First-pass review only. These are mechanical findings from Netero (our first-pass reviewer); the full review panel has not yet reviewed this PR and will do so after these are addressed. These are defects worth fixing before the panel spends parallel review time.

What the change does well: the root-caused waitForRadixLayerClose helper targets the real Radix teardown condition (re-querying by role so an aria-hidden target throws, then checking pointer-events, mirroring user-event's own gate), and it is well documented. Test density is high and the LeaveWithUnsavedChanges blur-then-probe fix is grounded in the actual useUnsavedChangesPrompt behavior.

Severity count: 3 P1, 2 P2, 1 P3, 1 Nit, 2 Notes.

Three items need attention beyond the inline comments:

[CRF-3] (P1) The PR title fails the required title check (CI already reports it red). Scope site/src does not contain site/vite.config.mts. Retitle to fix(site): deflake storybook interaction stories racing radix layer close so the scope covers all 10 changed files.

[CRF-7] (Nit) The PR description uses em dashes (U+2014), which the project bans in PR-facing text. The diff itself is clean. Replace them with commas, semicolons, or periods.

[CRF-8] (Note) The codebase now has two approaches to this exact race: this PR's explicit wait, and userEvent.setup({ pointerEventsCheck: 0 }) already used at AppLink.stories.tsx:120. One line in site/AGENTS.md or the helper JSDoc stating why the wait is preferred would keep the next author from picking the other.

The retry finding (CRF-1) and the false-justification finding (CRF-2) are coupled: the comment and PR body claim test-storybook runs concurrently with the Go tests under make pre-push, but the Makefile runs test-storybook in a separate sequential $(MAKE) invocation after the -j batch completes, with a comment explaining that ordering exists precisely to avoid CPU starvation. If the real contention source is the load harness rather than any real workflow, then a permanent global retry: 2 has no in-repo justification and just masks future flakes. As Netero put it: "What remains is exactly the middle band where a genuine intermittent bug looks green."

Both the retry: 2 decision and whether to accept the untouched-sites class (CRF-4) as out of scope are human decisions: file a ticket or state the acceptance explicitly. This review cannot accept either as permanent.

🤖 This review was automatically generated with Coder Agents.

Round 2. Strong response to round 1: six findings are addressed in dbaa308. The structural fix (selectRadixOption owning open then pick then wait so it cannot be forgotten) is the right call over the retry crutch, retry: 2 and its false comment are gone, the PR title now scopes only files under site/src, the FE4 comment noise is deleted, and the getByLabelText contract gap is eliminated by construction. CRF-9 is acknowledged with a sound rationale, and CRF-8 is contested with a real argument (pointerEventsCheck: 0 would silence the only signal that detects this class).

The panel review is blocked on one silent finding:

[CRF-7] (Nit) The em-dash finding on the PR description got no fix and no response. The body still contains 5 U+2014 characters (the project bans emdash/endash in PR-facing text). This is trivial, but a silent drop is what blocks the round, not the severity: the process does not spend parallel panel review time while any finding sits unanswered. Either edit the description to remove the em dashes (commas, semicolons, or periods), or reply stating why it should not be changed.

One item for the panel to verify next round, not a blocker: the CRF-4 modality audit claims 17 of the 18 flagged sites are non-modal (cmdk in a non-modal Popover, or inline lists) and therefore cannot race, leaving only AppearanceForm > SelectSingleFromSync as a real modal Select. That reasoning is plausible and the fix is in, but the 17-of-18 non-modal claim has not been independently verified; the panel will check it once the round unblocks.

Respond to CRF-7 (fix or justify) and the full panel runs on the next /coder-agents-review.

🤖 This review was automatically generated with Coder Agents.

Round 3, first-pass (Netero) again. The churn guard cleared round 2's block (the em-dash finding is fixed), so Netero re-scanned the restructured head. The restructure is genuinely better: Netero independently verified the CRF-4 modality audit (enumerated all 33 role="option" story files and confirmed every organization picker, model selector, autocomplete, and multi-select routes through a non-modal Popover, so there is no aria-hidden/pointer-events cleanup to race), and confirmed CRF-1 and CRF-3 are fixed. The selectRadixOption seam is the right call.

But the re-scan surfaced a new class the fix did not close, so this stays a first-pass round: the full panel has not reviewed yet and will run next round (the mechanical first-pass gate holds while P2s are open). Severity count: 2 P2, 3 P3.

The theme: waitForRadixLayerClose fixes the loud symptom of the Radix-layer race (a pointer interaction throwing on pointer-events: none) but not the silent one. While a modal Select's listbox is open, the page is aria-hidden, and testing-library's canvas.queryByRole excludes aria-hidden subtrees, so a negative queryByRole assertion issued in that window returns null unconditionally and passes no matter what. Netero found two such assertions in files this PR touches, and proved both by execution. As Netero put it: "a button that is definitely rendered is invisible to queryByRole in that window, so the two Delete assertions prove nothing."

The most consequential is CRF-10: in MCPServersPage.stories.tsx, the only assertions that a non-admin cannot see the Delete button run while the auth-method listbox is open, so they are vacuous. A UI regression that leaks Delete to a read-only org member would ship green.

CRF-8 re-raised (P3): the author's argument for rejecting pointerEventsCheck: 0 (it silences the only signal that detects this class) is sound, but it is the argument for banning the option, not for leaving it undocumented. One live usage remains at AppLink.stories.tsx:120; the next author who hits the same error will grep, find it, and copy it, re-opening the class. Either ban it mechanically (the way emdashes are banned via a check script) and convert the one usage, or add one line to site/AGENTS.md naming the default and the exception. A thread comment does not close it.

Two notes for later, not blockers: LeaveWithUnsavedChanges has two sequential 10s waits under a 15s default testTimeout, so a slow first probe truncates the second and the story dies with a generic timeout rather than the specific dialog-never-appeared error. And CRF-9's beforeunload coupling remains accepted.

Once CRF-10 and CRF-11 are addressed, the next /coder-agents-review runs the full panel.

site/src/pages/AISettingsPage/MCPServersPage/MCPServersPage.stories.tsx:1343

P2 [CRF-10] The Delete-permission assertions run while the Radix Select listbox is still open, so they cannot fail. (Netero)

UpdateOnlyOrgAdminCanUpdateMCPServer opens the "authentication method" Select at line 1334 and never closes it. Every subsequent canvas.queryByRole(...) runs while the modal layer has the whole page aria-hidden, and testing-library's ByRole queries exclude inaccessible subtrees. Both negative assertions (1343 Delete, 1346 delete server) return null unconditionally. Proved it: inserting expect(canvas.queryByRole("button", { name: "Update server" })).toBeNull() before line 1342 passed, even though that button is definitely rendered.

Orchestrator verified the structure: the auth-method combobox opens at 1334, the body.getByRole("option", ...) at 1336-1338 confirms the listbox is open, and the two canvas.queryByRole Delete assertions follow immediately. This is the only place asserting a non-admin cannot see Delete (1440/1505 assert the positive case), so a regression leaking Delete to a read-only member ships green. Fix: close the listbox (Escape or pick an option, then waitForRadixLayerClose), or move the two Delete assertions above the Select interaction at 1331.

🤖

site/src/modules/tasks/TaskPrompt/TaskPrompt.stories.tsx:503

P3 [CRF-12] Same root cause as CRF-10, second instance: this negative assertion can pass while the page is still aria-hidden from the just-closed version Select. (Netero)

CheckExternalAuthOnChangingVersions picks a version option at 498 with no wait, then asserts canvas.queryByRole("button", { name: /connect to github/i }) is absent. The assertion cannot distinguish "the button was removed" from "the canvas is still hidden by the closing layer". Proved the window is non-zero even on an idle machine: an aria-hidden check on the canvas after the pick threw, and canvas.queryByRole("button", { name: /run task/i }) was null in the same window while canvas.getByText(/run task/i) resolved.

Lower severity than CRF-10 because the race window is short rather than permanent, but the failure mode is the same silent false pass. Fix: await waitForRadixLayerClose(() => canvas.getByRole("combobox", { name: /template version/i })) after the pick, or wrap the negative assertion in waitFor(() => expect(...).not.toBeInTheDocument()).

🤖

🤖 This review was automatically generated with Coder Agents.

First full panel round (rounds 1 and 3 were Netero first-pass, round 2 was blocked). The core of this PR is solid and now verified independently, not taken on trust: the Radix layer-close race is genuinely fixed. Pariston and Bisky both mutation-tested the CRF-10 fix (grant the org delete permission so a Delete button really renders, and the story fails at head; delete the two wait lines and the impossible assertion passes again), so the negative assertions now assert something. Pariston, Mafuuu, and Zoro each independently re-walked the CRF-4 modality audit and it holds. CRF-13 is a real root-cause fix, and the beforeunload probe is sound at the code level. The mechanism in the JSDoc is the mechanism that runs.

What still needs work, new findings this round: 1 P1, 4 P2, 5 P3, 1 P4, 3 Nit.

The one hard blocker is process, not code: [CRF-14] (P1) the required title check is red again. This round adds site/AGENTS.md (the CRF-8 doc fix), which is outside the PR title's fix(site/src) scope, so CRF-3 recurred exactly as before. As Mafu-san put it, both commits are titled fix(site) while the PR title stayed fix(site/src): the knowledge was present, the action was taken in one place and not the other. Retitle to fix(site).

The rest cluster into one theme the panel converged on hard: the helper is now mandated by site/AGENTS.md, so its ergonomics and diagnostics are load-bearing, and three of its rough edges undercut the very goal of the PR (legible failures).

• Nine reviewers independently flagged that the helper's 10s wait sits inside a 15s test cap [CRF-15], so a genuinely failed wait past the first call in a story reports as a bare Test timed out in 15000ms instead of the named role/name error. That is the exact illegible signal that made this class take four rounds to pin down. Zoro measured the real teardown at a few hundred milliseconds; the fix is a ~2-3s default plus an override.
• Zoro's [CRF-16] is the sharpest structural finding: CRF-13 made the query mechanical but left the choice of wait target with the caller, and a wrong target silently waits for nothing, which is the same vacuous class as CRF-6/10/12 moved into the parameter list. Waiting on the just-closed combobox trigger (always derivable, always outside the portal) removes the caller's decision and makes the helper self-protecting at both ends.
• Leorio [CRF-17] ran both failure branches: they say expected 'none' not to be 'none' and, worse, blame a missing combobox that is actually just hidden, pointing the reader at the wrong file.

Two findings question the PR's own scope claims. [CRF-18] (Mafu-san P1, Mafuuu P2, Komugi P4): two TrialRequestForm stories still time out under the checked-in maxWorkers: 4, no busy-loop needed. They are a different, pre-existing class (per-character userEvent.type against the 15s cap, they fail at the base commit too), but they are in a file this PR edits, they defeat the stated "unblock pre-push" outcome, and the body's "complete tail / every failure is the same class / 457 files green" does not reproduce off the author's machine. This needs a human decision: fix the typing pattern, raise the storybook testTimeout, or narrow the body claim and file a ticket. And [CRF-22]: the new waitFor wrapped around ReasoningEffortValidationError runs strictly later than the version that already passed, so its "formik validates asynchronously" comment is a hypothesis; either it is speculative or it is a third failure class the "two classes" framing denies. One sentence from the author settles it.

One contradiction inside the panel, resolved: Komugi argued the CRF-12 external-auth negative is still vacuous [CRF-26]; Pariston empirically refuted it (mutating the mock so both versions need auth makes the story fail, so it discriminates). The concrete vacuity claim loses to the empirical result, so it is downgraded to P4, with an optional waitForElementToBeRemoved to close the residual timing margin.

Process note: the PR description has drifted, it documents the removed waitForRadixLayerClose(getTarget) callback API and has no round-3 section, so a reader following it writes code that will not compile. Worth a refresh alongside the retitle.

Everything green on the mechanics: tsc --noEmit and biome check clean across all reviewers, CRF-1/CRF-7 stayed fixed, no em dashes.

site/src/pages/DeploymentSettingsPage/PremiumPage/TrialRequestForm.stories.tsx:147

P2 [CRF-18] Wall-clock timeouts in this file still fail under the checked-in worker count, so the PR's stated outcome does not fully hold. (Mafu-san P1, Mafuuu P2, Komugi P4, Nami Note)

Run 1, the nine affected story files together at head: Company Name Over Limit 19129ms and Submits Complete Form 15000ms, both Test timed out in 15000ms. maxWorkers: 4 is the checked-in default, not a harness; I did not need a busy loop. Root cause is wall-clock: line 147 types 101 characters one keystroke at a time, each a full React render plus formik validation. These are not the Radix class. (Mafuuu)

Mafu-san and Komugi both confirmed the same stories fail at the base commit too, so this is pre-existing and a different class, not a regression. Severity is contested (P1/P2/P4). It lands at P2 because it is in a file this PR edits, it defeats the stated "unblock make pre-push" goal, and the body's completeness claims ("surfaced the complete tail", "every failure across all waves is the same class", "457 files green") are falsified by a cheaper experiment than the one they describe. This needs a human decision, not silent acceptance: fix the typing (userEvent.type(el, str, { delay: null }) or paste), raise the storybook testTimeout, or file a ticket and narrow the body claim to "closes the Radix class".

🤖

site/src/pages/CreateUserPage/CreateUserForm.tsx:231

Nit [CRF-25] data-testid="login-type-input" is now dead markup. (Bisky, Gon)

CRF-11 replaced its only consumer with a role query (selectRadixOption(canvas, /login type/i, ...)). A repo-wide grep for login-type-input returns the attribute and nothing else. site/AGENTS.md allows data-testid only where no role or accessible name exists, and this PR proved one exists. (Bisky)

Fix-chain cleanup: delete the attribute.

🤖

🤖 This review was automatically generated with Coder Agents.