fix: harden typed metrics review findings

crates/crank-observability/tests/http_metrics.rs

@@ -5,6 +5,7 @@ use axum::{
     body::{Body, to_bytes},
     http::{Request, StatusCode, header},
     middleware,
+    response::IntoResponse,
     routing::get,
 };
 use crank_observability::{
@@ -32,10 +33,12 @@ async fn http_metrics_use_matched_routes_and_closed_labels() {
         .route(
             "/api/admin/workspaces/{workspace_id}/operations/{operation_id}",
             get(|| async {
-                (
-                    StatusCode::NO_CONTENT,
-                    [("x-trace-id", "0123456789abcdef0123456789abcdef")],
-                )
+                let mut response = StatusCode::NO_CONTENT.into_response();
+                response.extensions_mut().insert(
+                    crank_metrics::ExemplarTraceId::parse("0123456789abcdef0123456789abcdef")
+                        .unwrap(),
+                );
+                response
             }),
         )
         .layer(middleware::from_fn(record_http_request));

crates/crank-observability/tests/prometheus.rs

@@ -28,6 +28,35 @@ fn loopback_is_allowed_without_a_token() {
     assert!(!config.requires_authentication());
 }
 
+#[test]
+fn disabled_config_remains_disabled_without_auth_side_effects() {
+    let config = MetricsConfig::new(
+        false,
+        SocketAddr::new(IpAddr::V4(Ipv4Addr::UNSPECIFIED), 9464),
+        None,
+    )
+    .expect("disabled listener does not require a token");
+    assert!(!config.enabled());
+}
+
+#[tokio::test]
+async fn bind_collision_returns_a_typed_safe_error() {
+    let listener = tokio::net::TcpListener::bind((Ipv4Addr::LOCALHOST, 0))
+        .await
+        .unwrap();
+    let address = listener.local_addr().unwrap();
+    let config = MetricsConfig::new(true, address, None).unwrap();
+    let error = match MetricsSurface::for_test(config, identity())
+        .unwrap()
+        .bind()
+        .await
+    {
+        Ok(_) => panic!("occupied port must fail closed"),
+        Err(error) => error,
+    };
+    assert_eq!(error.to_string(), "failed to bind metrics listener");
+}
+
 #[tokio::test]
 async fn default_service_ports_bind_and_serve_real_metrics_listeners() {
     for (service, port) in [("admin-api", 9464), ("mcp-server", 9465)] {