[freeqaz]

Problem

Some browser fakes still answered with error codes the API never sends: RATE_LIMITED, ACCESS_DENIED, UNAVAILABLE, SERVICE_UNAVAILABLE, RESOURCE_NOT_FOUND and TOO_MANY_REQUESTS. Some also used a 429 on routes that have no 429. Two files built envelopes with their own helper, so the contract check in apiErrorResponse (#3612, #3615) never saw them. A Console change that matched one of the invented codes would pass these tests and break against the real API.

Change

Each fake now uses the code its route really sends, or the proxy page for a status the route never sends. Each test still checks what it checked before.

File	Was	Now
console-agent-channels	403 ACCESS_DENIED ×3 (Configuration PATCH ×2, access-binding POST); grant loop 403 ACCESS_DENIED / 429 TOO_MANY_REQUESTS	403 FORBIDDEN; 429 → proxyErrorResponse(429)
console-drafts-kept	429 RATE_LIMITED (Configuration POST, credential-source POST); local apiError helper	proxyErrorResponse(429); helper removed, apiErrorResponse
console-namespace-create	429 RATE_LIMITED (Namespace POST); 503 UNAVAILABLE ×2 (/observability, Namespace POST)	proxyErrorResponse(429); 503 DEPENDENCY_UNAVAILABLE
console-agents.test.ts	repository options 429 RATE_LIMITED	proxyErrorResponse(429) (case renamed "proxy rate limited")
console-agent-deploy-again	local failure() helper: 503 UNAVAILABLE, and a 429 deployment-record read with UNAVAILABLE	apiErrorResponse 503 DEPENDENCY_UNAVAILABLE / 403 FORBIDDEN; 429 → proxyErrorResponse(429)
console-agent-overview	503 SERVICE_UNAVAILABLE	503 DEPENDENCY_UNAVAILABLE
console-agent-state	404 RESOURCE_NOT_FOUND; 503 SERVICE_UNAVAILABLE; 503 UNAVAILABLE	404 NOT_FOUND; 503 DEPENDENCY_UNAVAILABLE
console-agents-2.test.ts	503 SERVICE_UNAVAILABLE ×2	503 DEPENDENCY_UNAVAILABLE

Where a test asserts a request ID, the fake keeps it.

Left for a follow-up, because open work touches these files:

• console-agent-detail.test.mjs:1511 and :2520 answer 403 ACCESS_DENIED. An in-flight console permissions change edits this file.
• console-agent-detail-2.test.mjs:514 answers a repeat Agent DELETE with 429 INVALID_REQUEST and no meta. It goes with the same follow-up.

Not changed: the diagnostics UNAVAILABLE check codes in console-agent-state are check results, not error envelopes. console.test.mjs uses the session route, not the API's error envelope.

Verification

All browser runs used a remote test VM, each in a private network namespace.

• All 8 changed files pass: 230/230.
• The 8 files pinned 20/20 at 2 CPUs each.
• The old answers no longer build: apiErrorResponse refuses every code removed here.
• Console mutants that match the old fake codes fail on this branch and pass on main, where the fakes hid them:
  • Namespace creation shows its rate-limit message only for code RATE_LIMITED (namespaces.mts). a rate-limited or malformed creation answer is reported fails on the branch and passes on main.
  • The shared refusal message treats a 403 as a denial only for code ACCESS_DENIED (list.mts message). Channel drawer does not grant Slack Secret access when Configuration save is rejected fails on the branch and passes on main.
• tsc (repo and tests), ESLint and Prettier pass on the touched files.

Risks

Test-only. No product, docs or suite-mapping change.

[clawsweeper]

🦞👀
ClawSweeper picked this up.

Pull request received. I will update this pull request when review starts.

ClawSweeper review complete

ClawSweeper finished reviewing this revision. The review result is being finalized.

View the workflow run.

[clawsweeper]

ClawSweeper status: review started.

I am starting a fresh review of this pull request: test(console): fake api refusals with codes the routes really send This is item 1/1 in the current shard. Shard 0/1.

This temporary status tracks the active review worker. The completed review will appear in the durable ClawSweeper review comment.

Crustacean status: shell secured, claws on keyboard, evidence pebbles being sorted.