test: promote the published-account fixture into the engine testkit

[FSM1]

The duplication

The published-account fixture now exists twice, hand-rolled, in two crates' tests/ directories:

• crates/engine/tests/write_plane.rs — Blocks, serve_http, seed_account, engine_on, poll_each/WokenFlag, boot
• crates/fuse/tests/fuse_op_core.rs — mod published: the same six helpers, near line-identical, with the scripting knobs stripped

That is roughly 230 duplicated lines, but the line count is not the problem. The sequence encodes live wire invariants — the pointer payload version, the writeSeed(writeScopeSeed, root) → ipnsKeypair edge, the writeEpoch/minReadEpoch pairing, and sequence-1 semantics on a first publish. When one of those moves, both suites fail and there is no shared site to fix. crates/engine/src/testkit/content.rs states exactly the doctrine this violates: the kit exists "so a change to the … contract lands in one place rather than in every suite that hand-rolls it".

A third copy is already implied: every later suite that needs a file with real published content has to hand-roll it again. The two FUSE slices that follow this one both need one.

What to promote

Into cipherbox_engine::testkit, beside owner_root_fixture (which was already promoted for exactly this reason):

• testkit::account::seed_account(&FakeWorld, &Blocks) -> IpnsName — the owner root, the vault pointer, and the record-store seeding around them
• a scriptable content-addressed Blocks store plus serve_http, covering /content/upload, /account/quota, /registry/*, and the gateway GET. The existing testkit::serve + testkit::block_store answer gateway GETs from a static map only, so they are not a substitute
• testkit::poll_each(&mut [BoxedTask]) — the flag-waker poll-to-park loop, next to testkit::block_on. This is hand-rolled three times today: write_plane.rs, fuse_op_core.rs, and crates/engine/src/testkit/fakes/scheduler.rs has a FlagWaker of its own

Then delete both copies.

Why it was not done in the FUSE slice

crates/engine/src/testkit/ is outside that slice's file ownership, and the four FUSE slices are strictly sequential over crates/fuse/src/ops.rs — landing an engine-side testkit change in the middle of that chain would widen the contention. Doing it as its own change also lets both call sites be deleted in one diff, which is the only way to prove the promotion is faithful.

Done when

• The two hand-rolled fixtures are gone and both suites drive the promoted helpers
• Engine Tests and FUSE Op Core both pass unchanged in what they assert

---

Correction 2026-08-19 — verified at 818d5132a

"A third copy is already implied" understates it — a third copy already exists, in a suite the body does not mention.

crates/engine/tests/vault_settings.rs hand-rolls two of the six helpers verbatim:

• struct Blocks — crates/engine/tests/vault_settings.rs:48, under the same header comment as the others ("One content-addressed block store behind both the pin API and the gateway")
• fn serve_http(device: &FakeDevice, blocks: &Blocks, calls: usize) — crates/engine/tests/vault_settings.rs:123

The signature of serve_http is character-identical across all three copies:

copy	Blocks	serve_http
crates/engine/tests/write_plane.rs	:206	:489
crates/fuse/tests/fuse_op_core.rs (mod published, :1330)	:1376	:1441
crates/engine/tests/vault_settings.rs	:48	:123

It is a partial copy — vault_settings.rs has no seed_account, engine_on, poll_each/WokenFlag, or boot — which is why it was missed. But Blocks + serve_http are the two helpers that encode the wire surface (/content/upload, /account/quota, /registry/*, the gateway GET), i.e. exactly the pair the "What to promote" section's second bullet is about. Promote them and delete three copies, not two. The Done-when criterion should read three suites, and Engine Tests covers all three (vault_settings.rs and write_plane.rs are both engine integration tests; only fuse_op_core.rs sits behind FUSE Op Core).

For completeness, the other two copies' full helper sets, confirmed: write_plane.rs — Blocks:206, serve_http:489, seed_account:505, engine_on:572 (plus engine_on_api:595), WokenFlag:648, poll_each:662, boot:709. fuse_op_core.rs mod published — Blocks:1376, serve_http:1441, seed_account:1452, engine_on:1515.

Adjacent, not in scope, but worth knowing before this lands: crates/engine/tests/ also hand-rolls 11 seam-trait stubs across four files, of which vault_settings.rs alone holds eight (AcksNothingBack:389, NeverAnswers:568, UnreadableFloors:694, ServesCiphertext:909, SpyCache:969, NeverReads:1102, StuckCounter:1656, AcksNoPut:1682; plus floor_atomic.rs:41,98 and net.rs:527). Those are fault-injection stubs rather than the published-account fixture, so they are a different promotion — do not widen this issue to cover them, but expect to touch vault_settings.rs heavily and to rebase against them.

---

Cross-reference 2026-08-19 — #1303

#1303 was filed against the same duplication from the poll-driver angle and lists a fourth divergence this body does not: vault_settings.rs also carries the driver, as Woken/poll_until_parked, and crates/engine/src/facade.rs's unit tests carry a single-poll poll_each that collides by name with the integration suites' poll-to-fixpoint one. Whoever takes this should pull that residue in and retire #1303 rather than leaving a second promotion open over the same files.

---

Poll-driver residue folded in from #1303 — 2026-08-19, verified at main 8df8f6e03

#1303 was retired as substantially duplicating this issue. Its residue lands here. Two of its claims did not survive verification and are corrected below.

Already covered by the third "What to promote" bullet — no change needed:

• crates/engine/tests/write_plane.rs:662 poll_each + WokenFlag:648 — the fixpoint driver the bullet names.
• crates/fuse/tests/fuse_op_core.rs:1532 pump + Woken:1549 — the same fixpoint driver under a different name. The bullet calls this the fuse_op_core.rs copy; note it is spelled pump there, not poll_each.

Genuinely residual — in no issue's list before this note:

1. A fourth copy, in src/ rather than tests/. crates/engine/src/facade.rs:5702 carries its own poll_each: a single poll of every task under Waker::noop(), not the poll-to-fixpoint loop. Same name, different drive model, and a site none of the promote bullets reach.

2. Two names each carry two meanings, and the collisions run in opposite directions. Three distinct drive models are spread across four names:

   name	site	model
   poll_each	crates/engine/tests/write_plane.rs:662	poll every task to fixpoint
   poll_each	crates/engine/src/facade.rs:5702	poll every task once
   poll_once	crates/engine/tests/write_plane.rs:676	poll every task once
   poll_once	crates/fuse/tests/fuse_op_core.rs:166	poll one future once
   pump	crates/fuse/tests/fuse_op_core.rs:1532	poll every task to fixpoint

   A reader moving between write_plane.rs and facade.rs gets the opposite drive model under the identical name, and poll_once means one of two unrelated things depending on which file it is read in. The promotion should give the poll-to-fixpoint driver and the single-poll driver distinct names in testkit/executor.rs, beside block_on, and drive every site above from them.

Incoming — sweep at rebase time. PR #1298, unmerged as of this note, adds a fifth copy to crates/engine/tests/vault_settings.rs: poll_until_parked + Woken, plus its own engine_on and boot. #1303's body reported that copy as already on main and reported engine_on/boot as duplicated between write_plane.rs and vault_settings.rs; neither is true of main at 8df8f6e03 — both exist only on that branch. If #1298 has landed by the time this is picked up, vault_settings.rs needs those three helpers deleted alongside its Blocks/serve_http (the 2026-08-19 correction above).

Added to Done when:

• No hand-rolled poll driver remains in crates/engine/tests/, crates/fuse/tests/, or crates/engine/src/facade.rs's unit tests.
• The single-poll and poll-to-fixpoint drivers carry distinct names, and no name in the promoted surface denotes two drive models.