test(e2e): isolate administrator roles and locale between journeys

2026-10-21 07:21:29 +02:00
parent dda1687345
commit b39a5af4de
10 changed files with 260 additions and 13 deletions
@@ -0,0 +1,26 @@
+# Shared native fixture isolation
+
+## Recorded failure
+
+The committed-source run on `b333ef55d5665223d2f570ec9681336fc3971c8a` completed20October19:15:16UTC with **103passed/248failed/0skipped/0flaky**, zero configured retries. This is a failed integrated run, retained in its raw JSON/log/trace evidence, not248 established application defects.
+
+Earlier zoom and route-census cases created synthetic administrators without removing their elevated roles. The Users case assumed the bootstrap administrator was the last one, attempted self-demotion, received204instead of409 and consequently removed the shared fixture's administrative access. Most later setup requests returned403. No server authorization failure is established: demotion was permitted because other administrators existed.
+
+Separately, Audit’s bilingual samples persisted Bokmål to the shared administrator. System’s English fixture seeded only localStorage; the application correctly hydrated authoritative `/auth/me` language and displayed `Prøv igjen`/`Innstillinger`, while the test expected English. Trace responses and accessible snapshots confirm this cause.
+
+An earlier Audit GET of the restored owned job328 returned500. It does not follow from later self-demotion. A read-only SQLite backup into an isolated diagnostic data root and an authenticated GET returned200; the combined successor case also passes. Root cause remains unproven. Do not close the intermittent read debt from these successful continuations. The ordinary browser backend now pipes Warning/error logs so future500responses retain server diagnostics without verbose SQL logging.
+
+## Bounded correction and preservation
+
+- Zoom and route census retain the exact ID of their own created administrator, remove only that synthetic account's roles in `finally` using bootstrap credentials, assert204and still dispose contexts/attach evidence on cleanup failure. No account or database is deleted.
+- Users first asserts the bootstrap is the sole administrator before attempting self-demotion. This prevents another future fixture leak from causing a cascading loss of test authority. Its original409, ordinary-user403, session revocation and deletion-disabled503assertions remain. Its promoted synthetic account is demoted in `finally` through the independent bootstrap context.
+- Audit, System and Users bootstrap login helpers explicitly save the language required by their fixture through the existing protected API. The bilingual cases retain every explicit per-sample update and assertion. Ordinary owners are unaffected.
+- No application/API/schema/security semantics, production data, model, renderer, test timeout, skip, expected-failure marker or configured retry is changed. No case is removed or reordered to hide the integration failure.
+
+## Successor evidence
+
+The combined ordinary run executes both zoom cases, all five route/Board cases, Audit3, System3and Users3in their normal order on one fresh fixture: **16/16PASS**,21October05:11:01–05:15:20UTC, zero skips/flaky/retries. This proves producers and consumers compose, including the last-admin precondition and original409. Raw artifacts are `.artifacts/phase7/current/ui/composition.json`, `composition.log` and `composition-results/`; the portable manifest records hashes.
+
+Two earlier composition attempts correctly refused to reuse port5302left by the parent's isolated diagnostic process. That exact task-owned process was identified and stopped; neither failed setup is a passing run. Source collection is post-run; the late stdout/log-level diagnostic change is qualified separately and receives fresh type/lint/full-run proof.
+
+Case inventories remain899frontend/101suites,1057backend,56sidecar and351ordinary browser. This repair adds0cases; the preceding confirmation repair accounts for the899th frontend case. Overlapping focused vectors are not summed. Full integrated successor execution and final post-run source reconciliation remain required. All57 PRES dispositions and33routes remain; production readiness is NO-GO, P5-13 withheld and Phase8 not started.