test: serialize cap_gate counter tests against each other (#131)

[Abdk4Moura]

Summary

Make capability::tests::shadow_detector_proof_six_buckets (and every other test that touches the process-global counters) immune to concurrent interleaving, by serializing them on a shared test-only mutex. Production code untouched.

Why it is not hygiene

The test snapshots six process-global atomic counters, calls cap_gate_effective, and asserts on DELTAS. cargo test runs tests in parallel; any concurrent test touching the same counters between the snapshot and the call breaks the delta. This test went RED on PR #143, a CHANGELOG-ONLY diff, against a main that was green minutes earlier. A flaky test invites a retry; a test that failed on a docs-only PR is a real race.

The race, reproduced without the lock

Baseline (this branch with the lock removed), 60 runs of capability::tests --test-threads=4:

shadow_detector_proof_six_buckets FAILED on iterations 22 and 41
panicked at src/capability.rs:937/938  assertion `left == right` failed
2/60

With the lock, same 60 runs:

0/60 failures

The fix

A single CAP_GATE_TEST_LOCK declared inside #[cfg(test)] mod tests. All 11 test functions that call cap_gate_effective acquire it (2 revoke, per-action bucket, six-bucket proof, 7 fleet gates). The six-bucket proof holds it across every snapshot/call pair. A panic while holding poisons the mutex, so subsequent tests fail loudly rather than silently interleaving.

Verification

• cargo test --profile measure capability::tests: 20 passed (all module tests, includes the 11)
• A/B above: 2/60 red without, 0/60 with
• git diff --check clean
• Production cap_gate_effective unchanged; the lock and its guard are cfg(test) only

Note: this PR cannot merge while GitHub Actions is down (no checks can run); pushing and holding as directed.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	filament	1f5612d	Commit Preview URL Branch Preview URL	Aug 06 2026, 08:47 PM