test: two dead test files — rx-coverage-escape never passed, pr-1490 GPU-animation e2e needs an uninstalled package #170

Summary

Two test files in the repo root never run in CI and fail when run locally, so they give no protection. Found by the #150 work (PR #169), which listed them as pre-existing failures. Neither is registered in test-all.sh or .github/workflows/deploy.yml on master 727efca0.

1. test-rx-coverage-escape.js: fails at its own source-extraction step

What it does: it reads public/rx-coverage.js as text, cuts out the leaderboard row builder by searching for marker strings, and tests that the builder escapes HTML (an XSS guard for observer and node names).

What happens: AssertionError: could not locate row-builder end in rx-coverage.js (line 24). The marker it looks for does not exist in rx-coverage.js.

When it broke: I ran the test against its own public/rx-coverage.js at three points:

• 22fe929d, the commit that added it (upstream #1728, 2026-06-19);
• 1ab283a2~1, just before fix(rx-coverage): honour configured defaults and save an independent viewport #136;
• master 727efca0.

It fails the same way at all three, so it has never passed in this fork. It is not a regression from #136 or #1860.

Fix:

• Rewrite the extraction so it matches the current code. Better still, load rx-coverage.js in a vm context the way test-issue-124-rx-coverage-viewport.js does, and test the real row builder rather than a text slice.
• Keep the XSS assertions: names containing <script>, " and & must render escaped.
• Register the file in test-all.sh and in the JS unit step of deploy.yml.
• Show that a mutant which removes the escaping turns it red.

2. test-pr-1490-live-map-gpu-animations-e2e.js: depends on a package that is not installed

What happens: line 1 is require('@playwright/test'). package.json only has playwright and @axe-core/playwright, so the file cannot load locally or in CI.

The file came in with bf8bb872 (upstream #1514/#1520, live canvas-animation cleanup) and was never wired into CI.

Fix (pick one and say why):

• Port it to the plain playwright API used by the other test-*-e2e.js files (chromium.launch, a local test() helper), and register it in the Playwright E2E step. This is preferred: no new dependency.
• Or delete it, if its checks are already covered elsewhere. Name the covering test.

Do not add @playwright/test as a dependency without asking (AGENTS.md).

Acceptance criteria

• Both files either run green in CI or are removed with the reason recorded.
• A kept file has a mutant that turns it red, which proves it tests something.
• Fork guards in deploy.yml are unchanged: 9 × github.repository == 'Kpa-clawbot/CoreScope'.
• No new npm dependencies.

Relates to #150, #169.