test: green Rust Core Coverage (stale assertions + env-race serialization)

src/core/cli.rs

@@ -278,8 +278,17 @@ fn run_server_command(args: &[String]) -> Result<()> {
     crate::core::logging::init_for_cli_run(verbose, log_scope);
 
     // Initialize the Tokio multi-threaded runtime.
+    //
+    // A single agent turn is a very large async state machine (system prompt +
+    // hundreds of tool specs + the nested provider/tool loop), and delegating
+    // to a sub-agent runs another full turn one level down. Even with the inner
+    // sub-agent future boxed (`subagent_runner::ops`), that nesting overflows
+    // tokio's default 2 MiB worker-thread stack and aborts the whole process
+    // (SIGABRT: "thread 'tokio-rt-worker' has overflowed its stack"), taking
+    // the JSON-RPC server down mid-request. Give workers a roomier stack.
     let rt = tokio::runtime::Builder::new_multi_thread()
         .enable_all()
+        .thread_stack_size(16 * 1024 * 1024)
         .build()?;
     rt.block_on(async {
         crate::core::jsonrpc::run_server(host.as_deref(), port, socketio_enabled).await

tests/near90_closure_raw_coverage_e2e.rs

@@ -441,6 +441,17 @@ async fn round20_memory_sources_readers_and_sync_cover_error_edges_without_netwo
     std::fs::create_dir_all(&bin).expect("bin dir");
     let script = bin.join("gh");
     write_fake_gh_round20(&script);
+    let git_stub = bin.join("git");
+    std::fs::write(&git_stub, "#!/usr/bin/env bash\nexit 1\n").expect("write fake git");
+    #[cfg(unix)]
+    {
+        use std::os::unix::fs::PermissionsExt;
+        let mut perms = std::fs::metadata(&git_stub)
+            .expect("metadata")
+            .permissions();
+        perms.set_mode(0o755);
+        std::fs::set_permissions(&git_stub, perms).expect("chmod fake git");
+    }
     let old_path = std::env::var("PATH").unwrap_or_default();
     let _path = EnvGuard::set("PATH", format!("{}:{old_path}", bin.display()));
 

tests/tools_approval_channels_raw_coverage_e2e.rs

@@ -1606,6 +1606,14 @@ fn tools_and_tool_registry_public_surfaces_cover_schema_and_assembly_paths() {
 
 #[tokio::test]
 async fn orchestrator_tool_synthesis_covers_agent_and_integration_delegation_edges() {
+    // This test reads the process-global connection/toolkit registry (the
+    // integrations tool's available-toolkit list). Sibling tests mutate
+    // OPENHUMAN_WORKSPACE under env_lock; without holding it here, a concurrent
+    // workspace swap trampled our view and dropped gmail_pro/slack_bot from the
+    // unknown-toolkit suggestion (flaky only under llvm-cov's slower parallel
+    // run). Hold the same lock so this test is hermetic without serializing the
+    // whole suite.
+    let _lock = env_lock();
     let mut registry = AgentDefinitionRegistry::default();
     registry.insert(coverage_agent_definition(
         "researcher",