From 2eff35bfbf69457d8274ea470ae78919373b1fc2 Mon Sep 17 00:00:00 2001
From: Brennan Benson <79079362+brennanb2025@users.noreply.github.com>
Date: Fri, 28 Aug 2026 08:07:17 -0700
Subject: [PATCH] test(secrets): make the deferral wiring pin resist an inert
 call site
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Round 2 of the review gamed the pin it had just added. Both anchors were bounded
against -1 but not against overshoot, and the marker matched anywhere in the
file — so nesting the call in a block, prefixing it with a guard, or commenting
it out all left three green tests standing over a call that never runs.

Bound the slice length, and anchor the marker to a statement at whenReady's own
indent. Commenting the call out, wrapping it in `if (...) schedule(...)` with or
without a block, and flipping the flag each redden now; previously only the
unused-import typecheck error caught the first.
---
 .../secret-protection-report-deferral-wiring.test.ts   | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/main/startup/secret-protection-report-deferral-wiring.test.ts b/src/main/startup/secret-protection-report-deferral-wiring.test.ts
index 4f0d45c2b97..eda9721667f 100644
--- a/src/main/startup/secret-protection-report-deferral-wiring.test.ts
+++ b/src/main/startup/secret-protection-report-deferral-wiring.test.ts
@@ -39,8 +39,18 @@ describe('secret protection report deferral wiring', () => {
     expect(start).toBeGreaterThanOrEqual(0)
     const end = source.indexOf('\n  })', start)
     expect(end).toBeGreaterThan(start)
+    // Why bound the length too: `end` is the next call-shaped close at this indent, not
+    // necessarily this call's. Nest the call one level deeper and that anchor overshoots into
+    // unrelated code, so the assertions below pass against a call site that never runs.
+    expect(end - start).toBeLessThan(500)
     const call = source.slice(start, end)
 
+    // Why anchor the indent: `SCHEDULE` matches anywhere, including as the body of an added
+    // `if (...) schedule(...)` guard, which leaves every assertion here true while the call
+    // stops running unconditionally. Pinning it as a statement at whenReady's own indent is
+    // what makes "this runs on every desktop startup" the thing under test.
+    expect(source).toContain(`\n  ${SCHEDULE}`)
+
     expect(call).toContain('deferUntilFirstWindow: !isServeMode')
     // Why assert the constants are absent too: `!isServeMode` being present does not stop a
     // later property in the same literal from overriding it.