[freeqaz]

Problem

A mutation sweep of the rules that landed on 10-14 (#2459 and #2473: the console create page and Agent page deciding stopped, failed, superseded or cancelled; #2461: isDevelopmentBrowserOrigin and its two call sites, plus the dev CA name constraints) found 8 conditions that no test pins. Main kills 51 of 66 mutants. Among the survivors:

• create page, C9: cancelledAgentState treating any 4xx Agent read as "gone" survives. Only a 404 means gone; a 403 must stay "unknown" and offer both paths.
• create page, C10: reading the Agent for every failed job, not just PROVISIONING_CANCELLED, survives. That would label each job that created its Agent and then failed after its retries "Provisioning stopped.".
• Agent page, N11: dropping the stopped "Completion recorded" text ("Not recorded: the Agent was stopped first...") survives.
• dev browser origin, D7/D10/D12: three mutants survive: adding 0.0.0.0 to the loopback set, matching localhost as a hostname suffix instead of the whole last label, and matching it anywhere in the hostname.
• createFastifyApp, D14: dropping the development.enabled requirement in developmentBrowserOrigin survives, so a valid loopback origin would be admitted outside development.

Change

Test-only. Each change goes into the test that already owns its rule.

• tests/browser/console-agents-2.test.mjs ("reports a stop before the first deployment and links the kept Agent") gains two steps:
  • a 403 on the kept Agent read shows the "If the Agent still exists..." guidance and the Open Agent link;
  • a PROVISIONING_DEPENDENCY_UNAVAILABLE job naming the kept Agent reads "Provisioning failed.", with no .provisioning-stopped span.
  • The job route takes an optional error override for that step.
• tests/browser/console-agent-state.test.mjs (stopped-by-owner test): asserts the stage-3 stopped text.
• tests/integration/configuration-startup.test.mjs: three refusal rows, http://0.0.0.0:3000, https://console.notlocalhost and https://localhost.example.com.
• tests/conformance/occ-api-security.test.mjs: { enabled: false, browserOrigin: "http://127.0.0.1:3000" } is refused.

Verification

• Mutation: 66 mutants, each run alone against its owning files, pinned to 2 CPUs.
  • Main kills 51; this branch kills 58.
  • All 8 real survivors (C9, C10, N11, D7, D10, D12, D14) are now killed by the new rows.
  • The 7 Go dev-CA mutants (generateDevelopmentTLS: MaxPathLenZero, critical name constraints, permitted domains, wildcard trim, lifetime, CA key file) were already killed by go test ./internal/occdev/.
• The 8 remaining survivors are equivalent or unreachable:
  • C1, C2 and C3 need a cancelled job with no agentId. Only cancelByAgent cancels, and it filters on the job's agent_id.
  • C5: AgentStatus is only active or deleting.
  • C14 and N6: an error code appears only on failed status.
  • C24: stopped or unknown implies an agentId.
  • D9: single-label localhost is caught by the loopback set first.
• Stability: each touched file passed 20/20 pinned to 2 CPUs: console-agents-2 at about 38 s per run, console-agent-state 22 s, configuration-startup 38 s, occ-api-security 22 s.
• Static checks: prettier --check and eslint --max-warnings 0 are clean on the four files.
• Not run: the packages/occ message rewrites in fix(console): clarify a stopped initial deployment #2459 and fix(console): show an owner's stop as stopped, not failed #2473 (provisioningProgress, the first-deploy REVISION_STOPPED sentence) are covered only by PostgreSQL integration tests, which were not run here. They were not mutated.
• fix(credentials): re-check a stored source's host at attach #2460: checkStoredHost was not mutated, because test(credentials): consolidate credential-source-api host and token_url rule tests #2471's sweep already kills its mutants.

Risks

Test-only. The new browser steps reuse the existing page and routes. Each step waits for text that differs from the step before it, so none can pass on stale DOM.

[clawsweeper]

ClawSweeper reviews are opt-in for maintainers. If a review is required, finish the work and validation first, then comment @clawsweeper review. Please avoid repeated requests while a review is queued or running; agents should not request reviews automatically.