test(api): wait for complete app session replies

[frahlg]

App sharing tests could send their next request after receiving only api.head, while the previous request still held the session busy. CI then reported E_UNAVAILABLE instead of reaching the expected permission check.

Wait for the matching api.end, read the complete body, and check its byte count and truncation flag. Give independent access attempts their own sessions against the same real enrollment. The owner, viewer and last-owner assertions keep their original status and persisted-role checks. This changes tests only.

A transport that pauses after api.head reproduces the premature return before the fix. The new regression passes after it. Focused tests passed 30 runs, race tests passed 10 runs, the full API suite passed, and make verify passed on the standalone branch.

This fixes the test failure seen in Core #1096 while preparing the next beta. no-changeset applies because no shipped code changes.

---

Note

Low Risk
Test-only changes to the app session harness; no production API or enrollment behavior is modified.

Overview
Fixes flaky app-link session tests that could fire the next API call after only api.head, while the session was still finishing the prior response (CI saw E_UNAVAILABLE instead of expected 403/409 checks).

appRig.call now blocks on the matching api.end, assembles api.chunk bodies, and fails if Truncated or Bytes do not match the collected payload. TestAppRigCallWaitsForTheCompleteResponse uses a sender that pauses after api.head to lock in that behavior.

Multi-step permission tests (owner escalation, guest roster, last-owner self-removal) create a fresh newAppSession per sub-case so sequential attempts do not share one busy session against the same enrollment. Assertions on status codes and persisted roles are unchanged; tests only.

^{Reviewed by Cursor Bugbot for commit e865108. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Bugbot couldn't run - usage limit reached

Bugbot is counted against Cursor usage for this user or team, and this run hit a usage or spend limit.

A user or team admin can review and increase usage limits in the Cursor dashboard.

(requestId: serverGenReqId_4e72fa79-5dcd-4f44-acf4-8ecb7dda1c46)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T14:30:24.141136Z	e865108	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.