test(macos): residual deadline and unclassified failures after the canonicalization fixes

[ScriptedAlchemy]

After the macOS-only fixes landed on PR #707 (4ec65ea projectless resolved roots, c31b086c8 bootstrap keys, 703d9d063 codex fixtures, non-UTF-8 probes ff17aba14/1650b56b9/0a091549c, d63f499a2 /dev/full probe, 6bcf1ad8e paging contract, bdefc4e45 /usr/bin/grep), two macOS-only families from run 33897253099 remain unaddressed:

Timing on the slower runner (4): daemon::tests::bootstrap::direct_tool_cache_miss_returns_warming_while_project_opens_in_background (bootstrap.rs:3279 Elapsed), analyzer_runtime.rs:87, controlled_invocation_tests.rs:974, activation_tests.rs:174 (did not reach phase … before deadline). Fix what stalls or move to the shared slow-runner budget; do not just raise deadlines.

Unclassified (4): mcp/server/rmcp.rs:946 (left: Null right: Bool(true)), background_refresh_writer_tests.rs:46 (retained background refresh graph is stale), tests/scheduler_config.rs:701, and the sessions backfill test non_utf8_canonical_worktree_resumes_exactly_then_fails_typed_publish (git_correlation/backfill/bounded/tests.rs:799) which still needs the runtime non-UTF-8 probe that 2551e5b added for the fixture.

Parsed failure sets are in the sweep artifacts; see #863 for the shared Linux+macOS set.

[ScriptedAlchemy]

macOS-only residual set, run 33978239206 (job 101338647437)

Method: took the final FAIL/TMT lines from the macOS job and subtracted the Linux job's (101338647423) set. 44 macOS failures, 28 shared with Linux (those belong to #863), 16 macOS-only. Grouped by root cause below. Linux per-test durations come from that run's nextest-junit-Linux artifact.

F1 — Fixture temp roots keep the /var symlink (6 tests) — fixed, 28ccccbe3

macOS puts TempDir under /var/folders/..., and /var is a symlink to /private/var. Production canonicalizes a project root before it hashes the code-index scope, keys the retained project graph, or decides whether an ignored dependency escaped the worktree — so a fixture handing out the symlinked spelling names a different project than the one the runtime mounted.

• code_index_scheduler::tests::a_same_content_successor_pointer_keeps_the_seated_generation_serving
• code_index_scheduler::tests::a_different_content_successor_pointer_refuses_the_stale_seat
  — both computed scoped_code_index_store_root from the symlinked root, so the pointer they rewrote sat under a different scope hash than the scheduler's (read active pointer: NotFound, tests.rs:7712).
• code_index_scheduler::activation_tests::cold_mount_defers_sealed_decode_and_truth_verification_to_the_retained_owner (activation_tests.rs:174) — published into that same divergent scoped store, so the mounted owner never found the sealed generation.
• daemon::code_index_ignored_dependencies_tests::cancellation_tests::admitted_source_read_observes_live_cancellation_between_chunks — refused IgnoredDependency(SymlinkEscape), because canonical_package_root compares a canonicalized package root against the caller's project root.
• mcp::server::rmcp::tests::rmcp_wire_matrix_matches_legacy_initialize_tools_and_resources (rmcp.rs:946, left: Null right: Bool(true)) — the fact-store list returned nothing to truncate, because the server had been handed a root the registered runtime had canonicalized.
• mcp::server::background_refresh_writer_tests::read_refresh_routes_through_the_freshness_probe_not_forced_reconcile (retained background refresh graph is stale) — same shared fixture, writer_test_support::init_indexed_repo.

Fix: each fixture now allocates its TempDir inside a canonicalized temp base, so every path taken from it is already canonical. Production is unchanged — it already canonicalizes, which is exactly why the fixtures had to.

F2 — Cold tiktoken BPE load eats the 1 s Scout deadline (2 tests) — fixed, 25d49d9a5

• agents::context_scout_model::tests::disconnected_backend_surfaces_disconnect_not_unavailable (left: Err(DeadlineExceeded) right: Err(Disconnected))
• agents::context_scout_model::tests::configured_model_measures_usage_when_backend_omits_token_counts

propose measures input tokens via o200k_base_singleton() before it races the backend against the deadline, so a slow first tokenizer build spends the whole 1 s budget and the already-elapsed sleep_until branch wins the select!. The Linux artifact proves the cost rather than the logic: these two no-I/O tests take 0.505 s and 0.657 s there.

That first load is the seconds-long unoptimized BPE build the root Cargo.toml already documents — but the opt-level = 2 override sat under perf only, and CI runs cargo nextest run --profile ci, a nextest profile that leaves the cargo profile at test. The gate never got it. Applied the same tiktoken-rs/regex opt-levels to dev and test. No deadline was raised.

F3 — yield_now() busy-spin polling on 2-worker runtimes (2 tests) — fixed, f9b13e190

• daemon::code_index_ignored_dependencies_tests::branch_publication_tests::branch_materialization_then_reconcile_and_restart_retains_the_exact_roster (background reconcile reaches expected state: Elapsed, 2.086 s on Linux against a 5 s wait)
• code_index_scheduler::tests::graph_decode_does_not_block_text_freshness (0.656 s on Linux)

Every readiness wait in these modules polled with tokio::task::yield_now(). These tests are worker_threads = 2, so a yield-only loop keeps one of the two workers permanently runnable and burns a core while several nextest processes already share a small machine — starving exactly the background reconcile / graph decode being waited on. Now sleeps 2 ms between polls; deadlines unchanged, and sibling loops in the same file already used tokio::time::sleep for this reason.

F4 — macOS refuses non-UTF-8 file names (1 test) — fixed, 445aa6904

runtime::git_correlation::backfill::bounded::native::resume::tests::non_utf8_local_ref_is_sealed_without_fabricated_branch_text (resume/tests.rs:293) asked git to create branch topic-\xff; APFS refuses that loose-ref name with EILSEQ, so assert!(output.status.success()) failed on a filesystem limit. Reuses the runtime probe 2551e5b added, rather than writing a third copy.

(The non_utf8_canonical_worktree_resumes_exactly_then_fails_typed_publish named in this issue is already covered by 2551e5b and no longer failing; this sibling was the one still missing the probe.)

F5 — seekdir-cookie directory paging (1 test) — already fixed by a peer lane, no action

tracedecay-maintenance retention::storage_report::tests::project_directory_pages_cover_every_entry_within_a_bounded_pass timed out at 360 s on both attempts and in both recent macOS runs; it takes 0.242 s on Linux, so this was a pathology, not a slow runner — the POSIX directory-offset cursor. The working tree already carries that lane's replacement (unregistered_page.rs rewritten to a name-ordered name-v3: cursor with a BinaryHeap page select). Nothing left for this issue.

F6 — LSP gateway authority unavailable (1 test) — belongs to #863

runtime_acceptance_suite::runtime_surface_acceptance::stdio_bridge_exits_successfully_after_client_shutdown_and_exit fails with graceful LSP exit must not fail explicit bridge detach: config error: LSP gateway authority is unavailable — the same error family as the Linux+macOS production_lsp_negotiates_and_projects_canonical_context failures. crates/tracedecay-lsp/src/gateway.rs is under active edit by another lane (47f8cb967 fix(lsp): admit root URIs without a local path conversion), so this is not a macOS-specific root cause.

---

Not fixed here — owned by crates/tracedecay/src/daemon/** (3 tests)

Left for the daemon lane; exact fixes below.

DuplicateProjectAuthority (2 tests) — the same F1 root, in daemon fixtures.

• daemon::retained_owner::memory_target::tests::selected_project_opens_its_exact_read_only_store_not_the_active_store (memory_target.rs:323) — project_pair() derives selected_id with default_profile_project_id(&selected_root) from the raw tempdir() path, while initialize_project_graph_for_test canonicalizes the same root, so the authority is registered under two spellings.
• daemon::scheduler::combined_effect::tests::partial_replay_reuses_prior_scheduler_skip_without_current_publication (combined_effect.rs:1259) — CombinedAdmissionFixture::new calls init_with_options(&project_root) with the raw temp path, then re-reads memory.project_root().canonicalize() at line 1173-1176; the later project_sessions(project_id, [project_root]) therefore registers the session authority against a root that disagrees with the one already registered.

Fix for both: allocate the fixture TempDir inside a canonicalized temp base (or canonicalize temp.path() once before deriving project_root/profile_root) so the pre- and post-canonicalization spellings agree. Same one-liner as 28ccccbe3.

Vector generation not installed (1 test).

• daemon::query_authority_provider::tests::activation_tests::committed_query_routes_install_and_rollback_as_one_revision (query_authority_provider_activation_tests.rs:183): left: None, right: Some(VectorGenerationIdV1(ManifestDigest("sha256:dddd…"))) — the committed revision did not install its vector generation. Not diagnosed here; needs the daemon lane.

---

Commits on codex/tracedecay-total-redesign-plan-reopened (not pushed): 28ccccbe3, f9b13e190, 445aa6904, 25d49d9a5.

[ScriptedAlchemy]

Linux verification result + one correction to the F3 claim above

F4 verified green. cargo test -p tracedecay-sessions --lib …native::resume → 13 passed, 0 failed, including non_utf8_local_ref_is_sealed_without_fabricated_branch_text. Linux accepts non-UTF-8 names, so this exercised the real assertion path, not the new skip branch — it validates both the probe reuse and the pub(in …bounded) visibility change.

F1 cannot be validated on Linux — it is a provable no-op here. TMPDIR is unset and /tmp is a real directory, so canonical_temp_root() returns /tmp and TempDir::new_in("/tmp") is behaviourally identical to TempDir::new(). The fix only changes anything where the temp base is a symlink, i.e. macOS. Its validation has to come from the next macOS CI run. Confirmed no regression: the old F1 panic sites (tests.rs:7712 "read active pointer", and any SymlinkEscape refusal) appear zero times in the Linux run.

tracedecay-code-index-runtime is currently red on Linux at HEAD — 59 failures — and it is not from these commits. cargo test -p tracedecay-code-index-runtime --lib code_index_scheduler → 250 passed, 59 failed (hauler cc-6158). Attribution:

• All 59 are timeouts with one signature — the registry never seats a serving generation: 31 at tests.rs:12126 ("live generation"), 5 at :12220 (changed generation published: Elapsed), 3 at :12148, 2 at :12105.
• The dominant site :12126 is inside wait_for_live_complete_generation, whose poll loop was already sleep(10 ms) before f9b13e190 — it is not in any hunk that commit touched. Same for :12220 and :12105. Only :12148 (3 of 59) sits in a converted loop, and it fails on a 5 s tokio::time::timeout, which a 2 ms sleep cannot cause.
• These tests were green in the Linux CI job of run 33978239206. The changes to this crate since are four commits in exactly the seating path those helpers poll: f24d5ebe3 (advance the latest id only from a seated generation), 76f06b616 (let a serving swap replace a superseded incumbent, Refs fix(code-index): ignored-dependency admission and roster tests converge to the wrong generation #902), 01289d1e9 (wake the successor of a refused source roster), 9ccd83660 (spell resolved paths plainly before they cross into git). The working tree was clean for this crate, so the build was exactly HEAD.

This is #902's active work area. Flagging it because the branch's next CI run will be red on Linux for this crate regardless of the macOS work.

Correction to F3 above. I attributed branch_materialization_then_reconcile_and_restart_retains_the_exact_roster to the yield_now() spin. #902 already lists that test as "intermittent in the same family" as its serving-convergence defect, so the spin is at best a contributing factor and not the established root cause — treat that one as #902's, not as fixed by f9b13e190. The spin removal stands on its own merits (a yield-only loop pins one of two workers), and the F3 reasoning for graph_decode_does_not_block_text_freshness was already flagged as a hypothesis; neither is confirmed while this crate is red.

Not yet run: -p tracedecay-agent-hosts --lib context_scout_model (F2 — Cargo.toml-only, no code risk) and -p tracedecay --lib mcp::server:: (F1's init_indexed_repo), the latter still blocked on a peer lane's daemon/invocation_tests/project_lifecycle_tests.rs not compiling.

[ScriptedAlchemy]

Landed on codex/tracedecay-total-redesign-plan-reopened: a677c5aed canonicalizes the four remaining daemon fixture roots (projectless symlink pin, memory_target read-only store, combined_effect partial replay, query_authority committed routes — all reproduced on Linux with a symlinked TMPDIR and fixed by reusing lifecycle_lease::canonical_or_original), 76bf976a4 makes corrupt_derived_graph_preserves_relational_owner_lifecycle await the derived-graph recovery instead of sampling the warm-up window. Verified: the four modules pass under both plain and symlinked TMPDIR; clippy -p tracedecay -p tracedecay-daemon-protocol clean. Still open, macOS-only: tracedecay-daemon-protocol controlled_invocation_tests::{remote_effect_cancel_delivery_failure_returns_reset_required, remote_effect_without_authoritative_settlement_returns_reset_required} (first accept() sees EOF before the handshake; hypothesis is start_paused auto-advance jumping the connect deadline, unconfirmed because a structurally identical test passes) and runtime_surface_acceptance::stdio_bridge_exits_successfully_after_client_shutdown_and_exit (LSP gateway authority unavailable, also flaky on Linux).