test: revive the two dead root test files (#170)

[adminopenclaw8-sketch]

Relates to #170

Both dead root test files are now real tests that run in CI. No production code changed, and no npm dependencies were added.

1. test-rx-coverage-escape.js: rewritten

Why it failed. It cut the leaderboard row builder out of public/rx-coverage.js by marker strings. The end marker (o.nodes + '</span></div>';) no longer exists, so it stopped with could not locate row-builder end. This still reproduces on master 84c637ea.

Now. It loads the real public/rx-coverage.js in a vm context, the same way test-issue-124-rx-coverage-viewport.js does, with the real escapeHtml from public/app.js. It then mounts the page, answers /api/rx-leaderboard with hostile observers and parses the rendered #rxBoard rows strictly. Each row's opening tag must contain exactly the expected double-quoted attributes, with no raw <, > or " in any value. The name span must contain no raw quotes or brackets, and every & must start an entity.

#	Check
1	Names containing <script>, ", ', &, "><img src=x onerror=…> and '><svg onload=…> are escaped in the label, data-name and aria-label. The exact escaped forms are checked.
2	A hostile pubkey is escaped in data-rx and in the unnamed-label fallback (pubkey.slice(0, 10)…).
3	A selected observer (rx= in the URL) is still escaped (class="rxb-row sel", aria-pressed="true").
4	Rows keep role="button", tabindex="0" and aria-pressed (kept from the old test).

Registered in test-all.sh and in the JS unit step of deploy.yml.

Mutants (run on a copy, all red)

Mutant	Result
escapeHtml(o.name) removed from the label	red (2 cases)
escapeHtml removed from the pubkey label fallback	red (1)
escapeHtml removed from data-rx	red (2)
escapeHtml removed from data-name	red (2)
escapeHtml removed from aria-label	red (3)
all escaping removed from the row builder	red (3)
escapeHtml in app.js without ' / & / " escaping	red (1 / 2 / 3)

2. test-pr-1490-live-map-gpu-animations-e2e.js: ported, not deleted

Decision: port. The file's checks are not covered elsewhere:

• test-issue-1599-replay-freeze-e2e.js (in CI) drains a single animation after a replay handoff. It does not check that the engine wakes and then sleeps again, the 20-line burst, the recentPaths cap or the panes.
• test-live-anims.js and test-issue-1485-live-anim-z.js only match strings in the live.js source. Neither is in deploy.yml, and both already fail on master (see below).
• test-live.js and test-e2e-playwright.js do not touch _liveTestSeams, isAnimating or recentPaths.

Now. The test uses the plain playwright API like the other *-e2e.js files: chromium.launch, a local step helper and CHROMIUM_REQUIRE. For each viewport, desktop 1400×900 and mobile 375×812, it:

1. loads /#/live and waits until init is done (_liveWSHandler()) and the engine is idle;
2. checks that the animation canvas sits on .leaflet-animations-pane (z-index 625);
3. fires 20 lines through window._liveDrawAnimatedLine and checks that all 20 are queued and the engine wakes;
4. checks that they drain to 0, with the measured time logged and a 5 s bound;
5. checks that recentPaths is at most 5 in the frame where the queue empties (20 > 5, so the cap actually runs);
6. checks that the engine goes back to sleep;
7. checks that the fading polylines render on the animations pane;
8. checks that there are no page errors.

The drain is driven by awaiting requestAnimationFrame inside the page, as test-issue-1599 does.

Changes from the original:

• The old fade-pane assertion counted svg path, canvas in the pane, which the animation canvas alone satisfies. The test now looks for the Leaflet renderer canvas (canvas.leaflet-zoom-animated) that the fades create on that pane.
• The old 1500 ms drain bound is now 5000 ms, so slow CI runners and the instrumented frontend have headroom. Locally the drain takes about 670–680 ms.

Registered in the Playwright E2E step, right after test-issue-1599-replay-freeze-e2e.js.

Mutants (each public/live.js mutant served from a copy of public/, all red)

Mutant	Result
isAnimating = false removed from the empty-queue branch	red: "engine goes back to sleep" (desktop + mobile)
recentPaths cap 5 → 50	red: "recentPaths grew to 20"
pane: 'animationsPane' removed from both fading polylines	red: "no Leaflet renderer canvas on .leaflet-animations-pane"
finished animations never spliced	red: drain (count=20) + sleep
animation canvas appended to overlayPane	red: "no <canvas> on .leaflet-animations-pane"
wake logic in drawAnimatedLine disabled	red: wake, drain, paths, fade pane

Local verification

The server was built from this head, using CI's fixture recipe on a scratch copy: freshen-fixture.sh, the Kpa-clawbot#1486/Kpa-clawbot#1791 seed block from deploy.yml, corescope-migrate and seed-2073-route-adverts.sql.

Run	Result
test-pr-1490-…-e2e.js, plain public/	14/14
test-pr-1490-…-e2e.js, public-instrumented/ (as in CI), 3 runs	14/14 each
test-issue-1599-replay-freeze-e2e.js (neighbour)	3/3
test-rx-coverage-escape.js	4/4
test-issue-124-rx-coverage-viewport.js	13/13
test-live.js	110/110
test-packet-filter.js / test-aging.js	92/92, 19/19
test-frontend-helpers.js	705 passed, 2 failed (the known favStar baseline)

test-all.sh stops at line 18 on the favStar baseline (set -e), so I ran each of its node lines separately:

• this branch: 93/105 pass;
• master 84c637ea: 92/104 pass.

The same 12 files fail on both. The one extra pass on this branch is test-rx-coverage-escape.js. The 12 pre-existing local failures are out of scope here: test-frontend-helpers, test-channel-psk-ux, test-analytics-channels-integration, test-observers-headings, test-issue-1648-m3-emoji-scan, test-issue-1648-m6-final-sweep, test-issue-1648-m6-lint-self, test-issue-1438-customizer-mcrole, test-issue-1446-cb-preset-cascade, test-issue-1470-node-tile-helper, test-issue-1485-live-anim-z and test-naive-banner-tone.

deploy.yml

There are two added lines and nothing else. The fork guards are unchanged: 9 × github.repository == 'Kpa-clawbot/CoreScope' on both base and head.

@@ -194,6 +194,7 @@ jobs:
           node test-issue-124-rx-coverage-viewport.js
+          node test-rx-coverage-escape.js
           node test-issue-125-live-toggles-wiring.js
@@ -540,6 +541,7 @@ jobs:
           CHROMIUM_REQUIRE=1 BASE_URL=http://localhost:13581 node test-issue-1599-replay-freeze-e2e.js 2>&1 | tee -a e2e-output.txt
+          CHROMIUM_REQUIRE=1 BASE_URL=http://localhost:13581 node test-pr-1490-live-map-gpu-animations-e2e.js 2>&1 | tee -a e2e-output.txt
           CHROMIUM_REQUIRE=1 BASE_URL=http://localhost:13581 node test-issue-1648-m1-icons-e2e.js 2>&1 | tee -a e2e-output.txt

Not covered

• I did not run the rx-coverage leaderboard in a real browser. The escape test is a vm render test of the real page module.
• I did not check Firefox or WebKit. The E2E runs only in Chromium, like the rest of the E2E step.

🤖 Generated with Claude Code