[quality] msw 3 (#278) fails 6 tests and silently drops onUnhandledRequest: 'error' — the suite would call the real GitHub API #279

Finding

#278 (dependabot, msw 2.15.0 → 3.0.1) fails build-test on both its runs (37137271500, 37137268904) with 6 red tests in 4 files, while #277 passes the same check on the same day and main @ a270568 is green. Reproduced on fresh origin/main a270568 with msw@3.0.1 on Node 24.21.0 (the CI toolchain). Every failure is in test code; src/ is untouched by the bump.

1. __tests__/issueCommentTest/assign.test.ts ×2, __tests__/issueCommentTest/cc.test.ts ×1 — assert assignees/reviewers as ['some-user', 'other-user']. getOrgCollabCommentUsers (src/utils/auth.ts:161-176) fills the list with Promise.all + push, so the order follows whichever user's three auth probes settle first; msw 3's dispatch timing flips it. The order was never a contract.
2. __tests__/utils/configLoader.test.ts "prefers .github/prow.yaml over a root .prowlabels.yaml" — legacy.notCalled() sees a GET …/contents/.prowlabels.yaml. It comes from the previous test ("fails closed when an org repo answers with something other than 404"): loadProwConfig probes the org and repo tiers in parallel (src/utils/config.ts:179), the org tier rejects, the test ends, and the repo tier's 8-probe 404 chain keeps running into the next test's freshly registered handlers. A pre-existing isolation gap that msw 2's timing happened to hide.
3. __tests__/utils/configLoader.test.ts + __tests__/utils/utilsErrorPaths.test.ts — HttpResponse.error() now surfaces as undici's TypeError: fetch failed; the assertions expect msw 2's TypeError: Failed to fetch.

The larger problem is the one CI did not flag. msw 3 renamed server.listen({ onUnhandledRequest }) to onUnhandledFrame. All 55 server.listen({ onUnhandledRequest: 'error' }) calls in __tests__/ are therefore silently ignored under msw 3; the default becomes warn, and unhandled requests pass through to the real network. On CI this is why #278 only shows 6 failures: the unhandled POST https://api.github.com/graphql (MergeQueueState, from queueState in src/utils/mergeQueue.ts:84) reached GitHub, got a 401, and queueState fell back as designed. In a sandbox without egress the same suite times out 141 tests (handleCronJob, lgtm, sweep, tide, trigger, approve, onPrLgtm, …) — vitest run on the #278 head reproduces it with HTTPS_PROXY pointing at a closed port. Once the bump lands, the "offline, every request mocked" guarantee the suite relies on would be gone and the tests would depend on api.github.com being reachable.

Recommendation

Tests-only change, compatible with both msw 2 (what main ships) and msw 3 (so #278 can rebase onto it and go green):

• __tests__/testUtils.ts: export one failOnUnhandledRequest = { onUnhandledRequest: 'error', onUnhandledFrame: 'error' } and make all 55 server.listen(...) calls use it, so neither msw version lets an unhandled request leave the process
• configLoader.test.ts org-500 test: serve the repo tier's first probe and await it so no probe outlives the test
• assign.test.ts / cc.test.ts: compare the multi-user lists order-insensitively
• configLoader.test.ts / utilsErrorPaths.test.ts: accept Failed to fetch (msw 2) or fetch failed (msw 3) for HttpResponse.error()

Verified on main @ a270568, Node 24.21.0: npx vitest run → 77 files / 1556 tests green with msw@2.15.0, and green with msw@3.0.1 (124 s, no network). npm run test:coverage on msw 2 stays at 100 % statements / 99.6 % branches.

Open hold-gated PRs that add new test files with server.listen({ onUnhandledRequest: 'error' }) will keep passing on msw 2 and need the same one-line switch to utils.failOnUnhandledRequest when they rebase.

Priority

• Impact: high — chore(deps-dev): bump msw from 2.15.0 to 3.0.1 #278 is permanently red, and merging it as-is would silently turn the suite into one that makes real GitHub API calls
• Effort: low — mechanical, test files only

Filed by quality agent (hold-gated mode)

🐝 Hive Agent: quality | Instance: hosted-available-lke648397-260827-5q9t | SHA: a270568

— hive: agent=quality backend=copilot model=claude-fable-5.1 copilot=1.0.88