main is red: 10 refresh_worker_tests fail on the root-keyed lease enforcement

[iceteaSA]

main at 10e82eea fails the unit suite on all three platforms — Linux, macOS, and Cargo test (Windows). Run 31206122858.

Ten tests, all in callgraph_store::refresh_worker_tests:

bounded_shutdown_defers_unprocessed_batches
fenced_refresh_with_advanced_publish_epoch_defers_paths_without_commit
fenced_refresh_with_current_ticket_commits_normally
fenced_refresh_with_stale_lifecycle_generation_defers_paths_without_commit
manifest_event_rebuilds_workspace_prefix_cache_and_resolves_new_crate
queued_batches_for_one_root_coalesce_while_worker_is_busy
queued_refresh_opens_generation_published_after_enqueue
refresh_failure_marks_files_stale
refresh_worker_reuses_workspace_prefix_cache_for_one_root
superseded_open_failure_defers_without_self_replay

All ten die at the same place, with the same error:

panicked at crates/aft/src/callgraph_store/mod.rs:10712:10:
called `Result::unwrap()` on an `Err` value: Unavailable("cold build could not acquire writer capability")

Line 10712 is the .unwrap() on CallGraphStore::cold_build_with_lease(...) in the fixture helper those tests share. 6f5e64b4 (mason: enforce root-keyed cache leases) tightened lease acquisition; the fixture builds its store without whatever now establishes writer capability, so every test routing through the helper fails identically. One fixture, ten symptoms.

612aad2d and everything before it are green, so the window is the last two commits.

I hit this rebasing #152 onto 10e82eea and reproduced it locally — same ten names, same panic line. Flagging rather than fixing since the fix depends on which side you intend to be right: the fixture should acquire the capability the enforcement now demands, or cold_build_with_lease should still serve a fresh single-writer root. That's your call.

[iceteaSA]

The ten refresh_worker_tests failures are fixed — 73e867b2, c718f898, and 89f8d5ce between them fix the writer gate path aliases and register fixture writer capability. That part is closed from where I'm standing.

main is still red though, on a different failure. Latest completed run on 89f8d5ce fails the same three jobs (Linux, macOS, Cargo test Windows), now with exactly one test:

subc_bridge_test::subc_bridge_callgraph_maintenance_is_per_root ... FAILED
test result: FAILED. 0 passed; 1 failed; 1517 filtered out; finished in 90.69s

panicked at crates/aft/tests/integration/subc_bridge_test.rs:9043:5:
callgraph store did not become ready within 90s; last response:
  {"code": "callgraph_building",
   "message": "callers: callgraph store is building in the background; retry shortly"}
then: panicked at subc_bridge_test.rs:1483:17: fake daemon joins: Any { .. }

The store never leaves callgraph_building inside the 90s budget, so the readiness poll exhausts and the fake daemon join panics behind it. Given the commits in flight, a cold build that no longer completes — or no longer publishes — under the tightened lease/alias rules looks more likely than the timeout simply being too tight, but I haven't dug into which.

52b88520 is still in progress; I'll leave this open until a main run comes back green rather than guess whether that one covers it.

[iceteaSA]

Root-caused and fixed in #194.

configure_bridge_context never registered its root, so be76cf8b's fail-closed gate denied the callgraph writer lease and the store could never publish. Same class as the two fixtures you already fixed in c718f898 and 89f8d5ce.

Verified red → green → red → green: 0.72s patched, 90.44s reverted, 0.72s re-applied. The wall clock is the tell — the lease is granted rather than a race being won.