fix: e2e CI flake — goal-0017 emit fanout raced canvas-live-sync

[alicoding]

Summary

• Root cause found for the recurring shard-1 e2e flake (docs/goals/BACKLOG.md Standing build(deps): Bump golang.org/x/oauth2 from 0.35.0 to 0.36.0 in the go-dependencies group #1): goal 0017's per-service dataevent.Emit fanout made a single MCP update_workflow write fire mill-data-changed twice (SnapshotDraft + UpdateWorkflow), plus a third self-echo from the test's own earlier CreateWorkflow — three near-simultaneous events, each independently re-fetching, whichever resolved last won unconditionally regardless of dispatch order. A stale response could beat an already-applied newer one and wrongly show the external-change banner on a clean canvas.
• Fixed in frontend/src/composition/useCanvasLiveSync.ts with a monotonic request-sequence guard (standard out-of-order-async-response pattern): drop a fetch response once a newer event has arrived since it was dispatched.
• canvas-live-sync.spec.ts cleanup hardened into an outer try/finally (both tests) so a future failure can't leave an undeleted workflow / unattended-MCP-writes settings for later tests in the same shard worker.
• resizable-table.spec.ts's one occurrence (PR feat: inline hotkey hints (goal 0015 remainder) + real Close-tabs bindings #24) hardened with a condition-based expect.poll wait for the resize handle's bounding box, additive to the suite's existing retries: 1.
• docs/goals/BACKLOG.md Standing build(deps): Bump golang.org/x/oauth2 from 0.35.0 to 0.36.0 in the go-dependencies group #1 checked off with the full root-cause writeup; docs/SPEC.md's realtime-lock section gets an Update note generalizing the lesson for future mill-data-changed consumers.

Evidence

• Real CI history: canvas-live-sync.spec.ts:151 failed 6/6 times sampled across the last ~30 ci.yml runs, always shard 1, always after goal 0017 (PR goal 0017: real-time surfaces audit — direct-UI/service mutations now emit mill-data-changed #16) merged, zero occurrences before. Every occurrence co-occurred with a configure-lists.spec.ts flake in the same run (recovered on Playwright's own retry every time — a resource-contention side effect of the extra retry overhead, not a separate state-cascade bug).
• Local reproduction: 9/20 "clean canvas" repeats failed with zero artificial load, identical assertion/line to all CI failures — confirmed via a temporary event-trace instrument (removed before commit) showing exactly 3 near-simultaneous mill-data-changed arrivals per run.
• Post-fix: 88 consecutive clean local repeats (0 failures), same build that showed 9/20 before the fix.

Test plan

• Full local suite green: go vet, golangci-lint, go test ./... -race -cover, go build (desktop + server), npm run boundaries, npm run lint, npm run test (vitest), tsc --noEmit
• Full local e2e suite green (179 tests, 176 passed + 3 pre-existing/unrelated local-multi-worker flakes recovered on retry — none in the target specs)
• canvas-live-sync.spec.ts + resizable-table.spec.ts run --repeat-each=5, 0 failures
• Lefthook pre-commit hooks passed on the real commit

🤖 Generated with Claude Code

https://claude.ai/code/session_018pkViCNAuZp2vBv2K9AbUh