Adversarial re-review of df275bb found the two-guard ready-flip fix still left a
narrow double-race open, plus test-hygiene drift from the banUser param removal.
MED — residual stale-keepsake race the `export_released_at` guard alone missed
The flip relied on two guards defeating two clearers: the `release_seq` EXISTS
check (vs a re-release bump) and `export_released_at IS NOT NULL` (vs open_event's
clear). But release_gallery re-arms `export_released_at = NOW()` and bumps
`release_seq` as SEPARATE statements, so a stale worker's flip landing in the gap
between them satisfies BOTH guards (released re-armed, seq not yet bumped) and
resurrects a pre-reopen keepsake — the next re-release then skips regeneration and
serves an archive missing the reopen-window uploads.
Root-cause fix: `open_event` now bumps every `export_job.release_seq`, making a
reopen a supersession point symmetric with a re-release. A worker that captured the
pre-reopen seq can never match its `release_seq`-guarded finalize/flip again,
regardless of when the re-release re-arms `export_released_at`. The released-anchor
guard stays as defense-in-depth. Added a deterministic e2e asserting the reopen
bumps the seq (the invariant that closes the race without depending on
sub-millisecond worker timing).
LOW
- Gate the `export-progress: 100` SSE + `prune_stale_export_files` on the ready-flip
actually flipping (rows_affected > 0). A superseded worker no longer advertises a
misleading 100% or prunes on a fresh generation's behalf.
- moderation.spec.ts: the two ban tests had become byte-identical after the
hide_uploads param removal; drop the one whose "hide_uploads=true" title no longer
matched what it exercised, keep the accurate "always hides" test.
- host-dashboard page-object: drop the dead `banUser(hideUploads)` param + its
checkbox branch (the UI no longer renders that checkbox — a latent hang trap).
- sse-eviction.spec.ts: rename the test whose title referenced the removed flag.
Verified: backend 40 tests, e2e 156 passed / 1 skipped on chromium-desktop
(incl. the new reopen-supersession regression).
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Follow-ups from the code review of the test-quality batches:
- Consolidate duplicated helpers into e2e/helpers/: seed.ts (seedUpload,
seedComment, listComments, findFeedRow) and sse.ts (mintSseTicket, openStream,
trackStreamOpens). Refactor authorization-deep, xss-injection, like-comment,
sse-ticket-abuse, ddos, sse-realtime, multi-tab, and SseListener to use them —
the upload/comment/ticket-flow contracts now live in one place each instead of
being re-inlined across 3–7 specs.
- xss-injection display-name loop: it navigated to /feed (which renders uploader
names, not the viewer's) so "nothing fired" passed vacuously — the payload was
never rendered. Now navigate to /account (the actual sink) and add a render
guard asserting the payload reached the DOM as escaped text before checking
__xssFired.
- sse-realtime reconnect: snapshot the stream-open count AFTER backgrounding, so
the "new connection" assertion is attributable to the foreground event and can't
be satisfied by a spurious native/error reconnect before the toggle.
- recover-page: correct the comment (auto-submit is the onPinInput handler, not an
$effect).
44 affected specs verified green.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
The running test container had been built from an older tree; rebuilding it to
pick up current app code surfaced several tests that predated shipped
security/UX features:
- file-upload-attacks / rate-limit: assert the magic-byte rejection wording and
upload a real decodable JPEG (a zero-buffer is now rejected at the boundary).
- ddos: open SSE via the single-use /stream/ticket flow, not the dead ?token=.
- recover-page / join: the PIN field auto-submits on the 4th digit, so don't
race an explicit submit click against the ensuing navigation.
- gestures-doubletap / sheet-escape: target the lightbox by aria-labelledby and
anchor the radio accessible-name match at the start (gated dialog semantics).
playwright.config: camera/mic/clipboard are Chromium-only permissions (they threw
"Unknown permission: camera" on firefox/webkit and failed the test at context
creation); grant them per-Chromium-project. firefox-android drops the
unsupported isMobile flag.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
