Cover the Brain Explorer panes and fix two routing bugs

[selfcontained]

Recurring Test Enforcer run. Local suite was green on first pass (26th consecutive), so the run went to the next_focus coverage target — the last two zero-coverage surfaces from the #925 brains split. The coverage work turned up two real product bugs, both fixed here.

Product bugs fixed

Dead redirect on a malformed repo root. BrainsDetailPane recovered from an undecodable base64url repo root by calling navigate() during render. React Router v7 refuses imperative navigation during render — it logs You should call navigate() in a React.useEffect() and no-ops (verified with a probe). So the pane rendered the overview while the broken URL stayed in the address bar, came back on reload, and survived in a shared link. Now a declarative <Navigate to="/automations/brains" replace />.

Double-decoded collection param. selectedCollection={collection ? decodeURIComponent(collection) : null} decoded a path param react-router had already decoded. A collection named 50%off threw URIError and took the whole pane down; one named %41 silently selected a collection that does not exist and rendered it empty. Both names are reachable — collection names come from agents, and the sidebar links to whatever exists. Now collection ?? null. There are no other decodeURIComponent call sites in apps/web/src, and every producer of that segment already goes through encodeURIComponent, so encode/decode is symmetric.

Coverage added

brains-detail-pane.test.tsx (19 tests) mounts the pane on the same three routes the real router declares, so useParams behaves exactly as in production. It pins the repo-root decode and its malformed fallback, the collection round trip, pill counts and the active marker, search wiring, and the destructive "Clear project" flow — wire contract, summed toast, failure path, and pending gating. 20/21 mutants killed. The survivor is the collectionsLoading guard, which is unobservable in both branches because the query's data already defaults to []; it is recorded as a dead guard for a future run rather than papered over with a test that cannot fail.

brains-pane.test.tsx (14 tests) pins the encode half of the same URL contract plus list states, per-type count gating, keyboard activation, and the selection highlight. 19/19 mutants killed.

No new E2E test: e2e/brains-page.spec.ts already drives this route in a real browser, and the two fixes are unit-observable.

Review

One general review agent inspected the diff. Its substantive findings were fixed in the follow-up commit: the first battery never mutated the { replace: true } flags, so nothing guarded the back-button-trap half of the redirect fix — a navigation-type probe now pins REPLACE on all three redirects and PUSH on ordinary pill navigation. It also caught a test that could not fail, a duplicated sidebar test, and a keyboard test that reused a DOM node captured before its own route change.

Validation

pnpm run check, pnpm run format (clean on a warm tree), pnpm run finalize:web, pnpm run test (server 2733 passed / 9 skipped, web 875, extension 60, scripts 4), pnpm run test:e2e (180 passed / 12 skipped), pnpm run test:e2e:live (11 passed, 20.8s, zero leaked e2e-* tmux sessions).

CI scan of the last 50 runs: 49 success. The one failure is the Release workflow's own origin/main advanced after smoke tests guard firing during a merge race — not a test failure. No CI-only flakes found; the flakes list stays empty.

🤖 Generated with Claude Code