Ignore the test database and record the abstention trap

[silverbackdan]

Two pieces of housekeeping, neither touching behaviour.

tests/Functional/app/db.sqlite was not ignored

It is created by the test setup this repo documents:

php tests/Functional/app/bin/console -e test doctrine:database:create

So anyone following the README ends up with an untracked binary in their working tree, and a git add -A commits it. It has never been committed, which is luck rather than design — it came close twice today, and both times only because workers were told to stage explicitly.

Abstention has caused four bugs, and they are one rule

Each was recorded separately as its own war story. They are the same mistake:

• RouteVoter::supports() returned false when route_security was unconfigured, so every voter abstained and AffirmativeStrategy::decide() denied via allowIfAllAbstainDecisions (default false) — every routed page 401 for everyone, silently (Feature: Route-level live / scheduled publication date #224)
• ComponentVoter returned true when all three sub-votes abstained, so a component in a page nothing routes to was public (Nested child page whose parent has no Route: the parent is invisible to the public (voter chain ignores parentPage/parentPageData) #225)
• SiteConfigParameterVoter::supports() requires an instance, and a plain security: on a Post runs before denormalization with no object — so every voter abstains and the write is denied, admins included. securityPostDenormalize: is required (Purge rendered HTML when a site-wide resource changes (front-end cache tag, no new endpoint) #232)
• voteByPageTemplate abstains only when a Page has no page data at all, which is why a routeless template page was already protected while a routeless plain page leaked its components — the two shapes are not interchangeable in a regression test (Nested child page whose parent has no Route: the parent is invisible to the public (voter chain ignores parentPage/parentPageData) #225)

Consolidated into a Working Principles entry, because the pattern is what generalises, not the four instances:

Abstention is a decision, not a neutral one. Before relying on a voter, state what happens when it abstains and write the scenario that pins it. supports() returning false is abstention, not denial — the most common way to get this wrong is to put a configuration check there.

Two of those four bit this week. Recording it as a rule rather than as history is the point.

🤖 Generated with Claude Code

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.81%. Comparing base (12d5f2f) to head (8240323).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff            @@
##               main     #241   +/-   ##
=========================================
  Coverage     87.81%   87.81%           
  Complexity     2665     2665           
=========================================
  Files           258      258           
  Lines          7730     7730           
=========================================
  Hits           6788     6788           
  Misses          942      942           

Flag	Coverage Δ
behat	68.84% <ø> (ø)
phpunit	35.09% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.