[lidge-jun]

Carries the remaining commit from #6723 (rest landed via #6796/#6797, CI part in #6806).

Summary

• Source commit: 39663ff31010dd1c1661f6dc005fd6ac6f36cf89 (fix(test): preserve file IDs and settle Windows fixture owners, mashfromband, 2026-10-09 23:47 +0900).
• The BigInt dev/ino comparison in src/claude/intercept/picker-ca-persistence.ts is already on dev via fix(claude): compare picker metadata file identity with BigInt stats #6772 (c8108ef4c). This carry keeps that implementation, including its comment, and records the same contract in structure/clients/claude-desktop.md.
• Log-cursor admission cases move from tests/server/server-management-auth.test.ts into tests/server/server-management-log-admission.test.ts, registered in both layout maps. Teardown uses the current drainAndRemoveFixtureRoots helper so history close and ACL drain stay in the order dev already uses.
• tests/server/server-new-model-policy-arrival.test.ts waits for native-main release, config-dir hardening, and Windows ACL reaps before removing its fixture root.
• The new layout entry shares a line with the management-auth entry so scripts/test-layout/layout.json stays at 1999 lines (the file-size ratchet fails a new 2000-line file).
• Not carried: the diagnostic-crate hunks in that commit (scripts/diagnostics/windows-version-control/README.md and tests/async_contracts.rs, including picker_metadata_identity_preserves_full_width_file_ids). Those files are not on dev; the crate is open draft ci: add portable catalog async contracts and a Windows liveness diagnostic #6806, whose head does not yet contain that picker contract. Earlier fix(runtime): keep catalog probes async and release aborted budgets #6723 diffs against current dev (catalog probes, ACL ownership, translator budgets) are the landed fix(runtime): keep catalog probes async and release aborted translator budgets #6796/fix(test): drain ACL work and close history before Windows fixture removal #6797 formulations; replaying the PR copies would regress newer subprocess and removal-identity code. Cold-spawn attribution and the Rust workflow stay with ci: add portable catalog async contracts and a Windows liveness diagnostic #6806.

Verification

• bun test tests/server/server-management-log-admission.test.ts tests/server/server-new-model-policy-arrival.test.ts tests/server/server-management-auth.test.ts — 53 pass, 0 fail (Bun 1.4.0, the pinned test runner).
• bun test tests/test-layout.test.ts tests/test-layout-tooling.test.ts — 19 pass, 0 fail.
• bun run typecheck — pass (Bun 1.4.2).
• bun run structure:check — pass.
• bun run privacy:scan — pass.
• bun scripts/file-size-ratchet.ts — pass after the layout line fold.
• Full bun run test was not run locally. On head 490bbab24, Cross-platform CI passed, including all four test shards, all nine Windows shards, gates, structure gate, docker smoke, storage policy, and api usage.
• The enforce-target job on that head was cancelled before it started: two pull_request_target events landed in the same second and the concurrency group pr-gate-comment-6847 dropped both. This description edit is the revalidation.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

  

Summary by CodeRabbit

• Tests
  • Added isolated coverage for log-management admission, including authentication, origin checks, malformed cursors, and unavailable management authority.
  • Updated test grouping and ensured asynchronous cleanup completes before temporary test files are removed.
• Documentation
  • Clarified that picker CA persistence compares device and inode identifiers using full-precision values.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Repository: lidge-jun/opencodex/.coderabbit.yaml
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: dc700dfc-e0a1-42a6-8231-13ce9725122b

---

📥 Commits

Reviewing files that changed from the base of the PR and between d17a9f2 and 490bbab.

---

📒 Files selected for processing (6)

• scripts/test-layout/layout.json
• structure/clients/claude-desktop.md
• tests/fixtures/test-layout-expected.json
• tests/server/server-management-auth.test.ts
• tests/server/server-management-log-admission.test.ts
• tests/server/server-new-model-policy-arrival.test.ts

---

💤 Files with no reviewable changes (1)

• tests/server/server-management-auth.test.ts

---

Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

---

📝 Walkthrough

Walkthrough

The pull request adds dedicated /api/logs admission tests and updates their server test-layout mappings. It also extends test teardown cleanup and clarifies picker CA device and inode identity comparisons in the documentation.

Changes

Log Admission Tests

Layer / File(s)	Summary
Isolated log-admission coverage tests/server/server-management-log-admission.test.ts, tests/server/server-management-auth.test.ts, scripts/test-layout/layout.json, tests/fixtures/test-layout-expected.json	The dedicated test file checks authentication and origin admission, cursor responses, and unavailable management authority. It isolates test setup and cleanup. The corresponding tests are removed from the authentication test file, and both test-layout mappings include the new test. (New test: lines 1–112; removed tests: pre-image lines 1838–1896.)

Test Cleanup

Layer / File(s)	Summary
Await cleanup helpers tests/server/server-new-model-policy-arrival.test.ts	The test imports cleanup helpers for config-directory hardening, native main startup releases, and Windows secret ACL reaps. Teardown awaits these helpers before removing the temporary home. (Lines 4–6, 34–36.)

Picker CA Documentation

Layer / File(s)	Summary
Document bigint identity comparisons structure/clients/claude-desktop.md	The picker CA persistence documentation specifies bigint device and inode comparisons to avoid numeric-rounding aliasing of distinct full-width file IDs. (Lines 253–254.)

Priority: ⬇️ Low

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Other

---

Merge Risk: ⚪ Minimal · up to 490bb

This PR moves log-admission tests, extends test cleanup, and clarifies documentation. It does not change production behavior, and no merge-blocking risk was found.

Pre-merge checks | 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly identifies the two main changes: picker CA persistence documentation and log-admission test updates. It is specific and related to the pull request.
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 2…
Linked Issues check		Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check		Check skipped because no linked issues were found for this pull request.

---

---

✨ Finishing Touches

📝 Generate docstrings

• Commit to this branch
• Create a new PR

---

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

---

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-09T21:00:11.031618Z	490bbab	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.