Isolate #[throttle] registry tests with a shared TEST_LOCK

[madmax983]

Before

Two rate-limit integration tests intermittently failed, returning 429 instead of 200:

• throttle_route::principal_key_derives_from_session_without_global_principal_middleware
• rate_limit_principal::principal_strategy_keys_on_session_user_id

Under the ~1200 parallel integration tests, per-principal token buckets could leak between concurrently-running tests through the process-global #[throttle] limiter registry (THROTTLE_REGISTRY). Calling __throttle_registry_reset() alone is insufficient: it clears the entire process-wide registry, so a sibling test running concurrently can either repopulate a bucket mid-assertion or have its own limiter dropped out from under it.

After

Each test that touches the throttle registry now takes a process-global TEST_LOCK first, then resets the registry, and holds the lock guard for the whole test body. This serializes all registry-touching tests against each other, so no sibling can mutate the registry during another's assertions — the same isolation precedent already used by the circuit-breaker tests (circuit_breaker::TEST_LOCK, PR #1817) and config_runtime_drift.

How

• Added a pub static TEST_LOCK: std::sync::Mutex<()> to security/rate_limit.rs, mirroring circuit_breaker::TEST_LOCK, and re-exported it (#[doc(hidden)]) from security/mod.rs next to __throttle_registry_reset.
• At the top of every #[throttle]-registry test in throttle_route.rs (and the two named flaky tests), take the lock first, then call __throttle_registry_reset(), holding the guard for the whole test. Because the reset clears the whole registry, every registry-touching test must hold the lock — otherwise a locked test's reset could drop an unlocked sibling's limiter — so the guard is applied consistently across all of them. Each also carries #[allow(clippy::await_holding_lock)], matching the circuit-breaker precedent.

Notes

• Issue Flaky rate-limit tests: throttle_route / rate_limit_principal 429-vs-200 from shared global THROTTLE_REGISTRY (test isolation) #1725 is closed, so this is a recurrence: the two named tests still lacked the lock+reset isolation, so the original fix either regressed or was never fully applied to them. Hence "Part of Flaky rate-limit tests: throttle_route / rate_limit_principal 429-vs-200 from shared global THROTTLE_REGISTRY (test isolation) #1725".
• rate_limit_principal::principal_strategy_keys_on_session_user_id uses the global RateLimitLayer, whose token buckets are per-Limiter (per-TestApp) in an in-memory MemoryStore, not the shared THROTTLE_REGISTRY. The guard is applied there as requested for consistency and to serialize it against the throttle tests, but the registry reset is effectively a no-op for it — so if that test's flakiness recurs, the root cause is likely elsewhere (timing / the previously-fixed cookie-jar collision) rather than registry bleed. Flagging for reviewer awareness.

Gates

• cargo fmt --all -- --check — clean
• cargo clippy -p autumn-web --all-targets -- -D warnings — clean
• Both named tests pass, repeated 3x; all 37 throttle_route + rate_limit_principal tests pass.

---

Generated by Claude Code

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[gemini-code-assist]

Warning

You have reached your daily quota limit. Please wait up to 24 hours and I will start processing your requests again!

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 87.02%. Comparing base (14e6518) to head (04ed87d).
⚠️ Report is 37 commits behind head on trunk-dev.

Additional details and impacted files

@@              Coverage Diff              @@
##           trunk-dev    #1849      +/-   ##
=============================================
+ Coverage      86.82%   87.02%   +0.19%     
=============================================
  Files            273      276       +3     
  Lines         202424   207214    +4790     
=============================================
+ Hits          175761   180330    +4569     
- Misses         26663    26884     +221     

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.