fix(control-pane): settle the poll guard against the last settled request

The staleness guard compared a poll against the newest poll STARTED, and
only the failure path used it. Two orderings were wrong.

An older success settling after a newer one had no guard at all, so it
overwrote the newer counts, the canvas label and the announcement with
older data. Both paths now check the token.

An older failure settling while a newer poll was still in flight was
discarded, because a newer poll had merely started. The page then kept
the last successful counts and its no-steering message as if they were
current. Anchoring the guard to the newest poll that has SETTLED fixes
that: the older failure is still the newest thing to have settled, so it
lands, and the pending poll restores the view when it answers.

That single change covers both orderings, so the guard no longer needs
to know which path it is on. Each poll records itself as settled when it
finishes, whatever the outcome.

A poll also had no timeout, so a request that never answered left the
last steering guidance on screen indefinitely. Each poll now aborts
after ten seconds through an AbortController, and that abort is what
wakes the poll, so a timeout is reported as an outage instead of
silently leaving stale guidance.

The test harness can now hold a request open indefinitely and fire
pending timers on demand, so the timeout is exercised without waiting.
New assertions cover an older success losing to a newer one, an older
failure landing while a newer poll is in flight and then being
recovered by it, and a hung poll timing out into the offline state.
Removing the success guard, re-anchoring the guard to the last started
poll, and removing the timeout each fail one of those assertions, and
the unmutated file passes all of them.

Co-authored-by: CommandCodeBot <noreply@commandcode.ai>

scripts/lib/control-pane/control-plane-view-ui.js

@@ -243,10 +243,18 @@ function renderControlPlaneViewHtml() {
   // Wording shared by the canvas label and the live region so an outage reads
   // the same way however the operator reaches it.
   var UNAVAILABLE = 'Control-plane data is unavailable. Advisories and steering are unknown.';
-  // Monotonic poll id. Polls are not sequenced, so a slow older request can
-  // settle after a newer one. Only the newest poll may touch the view, which
-  // stops a late failure from overwriting a newer success.
-  var latestPoll = 0;
+  // Polls are not sequenced, so a slow request can settle out of order. Only
+  // the newest poll that has already settled may update the view: a success
+  // from a superseded poll would show older counts, and a failure from a
+  // superseded poll would erase newer counts. Anchoring to the last settled
+  // poll rather than the last started one also lets a failure land while a
+  // newer poll is still pending, instead of leaving stale guidance on screen.
+  var settledPoll = 0;
+  // Monotonic id handed to each poll as it starts.
+  var pollSeq = 0;
+  // A poll that never answers must not stay pending forever, or the last
+  // steering guidance stays on screen indefinitely.
+  var TIMEOUT_MS = 10000;
 
   // Polling runs every few seconds, so only speak when the advisory and
   // steering counts actually move. Repeating an unchanged summary would talk
@@ -257,6 +265,15 @@ function renderControlPlaneViewHtml() {
     document.getElementById('announce').textContent = message;
   }
 
+  function unavailable() {
+    document.getElementById('status').textContent = 'offline';
+    // The last guidance is now stale, so replace it rather than leaving the
+    // live region claiming the airspace is clear. The canvas label goes with
+    // it, or it would still report the last successful counts.
+    canvas.setAttribute('aria-label', UNAVAILABLE);
+    announce(UNAVAILABLE);
+  }
+
   function apply(data) {
     if (!data || data.schemaVersion !== 'ecc.control-plane.view.v1' ||
         !['tasks', 'lanes', 'pairs', 'events'].every(function (key) { return Array.isArray(data[key]); }) ||
@@ -282,21 +299,30 @@ function renderControlPlaneViewHtml() {
   }
 
   function poll() {
-    var token = ++latestPoll;
-    fetch('/api/control-plane').then(function (r) {
+    var token = ++pollSeq;
+    var timer = null;
+    var controller = new AbortController();
+    // Reject on a timer so a hung request cannot keep the previous guidance on
+    // screen forever. The abort is what wakes this poll up, so a timeout is
+    // reported as an outage rather than swallowed.
+    timer = setTimeout(function () { controller.abort(); }, TIMEOUT_MS);
+    // A poll that has already answered, or timed out, owns the view. Anything
+    // that settles later is superseded and must be dropped.
+    function settle() {
+      clearTimeout(timer);
+      settledPoll = token;
+    }
+    fetch('/api/control-plane', { signal: controller.signal }).then(function (r) {
       if (!r.ok) throw new Error('Control-plane request failed');
       return r.json();
-    }).then(apply).catch(function () {
-      // A newer poll has already answered, so this failure is stale and must
-      // not overwrite the newer counts.
-      if (token !== latestPoll) return;
-      document.getElementById('status').textContent = 'offline';
-      // The last guidance is now stale, so replace it rather than leaving the
-      // live region claiming the airspace is clear. The canvas label goes with
-      // it, or it would still report the last successful counts.
-      canvas.setAttribute('aria-label', UNAVAILABLE);
-      announce(UNAVAILABLE);
-    });
+    }).then(function (data) {
+      // A newer poll already owns the view, so do not resurrect older counts.
+      if (token < settledPoll) return;
+      apply(data);
+    }).catch(function () {
+      if (token < settledPoll) return;
+      unavailable();
+    }).then(settle, settle);
   }
 
   resize();