test: cover settings classification

- Require a literal settings inventory\n- Limit Guardian configuration to the approved subset

src/__tests__/record-settings-contract.test.ts

@@ -4,6 +4,11 @@ import {
   assertRecordSettingsAccess,
   type RecordSettingsAccess,
 } from "@/lib/record-settings/access";
+import {
+  classifySettingsDestination,
+  isGuardianSettingsWriteAllowed,
+  SETTINGS_DESTINATION_INVENTORY,
+} from "@/lib/record-settings/classification";
 import { toRecordSettingsDto } from "@/lib/record-settings/dto";
 import { recordSettingsKeys } from "@/lib/query-keys";
 
@@ -45,4 +50,20 @@ describe("record settings contract", () => {
       "Guardian configuration is unavailable for this record",
     );
   });
+
+  it("classifies every Settings destination and limits Guardian writes", () => {
+    expect(Object.keys(SETTINGS_DESTINATION_INVENTORY)).not.toHaveLength(0);
+    expect(classifySettingsDestination("integrations")).toMatchObject({
+      kind: "managed-guardian",
+      guardianWritable: false,
+    });
+    expect(classifySettingsDestination("ai").kind).toBe("unavailable");
+    expect(classifySettingsDestination("dashboard").kind).toBe(
+      "adult-shared-unavailable",
+    );
+    expect(isGuardianSettingsWriteAllowed("account")).toBe(true);
+    expect(isGuardianSettingsWriteAllowed("notifications")).toBe(true);
+    expect(isGuardianSettingsWriteAllowed("integrations")).toBe(false);
+    expect(isGuardianSettingsWriteAllowed("ai")).toBe(false);
+  });
 });