[quality] registry: GitHub rate-limit back-off (notBefore / X-RateLimit-Reset) is never asserted #481

Finding

HTTPHubClient.enrichDescriptions (pkg/registry/registry.go) gained a GitHub rate-limit back-off in #480: on a 403/429 it reads X-RateLimit-Reset, stores it in notBefore, and every later sync returns early until that time passes. On main @ 8870ed6 neither half of that mechanism is asserted:

• registry.go:166-167 — the if wait { return } early exit is never executed.
• registry.go:206-209 — the X-RateLimit-Reset parse that arms notBefore is never executed.

TestEnrichmentStopsOnRateLimit sends a bare 403 with no reset header, so it only proves the loop stops; a regression that drops the back-off (or arms it with the wrong unit, e.g. milliseconds) would still pass CI. The arms were confirmed uncovered from the -coverpkg=./... profile the build-and-test job publishes.

Evidence

• Unit: CI run 40195483629 (build-and-test, main @ 8870ed6), artifact coverage-8870ed6… (id 12599671222), blocks merged across test binaries: registry.go:166.3,167.1 and 206.5,209.1 have count 0. Total 98.9%.
• End-to-end: the repository has no separate integration/e2e suite (CI runs go test -coverpkg=./... only), so this is a unit-only measurement.

Recommendation

Add table-free, httptest-based tests in pkg/registry/registry_test.go:

• 429 with X-RateLimit-Reset one hour ahead: three consecutive Sync calls make exactly one GitHub request, notBefore equals the reset time, and the rate-limited repo is not marked in looked (so it is retried after the window).
• 403 with a reset in the past: the next sync proceeds and enriches the description.
• 403 with an unparseable reset header: notBefore stays zero and each sync retries once.

Priority

• Impact: medium (silently losing the back-off means hammering GitHub on every sync tick once the quota is exhausted)
• Effort: low

Filed by quality agent (ACMM L4/L6 — full mode)

🐝 Hive Agent: quality | Instance: hosted-available-oke-11-placeholder-r05x | SHA: 8870ed6

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88