fix: keep delivery recovery single-flight (Closes #1016)

tests/e2e/test_mobile_home_bootstrap_release.py

@@ -140,3 +140,63 @@ def test_release_artifact_bootstraps_mobile_home_and_returns_from_insights(
         fake.shutdown()
         fake.server_close()
         fake_thread.join(timeout=5)
+
+
+def test_release_artifact_keeps_mobile_delivery_recovery_single_flight(tmp_path: Path):
+    archives = sorted((ROOT / "dist").glob("stackchain-dashboard-*.tar.gz"))
+    assert len(archives) == 1, "browser job must download exactly one assembled release archive"
+
+    fake = FakeGiteaServer(("127.0.0.1", 0))
+    fake_thread = threading.Thread(target=fake.serve_forever, daemon=True)
+    fake_thread.start()
+    fake_url = f"http://127.0.0.1:{fake.server_port}"
+    browser_errors: list[str] = []
+
+    try:
+        with release_server(archives[0], tmp_path, fake_url) as origin, sync_playwright() as playwright:
+            browser = playwright.chromium.launch(args=["--ignore-certificate-errors"])
+            page = browser.new_page(viewport={"width": 390, "height": 844})
+            page.on("pageerror", lambda error: browser_errors.append(error.stack or str(error)))
+            page.goto(origin + "/", wait_until="networkidle")
+            page.locator('input[name="device_label"]').fill("Delivery recovery release phone")
+            page.locator('input[name="access_token"]').fill(ACCESS_TOKEN)
+            page.locator("#submit-sign-in").click()
+            page.wait_for_url(origin + "/", wait_until="networkidle")
+
+            page.evaluate(
+                """
+                () => {
+                  window.__deliveryAttempts = 0;
+                  window.__deliverySettled = new Promise(resolve => { window.__finishDelivery = resolve; });
+                  window.__releaseRecovery = createMobileDeliveryRecovery({
+                    getItems: () => [{outbox_id:'release-retry', delivery_state:'waiting', title:'Post release note'}],
+                    activate: async () => {
+                      window.__deliveryAttempts += 1;
+                      await window.__deliverySettled;
+                    },
+                  });
+                  window.__releaseRecovery.open();
+                  window.__firstRecovery = window.__releaseRecovery.activate();
+                  window.__secondRecovery = window.__releaseRecovery.activate();
+                }
+                """
+            )
+            action = page.locator("#mobile-delivery-recovery-action")
+            expect(page.locator("#mobile-delivery-recovery")).to_be_visible()
+            expect(action).to_be_disabled()
+            expect(page.locator("#mobile-delivery-recovery-status")).to_have_text("Working…")
+            assert page.evaluate("window.__deliveryAttempts") == 1
+            bounds = action.bounding_box()
+            assert bounds and bounds["height"] >= 44
+            assert page.evaluate("document.documentElement.scrollWidth <= window.innerWidth")
+
+            page.evaluate("window.__finishDelivery()")
+            page.evaluate("Promise.all([window.__firstRecovery, window.__secondRecovery])")
+            expect(action).to_be_enabled()
+            assert page.evaluate("window.__deliveryAttempts") == 1
+            assert browser_errors == []
+            browser.close()
+    finally:
+        fake.shutdown()
+        fake.server_close()
+        fake_thread.join(timeout=5)