fix(live): never paint from cache on paused load — data only when run is active

Root cause: the synchronous optimistic reveal in DOMContentLoaded trusted the
localStorage snapshot (_cachedRunActive → rehydrateFromCache). But a snapshot
persisted mid-run keeps state.status:'running' after the run is stopped —
persistence halts on stop, so the cache is never updated to a terminal state.
On a paused hard-refresh that stale 'running' cache made the page:
  - paint the last run's rows + restore the TESTED/progress counters behind the
    opaque paused overlay (visible if you delete the overlay in devtools), and
  - set _liveState to the stale running state, so applyLiveModeBadge saw
    active=true and fired /api/public/sdk-info — all with no network proof that
    a run was actually live.

The cache can't know the run stopped without asking the server, so the
cache-only synchronous decision is unsound. Remove it entirely: nothing paints
until checkBroadcastState polls /api/broadcast and gets activeRun=true, which
runs connectLiveWork (the sole paint path: cache rehydrate → render → SSE →
live-state → batch → stats). The paused overlay ships shown in markup, so a
paused page stays covered AND data-free from first paint. Deleted the now-dead
_cachedRunActive(). Cost: a genuine mid-run refresh shows the overlay for one
/api/broadcast round-trip before connectLiveWork paints — correct over stale.

Tests: live-load-gating [0] now asserts _cachedRunActive is gone and there's no
optimistic reveal (with a hard regression guard that exits non-zero if either
returns); rehydrate/seed active-gating tests unchanged. Full suite green.

Author: Sentinel-Bluebuilder

live.html

@@ -964,21 +964,18 @@ <h1 class="live-page-title">
       if (_liveResultsNext) _liveResultsNext.addEventListener('click', () => liveGoPage(1));
       const _liveSearchInput = document.getElementById('liveSearchInput');
       if (_liveSearchInput) _liveSearchInput.addEventListener('input', (e) => setLiveSearch(e.target.value));
-      // Decide the overlay SYNCHRONOUSLY from the last-known snapshot — BEFORE the
-      // async broadcast check — so the page never flashes the live shell while
-      // that fetch is in flight. The overlay ships SHOWN in the markup, so a
-      // stopped page stays fully covered from the very first paint. Only when the
-      // cached snapshot was an active run (operator refreshing mid-run) do we
-      // paint it and reveal the work up-front; the single poll below confirms or
-      // corrects, and fans out to the work endpoints only if a run is live.
-      if (_cachedRunActive()) {
-        rehydrateFromCache();
-        renderTable();
-        renderLiveStats();
-        showPaused(false);
-      }
-      // One call. If a run is live it fans out (SSE + live-state + logs + runs +
-      // stats); if paused it does nothing else and the page stays on the overlay.
+      // NOTHING is painted before the server confirms an active run. We do NOT
+      // optimistically rehydrate from the localStorage snapshot: a snapshot
+      // persisted mid-run keeps status:'running' after the run is stopped
+      // (persistence halts on stop, so the cache never updates to a terminal
+      // state). Trusting it flashed the last run's rows behind the paused
+      // overlay AND triggered a /sdk-info fetch while paused. The overlay ships
+      // SHOWN in the markup, so a paused page stays fully covered and data-free
+      // from the very first paint until the poll below proves a run is live.
+      // One call. If a run is live, checkBroadcastState fans out via
+      // connectLiveWork (cache rehydrate → SSE + live-state + logs + batch +
+      // stats) and drops the overlay; if paused it paints nothing and the page
+      // stays on the overlay.
       await checkBroadcastState();
       // Re-poll the single endpoint so a run that STARTS while we're paused flips
       // the page to live within ~10s — without any traffic in the meantime.
@@ -1976,17 +1973,6 @@ <h1 class="live-page-title">
     // session leave an ACTIVE, broadcasting run? Used at load to decide the
     // overlay before the async broadcast check, so a stopped page never flashes
     // the live shell and an operator's mid-run refresh reveals the work instantly.
-    function _cachedRunActive() {
-      try {
-        const raw = localStorage.getItem(LIVE_CACHE_KEY);
-        if (!raw) return false;
-        const snap = JSON.parse(raw);
-        if (!snap || !snap.ts || (Date.now() - snap.ts) > LIVE_CACHE_TTL_MS) return false;
-        if (!snap.broadcastLive) return false;
-        const s = snap.state && snap.state.status;
-        return s === 'running' || s === 'paused' || !!(snap.cb && snap.cb.batchId);
-      } catch { return false; }
-    }
     function rehydrateFromCache() {
       try {
         const raw = localStorage.getItem(LIVE_CACHE_KEY);

test/live-load-gating.test.js

@@ -9,12 +9,19 @@
  * broadcast left on after a run finished, live-state still returns the last
  * run's results, so seed/rehydrate flashed a stale snapshot behind the overlay.
  *
- * Fix: gate every paint path on there being an ACTIVE run to show —
+ * Fix: NOTHING paints before the server confirms an active run. DOMContentLoaded
+ * no longer optimistically rehydrates from the localStorage snapshot at all — a
+ * snapshot persisted mid-run keeps status:'running' after the run is stopped, so
+ * trusting it flashed the last run's rows (and fired /sdk-info) while paused.
+ * Painting happens ONLY inside connectLiveWork, which runs only once the
+ * /api/broadcast poll reports activeRun. As defense-in-depth the two paint
+ * functions still self-gate on an active run:
  *   - rehydrateFromCache repaints cached rows ONLY when the cached snapshot was
  *     an active run (status running/paused or a live batchId).
  *   - seedLiveStateFromRest paints rows ONLY when the seeded status is active.
- *   - (DOMContentLoaded resolves broadcast before any paint — covered by the
- *     pause-overlay suite; this suite locks the two paint-gate functions.)
+ *   - (The paused-overlay decision is covered by the pause-overlay suite, and
+ *     the single-poll gate by live-single-poll-gate; this suite locks the two
+ *     paint-gate functions.)
  *
  * This runs the REAL rehydrateFromCache + seedLiveStateFromRest extracted from
  * live.html against a fake localStorage / fetch / DOM and counts paints.
@@ -48,9 +55,19 @@ function extractFn(src, name) {
   return src.slice(m.index, j);
 }
 
-const extracted = ['_cachedRunActive', 'rehydrateFromCache', 'seedLiveStateFromRest']
+const extracted = ['rehydrateFromCache', 'seedLiveStateFromRest']
   .map(n => extractFn(html, n)).join('\n\n');
 
+// Guard: the speculative pre-broadcast reveal must stay gone. If a future edit
+// reintroduces a _cachedRunActive() optimistic paint in DOMContentLoaded, a
+// paused hard-refresh would flash stale cached rows behind the overlay again.
+if (/function\s+_cachedRunActive\s*\(/.test(html)) {
+  console.error('REGRESSION: _cachedRunActive() is back in live.html — the ' +
+    'speculative pre-broadcast cache reveal was removed on purpose (it flashed ' +
+    'stale rows + fired /sdk-info while paused). Paint only via connectLiveWork.');
+  process.exit(1);
+}
+
 // ─── Fake environment ────────────────────────────────────────────────────────
 let addSingleRowCount = 0; // rehydrate row paints
 let upsertCount = 0;       // seed row paints
@@ -110,27 +127,11 @@ const idleSnap = {
 };
 
 console.log('\n/live load-sequence gating — stopped-flash regression\n');
-
-// ─── 0. _cachedRunActive: synchronous overlay decision (no network) ──────────
-console.log('[0] _cachedRunActive drives the synchronous overlay decision');
-function cachedActive(snap) {
-  const sb = makeSandbox();
-  sb.localStorage = fakeLocalStorage(snap);
-  return vm.runInContext('_cachedRunActive()', sb);
-}
-ok(cachedActive(activeSnap('running')) === true,
-   'broadcasting + running cache → active (reveal work synchronously)');
-ok(cachedActive({ ts: NOW, broadcastLive: true, state: {}, cb: { batchId: 9 }, results: [] }) === true,
-   'broadcasting + live batchId → active');
-ok(cachedActive(idleSnap) === false,
-   'broadcasting + done status → NOT active (overlay stays up)');
-ok(cachedActive({ ...activeSnap('running'), broadcastLive: false }) === false,
-   'last session not broadcasting → NOT active even if status running');
-ok(cachedActive(null) === false, 'no cache → not active (default to overlay)');
-{
-  const stale = activeSnap('running'); stale.ts = NOW - (2 * 60 * 60 * 1000);
-  ok(cachedActive(stale) === false, 'expired cache → not active');
-}
+console.log('[0] _cachedRunActive removed — no speculative pre-broadcast paint');
+ok(!/function\s+_cachedRunActive\s*\(/.test(html),
+   'live.html has no _cachedRunActive (paint only via connectLiveWork)');
+ok(!/if\s*\(\s*_cachedRunActive\(\)\s*\)/.test(html),
+   'DOMContentLoaded does not optimistically reveal from cache');
 
 // ─── 1. rehydrateFromCache: active cache repaints, idle cache does NOT ────────
 console.log('[1] rehydrateFromCache gates row paint on a cached ACTIVE run');