test: register fixture writer capability in subc bridge tests

[iceteaSA]

Fixes the last failure keeping main red (#193). Same class and same fix as c718f898 and 89f8d5ce — one more fixture that never registered its root.

configure_bridge_context in subc_bridge_test.rs is the tests' stand-in for configure. It sets the config, the canonical cache root, and the cache role, but never calls configure_artifact_access the way real configure does at commands/configure.rs:2225-2229. That was harmless until be76cf8b made unregistered roots fail closed: ArtifactAccess::for_root now defaults to borrow-only and writer-shaped cold-build paths return Unavailable rather than falling back to a borrower.

So ensure_built_with_lease_chunked never gets a lease, the background ensure settles without publishing, .current is never written, and every retry comes back callgraph_building until the 90s poll gives up:

panicked at crates/aft/tests/integration/subc_bridge_test.rs:9043:5:
callgraph store did not become ready within 90s; last response:
  {"code": "callgraph_building",
   "message": "callers: callgraph store is building in the background; retry shortly"}

The fake daemon joins panic at :1483 is the daemon thread joining on the already-panicked poller, not a second fault.

Verification

Red → green → red → green on the targeted test, so the pass isn't a flake getting lucky:

	result	wall clock
patched	1 passed; 0 failed	0.72s
reverted	0 passed; 1 failed	90.44s
re-applied	1 passed; 0 failed	0.72s

The 0.72s is the useful number. The lease is granted and the store publishes immediately, rather than the poll happening to win a race — a timing fix would still take most of the budget.

I also checked the rest of the file for the same omission: configure_bridge_context is the only helper touching set_cache_role / set_canonical_cache_root without a registration, and it has a single call site.

Not timing and not a product defect. The lease is denied before any build or publication begins, and production configure registers correctly — this is only the fixture drifting behind the new gate.

Ran the full integration binary too. Beyond the two sandbox tests that fail on my box for local PATH reasons, I get 24 callgraph_test::* failures reporting callgraph_unavailable — those are an artifact of my running from a linked worktree (.git/worktrees/...), not from this change; configure_bridge_context is defined and called only in subc_bridge_test.rs, so it can't reach them. They should not appear on a normal checkout, but flagging it so the result isn't a surprise if you see it.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Register the writer capability for the callgraph test cache root in subc_bridge_test.rs, matching production. Canonicalize the root and call aft::root_cache::configure_artifact_access so cold builds get a lease, publish immediately, and the callgraph_building retries go away.

Also regenerates the v0.49 agent-surface manifest and legacy vocabulary allowlist to update the source commit and hashes.

^{Written for commit 4ba673f. Summary will update on new commits.}

Greptile Summary

The PR registers writer capability for the temporary callgraph root used by the subc bridge fixture, aligning the test setup with production configuration.

• Canonicalizes and registers the fixture’s callgraph cache root before transport timing begins.
• Regenerates agent-surface provenance metadata and adjusts legacy-vocabulary allowlist locations for the inserted lines.

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
crates/aft/tests/integration/subc_bridge_test.rs	Registers artifact writer access for the fixture’s unique temporary callgraph root so cold builds can acquire a lease and publish.
docs/v0.49-agent-surface-manifest.json	Updates generated source-commit provenance and the changed allowlist artifact hash.
docs/v0.49-legacy-vocabulary-allowlist.json	Shifts recorded source locations by eight lines to reflect the fixture setup addition.

_{Reviews (3): Last reviewed commit: "test: register fixture writer capability..." | Re-trigger Greptile}

[cubic-dev-ai]

No issues found across 1 file

_{Re-trigger cubic}

[iceteaSA]

Pushed a manifest refresh — the two red jobs were my omission, not the fix.

The legacy-vocabulary allowlist pins occurrences by file:line:col, so inserting 7 lines at ~668 shifted every allowlisted filePath below it in that file:

error: legacy vocabulary audit failed:
crates/aft/tests/integration/subc_bridge_test.rs:5964:18:filePath is not allowlisted
…

Regenerated with --write-allowlist --write-manifest, following 10e82eea. The diff is only the shift:

• allowlist: 678 entries before, 678 after; the 16 subc_bridge_test.rs coordinates all move exactly +7, columns unchanged, the other 662 entries byte-identical
• surface manifest: 22 artifacts, exactly one changed pin (LIST-V049-LEGACY-VOCABULARY-001), plus source_commit

One thing I deliberately left out. Running the regeneration with --write-prefix-capture also rewrote docs/v0.49-agent-prefix-capture.json with my machine's state — opencode host_version 1.18.3 → 1.18.11, and pi's recorded version to null with "method": "pi --version (not available in capture environment)" since pi isn't installed here. That's my environment, not a manifest refresh, so I reverted it and re-ran without the flag. The prefix-capture pin is unchanged from your committed bytes. Worth knowing that flag captures the local box if a contributor reaches for it.

bun scripts/audit-v049-agent-surface.ts passes, and the target test still passes in 0.91s.

[iceteaSA]

Hold off merging this — the patch has a side effect I hadn't accounted for, and it's mine, not a flake.

Unit / Cargo test (Windows) now fails a different test in the same file:

subc_bridge_test::subc_bridge_routebind_ack_is_prioritized_over_reliable_flood ... FAILED
panicked at subc_bridge_test.rs:4315:17:
  RouteBindAck waited behind 799 reliable Push frames after configure finished

I pulled that test's Windows result across the last ten runs:

sha	routebind test
3ac5c3b8 (this PR)	FAILED
29fa3f73 (this PR, before the manifest refresh)	FAILED
52b88520 … 199e29d9 (8 upstream runs)	passed

2/2 on mine, 0/8 on yours. On 52b88520 it explicitly passed on Windows while the callgraph test failed — so it isn't pre-existing and it isn't the runner.

Working hypothesis, not yet confirmed: configure_bridge_context is the shared fake-configure for every test in the file. Before the patch the writer lease was always denied, so callgraph work died instantly and did nothing. Granting the capability means a real cold build can now run during configure for every test in that file — plausibly enough work to push the RouteBindAck behind the flood, and Windows-only because its filesystem is slower.

If that holds, the question is whether to scope the registration to the one test that needs it, or whether the routebind assertion was calibrated against a configure that did nothing — in which case the more interesting possibility is that a real prioritization weakness under load was previously masked. I don't want to guess between those on your repo, so I'm digging before I push anything else.

I can't reproduce it locally (Linux), so I'm working from the code and will be explicit about what's inference. Will report back either way — if it turns out the right fix is narrower, I'll push that; if it points at something in the product, you'll want to know regardless of this PR.

[iceteaSA]

Root-caused, and it's narrower than I feared — no product defect, and my callgraph guess was wrong.

The routebind test disables the callgraph store (callgraph_store: false, search_index: false, semantic_search: false) and never issues a callgraph command, so no cold build happens there. What my patch actually added is artifact_cache_key(&canonical_root), which shells out to git rev-list --max-parents=0 HEAD. That subprocess runs inside configure_bridge_context — which executes after slow_configure_finished is set and before route-bind completion reaches the subc loop.

Which is exactly the window 9bf92bd rebased the bound to exclude:

Counting from the finished flag measures only loop-owned latency (completion handoff, pre-turn bind drain, writer-queue FIFO), which is the priority mechanism the bound exists to verify.

So this is a measurement-boundary regression against that stated invariant, not a starvation defect. The ack hasn't been generated yet when the 799 frames are counted — the priority mechanism never gets a chance to fail. And given 7867d71 already widened the slack once for contended runners, widening it again would be the wrong move: it would absorb real non-loop work into a bound that exists to measure loop-owned latency only.

Fixing it by keeping the registration out of the timed window rather than by touching the bound or the marker. Will push once the full integration binary is green locally — running the whole binary this time, not just the target test, since a shared fixture is exactly where that shortcut bites.

To be explicit about the limits: I'm on Linux and the failure is Windows-only, so nothing I run locally can prove it fixed. Your CI is the oracle. The Linux runs only establish non-regression.

[iceteaSA]

Pushed the narrower fix. The registration now happens in SubcBridgeTestRoots::new, scoped to callgraph_root, at temp-root construction — before any transport timing starts:

let canonical_callgraph_root = std::fs::canonicalize(callgraph_root.path())
    .unwrap_or_else(|_| callgraph_root.path().to_path_buf());
// Register the fixture's writer capability before transport timing begins.
aft::root_cache::configure_artifact_access(
    &canonical_callgraph_root,
    &aft::search_index::artifact_cache_key(&canonical_callgraph_root),
    false,
);

and it's gone from configure_bridge_context. Nothing is added after the configure-finished flag, so 9bf92bd's invariant holds — the bound still measures only loop-owned latency, and I didn't touch the bound or the marker. It also leaves slow_configure_finished alone, which other tests use as the slow-gate release signal.

Two alternatives I rejected. Moving the routebind test's completion marker would work but changes measurement semantics other tests depend on, for a problem my patch introduced. Substituting a cheaper key to dodge the git subprocess would let the fixture register a different key than production computes — granting capability for the wrong root and masking future breakage. The fixture should use production's real key; it just shouldn't compute it inside a timed path.

Local, on Linux:

callgraph maintenance test:  1 passed, 0.73s
routebind priority test:     1 passed, 0.22s
full integration binary:     1486 passed, 26 failed
audit:                       v0.49 agent surface audit passed

Ran the whole binary this time rather than just the target — a shared fixture is exactly where that shortcut bites, as this round demonstrated. The 26 are the two sandbox_native_test failures from /home/linuxbrew on my PATH plus 24 callgraph_test::* callgraph_unavailable from running in a linked worktree; both sets are unrelated to the patch and present before it.

Manifests regenerated again since the line count shifted by 1: allowlist still 678 entries, the 16 subc_bridge_test.rs coordinates all move by exactly +1, the other 662 byte-identical, one surface-manifest pin changed, prefix-capture untouched.

Standing caveat: I'm on Linux and the failure is Windows-only. Removing the git probe from the timed window addresses the mechanism structurally, but only your CI can confirm it.

[iceteaSA]

Green — 14/14. Both tests pass on the Windows job that was the oracle here:

PASS [1.215s] subc_bridge_test::subc_bridge_callgraph_maintenance_is_per_root
PASS [0.479s] subc_bridge_test::subc_bridge_routebind_ack_is_prioritized_over_reliable_flood

The one I couldn't verify locally is confirmed: hoisting the registration out of the configure path fixed the routebind regression, and the callgraph test still gets its writer capability.

Ready to merge whenever you are. It should take main green again — that test was the last thing failing there.