test(tailscale): retire duplicate substituted-listener withdrawal (#16106)

Co-Authored-By: Paperclip <noreply@paperclip.ing>

doc/plans/2026-10-13-tailscale-withdrawal-test-audit.md

@@ -0,0 +1,9 @@
+VERIFIED: retire one repeated Tailscale idempotent-withdrawal execution while preserving its assertion union.
+
+Exact parent: #16099 at 8e955181d8a3776acc86e4662de3c77933231a76. Production is unchanged. The test file changes from 593 to 559 lines and 22 to 21 cases (2 additions, 36 deletions); one reserve/expose/reserve/expose fake-broker sequence is removed. No wall-clock performance claim.
+
+Full-owner controls, run serially: baseline 22/22 pass; candidate 21/21 pass; full revert 22/22 pass; restored candidate 21/21 pass. A real production mutation made the retained test fail at its removal-count assertion. Source was restored and byte-verified before the final passing run. Production SHA-256: c957d6ee89d61af6e8bfaac699bb4ed2d1d9fc1b12da89bffba613451cfd47d5.
+
+Reproduce from the repository root with: pnpm --filter @paperclipai/tailscale-https-broker exec vitest run src/broker-core.test.ts
+
+Mutation check: in packages/tailscale-https-broker/src/broker-core.ts, inside the leaseWasExposed branch that handles substituted ports, temporarily remove the statement that adds each substituted port to appliedPorts (currently: if (!appliedPorts.includes(port)) appliedPorts.push(port);). Re-run the same owner command: the retained test “withdraws an idempotently-skipped mapping whose listener was substituted” must fail at expect(fake.removeCalls).toBeGreaterThan(0). Restore the source and rerun to confirm the owner passes. This mutation skips the withdrawal admission and leaves the keeper's provider-removal assertion to catch it; it does not alter the candidate test.

packages/tailscale-https-broker/src/broker-core.test.ts

@@ -321,6 +321,7 @@ describe("expose", () => {
     expect(first.ok).toBe(true);
     expect(fake.ports.get(42010)).toBe("http://127.0.0.1:42010");
     const exposeCallsAfterFirst = fake.exposeCalls;
+    const removeCallsAfterFirst = fake.removeCalls;
 
     // Re-expose the same port. The mapping already matches, so the apply loop
     // takes the idempotent path and publishes nothing.
@@ -337,7 +338,7 @@ describe("expose", () => {
     expect(fake.exposeCalls).toBe(exposeCallsAfterFirst); // nothing re-published
 
     // The substituted mapping must not survive the rejected request.
-    expect(fake.removeCalls).toBeGreaterThan(0);
+    expect(fake.removeCalls).toBeGreaterThan(removeCallsAfterFirst);
     expect(fake.ports.has(42010)).toBe(false);
     expect([...fake.ports]).toEqual([[443, "http://127.0.0.1:3100"]]);
   });
@@ -369,41 +370,6 @@ describe("expose", () => {
     expect([...fake.ports]).toEqual([[443, "http://127.0.0.1:3100"]]);
   });
 
-  it("withdraws a substituted idempotent mapping without depending on a readable Serve status", async () => {
-    // The withdrawal decision must not hinge on a live status read. If it did, a
-    // status read that fails at exactly the wrong moment would make the broker
-    // return `listener_substituted` while leaving the replacement service
-    // exposed. Provenance comes from the `exposed` lease instead, so the remove
-    // is still issued.
-    const fake = new FakeTailscale();
-    let statusReadsBeforeReExpose = Number.POSITIVE_INFINITY;
-    const { core } = makeCore(fake, registryPath, () => ({
-      present: true,
-      loopbackOnly: true,
-      ownerUidMatches: true,
-      inodes: [fake.statusCalls > statusReadsBeforeReExpose ? "9999" : "5001"],
-    }));
-
-    const first = await reserveAndExpose(core);
-    expect(first.ok).toBe(true);
-    const removeCallsAfterFirst = fake.removeCalls;
-
-    const reserved = await core.handle(reserveReq(), PEER);
-    if (!reserved.ok || reserved.op !== "reserve") throw new Error("reserve failed");
-    statusReadsBeforeReExpose = fake.statusCalls;
-
-    const second = await core.handle(
-      { op: "expose", requestId: "req-noread", runtimeId: RUNTIME_A, handle: reserved.handle },
-      PEER,
-    );
-    expect(second.ok).toBe(false);
-    if (!second.ok) expect(second.code).toBe("listener_substituted");
-
-    // The remove was issued for the substituted port even though this request
-    // published nothing itself.
-    expect(fake.removeCalls).toBeGreaterThan(removeCallsAfterFirst);
-    expect(fake.ports.has(42010)).toBe(false);
-  });
 
   it("withdraws a published mapping when the listener disappears entirely", async () => {
     // Absent is not "unchanged". A closed listener leaves the mapping pointing at