[#34] add negative tests for MediaPhotoDescribed invariants + media_type warning

Closes 3 flags from the verify round of the Phase B review pipeline:

- test_models.py: 3 negative tests pin the model-level invariants on
  MediaPhotoDescribed (UTC-aware described_at, SUPPORTED_LANGUAGES
  membership for description_lang, decorative => empty description).
- test_describe.py: 1 unit test pins _media_type's unknown-extension
  fallback to image/jpeg AND the operator-visible logger.warning, so
  a silent regression on either side is caught.

Test count: 502 -> 506. Quality gate green.

Author: VGonPa

tests/test_describe.py

@@ -1026,6 +1026,25 @@ def test_describe_all_sends_payload_with_expected_kwarg_shape(tmp_path: Path):
     assert "Describe images 0 through 1" in text_block["text"]
 
 
+def test_media_type_warns_on_unknown_extension(caplog):
+    """Unknown extensions fall back to image/jpeg AND emit a `logger.warning`.
+
+    The downloader only writes `.jpg`/`.jpeg`/`.png`/`.webp`, so an unknown
+    suffix means either a hand-edited `items.json` or a future format the
+    code does not register. The warning is the operator's only signal that
+    the wrong MIME type was sent to Anthropic — pin it so a silent fallback
+    cannot regress.
+    """
+    import logging
+
+    from xbrain.describe import _media_type
+
+    with caplog.at_level(logging.WARNING, logger="xbrain.describe"):
+        result = _media_type("123/0.gif")
+    assert result == "image/jpeg"
+    assert any("unknown extension" in rec.message.lower() for rec in caplog.records)
+
+
 # --------------------------------------------------------------------- refusal
 
 

tests/test_models.py

@@ -408,6 +408,93 @@ def test_media_photo_described_rejects_parent_traversal_local_path():
         )
 
 
+def test_media_photo_described_rejects_naive_described_at():
+    """`described_at` must be timezone-aware (UTC); a naive datetime is rejected.
+
+    The UTC-aware invariant is enforced by a field validator so a
+    hand-edited `items.json` entry cannot smuggle a local-time datetime
+    past the type boundary. Naive timestamps cause downstream UTC math
+    (eligibility checks, sort orders) to drift silently.
+    """
+    import pytest
+    from pydantic import ValidationError
+
+    from xbrain.models import MediaPhotoDescribed
+
+    with pytest.raises(ValidationError):
+        MediaPhotoDescribed(
+            url="https://pbs.twimg.com/media/X.jpg",
+            local_path="123/0.jpg",
+            width=10,
+            height=10,
+            bytes_size=100,
+            downloaded_at=datetime(2026, 5, 24, tzinfo=timezone.utc),
+            is_decorative=False,
+            description="hello",
+            description_lang="English",
+            description_version="v1",
+            described_at=datetime(2026, 5, 24),  # naive — must fail
+        )
+
+
+def test_media_photo_described_rejects_unsupported_description_lang():
+    """`description_lang` must be in `SUPPORTED_LANGUAGES`; others are rejected.
+
+    The type alias is derived from `i18n.SUPPORTED_LANGUAGES` so the
+    `Literal[...]` validator rejects unknown languages at construction.
+    Prevents an out-of-band language tag from polluting the vault.
+    """
+    import pytest
+    from pydantic import ValidationError
+
+    from xbrain.models import MediaPhotoDescribed
+
+    with pytest.raises(ValidationError):
+        MediaPhotoDescribed(
+            url="https://pbs.twimg.com/media/X.jpg",
+            local_path="123/0.jpg",
+            width=10,
+            height=10,
+            bytes_size=100,
+            downloaded_at=datetime(2026, 5, 24, tzinfo=timezone.utc),
+            is_decorative=False,
+            description="hello",
+            description_lang="Klingon",  # not in SUPPORTED_LANGUAGES
+            description_version="v1",
+            described_at=datetime(2026, 5, 24, tzinfo=timezone.utc),
+        )
+
+
+def test_media_photo_described_rejects_decorative_with_nonempty_description():
+    """`is_decorative=True` implies `description == ""` — model-validator enforces.
+
+    Defence-in-depth for hand-edited records: the producer
+    (`describe._apply_judgment`) already blanks the description on
+    decorative judgments, but a hand-written entry that violates the
+    invariant must still be rejected at the type boundary so downstream
+    callers can rely on `is_decorative => not description` unconditionally.
+    """
+    import pytest
+    from pydantic import ValidationError
+
+    from xbrain.models import MediaPhotoDescribed
+
+    with pytest.raises(ValidationError):
+        MediaPhotoDescribed(
+            url="https://pbs.twimg.com/media/X.jpg",
+            local_path="123/0.jpg",
+            width=10,
+            height=10,
+            bytes_size=100,
+            downloaded_at=datetime(2026, 5, 24, tzinfo=timezone.utc),
+            is_decorative=True,
+            description="should be empty when decorative",  # violates invariant
+            description_lang="English",
+            description_version="v1",
+            described_at=datetime(2026, 5, 24, tzinfo=timezone.utc),
+        )
+
+
 def test_media_discriminator_rejects_unknown_kind():
     """Silently inventing a variant would mask data corruption — reject loudly."""
     import pytest