test(mutants): bounded catches for repo-wide survivors + run the lane under nextest

[heyoub]

What & why

The repo-wide ratchet smoke shard 0 went red on its first complete cloud run (now that Blacksmith is fast enough to finish the 85-min lane). It scored 94% — well above the 75% floor — but hard-failed on 5 TIMEOUT mutants: genuine livelock mutants in the writer / visibility / frontier paths.

Root cause (the deeper issue)

The bounded tests alone would not have fixed this. The mutation lane was the only test lane in the house still on raw cargo test. Under cargo test, one test hanging on a mutation never lets the shared lib-unittests binary exit, so it masks every fast-failing assertion in that binary, and a killable mutant reads as a TIMEOUT survivor (our policy correctly treats timed_out > 0 as a failure, not as caught). lanes.rs even carried a stale comment betting "cargo-mutants treats a timeout as caught" — false under that policy.

The fix (two parts)

1. Run mutants under nextest. --test-tool nextest + the ci profile's terminate-after (pinned via NEXTEST_PROFILE=ci in the runner). Per-test process isolation means a livelock is reaped as a bounded per-test timeout and the fast assertion convicts the mutant first. This aligns the mutation lane with every other test lane (run_nextest_ci) and fixes hang-masking for the other 47 shards too.

• .cargo/mutants.toml, plan.rs, mod.rs fixtures: --test-tool nextest
• run.rs: NEXTEST_PROFILE=ci (its slow-timeout overrides keep the unmutated baseline from tripping terminate-after)
• lanes.rs: corrected the stale timeout-vs-caught note

2. Seven bounded assertion catches — each survivor flips TIMEOUT/MISSED → CAUGHT by a sub-millisecond assertion instead of a 203s hang:

seam	class	catch
writer_queue_len Some(0)	TIMEOUT	direct-read, non-gated so the --no-default-features lane (where the existing catcher is dangerous-test-hooks-gated) kills it too
SequenceGate::publish_on_lanes >→>=	TIMEOUT	publish-at-frontier returns Ok + advances visible
unfenced single-append global_seq + 1→* 1	TIMEOUT	global visible_sequence() == 1 after first event
recreate_restart_segment→None	TIMEOUT	restart precondition yields Some
MonotonicClock::process_boot_ns	MISSED	delegates the real anchor, not a stub
sim next_seq += 1→*= 1	MISSED	op-trace digest golden pin
cursor stop_and_join→Ok(())	MISSED	surfaces the worker's startup error

prepared-batch-items (empty-slice) needs no new test: the existing prepared_batch_dedupes_entity_and_scope_strings already asserts on items(); it was only masked by a sibling hang, which nextest now unmasks.

Verification (local, before push)

• All 7 new tests pass on real code: cargo test -p batpak --all-features (incl. the sim op-trace golden constant).
• The writer-queue-len test compiles under --no-default-features.
• All 34 xtask mutants fixture/policy tests stay green (nextest switch is internally consistent).
• Pre-commit gates clean: traceability-check: ok, structural-check: ok (overclaim, triangulation, capability-snapshot, …).

What proves it in CI

The four required gates (ci-fast, meta-gate, gauntlet, Windows) gate the merge. The thing that actually proves the 5 TIMEOUTs are gone is the non-required Mutation smoke (repo-wide ratchet) lane — watch that one go green (and faster, with the 5×203s timeouts eliminated).

🤖 Generated with Claude Code