vtab permission test fails for any root user, so the Rust suite is never clean in the hosted sandbox #977

What

packages/rust/tests/vtab.rs::unreadable_file_yields_null_content_without_erroring_the_row fails whenever the suite runs as uid 0:

thread 'unreadable_file_yields_null_content_without_erroring_the_row' panicked at packages/rust/tests/vtab.rs:161:5:
assertion `left == right` failed: unreadable content is NULL, not an error
  left: Some("classified")
 right: None

The test writes a fixture, chmods it 0o000, and asserts the content column comes back NULL:

fs::write(&path, "classified").unwrap();
fs::set_permissions(&path, fs::Permissions::from_mode(0o000)).unwrap();

Root bypasses file permission bits, so the read succeeds and content is Some("classified"). Nothing is wrong with the product — the test's precondition simply cannot hold for a privileged user.

Why it matters here

The hosted Claude Code sandbox runs as uid 0, and this repo explicitly supports that environment (agents/build/environment.md, symlinked on session start by .claude/hooks/select-environment.sh). So cargo test --workspace --features cli — which AGENTS.md's "E2E Before Push" section directs agents to run before any substantial push — is never clean there.

The cost is per-session and repeated: the failure looks like a real regression, so each session has to stop and prove it is pre-existing (I did it with a git stash + re-run on the base commit) before it can trust its own test run. It also breaks tooling that needs a green baseline — cargo mutants aborts with ERROR cargo test failed in an unmutated tree, so no mutants were tested, which is how I hit it while working #975.

CI runs as a non-root user, so the gate is green and this has stayed invisible.

Suggested fix

Skip the test when the process is privileged, so it still runs for every normal developer and CI:

#[test]
fn unreadable_file_yields_null_content_without_erroring_the_row() {
    // Root bypasses permission bits, so the unreadable precondition cannot hold.
    if unsafe { libc::geteuid() } == 0 {
        return;
    }
    ...
}

unsafe needs an #[expect(unsafe_code, reason = ...)] per the crate's unsafe_code = "deny" lint, or use a crate that wraps it. Alternatives if a silent skip is unwanted: assert the root-path behavior explicitly instead of skipping, or leave the test alone and document the failure in agents/build/environment.md so sessions stop re-deriving it. Skipping seems better than documenting — a suite that is expected to be red trains people to ignore red.

Repro

$ id -u
0
$ cargo test -p dirsql --features cli --test vtab
test result: FAILED. 17 passed; 1 failed; 0 ignored

Found while working #951 / #966.