Cover the updates section's assisted-update safety routing

[selfcontained]

Recurring Test Enforcer run. The local suite was green on the first pass (29th consecutive), so the whole run went to the queued next_focus: the five subcomponents PR #949 split out of updates-section.tsx, none of which anything mounted.

Why here

release-utils.test.ts already covers the pure predicates — isForceRequired, isAssistedPreferred, describeForceTriggers — but not which UI they drive. The contract that actually protects an install is that a release requiring the agent-assisted flow must demote the standard updater into a dropdown and route it through a force confirmation instead of running it on one click, and that decision spans UpdatesCheckPanel → UpdateActions → UpdatesForceConfirmDialog. No single component owns it, so the test stubs useReleaseUpdates and mounts the real UpdatesSection, exercising all five subcomponents plus the assisted and pending-migration gates. forceConfirmOpen is held in real state inside the stub, so click → dialog → confirm is one real interaction rather than an assertion that a setter fired.

What it pins

• A required release and a migration-gated release both demote the standard update into the menu and open the confirmation instead of running it; confirming then forces the update, cancelling runs nothing.
• A migration evaluation error warns but leaves the one-click path open — a checker that could not run is not evidence of a risky update.
• A recommended release promotes the assisted flow without forcing a confirmation, which is what separates assistedPreferred from forceRequired.
• The wiring a component split is most likely to scramble: the { force: true } flag on the confirmed update, plain vs cache-clearing reload, and the channel / auto-update handlers.
• Both in-flight-update takeovers hide the controls, so a second update cannot be launched on top of the first.

Validation

check, format, finalize:web, test (server 163 files/2783, web 65/926, ext 60, scripts 4), test:e2e (180 passed / 12 skipped) and test:e2e:live (11 passed, 23.9s, no stray e2e-* tmux sessions) all green.

Mutation battery: 27 mutants, 23 killed. The survivors are not test gaps — three are one root cause (channelSaving / autoUpdateSaving exist only as a Tailwind opacity-50 pointer-events-none class with no disabled or aria-busy, so jsdom cannot observe them and asserting would mean class-name coupling), and the fourth is OperationTakeover's phasesOrder, which belongs to that component's own coverage. Both are recorded in the Brain backlog.

One review round; both findings applied — restore Element.prototype.scrollIntoView in afterEach so the stub cannot leak into later files sharing the worker, and narrow the preferences test's name to the wiring it actually covers.

🤖 Generated with Claude Code