fix(web-tests): ProxyZone bootstrap for Vitest to unblock ~200 fakeAsync specs

Partial closeout of SPRINT_20260420_003 FE-STAB2-005/009. Sprint NOT
archived — per-spec repairs remain for signal-input JIT NG0303/NG0950,
TestBed lifecycle/provider drift, and expectation drift families. Both
tasks flipped DOING → BLOCKED with justification in the sprint file and
Decisions & Risks. Follow-up sprint FE-STAB3-* needed; see
SPRINT_20260422_006_FE_web_test_infrastructure_followup (created in the
companion commit).

Root cause: zone.js/testing's jasmine patch short-circuits under Vitest
because neither `jasmine` nor `jest` globals exist at zone-testing load
time. Result: `fakeAsync()` bodies threw
  "Expected to be running in 'ProxyZone'"
across ~200 spec files — nearly every fakeAsync spec red.

Infrastructure fix (1 new file + 1-line import):
- src/Web/StellaOps.Web/src/test-setup.jasmine-bootstrap.ts (new, ~140
  lines): wraps Vitest's it/test/beforeEach/afterEach/beforeAll/afterAll
  globals to fork a fresh ProxyZone per test body; seeds a minimal
  `jasmine` global before zone.js/testing loads so the jasmine patch
  doesn't short-circuit.
- src/Web/StellaOps.Web/src/test-setup.ts: single
  `import './test-setup.jasmine-bootstrap';` prepended.

Verified green post-fix (targeted reruns):
- simulation-console 53/53
- batch-evaluation 40/40
- promotion-gate 52/52
- policy-merge-preview 39/39
- policy-exception 43/43
- policy-lint 38/38
- policy-diff-viewer 28/28
- conflict-detection 44/44
- fakeAsync sanity probe: pass
- ~450 tests now green in previously-blocked clusters.

Residual families (BLOCKED, per-spec repair scope — tracked in follow-up):
- Signal-input JIT: setup-wizard/step-content, deploy-diff, sbom-diff,
  evidence-drawer, verdict-proof-panel, patch-diff-viewer, vex-trust-chip
- TestBed lifecycle/provider drift: findings-container needs SCORING_API
- Expectation drift: simulation-history navigate/header/empty-state

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/implplan/SPRINT_20260420_003_FE_web_full_suite_stabilization.md

@@ -80,15 +80,18 @@ Completion criteria:
 - [x] The fix documents whether the source of truth was the component logic or the stale test expectation.
 
 ### FE-STAB2-005 - Re-run the full Web Vitest suite after the above clusters are green
-Status: DOING
+Status: BLOCKED
 Dependency: FE-STAB2-004
 Owners: Developer / Implementer, Test Automation
 Task description:
 - After the targeted failing clusters are stabilized, rerun the full Web Vitest suite to prove the repair is complete and to surface any remaining hidden failures.
 - Record the final suite result and the scope of the repaired files in the sprint execution log.
+- **2026-04-22 closeout rerun**: full suite still red. The rerun exposed a prior-undiagnosed systemic regression: the `zone.js/testing` jasmine patch never wired up under Vitest, so every spec body using `fakeAsync(...)` threw `Expected to be running in 'ProxyZone', but it was not found.` This invalidated many previously-claimed "DONE" results in the policy-simulation / watchlist / VEX / findings clusters. Root cause fix landed in `src/Web/StellaOps.Web/src/test-setup.jasmine-bootstrap.ts`: Vitest's `it/test/beforeEach/afterEach/beforeAll/afterAll` globals are now wrapped to run the user body inside a freshly-forked `ProxyZone` per invocation, and a minimal `jasmine` global is seeded before `zone.js/testing` loads so the patch does not short-circuit. After the fix, `simulation-console`, `batch-evaluation`, `promotion-gate`, `policy-merge-preview`, `policy-exception`, `policy-lint`, and `policy-diff-viewer` all go fully green under targeted reruns; `simulation-history` drops from 41 failed / 10 passed to 3 failed / 48 passed. However the full suite remains red because of a second, independent family of failures documented in FE-STAB2-009 (signal-input JIT `NG0303`, `TestBed.assertNotInstantiated`, `ScoringService` provider drift, etc.). The sprint therefore cannot be closed until FE-STAB2-009 lands.
 
 Completion criteria:
-- [ ] `npx vitest run --config vitest.codex.config.ts` passes for `src/Web/StellaOps.Web`.
+- [x] Infrastructure fix: ProxyZone bootstrap installed so `fakeAsync` bodies run under a real ProxyZone (`src/Web/StellaOps.Web/src/test-setup.jasmine-bootstrap.ts`).
+- [x] Policy-simulation and adjacent zone-dependent clusters verified green under targeted reruns after the fix (simulation-console 53/53, batch-evaluation 40/40, promotion-gate 52/52, policy-merge-preview 39/39, policy-exception 43/43, policy-lint 38/38, policy-diff-viewer 28/28).
+- [ ] `npx vitest run --config vitest.codex.config.ts` passes for `src/Web/StellaOps.Web` end-to-end. (Blocked on FE-STAB2-009.)
 - [ ] Final verification evidence is recorded in the sprint execution log.
 
 ### FE-STAB2-006 - Repair mounted watchlist and notify shell expectations
@@ -130,13 +133,17 @@ Completion criteria:
 - [x] `vex-create-workflow.component.spec.ts` passes under targeted Vitest execution.
 
 ### FE-STAB2-009 - Stabilize remaining standalone UI verification clusters
-Status: DOING
+Status: BLOCKED
 Dependency: FE-STAB2-005
 Owners: Developer / Implementer, Test Automation
 Task description:
 - After the shared findings, watchlist/notify, export, and VEX Hub batches are resolved, the remaining failures should be swept as targeted UI clusters: `registry-capability-matrix.component.spec.ts`, `chat-message.component.spec.ts`, `proof-tree.component.spec.ts`, `sources-list.component.spec.ts`, `scheduler-runs.component.spec.ts`, `keyboard-shortcuts-for-triage.component.spec.ts`, `evidence-subgraph.component.spec.ts`, and the admin notifications specs that still have DOM expectation drift.
 - The latest full-suite rerun shows the next remaining families are now concentrated in signal-input/JIT-host and ProxyZone drift across `quick-verify-drawer`, `timeline-list`, `vex-hub`, `ai-explain-panel`, `exception-dashboard`, `sbom-diff-view`, `deploy-diff-panel`, `version-proof-popover`, `witness-page`, `findings-container-finding-list-adoption`, and `vex-trust-column-in-findings-and-triage-lists`, plus smaller expectation drift in `registry-health-card`, `vex-sources-panel`, `scheduler-runs`, `gating-explainer`, `system-settings-page`, `scanner-ops-settings-ui`, and `proof-chain`.
 - Keep this batch scoped to expectation and harness correctness; only change product code where the current shipped behavior is actually wrong.
+- **2026-04-22 closeout update**: After the ProxyZone infrastructure fix from FE-STAB2-005, the remaining failing surface on a partial full-suite rerun (154 spec files processed before the runner was interrupted) contained 147 files with at least one failing test. Two dominant failure families now drive the residue:
+  1. **Signal-input JIT (`NG0303` + `NG0950`)** on components that declare `input.required<T>()` / `input<T>(...)` but whose JIT-compiled test metadata does not register the inputs, so `fixture.componentRef.setInput('step', ...)` throws `Can't set value of the 'X' input ...` followed by `Input is required but no value is available yet`. Large affected clusters: `setup-wizard/step-content`, `deploy-diff/component-diff-row`, `deploy-diff/deploy-diff-panel`, `sbom-diff/sbom-diff-view`, `evidence-drawer`, `verdict-proof-panel`, `patch-diff-viewer`, `vex-trust-chip`, and many others. The sprint's earlier "DONE" entries on these do not reproduce against the current tree — the fixes were either never landed or were reverted during subsequent UI work.
+  2. **TestBed lifecycle / provider drift**: specs like `findings-container.component.spec.ts` now throw `Cannot configure the test module when the test module has already been instantiated` or `NG0201: No provider found for InjectionToken SCORING_API`. These are shipped-component contract drifts: the component now depends on `ScoringService` and `SCORING_API`, and the spec's `configureTestingModule` neither mocks nor supplies them, nor reconfigures between test variants.
+- Not scoping FE-STAB2-009 to fix all 146 remaining files is a deliberate decision: the scale exceeds a single closeout pass, and most repairs are per-spec (dozens of `setInput` substitutions, per-component provider seeding) with no further shared infrastructure lever available. A follow-up sprint (`FE-STAB3-*`) should pick these up in targeted batches now that the ProxyZone foundation is stable.
 
 Completion criteria:
 - [ ] The remaining standalone UI clusters from the current full-suite rerun pass under targeted Vitest execution.
@@ -167,8 +174,13 @@ Completion criteria:
 | 2026-04-20 | Repaired shared standalone host-contract drift in `timeline-list` and `version-proof-popover`; combined targeted rerun passed with 2 files and 25 tests green after replacing JIT-hostile host bindings and noisy child imports. | Codex |
 | 2026-04-20 | Repaired the next low-cost UI expectation batch in `quick-verify-drawer`, `scheduler-runs`, and `system-settings-page`; combined targeted rerun passed with 3 files and 54 tests green. | Codex |
 | 2026-04-20 | Repaired expectation/harness drift in `gating-explainer` and `registry-health-card`; combined targeted rerun passed with 2 files and 77 tests green after removing stale emoji/Jest assumptions and routing registry input updates through Angular's input path. | Codex |
+| 2026-04-22 | Closeout rerun of the full Web Vitest suite (FE-STAB2-005) remained deeply red despite several tasks being marked DONE on 2026-04-20. Root cause identified: `zone.js/testing`'s jasmine patch never ran under Vitest (the patch short-circuits when `typeof jasmine === 'undefined'` at load time, which is always the case under Vitest) so `fakeAsync(...)` bodies threw `Expected to be running in 'ProxyZone', but it was not found.` across ~200 spec files. This is the shared cause behind the "DONE but now red again" regressions in the policy-simulation, watchlist, VEX, and findings clusters — the Vitest-side fix those sprints applied was never actually exercised end-to-end against the full suite. Fix landed in `src/Web/StellaOps.Web/src/test-setup.jasmine-bootstrap.ts`: wraps Vitest's `it/test/beforeEach/afterEach/beforeAll/afterAll` globals to run the user body inside a fresh ProxyZone per invocation and seeds a minimal `jasmine` global before `zone.js/testing` loads. Targeted reruns post-fix: `simulation-console` 53/53, `batch-evaluation` 40/40, `promotion-gate` 52/52, `policy-merge-preview` 39/39, `policy-exception` 43/43, `policy-lint` 38/38, `policy-diff-viewer` 28/28 all green; `simulation-history` 48/51 (3 residual non-zone failures). Sanity: `fakeAsync` standalone probe passes. Full-suite rerun truncated at 154 files (runner interrupted), with 147 of those having at least one failure; the remainder is now dominated by the independent signal-input JIT / TestBed lifecycle / provider-drift families tracked under FE-STAB2-009. FE-STAB2-005 and FE-STAB2-009 therefore move to BLOCKED pending a follow-up sprint that sweeps the remaining per-spec fixes. Sprint is not archived. | Closeout |
 
 ## Decisions & Risks
+- **2026-04-22 closeout decision**: Do NOT archive this sprint. FE-STAB2-005 (full-suite rerun green) cannot pass until FE-STAB2-009 is fully swept. Both tasks move from DOING to BLOCKED. A follow-up sprint (FE-STAB3-*) should pick up the remaining per-spec repairs.
+- **2026-04-22 closeout decision**: The ProxyZone bootstrap in `src/Web/StellaOps.Web/src/test-setup.jasmine-bootstrap.ts` is the canonical infrastructure fix for `fakeAsync` support under Vitest. Do not remove it — `zone.js/testing`'s jasmine patch cannot self-install under Vitest because neither `jasmine` nor `jest` globals exist at load time, which is why the test suite has been silently broken against any spec using `fakeAsync`.
+- **2026-04-22 closeout risk**: Sprint Execution Log entries from 2026-04-20 claiming individual clusters were "DONE" were accurate for their targeted reruns at that moment but did not hold under the full-suite run because the zone infrastructure was undiagnosed. Future stabilization sprints must treat the full-suite rerun as the authoritative signal and must surface any targeted vs. full-suite skew immediately, not after many downstream tasks have been marked DONE. FLOW.md §4.6.3 (forbidden shortcuts) applies: a targeted-run pass is not a full-suite pass.
+- **2026-04-22 closeout risk**: The remaining 140+ failing spec files are mostly per-file repairs (signal-input `setInput` contract alignment, TestBed provider seeding for `ScoringService` / `SCORING_API` / `POLICY_SIMULATION_API` / similar injection tokens, and small DOM-expectation drift). None of them share another cross-cutting fix we have found. Budget accordingly in follow-up planning — this is not a 1-day sweep.
 - Decision: the full Web suite, not only previously targeted slices, is the verification authority for closing frontend stabilization work.
 - Risk: the policy-simulation failures appear to be a cross-cutting spec-harness problem rather than isolated product defects, so fixes should be applied deliberately and rerun in targeted clusters before another full-suite pass.
 - Risk: several failures still look like test-host contract drift rather than runtime regressions; product code changes must remain minimal and should only land where the current shipped component contract is actually wrong.