test: regression + multi-client coverage for workspace-root routing

- Storage: migration FK-cascade survival (oauth_tokens/client preserved across
  the 005/006/012 rebuilds), synthetic DROP-with-FK-off, post-migration
  foreign_key_check integrity.
- Core: normalize_workspace_root idempotency, full-path case-fold, file://
  drive/UNC/localhost host handling, and the doubled-slash-before-drive
  regression.
- Resolver: roots-arrived-empty → ClientGrant (and → Deny without grants).
- FeatureSet composition cycle terminates and returns the de-duplicated union.
- Multi-client: same root → identical effective tools, doubled-slash root →
  canonical binding (effective_features); two roots-capable clients tracked
  independently over real HTTP (streamable_http; test client now answers
  roots/list).
- Prune redundant cases (duplicate token-hash / disable-server tests, empty
  resolver test module) and fix stale longest-prefix comments + the
  content-dedup test (measure delta around the unchanged event, not absolute
  count, so the legitimate connect-time resolution flip doesn't mask it).

Signed-off-by: Mohammod Al Amin Ashik <maa.ashik00@gmail.com>

Author: its-mash

tests/rust/tests/database/inbound_client.rs

@@ -302,16 +302,8 @@ async fn test_authorization_code_not_found() {
 // Token Tests
 // =============================================================================
 
-#[tokio::test]
-async fn test_token_hash_consistency() {
-    let hash1 = InboundClientRepository::hash_token("my_secret_token");
-    let hash2 = InboundClientRepository::hash_token("my_secret_token");
-    let hash3 = InboundClientRepository::hash_token("different_token");
-
-    assert_eq!(hash1, hash2);
-    assert_ne!(hash1, hash3);
-    assert_eq!(hash1.len(), 64); // SHA-256 hex
-}
+// Note: `hash_token` determinism/length is unit-tested in the storage crate
+// (`inbound_client_repository.rs::test_hash_token`); not duplicated here.
 
 #[tokio::test]
 async fn test_save_and_find_token() {

tests/rust/tests/gateway/server_manager.rs

@@ -169,38 +169,10 @@ async fn test_disable_increments_flow_id() {
 // Event Emission
 // ============================================================================
 
-#[tokio::test]
-async fn test_enable_emits_server_status_changed() {
-    let mut harness = ServerManagerTestHarness::new().await;
-    let key = test_key("server-1");
-
-    harness.manager.enable_server(key.clone()).await.unwrap();
-
-    let events = harness.collect_events().await;
-
-    let status_changed = events.iter().find(|e| {
-        matches!(e, DomainEvent::ServerStatusChanged { server_id, .. } if server_id == "server-1")
-    });
-
-    assert!(
-        status_changed.is_some(),
-        "Should emit ServerStatusChanged event"
-    );
-}
-
-#[tokio::test]
-async fn test_disable_emits_disconnected_event() {
-    let mut harness = ServerManagerTestHarness::new().await;
-    let key = test_key("server-1");
-
-    harness.manager.enable_server(key.clone()).await.unwrap();
-    harness.collect_events().await;
-
-    harness.manager.disable_server(&key).await.unwrap();
-
-    let events = harness.collect_events().await;
-    assert_event_status(&events, "server-1", ConnectionStatus::Disconnected);
-}
+// Note: enable→Connecting and disable→Disconnected event emission are
+// covered by `test_enable_server_starts_connecting` and
+// `test_disable_server_transitions_to_disconnected` above (which assert the
+// specific status); only the space-id correctness case is unique here.
 
 #[tokio::test]
 async fn test_event_contains_correct_space_id() {

tests/rust/tests/integration/effective_features.rs

@@ -19,8 +19,9 @@
 use std::sync::Arc;
 
 use mcpmux_core::{
-    normalize_workspace_root, FeatureSet, FeatureSetRepository, MemberMode, ServerFeature,
-    ServerFeatureRepository, SpaceRepository, WorkspaceBinding, WorkspaceBindingRepository,
+    normalize_workspace_root, FeatureSet, FeatureSetMember, FeatureSetRepository, MemberMode,
+    MemberType, ServerFeature, ServerFeatureRepository, SpaceRepository, WorkspaceBinding,
+    WorkspaceBindingRepository,
 };
 use mcpmux_gateway::services::{FeatureSetResolverService, ResolutionSource, SessionRootsRegistry};
 use mcpmux_gateway::{FeatureService, PrefixCacheService};
@@ -36,12 +37,16 @@ struct Ctx {
     feature_service: FeatureService,
     session_roots: Arc<SessionRootsRegistry>,
     binding_repo: Arc<dyn WorkspaceBindingRepository>,
+    fs_repo: Arc<dyn FeatureSetRepository>,
     space_id: Uuid,
     space_id_str: String,
     /// FeatureSet whose members are the two `github` tools.
     fs_github: String,
     /// FeatureSet whose only member is the `firebase` tool.
     fs_firebase: String,
+    /// Raw ServerFeature ids for composing custom FeatureSets in tests.
+    gh_issue_id: String,
+    fb_deploy_id: String,
 }
 
 impl Ctx {
@@ -117,10 +122,13 @@ impl Ctx {
             feature_service,
             session_roots,
             binding_repo,
+            fs_repo,
             space_id,
             space_id_str,
             fs_github: fs_github.id,
             fs_firebase: fs_firebase.id,
+            gh_issue_id: gh_issue.id.to_string(),
+            fb_deploy_id: fb_deploy.id.to_string(),
         }
     }
 
@@ -176,6 +184,59 @@ async fn mapping_determines_effective_tools_per_session() {
     );
 }
 
+/// Multi-client, SAME workspace root: two distinct client sessions (e.g. two
+/// editors opening the same folder) must resolve to the SAME binding and see
+/// an identical toolset — the root is the routing key, not the session/client.
+#[tokio::test(flavor = "multi_thread")]
+async fn two_clients_same_root_see_identical_tools() {
+    let ctx = Ctx::new().await;
+    let root = if cfg!(windows) {
+        "d:\\work\\shared"
+    } else {
+        "/work/shared"
+    };
+    // First client opens the folder and binds it.
+    ctx.bind("client-a", root, &ctx.fs_github).await;
+    // Second client (different session) reports the very same root.
+    ctx.session_roots.set("client-b", [root]);
+    ctx.session_roots.set_roots_capable("client-b", true);
+
+    let a = ctx.effective_tools("client-a").await;
+    let b = ctx.effective_tools("client-b").await;
+    assert_eq!(
+        a,
+        vec!["create_issue".to_string(), "list_repos".to_string()]
+    );
+    assert_eq!(
+        a, b,
+        "two clients on the same root must see identical tools"
+    );
+}
+
+/// Multi-client, DIFFERENT-shaped roots for the SAME folder: a binding created
+/// from the canonical Windows drive path must still match a client that
+/// reports that folder with a doubled leading slash (`//d:/…`, seen live from
+/// a `file:////D:/…` URI). Regression for the normalization bug that stored
+/// `\\d:\…` and silently never matched the canonical form.
+#[tokio::test(flavor = "multi_thread")]
+async fn doubled_slash_root_resolves_to_canonical_binding() {
+    let ctx = Ctx::new().await;
+    // Binding created from the canonical drive form.
+    ctx.bind("canon", "d:\\work\\proj", &ctx.fs_github).await;
+
+    // A second client reports the SAME folder via the doubled-slash form;
+    // SessionRootsRegistry::set normalizes it, and it must collapse to the
+    // canonical key so the resolver matches the existing binding.
+    ctx.session_roots.set("dslash", ["//d:/work/proj"]);
+    ctx.session_roots.set_roots_capable("dslash", true);
+
+    assert_eq!(
+        ctx.effective_tools("dslash").await,
+        vec!["create_issue".to_string(), "list_repos".to_string()],
+        "doubled-slash root must route to the binding created from the canonical form"
+    );
+}
+
 /// An *empty* mapping (a binding with zero feature sets) is valid: the session
 /// routes to the Space (source = WorkspaceBinding) but sees zero Space tools.
 /// Built-in servers (gated per Space) are layered on by the request handler and
@@ -221,3 +282,55 @@ async fn unbound_session_sees_zero_effective_tools() {
 
     assert!(ctx.effective_tools("sess").await.is_empty());
 }
+
+/// Regression (resolution #9): a composition CYCLE (FS X ⊇ Y, FS Y ⊇ X) must
+/// not infinite-loop the resolver on the live tools/list path. The command
+/// layer now blocks creating such a cycle, but the repository can still hold
+/// one (legacy data / direct writes), so the resolver must terminate
+/// defensively — returning the de-duplicated union of both sets' features.
+#[tokio::test(flavor = "multi_thread")]
+async fn composition_cycle_terminates_and_returns_union() {
+    let ctx = Ctx::new().await;
+
+    // Two custom FeatureSets that include each other.
+    let mut fs_x = FeatureSet::new_custom("CycX", ctx.space_id.to_string());
+    let mut fs_y = FeatureSet::new_custom("CycY", ctx.space_id.to_string());
+    ctx.fs_repo.create(&fs_x).await.unwrap();
+    ctx.fs_repo.create(&fs_y).await.unwrap();
+
+    let member = |fs_id: &str, mtype: MemberType, mid: String| FeatureSetMember {
+        id: Uuid::new_v4().to_string(),
+        feature_set_id: fs_id.to_string(),
+        member_type: mtype,
+        member_id: mid,
+        mode: MemberMode::Include,
+    };
+
+    // X ⊇ {gh_issue (feature), Y (featureset)}
+    fs_x.members = vec![
+        member(&fs_x.id, MemberType::Feature, ctx.gh_issue_id.clone()),
+        member(&fs_x.id, MemberType::FeatureSet, fs_y.id.clone()),
+    ];
+    // Y ⊇ {fb_deploy (feature), X (featureset)}  ← closes the cycle
+    fs_y.members = vec![
+        member(&fs_y.id, MemberType::Feature, ctx.fb_deploy_id.clone()),
+        member(&fs_y.id, MemberType::FeatureSet, fs_x.id.clone()),
+    ];
+    ctx.fs_repo.update(&fs_x).await.unwrap();
+    ctx.fs_repo.update(&fs_y).await.unwrap();
+
+    let root = if cfg!(windows) {
+        "d:\\work\\cyc"
+    } else {
+        "/work/cyc"
+    };
+    ctx.bind("sess", root, &fs_x.id).await;
+
+    // Must return (not hang) — the union of both sets' features, de-duplicated.
+    let tools = ctx.effective_tools("sess").await;
+    assert_eq!(
+        tools,
+        vec!["create_issue".to_string(), "deploy".to_string()],
+        "cyclic composition must resolve to the de-duplicated union and terminate"
+    );
+}

tests/rust/tests/integration/feature_set_resolver.rs

@@ -276,6 +276,45 @@ async fn rootless_client_without_grants_denies() {
     assert!(r.feature_set_ids.is_empty());
 }
 
+#[tokio::test]
+async fn roots_arrived_empty_falls_through_to_grants() {
+    // Regression (resolver 3.1): a roots-capable client whose roots arrived
+    // EMPTY (no folder open — Claude Desktop chat, empty editor window) is a
+    // SETTLED rootless answer and must fall through to its client grants, not
+    // hang forever in PendingRoots. Before the fix, `Some([])` was conflated
+    // with `None` (not-yet-arrived) and stranded granted clients on
+    // meta-tools-only with no recovery short of opening a folder.
+    let f = Fixture::new().await;
+    let client_id = "folderless.example/client";
+    f.make_client(client_id).await;
+    f.client_repo
+        .grant_feature_set(client_id, &f.space_id.to_string(), &f.fs_a_id)
+        .await
+        .unwrap();
+
+    f.session_roots.set_roots_capable("s", true);
+    f.session_roots.set("s", Vec::<String>::new()); // roots ARRIVED, but empty
+    let r = f
+        .resolver
+        .resolve(Some("s"), Some(client_id))
+        .await
+        .unwrap();
+    assert_eq!(r.source, ResolutionSource::ClientGrant);
+    assert_eq!(r.feature_set_ids, vec![f.fs_a_id]);
+}
+
+#[tokio::test]
+async fn roots_arrived_empty_without_grants_denies() {
+    // Same arrived-empty state but no grants → Deny, NOT PendingRoots, so the
+    // session settles instead of re-probing `roots/list` forever.
+    let f = Fixture::new().await;
+    f.session_roots.set_roots_capable("s", true);
+    f.session_roots.set("s", Vec::<String>::new());
+    let r = f.resolver.resolve(Some("s"), None).await.unwrap();
+    assert_eq!(r.source, ResolutionSource::Deny);
+    assert!(r.feature_set_ids.is_empty());
+}
+
 #[tokio::test]
 async fn capable_session_does_not_fall_through_to_grants() {
     // Critical: the leak we set out to fix. A roots-capable session whose

tests/rust/tests/integration/workspace_binding_events.rs

@@ -80,8 +80,8 @@ impl Ctx {
 async fn creating_binding_flips_next_resolution_source() {
     let ctx = Ctx::new().await;
 
-    // Normalize both sides so the longest-prefix lookup matches — the
-    // resolver compares already-normalized strings from both stores.
+    // Normalize both sides so the exact-match lookup matches — the resolver
+    // compares already-normalized strings from both stores (no inheritance).
     let raw = if cfg!(windows) {
         "d:\\proj\\bind-me"
     } else {