ci(browser): restore the Chromium job on Rust 1.99 and prove it ran

[grumbach]

From stable Rust's move to 1.99 on 2026-10-01 until this PR, the "Real Chromium and local nodes" job failed on every PR before any test ran, including #208, #210 and the merged #215 and #216. Those runs built the pinned ant-node, c092f225, with the workflow's RUSTFLAGS: -D warnings. Rust 1.99 deprecates Atomic::fetch_update, which that node calls twice in src/web_rtc.rs, so the build stopped at two errors and the devnet never started. The last green run was on 2026-10-01 at 10:44 UTC on Rust 1.98.1.

This PR moves the pin past ant-node's Rust 1.99 fix while keeping released node code, so the suite still tests this client against older nodes. It stops future toolchain warnings in that old code from breaking the job, and makes the job prove that it ran the pinned node and every Chromium test.

Changes

• node-revision: c092f225 → 26129a26. That is the ant-node main commit that merges the Rust 1.99 update (ant-node #245) into the 0.21.0 release. Its tree is the v0.21.0 tag plus that one change. The only non-test source edit renames the two calls to try_update, the same method. Cargo.lock is unchanged, so the nodes run the code of the current release. From c092f225 to v0.21.0, the runtime changes are the version number, one Windows-only lockfile edge (winapi-util → windows-sys 0.48), and ant-protocol 3.1.0 from crates.io. That release's src/ is identical to ant-protocol d11d1010, the git revision c092f225 pinned. The pointer rules this suite exercises are therefore unchanged. No release contains the rename.
• CI builds the pin without -D warnings (RUSTFLAGS: "" on the one step that compiles it). The pin is deliberately old code: each new stable can add warnings to it, and those are not this repository's to fix. The browser bindings built from this repository earlier in the job still deny warnings.
• start-devnet.mjs: without ANT_NODE_DIR, it refuses to start unless the sibling checkout is the pinned revision without tracked edits, and builds it with --locked. With ANT_NODE_DIR it builds whatever is there, as before.
• New run-guard.js Playwright reporter: fails an otherwise passing run unless every discovered test ran and passed. forbidOnly rejects .only in CI. Plain Playwright exits 0 when tests are skipped.

Alternatives considered

• Keep c092f225, or pin the v0.21.0 tag, and only drop -D warnings. This works: c092f225 builds with two warnings and passes the suite (below). But the pin would still fail the repository's own flags on today's toolchain. Moving the pin makes the build clean today, and dropping -D warnings covers the next toolchain.
• Pin a toolchain for the node build (for example cargo +1.98.1). That fixes the compiler version, but it is a second pin to keep in step with node-revision, plus a toolchain install on every run. Warnings are what broke this job. A hard compiler break in old code would still fail the job loudly.
• Use a released binary. The release archives contain only ant-node and bootstrap_peers.toml. The suite runs ant-devnet (seven nodes, Anvil and the browser manifest), which no release ships.

Linear issue

Closes V2-1399

ant-node #245, one of this issue's Rust 1.99 PRs, says in its description: "ant-client and evmlib were checked and need nothing". This job turned out to be the ant-client part.

Risk tier

• T0 — docs / tooling / CI / pure UX-output. Repo CI only.
• T1 — client-only, no network-facing behavior change. CI + prod compat smoke.
• T2 — node/client logic with behavioral surface, no protocol/format/economics change. Dev testnet + ADR.
• T3 — protocol / storage format / payments / routing. T2 evidence + adversarial testing.

Proposing T0: only the CI workflow and the browser test harness change. No crate source changes.

Compatibility

• Wire: none
• Storage: none
• API: none

Semver impact

• breaking
• feature
• fix

Test evidence

All local runs used macOS arm64, rustc 1.99.0 (the toolchain the hosted job now gets), Playwright 1.62.1 and wasm-pack 0.15.0.

• Failure reproduced. c092f225 with RUSTFLAGS="-D warnings" cargo +1.99.0 build --bin ant-devnet exits 101 with the same two fetch_update errors at src/web_rtc.rs:170 and :202 as the hosted run on fix(browser): gather ICE candidates one connection at a time #216.

• New pin builds. 26129a26 with --locked builds without warnings under both RUSTFLAGS="" and the old -D warnings. Cargo does not re-resolve the lockfile.

• Full browser suite on the new pin (CI=1, RUSTFLAGS="", npm test): three local runs, the last on this commit. Each printed 2 passed, then Run guard: all 2 tests ran and passed. The upload/recovery and pointer tests ran in real Chromium against seven nodes and Anvil. The two earlier runs used drafts of start-devnet.mjs that started the pinned node the same way. They differed only in how the pin check treats tracked edits, a missing checkout and ANT_NODE_DIR.

• Hosted run on this PR (job, head 56e653d, rustc 1.99.0): the node was checked out at 26129a2, and the step ran with RUSTFLAGS: empty. The log shows Starting ant-devnet from the pinned node 26129a26… and ant-node v0.21.0 built in 5m35s. Then 2 passed (5.8m) and Run guard: all 2 tests ran and passed. The job took 10 minutes.

• Unrelated hosted flake, passed on re-run. Merkle E2E (ubuntu-latest) first failed test_merkle_payment_across_batch_boundary. All three attempts collected fewer merkle candidates than the 16 needed (14, 13, then 7). That test runs a native 35-node testnet on the crates.io ant-node, not this pin or harness. The same failure hit fix(pointer): read back a completed write, and pay only for writes that can land #208's branch on 2026-09-30. The re-run passed (7 of 7 tests), so all 18 checks pass on 56e653d.

• Old pin without -D warnings. c092f225 via ANT_NODE_DIR with RUSTFLAGS="": two deprecation warnings, build succeeds, 2 passed. The flag change alone would have prevented this outage.

• Pin check (via npm test, and with a stub cargo that prints its arguments): a sibling checkout at c092f225 is refused ("is at c092f225…, not the pinned 26129a26…"), and so is a tracked edit at the pin. A missing or non-git sibling gets the same instruction. All four exit 1 before building. An untracked file is allowed. The pinned path passes --locked. An explicit ANT_NODE_DIR skips the check and --locked.

• Run guard (dummy specs under the same config):

  Case	Plain Playwright	With guard
  all pass	exit 0	exit 0
  one test skipped	exit 0	exit 1
  expected failure (test.fail())	exit 0	exit 1
  all skipped	exit 0	exit 1
  --list	exit 0	exit 0
  .only with CI=1	—	rejected by forbidOnly

• Dependency drift. No Cargo.toml, Cargo.lock, package.json or package-lock.json changes here. The pinned node's lockfile is byte-identical to v0.21.0's.

• Rust checks. cargo clippy --all-targets --all-features, cargo clippy -- -D warnings, cargo fmt (no changes) and cargo doc --no-deps with -D warnings all pass on rustc 1.99.0. cargo test --lib --all with -D warnings: 753 passed.

New dependency

none

ADR

n/a

Mitigation / rollback

Revert this commit. The job is not a required check, so neither this change nor its revert can block merges.

[dirvine]

Reviewed WithAutonomi/ant-client at 56e653d. No blocking findings.

Independent review: GLM-5.2 returned APPROVE-WITH-CONCERNS with no blockers. Its completed API response was recovered after the coordinating worker timed out (model z-ai/glm-5.2, finish_reason stop). Coordinator adjudication resolved its substantive concerns:

• A local Playwright 1.62.1 probe confirms --grep excludes unselected tests correctly; no false failure.
• Rejecting test.fail() expected failures is deliberate: this integration suite must actually pass its operations. The PR documents that behaviour.
• The merge between v0.21.0 and the compiler-fix commit has an identical tree to v0.21.0 (GitHub comparison has no changed files). The inferred extra docs/workflow change was not real.
• A malformed/empty pin fails closed; diagnostic wording is not a blocker.

Verification:

• Warning override applies only to npm test/node compilation. Client browser bindings retain -D warnings.
• New node pin preserves the release lockfile. Rust 1.99 fetch_update directly delegates to try_update. Published ant-protocol 3.1.0 src is byte-identical to the old protocol git pin (14 files).
• Nine local reporter integration cases passed, including --grep, skips, expected failure, real failure, CI .only, empty discovery and --list.
• Seven temporary-Git/stub-cargo pin-check cases passed. These check harness control flow, not Rust compilation.
• Hosted Chromium job ran both real-browser tests and reported 'Run guard: all 2 tests ran and passed': https://github.com/WithAutonomi/ant-client/actions/runs/37408059513/job/112105188412
• Head unchanged and all returned CI checks green, including Security Audit and both Merkle E2E jobs.

Limits: Full Chromium/node integration was verified from hosted logs, not rerun locally. This is code-review approval, not merge or deployment authorisation.