test(mcp): align fixtures with advertised tool arguments

tests/test_integration.c now sends trace_path depth instead of the never-advertised max_depth key. tests/test_depindex.c exercises dependency-aware trace_path through its supported graph contract without the search-only include_dependencies switch.

tests/test_input_validation.c requires strict rejection and supported-argument guidance for query_graph label. tests/test_index_resilience.c rebuilds its index_status arguments after reusing the buffer for query_graph, so it verifies persisted ignored paths instead of an unrelated validation error.

Verification: affected ASan/UBSan suites passed 6 index_resilience, 36 depindex, 52 input_validation, and 28 integration tests. The escalated full ASan/UBSan suite passed 7204 tests with one Windows-only skip and zero failures; scripts/check-source-safety.sh passed.
Signed-off-by: Andrew Hundt <ATHundt@gmail.com>

tests/test_depindex.c

@@ -341,16 +341,17 @@ TEST(search_graph_include_deps_marks_source) {
     PASS();
 }
 
-TEST(trace_path_marks_boundary) {
+TEST(trace_path_dependency_graph_uses_supported_schema) {
     char tmp[256];
     cbm_mcp_server_t *srv = setup_dep_query_server(tmp, sizeof(tmp));
     ASSERT_NOT_NULL(srv);
 
-    /* trace_path with include_dependencies should mark boundary */
+    /* Dependency nodes share the project graph and trace_path follows its
+     * selected edge set directly; it has never advertised a separate
+     * include_dependencies switch. Verify the supported call remains safe. */
     char *raw = cbm_mcp_handle_tool(srv, "trace_path",
                                     "{\"function_name\":\"process_data\","
-                                    "\"project\":\"dep-query-test\","
-                                    "\"include_dependencies\":true}");
+                                    "\"project\":\"dep-query-test\"}");
     char *resp = extract_text_content_di(raw);
     free(raw);
     ASSERT_NOT_NULL(resp);
@@ -1108,7 +1109,7 @@ SUITE(depindex) {
     /* AI grounding: core vs dependency disambiguation */
     RUN_TEST(search_graph_default_excludes_deps);
     RUN_TEST(search_graph_include_deps_marks_source);
-    RUN_TEST(trace_path_marks_boundary);
+    RUN_TEST(trace_path_dependency_graph_uses_supported_schema);
     RUN_TEST(get_code_snippet_dep_shows_provenance);
 
     /* External node marking */

tests/test_index_resilience.c

@@ -638,6 +638,9 @@ TEST(index_not_indexed_by_design_reported) {
     char *resp2 = cbm_mcp_handle_tool(lp.srv, "index_repository", iargs);
     ASSERT_NOT_NULL(resp2);
     free(resp2);
+    /* qargs was repurposed for query_graph above. Rebuild the index_status
+     * request instead of accidentally testing strict rejection of graph/query. */
+    snprintf(qargs, sizeof(qargs), "{\"project\":\"%s\"}", lp.project);
     char *sresp2 = cbm_mcp_handle_tool(lp.srv, "index_status", qargs);
     ASSERT_NOT_NULL(sresp2);
     ASSERT_NOT_NULL(strstr(sresp2, "secret.py"));

tests/test_input_validation.c

@@ -539,16 +539,16 @@ TEST(g1_summary_mode_has_results_key) {
 }
 
 /* ══════════════════════════════════════════════════════════════════
- *  CQ-3: Cypher + filter params produces warning
+ *  CQ-3: Cypher + search-only filter is rejected actionably
  * ══════════════════════════════════════════════════════════════════ */
 
-TEST(cq3_cypher_with_label_warns) {
+TEST(cq3_cypher_with_label_rejected) {
     char tmp[256];
     cbm_mcp_server_t *srv = setup_validation_server(tmp, sizeof(tmp));
     ASSERT_NOT_NULL(srv);
 
-    /* format:"json" — the ignored-filters warning is part of the legacy JSON
-     * response shape (the TOON default only carries Cypher-engine warnings). */
+    /* query_graph has never advertised label. Strict validation prevents an
+     * apparently successful call from silently ignoring the search filter. */
     char *raw = cbm_mcp_handle_tool(srv, "query_graph",
         "{\"cypher\":\"MATCH (n:Function) RETURN n.name LIMIT 5\","
         "\"label\":\"Class\",\"format\":\"json\"}");
@@ -556,8 +556,8 @@ TEST(cq3_cypher_with_label_warns) {
     free(raw);
     ASSERT_NOT_NULL(resp);
 
-    /* CQ-3: Should warn that label is ignored in Cypher mode */
-    ASSERT_NOT_NULL(strstr(resp, "warning"));
+    ASSERT_NOT_NULL(strstr(resp, "unknown argument 'label'"));
+    ASSERT_NOT_NULL(strstr(resp, "supported arguments"));
 
     free(resp);
     cbm_mcp_server_free(srv);
@@ -1565,7 +1565,7 @@ void suite_input_validation(void) {
     RUN_TEST(f15_valid_direction_succeeds);
     RUN_TEST(trace_invalid_mode_errors);
     RUN_TEST(g1_summary_mode_has_results_key);
-    RUN_TEST(cq3_cypher_with_label_warns);
+    RUN_TEST(cq3_cypher_with_label_rejected);
     RUN_TEST(ix2_status_resource_format);
     RUN_TEST(pattern_or_search_graph);
     RUN_TEST(pattern_or_search_graph_normalizes_valid_regex_shaped_glob);

tests/test_integration.c

@@ -373,7 +373,7 @@ TEST(integ_mcp_trace_path) {
     char args[256];
     snprintf(args, sizeof(args),
              "{\"function_name\":\"Compute\",\"project\":\"%s\","
-             "\"direction\":\"outbound\",\"max_depth\":3}",
+             "\"direction\":\"outbound\",\"depth\":3}",
              g_project);
 
     char *resp = call_tool("trace_path", args);