescheduled to very late UTC, getUTCMonth() could return the new month while Mexico is still in the old month.

SFN Choice condition order silently enforces 'explicit yearMonth wins' — undocumented contract

infra/cdk/src/stacks/services/utility/tariffs/cfe/stepfunctions.stack.ts:186

Reordering ASL conditions would silently change behavior. Document at the state definition.

TLS certificate verification disabled for CFE scrape HTTP client

services/utility/tariffs/cfe/src/handlers/tariff-collector.lambda.ts:599

rejectUnauthorized: false disables TLS peer verification. Pre-existing pattern from bill collector, necessitated by CFE cert chain incompatibility. Risk: network-positioned attacker could substitute rate values. Document as accepted risk; consider fingerprint pinning.

rateTypes override accepted without allow-list validation

services/utility/tariffs/cfe/src/handlers/tariff-transition.lambda.ts:200

Arbitrary strings can be written to tariff_jobs.config. Attack surface limited to platform operators.

CI watchdog annotation expands step output without scope-limiting

.github/workflows/tariff-coverage-watchdog.yml:278

Low risk with current SQL. If query modified to include sensitive columns, annotation would expose them.

finalizeTariffJobShell always emits JOB_COMPLETED for failed/partial_success outcomes

domains/utility/src/tariff-job/tariff-job.shells.ts:218

decideFinalizeJob returns 'failed' or 'partial_success' but shell unconditionally emits JOB_COMPLETED. Consumers routing on event type alone receive JOB_COMPLETED even for a failed job. Consider separate event types per outcome matching the cfe-job sibling pattern.

reapStaleActiveJob throws Error instead of returning Result at shell boundary

services/utility/tariffs/cfe/src/handlers/tariff-transition.lambda.ts:115

Acceptable at Lambda boundary, but thrown errors propagate to the SFN as untyped exceptions.

Bug 5 fix (zone skips surface as failures) has no test

services/utility/tariffs/cfe/__tests__/collector.test.ts:1

The zone-skip-as-failure fix lives in tariff-persist.lambda.ts. No test stubs an unresolvable zone through the persist layer and verifies the skipped entry appears in failures. The fix that un-silenced VDM data loss is untested.

resolveTargetYearMonth (determines which month gets scraped) is entirely untested

services/utility/tariffs/cfe/src/handlers/tariff-transition.lambda.ts:59

Pure function. Wrong month = wrong prices under the right key. Both branches (explicit yearMonth wins over monthsBack; malformed yearMonth throws) are untested. Export and test: malformed yearMonth, monthsBack=0/1, explicit overriding monthsBack.

Stale job reaping (bug 4 fix) has no test

services/utility/tariffs/cfe/src/handlers/tariff-transition.lambda.ts:109

reapStaleActiveJob fixes a dead job blocking the monthly cron. Neither path (young job -> throw; old job -> failTariffJobShell) is tested. A regression here would silently lose an entire month's data.

aggregatePersistResults has no unit test

services/utility/tariffs/cfe/src/handlers/tariff-transition.lambda.ts:76

Pure function that feeds decideFinalizeJob. A miscalculation would cause wrong job status. Trivially testable by exporting and passing mock inputs.

decideFinalizeJob not tested for divisionsPersisted=0 with empty failures

domains/utility/src/tariff-job/__tests__/tariff-job.decisions.test.ts:136

All none-persisted tests pass non-empty failures. The divisionsPersisted === 0 -> failed branch fires regardless of failures.length — untested edge case.

failTariffJobShell shell-level idempotency not integration-tested

domains/utility/src/tariff-job/__tests__/tariff-job.decisions.test.ts:175

Decision-level idempotency tested, but not the shell-level guarantee (one DB update, one outbox event on double-call).

Year-unavailable branch in month verification not tested

services/utility/tariffs/cfe/__tests__/collector.test.ts:238

Guard rejecting requests for unavailable years is untested. StubClient makes it trivially testable.

Stale-job age check roundtrips ms -> minutes -> ms losing precision

services/utility/tariffs/cfe/src/handlers/tariff-transition.lambda.ts:114

Use const ageMs = Date.now() - active.queuedAt.getTime(); derive ageMinutes for error message only.

Duplicated all-zones fan-out loop for UNSUPPORTED_RATE_TYPE and RATE_PAGE_FAILED

services/utility/tariffs/cfe/src/handlers/tariff-collector.lambda.ts:520

Extract failAllZones(targets, rateType, errorCode, message) to remove identical nested for-loops at both error paths.