Filtered orchestrator tests leak directly assigned AiConfig leaves

Context

A filtered unit order reproduced one orchestrator spec leaking its deploymentStateBridge.snapshotPath value into an unrelated MCP smoke assertion. The exact failing arm was 1 failed / 2080 passed; replacing this spec's ineffective cleanup with the shipped resolved-value capture made the same arm 2097 passed in PR #16901.

This leaf records only that delivered repair. Broad worker-local isolation and mutation-shape enforcement remain owned by #16885 and #15874.

The Problem

test/playwright/unit/ai/daemons/orchestrator/services/DeploymentStateBridgeService.spec.mjs directly writes leaves under AiConfig.orchestrator.deploymentStateBridge and deploymentRuntimeAccess. Its prior Neo.clone(...) plus Object.assign(...) cleanup did not restore those directly assigned leaves in the observed filtered run, allowing state to survive into later specs in the same worker.

The failure is behavioral and independently reproduced. This ticket deliberately does not generalize why every AiConfig/Provider clone behaves this way: two probes observed different clone shapes on different config surfaces, while both confirmed that the old cleanup failed to restore the written value.

The Architectural Reality

• ADR-0019 owns AiConfig as a reactive Provider single source of truth and treats shared-singleton test mutation as a safety-sensitive boundary.
• snapshotAiConfig() in test/playwright/unit/ai/services/memory-core/util.mjs is the shipped narrow capture/restore primitive for existing resolved leaves.
• The affected spec currently writes 14 leaves through two syntactic shapes: direct leaf assignment and Object.assign(node, {...}).
• No production class or new file placement changes. The Agent OS structure-map gate was attempted and hit its existing Cannot create a string longer than 0x1fffffe8 characters ceiling; exact diff and sibling inspection bind this leaf to the existing orchestrator service spec.

The Fix

In DeploymentStateBridgeService.spec.mjs:

1. Replace the five hand-rolled Neo.clone / Object.assign cleanup pairs with snapshotAiConfig(AiConfig, explicitPaths) restoration.
2. Name every currently written bridge and runtime-access leaf in explicit path lists.
3. Add a non-vacuous source census over both write shapes so a future written-but-unlisted leaf fails by name.
4. Preserve the no-sink and filtered-run behavior outside this cleanup change.

Contract Ledger

Decision Record impact

Aligned with ADR-0019. This leaf applies its existing test-isolation boundary; it does not amend the decision.

Acceptance Criteria

• All five ineffective cleanup sites in DeploymentStateBridgeService.spec.mjs use snapshotAiConfig over explicit resolved-leaf paths.
• The bridge and runtime-access path lists cover all 14 config leaves currently written by the spec.
• A production-bound census discovers both current write shapes, is non-vacuous, and fails with the missing path when any listed leaf such as deploymentRuntimeAccess.readOperations is removed.
• A real Provider probe confirms enabled, composeProject, allowedServices, and readOperations all restore after the repair.
• The reported filtered orchestrator-then-MCP unit arm passes after the repair.

Out of Scope

• Eliminating every shared AiConfig mutation across the test tree; #15874 owns that population and its mechanical guard.
• Closing #16885, which retains the broader worker-isolation and unresolved mechanism work.
• Changing production DeploymentStateBridgeService behavior.

Avoided Traps

• Do not claim a universal zero-enumerable-key clone mechanism; the two relevant config surfaces produced different clone populations.
• Do not derive the census baseline from the capture list itself; that would make an omitted path invisible by construction.
• Do not widen this one-file repair into subtree-replacement cleanup; those destructive shapes remain #15874 scope.

Related

• #16885 — broader filtered-run isolation carrier; remains open
• #15874 — assignment-shape enforcement and remaining AiConfig test pollution
• PR #16901 — delivered implementation
• ADR-0019 — reactive Provider single-source-of-truth authority

Origin Session ID: ff601885-0018-437a-af95-6fea47a186b9

Retrieval Hint: PR #16901 snapshotAiConfig DeploymentStateBridgeService filtered unit pollution

Live latest-open + A2A duplicate sweep: checked immediately before filing; no equivalent found.