Manual test checklist: unanswered-questions self-assignment (Claim/Release)

[rtanglao]

Human-only acceptance tests for the self-assignment system (#49), the token breadth guard (#51), and the write-capability probe (#52). These can't be automated in CI because they need real fine-grained PATs, a real browser (localStorage), and live writes to this repo. Do these on the deployed report at:
https://thunderbird.github.io/thunderbird-metrics-and-reports/UNANSWERED_QUESTIONS/HTML_REPORTS/desktop-latest-unanswered-questions.html

Ordered for efficient execution: no-token checks first → all rejection tests (they leave you signed out anyway) → sign in once → functional tests → multi-party/slow tests → teardown. Tick items top-to-bottom.

0. Prep

• Replace placeholder usernames PERSON1–PERSON4 in scripts/assignments.py with the 4 real GitHub usernames, commit, and let a report regenerate.
• Create a correctly-scoped token: fine-grained, Only this repo, Contents: Read and write, short expiry (see UNANSWERED_QUESTIONS/TOKEN_SETUP.md).
• Create the negative-test tokens: a read-only one (Contents: Read) and a broad one (classic PAT, or fine-grained "All repositories").

1. No-token checks (before signing in)

• Buttons safe with no token: buttons are disabled and show the "set token" tooltip; nothing breaks.
• Manual fallback link: the Claim manually (edit CSV) header link opens …/edit/main/UNANSWERED_QUESTIONS/desktop-assignments.csv.
• HTML escaping intact: a question whose title/content has HTML/quotes renders safely (no broken layout, no script injection).

2. Token rejection (stay signed out — good token not stored yet)

• Invalid token: paste a garbage/expired string → Token rejected (authentication failed); nothing stored.
• Broad token rejected (Add soft token-scope guard: reject broad GitHub tokens in the assignment UI #51): classic PAT or "All repositories" token → Token has access to multiple repositories…; not stored.
• Wrong-repo token rejected (Add soft token-scope guard: reject broad GitHub tokens in the assignment UI #51): token scoped to a different single repo → Token is scoped to X, not ….
• Read-only token rejected at set (Token guard: verify write capability reliably via a no-op write probe #52): correctly-scoped but Contents: Read-only → Token cannot write to …; not stored.
• Probe made no change (Token guard: verify write capability reliably via a no-op write probe #52): confirm the assignments CSV has no new commit after the read-only rejection (the bogus-SHA PUT changed nothing).
• Stored broad token cleared on load (Add soft token-scope guard: reject broad GitHub tokens in the assignment UI #51): manually put a broad token in localStorage, reload → detected and cleared with the warning.

3. Sign in (happy path)

• Set good token (write-capable passes Token guard: verify write capability reliably via a no-op write probe #52): click Set GitHub token, paste the correctly-scoped read-write token → Signed in as @you; Set becomes Sign out.
• Persistence across reload: reload → still Signed in as @you (token read from localStorage).

4. Claim / Release (signed in, single user)

• Claim: on an unassigned row click Claim → cell shows @you; a commit appears in desktop-assignments.csv (question_id,you,<ts>,you).
• Sort by Assignee: click the Assignee header → rows group by assignee; unassigned sort together.
• Release: on your own row click Release → cell clears; the row is removed from the CSV.
• Android report: repeat a Claim + Release on android-latest-…html writing to android-assignments.csv.

5. Multi-party & slow (coordinate with a teammate / second browser)

• Others' rows read-only: a row claimed by someone else shows Claimed and is disabled.
• Live state refresh: after a teammate claims a question, reload (or the on-load fetch) reflects it without waiting for a rebuild.
• Survives regeneration: claim a question, trigger the report workflow (or wait for the scheduled run) → the regenerated report still shows your assignment.
• Concurrency, different questions: two people claim different questions simultaneously → both succeed.
• Concurrency, same question: two people claim the same open question at ~the same time → one wins; the other sees Already claimed by @x (no duplicate row).

6. Teardown

• Sign out: click Sign out → Not signed in; localStorage key tbq_gh_token removed.
• Cross-browser: open the report in a second browser with no token → buttons disabled until a token is set there.

Refs: #49, #51, #52.