stack/agents/researcher/work/queue-97/build.md

Row 97 (#1591): Row 95 follow-up, Board tests fail fast, README lists every redirect

Owner: Researcher. Reviewers: Darkwing and Filbert. Brief: docs/plans/2026-10-12_pm-test-fixes.md, "Row 95 follow-up". Built in a scratch worktree at base 3bd3f85c (a baseline worktree at the same commit for the before column). Between 3bd3f85c and HEAD 646e3f77 nothing changed on the three candidate paths. Nothing under packages/webui/src/ changes; nothing goes live; no restart.

Candidate

candidate-manifest.sha256 lists three files, repo-relative, hashed from the candidate worktree. build.patch is git diff of the same three against 3bd3f85c (sha256 22150cee5aad48de22a041e78d7263d91f1f44959c78720b35393757b054ea24).

• packages/webui/tests/browser-edge.test.mjs
• packages/webui/tests/board-held.test.mjs
• packages/webui/README.md

N1: the toggle step fails fast

The wait for the first /api/board request after the toggle is raced against a 5 s timer. On a miss the test throws "Show machine sessions made no /api/board request in 5 s", and the existing finally closes the held responses, the browser and both servers.

Proof, mutant 19 (toggle on reads nothing), browser-edge.test.mjs alone, 30 s limit:

	result
baseline	STALLED, no exit at 30 s
candidate	exit 1 in 5.8 s

After each run, no browser or node process was left (checked through /proc cwd links, 0 found).

N2: option taken, the test reaches a poll tick, plus the timers themselves

Reaching a tick alone cannot kill mutants 13 and 27. After a tick, the guards downstream of schedule() (refresh()'s !machine, render()'s out()) stop the fetch, so nothing the page sends changes. What the mutants do change is whether the 10 s timer is armed. So the test does two things:

1. The page stub wraps window.setTimeout. A call with a delay of 10000 is recorded in window.__polls ('board' for refresh, 'bus' otherwise), and in test 2 it is run after 150 ms. The 600 ms settle in test 2 then spans several ticks, so the comment and README claim about polls is true.
2. Both tests assert on the recorded timers. Test 1: none for the board with the toggle off, also across Pause and Resume and after the ?off reload, while the bus views do poll. Test 2: no new timer after sign-out, including after a Pause and a Resume forced past disabled. The second click is needed: the first only pauses, and the bus schedule() is reached with paused() false only on the resume.

Mutants (mutants.py, outputs mut-base.txt and mut-candidate.txt):

mutant	baseline	candidate
13 schedule polls with the toggle off	ALIVE	killed
27 bus schedule polls signed out	ALIVE	killed
12 refresh reads with the toggle off	killed	killed
26 bus render without its signed-out guard	killed	killed
19 toggle on reads nothing	STALLED (30 s)	killed (5.8 s)
14 refresh without its signed-out guard	ALIVE	ALIVE

Mutant 14 is an equivalent mutant and is not claimed: the guard in refresh() is redundant behind api(), which already returns early when signed out, so no observable differs. It was alive in the baseline for the same reason and is outside N2's list. Sources were restored byte for byte (sha256 of app.js and bus.js checked at the end of both runs).

N3: the README

The test paragraph now names the six redirected requests: the board (/api/board), agents, /api/conversations, /api/seen, /api/queue and the send. It also says that the tests record the 10 s poll timers, that test 2's timers fire after 150 ms, and that browser-edge.test.mjs fails in 5 s if the toggle makes no board request.

Suites (candidate worktree, sequential, suites.txt)

• webui node --test tests/: 101 pass, 0 fail.
• control-board node --test tests/: 124 pass, 0 fail.
• scripts/test-auth.sh 15/0, test-conductor.sh 17/0, test-config.sh 24/0, test-extension-package.sh 18/0, test-foundation.sh 44/0, test-queue.sh 27/0, test-release.sh 14/0, test-task.sh 98/0.
• scripts/test-discord.sh: 57 pass, 1 fail: "pi binary present at node_modules/.bin/pi for the extension checks". The same single failure on the baseline worktree. A scratch worktree has no node_modules; this is not caused by the candidate. Sage's gate rerun in the canonical checkout is the real check.
• test-queue.sh skips its verify/render check because a worktree is not the queue's canonical root.

Secrets scan

build.patch, mutants.py, the mutant outputs and suites.txt were scanned for token, secret, password, api key and private key markers. The only match is a test title ("seeded secrets ...").

Assumptions

• Test 2's 150 ms is a test-only value; the 10 s in the product is untouched.
• The forced Pause click is a deliberate poke at a disabled control, commented in the test.