Re-arm Elixir test gate: root-cause `mix test --no-start` full-app-boot failure (burble#35 item 2)

[hyperpolymath]

Sub-issue of #35 (item 2). Tracks the blocked work: root-cause and fix the Test (OTP 27 / Elixir 1.17) failure so the gate can be re-armed. Do not remove continue-on-error until the suite is green on main.

Root-cause lead (evidence gathered 2026-05-17)

The failure is almost certainly a full-app-boot failure under mix test --no-start, not individual assertions:

1. Justfile:245 → cd server && mix test --no-start.
2. server/test/test_helper.exs → Application.ensure_all_started(:burble) (manually boots the whole app because --no-start suppressed the automatic start).
3. server/lib/burble/application.ex start/2 has no test-env guard — it unconditionally boots the full production supervision tree: Burble.Store (VeriSimDB @ http://localhost:8081), Burble.Transport.RTSP (TCP 8554), Burble.Bolt.Listener (UDP 7373), Burble.LLM.Supervisor (QUIC 8503 via :quicer/msquic NIF), Burble.Media.Engine, Zig coprocessor NIF (server/priv/libburble_coprocessor.so).
4. config/test.exs only sets Endpoint server: false; it does not disable Burble.Store or the network/NIF children.
5. In CI none of these externals exist: VeriSimDB is not running on :8081, the Zig FFI .so may be absent (the "Build Zig FFI" step is itself continue-on-error, so a failed build silently yields no .so), and the quicer NIF/msquic may be unavailable.

⇒ The first hard-crashing child collapses Burble.Supervisor; ensure_all_started(:burble) returns {:error, …}; every test fails at startup — exactly the predicted mode.

(Local repro on this machine is non-authoritative: toolchain is Elixir 1.18.4/OTP 25 vs CI 1.17/OTP 27, and a separate Guardian.Plug.Pipeline compile error blocks local boot. Confirming which child crashes first still needs the blocking prerequisite below.)

Blocking prerequisite (unchanged from #35)

ONE of: widen cloud-sandbox allowlist to repo.hex.pm + builds.hex.pm; or an actions:read token / Actions-logs MCP tool; or paste the failing ** ( / N) test … failed block.

Remediation directions (decide once root cause confirmed)

• A. Test-env start path: filter Burble.Application children via Application.compile_env(:burble, :start_children) so test boots only the minimal set (PubSub/registries/store-stub), excluding network listeners + external-dep children.
• B. Drop --no-start; disable heavy children via config/test.exs flags the supervisor honours.
• C. Build the Zig coprocessor .so before tests and re-arm the FFI gate (the FFI continue-on-error is part of the failure surface).

Acceptance criteria (from #35)

• just test-server passes on main for OTP 27 / Elixir 1.17
• continue-on-error: true removed from "Run server tests"; a planted failing test turns CI red
• "GATE DEACTIVATED" comment removed with it
• Consider gating dialyzer (it needs: test) and re-arming the "Build Zig FFI" gate

Refs #35

[hyperpolymath]

Root cause found — the static lead in the issue body was WRONG

Pulled the actual Test (OTP 27 / Elixir 1.17) run log (CI-logs unblock path). The failure is not app-boot under mix test --no-start:

##[group]Run just test-server
error: Unknown start of token:
   |
11 | import? "contractile.just"
   |       ^
##[error]Process completed with exit code 1.

just test-server aborts at the Justfile's import? (optional import, just ≥ 1.19.0). The workflow's unversioned tool: just resolves via taiki-e/install-action@v2.9.4's bundled manifest → just 1.14.0, which predates import?. mix test --no-start never ran — the suite was never actually executing, which is why it appeared "red for a pre-existing reason." The Application.ensure_all_started(:burble) / NIF / app-boot hypothesis is moot until just runs at all.

Fix: PR #40 — pin tool: just@1.34.0. Does not remove continue-on-error (per #35/#39, gate is re-armed only after the suite is confirmed green on main with just actually running). Once #40 merges, the genuine mix test --no-start result becomes visible and this issue proceeds on evidence: green → re-arm the gate; or a real, evidence-based test fix.

[hyperpolymath]

Static root-cause confirmation (CI-independent; pending real-log verification)

With the just@1.34.0 pin (PR #40) mix test --no-start will now actually
execute for the first time. Static analysis pins the exact failure it will
hit — and it is precisely the original #39 lead (the #40 fix addressed why
the suite never ran, not whether it passes once it does):

Failure chain, line-pinned:

1. Justfile:245 → cd server && mix test --no-start
2. server/test/test_helper.exs:3 → Application.ensure_all_started(:burble)
   — return value is ignored (no {:ok, _} / {:error, _} match)
3. server/lib/burble/application.ex start/2 — no test-env guard;
   Burble.Store is the first child; strategy: :one_for_one
4. server/lib/burble/store.ex:224-259 init/1:
   • await_verisimdb(client, @health_check_max_attempts=5, 1_000)
   • VeriSimDB is not running on :8081 in CI (config/test.exs
     points Burble.Store at http://localhost:8081, auth: :none)
   • 5 attempts with backoff → {:error, :unreachable} →
     {:stop, :verisimdb_unreachable} (store.ex:259)
5. First permanent child {:stop, …} during Supervisor.start_link →
   whole supervisor start aborts → ensure_all_started/1 returns
   {:error, …} → app, Store, registries, BurbleWeb.Endpoint all down
6. test_helper.exs ignores that error → ExUnit runs with no app
   started → every app-dependent test fails. Suite RED (and ~30s
   slower from the health-check backoff).

config/test.exs only sets Endpoint server: false; it does not
disable Burble.Store or the network/NIF children — confirming the gap.

⇒ The continue-on-error: true on "Run server tests" must stay until
this is fixed; re-arming now would redden main on the first real run.

Per-#40 discipline: a confident static lead was wrong about the
primary cause there, so the remediation PR still waits on the actual CI
log to confirm which child stops first. Watcher is on the latest main
Elixir CI run (currently queued on GitHub's runner backlog).

Remediation recommendation (decide once CI confirms): direction A
is cleanest — gate Burble.Application children via
Application.compile_env(:burble, :start_children), with config/test.exs
selecting a minimal set (PubSub + registries + dynamic supervisors + ETS
stores), excluding Burble.Store/BackupScheduler/Media.Engine/RTSP/
LLM.Supervisor/Bolt.Listener/Endpoint, plus a test Store stub for
suites that exercise the data layer. Direction C (build the Zig .so

• re-arm the FFI gate) is complementary, not a substitute — Burble.Store
  is the hard blocker regardless of the NIF.

Refs #35

[hyperpolymath]

Cross-ref: the generalised lesson from this root cause is now institutionalised estate-wide — see hyperpolymath/standards#95 (Tooling Version Integrity rollout) and the policy in hyperpolymath/standards#94. This issue (final Elixir gate re-arm) remains tracked there under the burble#35 item-2 handoff; it stays blocked on the queued CI signal, watcher live. No change to the re-arm discipline: confirm green before removing continue-on-error.