test(engine): stabilize runner and envoy suites

.agent/todo/envoy-surface-remaining-coverage.md

@@ -0,0 +1,32 @@
+# Envoy Surface Remaining Coverage
+
+Follow-up work from the Envoy test expansion.
+
+## P0
+
+- Fix and test HTTP tunnel callback errors completing Guard requests instead of hanging.
+- Re-enable the remaining ignored `engine/packages/engine/tests/envoy/` tests one by one, adapting Runner-era assumptions to Envoy semantics.
+- Run the full engine test suite after the Envoy-specific sweep is stable.
+
+## P1
+
+- Add targeted SQLite Envoy startup/takeover coverage:
+  - V1 migration lock
+  - native V2 metadata
+  - concurrent actor startup
+  - failed takeover recovery
+- Add multiple-Envoy coverage:
+  - actor distribution
+  - one Envoy loss reallocates only its actors
+  - unrelated Envoys stay healthy
+- Add explicit Envoy eviction coverage for intended actor/generation removal.
+- Add WebSocket tunnel edge coverage:
+  - client disconnect
+  - engine disconnect
+  - reconnect after actor sleep
+
+## P2
+
+- Deepen get-or-create idempotency/race coverage for Envoy-backed actors.
+- Fill payload/validation gaps not already covered by copied API tests.
+- Add backpressure/ordering assertions around command indexes and duplicate starts.

engine/packages/api-peer/src/runner_configs.rs

@@ -35,7 +35,7 @@ pub async fn list(ctx: ApiCtx, _path: ListPath, query: ListQuery) -> Result<List
 					.into_iter()
 					.map(|name| (namespace.namespace_id, name))
 					.collect(),
-				bypass_cache: false,
+				bypass_cache: true,
 			})
 			.await?;
 

engine/packages/engine/tests/common/actors.rs

@@ -116,7 +116,7 @@ pub async fn bulk_create_actors(
 			},
 			api_types::actors::create::CreateRequest {
 				datacenter: None,
-				name: format!("{}-{}", prefix, i),
+				name: prefix.to_string(),
 				key: Some(generate_unique_key()),
 				input: None,
 				runner_name_selector: TEST_RUNNER_NAME.to_string(),

engine/packages/engine/tests/common/ctx.rs

@@ -7,6 +7,7 @@ pub struct TestOpts {
 	pub datacenters: usize,
 	pub timeout_secs: u64,
 	pub pegboard_outbound: bool,
+	pub auth_admin_token: Option<String>,
 }
 
 impl TestOpts {
@@ -15,6 +16,7 @@ impl TestOpts {
 			datacenters,
 			timeout_secs: 10,
 			pegboard_outbound: false,
+			auth_admin_token: None,
 		}
 	}
 
@@ -27,6 +29,11 @@ impl TestOpts {
 		self.pegboard_outbound = true;
 		self
 	}
+
+	pub fn with_auth_admin_token(mut self, token: impl Into<String>) -> Self {
+		self.auth_admin_token = Some(token.into());
+		self
+	}
 }
 
 impl Default for TestOpts {
@@ -35,6 +42,7 @@ impl Default for TestOpts {
 			datacenters: 1,
 			timeout_secs: 10,
 			pegboard_outbound: false,
+			auth_admin_token: None,
 		}
 	}
 }
@@ -79,18 +87,33 @@ impl TestCtx {
 		// Setup all datacenters
 		let mut dcs = Vec::new();
 		for test_deps in test_deps_list {
-			let dc = Self::setup_instance(test_deps, opts.pegboard_outbound).await?;
+			let dc = Self::setup_instance(
+				test_deps,
+				opts.pegboard_outbound,
+				opts.auth_admin_token.clone(),
+			)
+			.await?;
 			dcs.push(dc);
 		}
+		dcs.sort_by_key(|dc| dc.config.dc_label());
 
 		Ok(Self { dcs, opts })
 	}
 
 	async fn setup_instance(
 		test_deps: rivet_test_deps::TestDeps,
 		include_pegboard_outbound: bool,
+		auth_admin_token: Option<String>,
 	) -> Result<TestDatacenter> {
-		let config = test_deps.config().clone();
+		let config = if let Some(admin_token) = auth_admin_token {
+			let mut root = (**test_deps.config()).clone();
+			root.auth = Some(rivet_config::config::auth::Auth {
+				admin_token: rivet_config::secret::Secret::new(admin_token),
+			});
+			rivet_config::Config::from_root(root)
+		} else {
+			test_deps.config().clone()
+		};
 		let pools = test_deps.pools().clone();
 
 		// Start the service manager with all required services