test: close three coverage gaps the post-merge audit found mutation-surviving

All three guard real behavior that no test actually pinned:

- antigravity canonicalization: removing MAX_CANONICAL_DEPTH left all 34 tests
  green. Byte and key budgets do not bound recursion — a deeply nested argument
  is tiny on the wire — so without the cap a replay observation throws RangeError
  instead of skipping. Depth 120 canonicalizes, 200 and 50k refuse with null.
- scheduler settle predicate: the end-to-end unknown-SCM test sets taskInstalled
  and registrationHealthy true, so its final clause is already false and deleting
  the nativeServiceAbsent guard left it green. schedulerVerificationMaySettle is
  now exercised directly against a transient-looking tail, one unproven flag at a
  time, and goes red when that guard is removed.
- ephemeral ACL memo release: the test inherited USERNAME from an earlier block's
  `??=`, which never restores it, so running it alone or in another order failed
  before reaching the memo behavior. It sets and restores its own environment now.

Author: lidge-jun

tests/google-antigravity-replay.test.ts

@@ -413,6 +413,25 @@ describe("antigravity replay fixed-size key identities", () => {
     expect(antigravityCanonicalJsonBoundedForTests({ a: [1, "x"] }, 1024)).toBe('{"a":[1,"x"]}');
   });
 
+  test("pathological nesting is refused by the depth cap, not by a stack overflow", () => {
+    // The byte and key budgets do not bound RECURSION: a deeply nested argument
+    // shape is tiny on the wire. Without the depth cap this walk exhausts the
+    // stack and throws RangeError out of a replay observation, which is a crash
+    // path rather than a skipped replay. Removing MAX_CANONICAL_DEPTH left every
+    // other antigravity test green, so this is the only case that pins it.
+    const nest = (levels: number): unknown => {
+      let value: unknown = 1;
+      for (let i = 0; i < levels; i++) value = { n: value };
+      return value;
+    };
+
+    // Comfortably inside the cap: canonicalizes normally.
+    expect(antigravityCanonicalJsonBoundedForTests(nest(120), 1024 * 1024)).toContain('{"n":');
+    // Past the cap: a null refusal, never a thrown RangeError.
+    expect(antigravityCanonicalJsonBoundedForTests(nest(200), 1024 * 1024)).toBeNull();
+    expect(antigravityCanonicalJsonBoundedForTests(nest(50_000), 8 * 1024 * 1024)).toBeNull();
+  });
+
   test("overflow aborts the walk near the cap, proven by scan instrumentation", () => {
     resetCanonicalScanUnitsForTests();
     const hugeString = "y".repeat(10 * 1024 * 1024);

tests/windows-elevation-spawn.test.ts

@@ -22,6 +22,7 @@ import {
 import {
   evaluateSchedulerInstallRestartReconciliation,
   finalizeWindowsSchedulerServiceRegistration,
+  schedulerVerificationMaySettle,
   setFinalizeWindowsSchedulerHooksForTests,
 } from "../src/service";
 import type { WindowsSchedulerInstallVerification } from "../src/service";
@@ -987,6 +988,43 @@ describe("finalizeWindowsSchedulerServiceRegistration", () => {
     expect(parentRollbackLaunches).toBe(0);
   });
 
+  test("the settle predicate refuses every unproven state on its own terms", () => {
+    // The end-to-end unknown-SCM test above cannot isolate this: its fixture has
+    // taskInstalled and registrationHealthy both true, so the FINAL clause is
+    // already false and deleting an earlier guard leaves it green. Exercising the
+    // predicate directly with a transient-looking tail (invisible task) is what
+    // proves each guard carries its own weight.
+    const transientTail: WindowsSchedulerInstallVerification = {
+      taskInstalled: false,
+      registrationHealthy: false,
+      registrationInvalid: false,
+      assetsHealthy: true,
+      nativeServiceAbsent: true,
+      nativeStatusUnknown: false,
+      conflict: false,
+      ok: false,
+      detail: "Task Scheduler task is not installed.",
+    };
+
+    // Baseline: a scheduler view that has genuinely not caught up may settle.
+    expect(schedulerVerificationMaySettle(transientTail)).toBe(true);
+
+    // Each of these is unproven or permanent, and must refuse even though the
+    // transient tail below it still looks retryable.
+    expect(schedulerVerificationMaySettle({ ...transientTail, ok: true })).toBe(false);
+    expect(schedulerVerificationMaySettle({ ...transientTail, conflict: true })).toBe(false);
+    expect(schedulerVerificationMaySettle({ ...transientTail, assetsHealthy: false })).toBe(false);
+    expect(schedulerVerificationMaySettle({ ...transientTail, nativeServiceAbsent: false })).toBe(false);
+    expect(schedulerVerificationMaySettle({ ...transientTail, registrationInvalid: true })).toBe(false);
+
+    // And a fully healthy-but-not-ok view has nothing left to wait for.
+    expect(schedulerVerificationMaySettle({
+      ...transientTail,
+      taskInstalled: true,
+      registrationHealthy: true,
+    })).toBe(false);
+  });
+
   test("ownership lost during a settle delay stops without rollback or state write", async () => {
     mockParentRollbackSpawn();
     let owned = true;

tests/windows-secret-acl.test.ts

@@ -626,6 +626,12 @@ describe("ephemeral ACL memo release (#840 refinement)", () => {
   test("ephemeral release clears temp-keyed timeout memos in BOTH namespaces", () => {
     setPlatformForTests("win32");
     setIcaclsRunnerForTests(() => timeout);
+    // Own the environment this test needs. It used to inherit USERNAME from an
+    // earlier describe's `??=`, which never restores it: run this file's blocks in
+    // another order, or this test alone, and the harden fails before it ever
+    // reaches the memo behavior under test.
+    const previousUsername = process.env.USERNAME;
+    process.env.USERNAME = "ocx-test-user";
     const tempA = join(testDir, "dest.ocx.1.1.tmp");
     const tempB = join(testDir, "dest.ocx.1.2.tmp");
     writeFileSync(tempA, "a", "utf-8");
@@ -642,6 +648,8 @@ describe("ephemeral ACL memo release (#840 refinement)", () => {
     } finally {
       setIcaclsRunnerForTests(null);
       setPlatformForTests(null);
+      if (previousUsername === undefined) delete process.env.USERNAME;
+      else process.env.USERNAME = previousUsername;
     }
   });