Census: the bridge's inert test grant takes the file's one capability pair (#228 follow-up)

[Broccolito]

Closes the half of the privacy-capability census that PR #228 (QA-E F4) broke. It touches only bridge.rs — crates/biorouter/tests/privacy_capability.rs is deliberately not edited, so it cannot conflict with the PR adding the workspace_inspector.rs row (#244's site, being handled separately).

The one-sentence answer

public_enforced was not needed at the site F4 added, so the site is gone rather than given a row.

What was wrong

inert_grant_for_test() (bridge.rs:1086, added by #228) inlined CallCapability::public_enforced(). The census counts that constructor line by line, #[cfg(test)] code included, and this file's row allows exactly one — the test_capability() helper every grant the file's own tests build takes its pair from. That row's own documentation names this exact drift:

a new test that inlines the constructor instead of calling this — still moves the count off 1 and still fires.

So the fix is the one the census asks for: the helper takes its pair from tests::test_capability(), now pub(super) because the helper sits outside mod tests (the claude_code and codex mirror tests reach it via lease_holding_for_test). The row, its count and its description are unchanged and true again.

It earns no row of its own because it decides nothing a caller reaches: it builds a BridgeGrant whose dispatcher returns an error, for tests that need a grant to hold a recorded result and need no Tokio runtime.

⚠ A plain grep overcounts this file: three hits, two sites

The report that flagged this listed three lines. The census sees two:

Line	What it is	Counted?
1086	inert_grant_for_test() — added by #228	yes → this PR removes it
2485	the doc comment on test_capability()	no — the census skips // lines (privacy_capability.rs:487-488), and it predates #228 (638e4c7c, already in this PR's base 7c96d796)
2502	test_capability() itself	yes — the site the row describes

A row written from grep -c (3) would have left the census red.

Verification

cargo test -p biorouter --test privacy_capability on this branch. bridge.rs now matches its row exactly, and the only remaining difference is the other PR's:

FOUND not WANT: ("CallCapability::sample(", "crates/biorouter/src/agents/workspace_inspector.rs", 2)
WANT not FOUND: ("CallCapability::sample(", "crates/biorouter/src/agents/workspace_inspector.rs", 1)
bridge.rs found: ("CallCapability::public_enforced(", ".../coding_agent/bridge.rs", 1)   ← equals the row

cargo test -p biorouter --lib -- providers::coding_agent providers::claude_code providers::codex passes (the helper's callers), and cargo fmt is clean. This binary is one CI does run since #239, so the census will start blocking as soon as the load-flaky esbuild test above it settles.

🤖 Generated with Claude Code

[Broccolito]

Measured: #258 + #259 together make the census green. Neither is green alone, so this is the only state that can be verified before merging.

Scratch branch = origin/main + this PR + the other, merged cleanly (d6552b80; #258 at 77394ab8, #259 at 3a131e1c):

cargo test -p biorouter --test privacy_capability
test result: ok. 4 passed; 0 failed; 0 ignored; 0 measured; 0 filtered out

Row state in the combined tree — one row per file, which the census requires since found is keyed (needle, file) with counts summed:

file	needle	count
agents/workspace_inspector.rs	sample(	2 (#258)
providers/coding_agent/bridge.rs	public_enforced(	1 (#259, row text untouched)

⚠ Expect each PR's own test (ubuntu-latest) to stay red until the other lands: #259 alone fails on workspace_inspector.rs, #258 alone on bridge.rs. On #259 that failure is already in CI, naming the file this PR does not touch. Either merge order is safe; main is red now and goes green once both are in.