test(a11y): gate the foreign-traffic, wardriving and areas analytics tabs

[dborup]

Problem

The last command of the "Run JS unit tests (packet-filter)" CI step, test-a11y-axe-routes-coverage.js (Kpa-clawbot#1706), fails on master:

axe ROUTES missing analytics tabs (issue #1706): areas, foreign-traffic, wardriving

The gate requires every data-tab button in public/analytics.js to be exercised by the axe-core browser gate (test-a11y-axe-1668.js). The Foreign Traffic, Wardriving and Areas tabs were added after the gate (July 2026) without matching ROUTES entries. The tabs are real — each has a case arm in the renderTab dispatch (public/analytics.js:316-318) — so the expectation is not stale: the axe gate simply never scanned these tabs.

This failure has been hidden until now because the same CI step stopped earlier, on the Kpa-clawbot#1648 M4 icon scan (fixed separately in #56).

Change

test-a11y-axe-1668.js only (+4/−1):

• Adds /analytics?tab=foreign-traffic, /analytics?tab=wardriving and /analytics?tab=areas to ROUTES, so the browser gate visits each tab, runs the existing mount assertion (tab active, content non-empty) and then axe.
• Adds the three tabs to REGISTERED_ANALYTICS_TABS, so the selftest's dispatch-arm reciprocity check covers them too.

Not changed: the coverage assertion, the selftest, the wait/mount logic, axe rules, the allowlist, workflows, production code.

Verification

All local, macOS arm64, Node v25.6.1 — not GitHub CI.

On this branch's HEAD (e3f57426, base e17377d8):

• test-a11y-axe-routes-coverage.js: fails on base with exactly the three tabs; passes on HEAD (declared=20 covered=20).
• test-a11y-axe-1668-selftest.js: passes (routes=29).
• node --check test-a11y-axe-1668.js and git diff --check: clean.

Local integration of master e17377d8 + #56 (52ae9d1c) + this change:

• The workflow's JS step (set -e + the 67 node commands, in workflow order): 67/67 passed. This result depends on fix(map): drop the M4-banned caret from a map.js comment #56; see "Merge order" below.
• Proto syntax check: passes. XSS --diff gate: passes.

axe browser gate (isolated local Go server on :13581 with a copy of test-fixtures/e2e-fixture.db, prepared like CI: freshen, seed, migrate; pinned playwright 1.58.2 / @axe-core/playwright 4.11.3 / axe-core 4.12.1; installed Google Chrome 151 via CHROMIUM_PATH with DNS restricted to localhost — CI uses Playwright's bundled Chromium with network access, so results may differ):

• The three new tabs: 12/12 cells clean (2 viewports × 2 themes × 3 routes).
• A separate diagnostic probe using the gate's navigation and wait confirmed each tab was active and loaded (no loading/error state, API calls 200) when axe ran:
  • Wardriving: populated content (329 elements, 4 tables).
  • Foreign Traffic: real section headings, but the fixture has no foreign traffic, so its lists are empty — no populated-data coverage.
  • Areas: the fixture has no configured Areas, so axe only sees the empty-state message — the data view is not covered. Populated coverage would need a fixture/config change, not made here.

Known limitations

• Full local axe gate is still red, on pre-existing UI problems (reproduced identically on master + fix(map): drop the M4-banned caret from a map.js comment #56 without this change, 2/2 runs):
  • /analytics?tab=scopes: duplicate-id on analytics-tbl-scopes-0 (4 cells).
  • /live desktop/light: color-contrast on the LIVE badge #vcrMode, 2.27:1 vs 4.5:1 (1 cell).
    These are not caused or fixed by this PR; they are being addressed separately.
• Merge order / Migrate emoji UI to Phosphor Icons (regular weight) — tracking Kpa-clawbot/CoreScope#1648: on its own, this PR's CI can still stop at the Migrate emoji UI to Phosphor Icons (regular weight) — tracking Kpa-clawbot/CoreScope#1648 M4 icon scan (command 55 of the JS step), because fix(map): drop the M4-banned caret from a map.js comment #56 is not merged yet. The 67/67 result above applies only to the local integration with fix(map): drop the M4-banned caret from a map.js comment #56.
• Not verified: Linux / GitHub CI for this change, the eslint step, the rest of the Playwright E2E suite, the Docker build, and later jobs.

🤖 Generated with Claude Code