test(host): two read-only window assertions stay green when the read itself is broken #2847

Implementation: FlyBot (ours) — PR follows within 24h. Do not pick up without a pickup-ok comment on this issue.

Written-by: FlyBot Lead
Claimed-by: FlyBot Lead
Claim-Id: c2c105030e81439c913e450dcb9015cb
Branch: dev/5-readonly-reads-assertions
Base: 6b4c53f
At: 2026-11-11T08:17:29Z

Implementation: FlyBot (ours) — PR follows within 24h. Do not pick up without a pickup-ok comment on this issue.

What is wrong

Two assertions in core/test/readonly-window-reads.test.js cannot fail on the defects they claim to guard:

1. The tasks row only checks value.some(task => task.id === 'task-1'). A view that drops title from every card, or a list that grows duplicate rows, still passes.
2. The project-board metrics row only checks Object.values(...).every(v => v === null). [].every() is vacuously true on {}, so a header with no numbers at all (metrics: {}) still passes.

Reproduced on 40f59a12 (base = live main)

Red first, twice, with the read path mutated in a throwaway tree, then restored:

• mutation A — core/src/host/tasks.js view() drops title (title: undefined);
• mutation B — plugins/project/src/project-metrics.js emptyMetrics() returns ({}).

Old assertions × broken tree, both runs: # tests 3 / # pass 3 / # fail 0 (595ms / 584ms) — the blind spot is real.

New assertions × broken tree, both runs: # fail 1 with two failing subtests, tasks: {"ok":true,"value":[{"id":"task-1","ownerBotId":"a","column":"waiting","status":"open",…}]} (no title) and metrics.metrics key set empty. Restored source, new assertions × two runs: # tests 3 / # pass 3 / # fail 0.

Expected behaviour

• tasks: assert Array.isArray, length === 1, and that the card carries its own id, title, column, queueRole, status.
• project-board: replace "all values are null" with exact key-set equality — issueCloseMedianMs, issuesClosedToday, issuesOpenedToday, prMergeMedianMs, prsMergedToday, prsOpenedToday, taskDoneMedianMs — plus all values null, keeping ok === false and reason === 'no-credentials'.

Scope

• core/test/readonly-window-reads.test.js (+10/−1) and its overlay entry patches/ds-bot/files/test/readonly-window-reads.test.js, which generate must rewrite (whole-file overlay, same as core: the read-only reads test passes on a dry answer — assert each row's own key #2280); after generating, diff -q between the two copies is identical and ds-bot-patches check reports ok 10 patches apply cleanly + ok core/ equals ds-bot/ + patches/ds-bot/.
• No source change, no client bundle, no changelog fragment (test-only, no user-visible behaviour change).

Risk tier: risk-tier: T1; basis: core/test/readonly-window-reads.test.js=T1, patches/ds-bot/files/test/readonly-window-reads.test.js=T1 (10 lines / 1 file + 1 generated overlay). T1 merges green without a Verdict.

Dedup

readonly-window-reads in title/body: 86 hits, all closed — the read-only window series #2264/#2267/#2269/#2273/#2275/#2306, the Reload lines #2521/#2523/#2247, and test-flake #2814; none about these two assertions. empty metrics assertion: 5 hits, all closed and unrelated (#1885, #2814, #1326, #2829, #1219). No open issue or PR covers this.

Bot: FlyBot Dev-5