Feature: BaseResourceHandler uncovered lines coverage (r3)
  Exercises uncovered code paths in _base.py: resolve RuntimeError,
  _require_location ValueError, CRUD NotImplementedError defaults
  (delete, list_children, diff, discover_children), create_sandbox
  RuntimeError, and project_access ImportError / ValueError branches.

  # ============================================================
  # resolve() — RuntimeError when sandbox.context is None (L132-134)
  # ============================================================

  Scenario: rhbcov resolve raises RuntimeError when sandbox context is None
    Given rhbcov a database handler with a located resource
    And rhbcov a mock sandbox manager returning context-less sandbox
    When rhbcov I call resolve on the handler
    Then rhbcov a RuntimeError should be stored containing "has no context"

  # ============================================================
  # _require_location() — ValueError for missing location (L159-160)
  # ============================================================

  Scenario: rhbcov _require_location raises ValueError for resource without location
    Given rhbcov a database handler with a locationless resource
    When rhbcov I call _require_location on the handler
    Then rhbcov a ValueError should be stored containing "has no location"

  # ============================================================
  # CRUD NotImplementedError defaults (L224-265)
  # ============================================================

  Scenario: rhbcov base handler delete raises NotImplementedError
    Given rhbcov a database handler with a located resource
    When rhbcov I call delete on the base handler
    Then rhbcov a NotImplementedError should be stored containing "delete"

  Scenario: rhbcov base handler list_children raises NotImplementedError
    Given rhbcov a database handler with a located resource
    When rhbcov I call list_children on the base handler
    Then rhbcov a NotImplementedError should be stored containing "list_children"

  Scenario: rhbcov base handler diff raises NotImplementedError
    Given rhbcov a database handler with a located resource
    When rhbcov I call diff on the base handler
    Then rhbcov a NotImplementedError should be stored containing "diff"

  Scenario: rhbcov base handler discover_children raises NotImplementedError
    Given rhbcov a database handler with a located resource
    When rhbcov I call discover_children on the base handler
    Then rhbcov a NotImplementedError should be stored containing "discover_children"

  # ============================================================
  # create_sandbox() — RuntimeError when context is None (L305-307)
  # ============================================================

  Scenario: rhbcov create_sandbox raises RuntimeError when sandbox context is None
    Given rhbcov a database handler with a located resource
    And rhbcov a mock sandbox manager returning no existing sandbox and context-less new sandbox
    When rhbcov I call create_sandbox on the handler
    Then rhbcov a RuntimeError should be stored containing "has no context"

  # ============================================================
  # project_access — ImportError fallback (L376-382)
  # ============================================================

  Scenario: rhbcov project_access returns local mode on ImportError
    Given rhbcov a database handler with a located resource
    And rhbcov the permission service import is patched to raise ImportError
    When rhbcov I call project_access with principal "agent-1" and action "read"
    Then rhbcov the access result should be permitted
    And rhbcov the access result reason should contain "Local mode"

  # ============================================================
  # project_access — ValueError for invalid action (L384, L386-391)
  # ============================================================

  Scenario: rhbcov project_access returns not permitted for invalid action
    Given rhbcov a database handler with a located resource
    And rhbcov the permission service is patched to raise ValueError on action
    When rhbcov I call project_access with principal "agent-2" and action "invalid_action_xyz"
    Then rhbcov the access result should not be permitted
    And rhbcov the access result reason should contain "Invalid action"