fix(fullstack): re-seed on a bound in tier-2 realtime recovery checks (#1078)

* fix(fullstack): re-seed on a bound in tier-2 realtime recovery checks

The 1s settle (#1074) was not sufficient: postgres_changes has no
backfill, and a single seed that lands while the re-subscribed channel's
server-side binding is still activating is never delivered — 3/3 CI runs
timed out at the recovery assertion while local runs (higher latency,
larger natural slack) always passed. seedNoteUntilDelivered re-seeds up
to 3 times with a 7s delivery assertion per attempt: recovery means
delivery resumes, and each attempt still asserts real end-to-end
delivery. Verified locally against the real project: 14/14 green.

* fix(fullstack): unblock ci gates for the realtime reseed branch

- regenerate the public interface snapshot (sha-only drift for
  ./open-dropdown from the hygiene sweep's anchor sync; no public
  declaration changes)
- fullstack:cloudflare-config-check: grant --allow-read to the test
  invocation; the new queue-name parity test reads the workflow file

---------

Co-authored-by: DevBot <devbot@openelement.dev>

Author: SisyphusZheng

deno.json

@@ -62,7 +62,7 @@
     "fullstack:boundary-check": "deno run --allow-read --allow-run tools/check-fullstack-boundary.ts",
     "fullstack:migrations-check": "deno run --allow-read tools/check-supabase-migrations.ts",
     "fullstack:evidence-freshness": "deno run --allow-env --allow-net=api.github.com tools/check-evidence-freshness.ts",
-    "fullstack:cloudflare-config-check": "deno test tools/render-cloudflare-async-config.test.ts && deno task --cwd examples/supabase-cloudflare-starter build && deno task --cwd examples/supabase-cloudflare-starter nitro:build && deno run --allow-read --allow-write tools/render-cloudflare-async-config.ts examples/supabase-cloudflare-starter/wrangler.jsonc examples/supabase-cloudflare-starter/.wrangler-async.generated.json && deno run -A npm:wrangler@4.123.0 deploy --dry-run --config examples/supabase-cloudflare-starter/.wrangler-async.generated.json && rm examples/supabase-cloudflare-starter/.wrangler-async.generated.json",
+    "fullstack:cloudflare-config-check": "deno test --allow-read tools/render-cloudflare-async-config.test.ts && deno task --cwd examples/supabase-cloudflare-starter build && deno task --cwd examples/supabase-cloudflare-starter nitro:build && deno run --allow-read --allow-write tools/render-cloudflare-async-config.ts examples/supabase-cloudflare-starter/wrangler.jsonc examples/supabase-cloudflare-starter/.wrangler-async.generated.json && deno run -A npm:wrangler@4.123.0 deploy --dry-run --config examples/supabase-cloudflare-starter/.wrangler-async.generated.json && rm examples/supabase-cloudflare-starter/.wrangler-async.generated.json",
     "arch:check": "deno run --allow-read --allow-run tools/check-architecture-contract.ts",
     "type-safety:check": "deno run --allow-read tools/check-type-safety.ts",
     "deno-api:check": "deno run --allow-read --allow-env tools/check-deno-api-free.ts",

docs/release/public-interface-snapshot.json

@@ -438,7 +438,7 @@
           "reExportedNames": []
         },
         "./open-dropdown": {
-          "sha256": "ca5847021381c99054b74d11d24de01a5fdf818e5654bf22f66edc76de2f3238",
+          "sha256": "ee57f9a630f32d695b7869060e1132435d4f8b2e7caf7a326cc28e0360a84d7a",
           "publicDeclarations": [
             "export const tagName = 'open-dropdown';",
             "export class OpenDropdown extends OpenElement {"

tools/smoke-supabase-browser.ts

@@ -5,7 +5,7 @@
  * secrets through the runner environment. This script never prints or writes
  * those values; its report contains check names only.
  */
-import { chromium } from 'npm:playwright@1.59.1';
+import { chromium, type Locator } from 'npm:playwright@1.59.1';
 
 function required(name: string): string {
   const value = Deno.env.get(name);
@@ -32,6 +32,41 @@ async function record(check: string): Promise<void> {
   );
 }
 
+/**
+ * Seed a note via the service role until the subscribed island renders it.
+ * postgres_changes has no backfill: an insert that lands while the
+ * server-side binding is still activating (the join is already acked) is
+ * never delivered, so a single zero-notice seed false-fails on low-latency
+ * networks (CI runners near the provider). Recovery means delivery resumes —
+ * re-seed on a bound while keeping each attempt's delivery assertion intact.
+ */
+async function seedNoteUntilDelivered(
+  live: Locator,
+  marker: string,
+  title: string,
+): Promise<void> {
+  for (let attempt = 1; attempt <= 3; attempt++) {
+    const insert = await fetch(`${supabaseUrl}/rest/v1/notes`, {
+      method: 'POST',
+      headers: {
+        apikey: serviceRoleKey,
+        authorization: `Bearer ${serviceRoleKey}`,
+        'content-type': 'application/json',
+        prefer: 'return=minimal',
+      },
+      body: JSON.stringify({ user_id: userId, title, body: marker }),
+    });
+    if (!insert.ok) throw new Error(`Realtime seed failed with HTTP ${insert.status}`);
+    const delivered = await live
+      .locator('#live-events')
+      .getByText(marker, { exact: true })
+      .waitFor({ state: 'visible', timeout: 7_000 })
+      .then(() => true, () => false);
+    if (delivered) return;
+  }
+  throw new Error(`Realtime seed "${marker}" was not delivered after 3 bounded attempts`);
+}
+
 const browser = await chromium.launch();
 try {
   const context = await browser.newContext();
@@ -206,33 +241,8 @@ try {
     state: 'visible',
     timeout: 20_000,
   });
-  // Hosted Realtime acknowledges the join before the postgres_changes binding
-  // finishes activating server-side; a zero-slack insert can land inside that
-  // window and never be delivered. Low-latency CI runners hit the window,
-  // high-latency dev machines do not — give the binding a beat before seeding.
-  await page.waitForTimeout(1_000);
   const recoveredMarker = `browser-realtime-recovered-${runId}`;
-  const recoveredInsert = await fetch(`${supabaseUrl}/rest/v1/notes`, {
-    method: 'POST',
-    headers: {
-      apikey: serviceRoleKey,
-      authorization: `Bearer ${serviceRoleKey}`,
-      'content-type': 'application/json',
-      prefer: 'return=minimal',
-    },
-    body: JSON.stringify({
-      user_id: userId,
-      title: 'realtime recovery smoke',
-      body: recoveredMarker,
-    }),
-  });
-  if (!recoveredInsert.ok) {
-    throw new Error(`Recovered Realtime seed failed with HTTP ${recoveredInsert.status}`);
-  }
-  await live.locator('#live-events').getByText(recoveredMarker, { exact: true }).waitFor({
-    state: 'visible',
-    timeout: 20_000,
-  });
+  await seedNoteUntilDelivered(live, recoveredMarker, 'realtime recovery smoke');
   await record('browser-realtime-offline-online-recovery-delivers');
 
   const refreshedSession = await fetch(`${supabaseUrl}/auth/v1/token?grant_type=password`, {
@@ -250,32 +260,8 @@ try {
     (element, token) => element.setAttribute('data-access-token', token),
     refreshedAccessToken,
   );
-  // Same settle as the reconnect case above: the server must apply the new
-  // access token before the next insert is evaluated under RLS.
-  await page.waitForTimeout(1_000);
-
   const refreshedMarker = `browser-realtime-refreshed-${runId}`;
-  const refreshedInsert = await fetch(`${supabaseUrl}/rest/v1/notes`, {
-    method: 'POST',
-    headers: {
-      apikey: serviceRoleKey,
-      authorization: `Bearer ${serviceRoleKey}`,
-      'content-type': 'application/json',
-      prefer: 'return=minimal',
-    },
-    body: JSON.stringify({
-      user_id: userId,
-      title: 'realtime refreshed token smoke',
-      body: refreshedMarker,
-    }),
-  });
-  if (!refreshedInsert.ok) {
-    throw new Error(`Refreshed-token Realtime seed failed with HTTP ${refreshedInsert.status}`);
-  }
-  await live.locator('#live-events').getByText(refreshedMarker, { exact: true }).waitFor({
-    state: 'visible',
-    timeout: 20_000,
-  });
+  await seedNoteUntilDelivered(live, refreshedMarker, 'realtime refreshed token smoke');
   await record('browser-realtime-refreshed-jwt-delivers');
 
   await live.evaluate((element) => element.remove());