fix(runner): the leak spec must poll KV list(), not read it once (DEV-2567)

[danielzytohoc]

First production execution of this spec — unlocked by the new E2E_API_TOKEN (DEV-2583) — failed its positive control in run 32491144642: a create nobody abandoned is still metered read the admin panel once, immediately after the create's 200. Test bug, not product: the meter put is awaited before the response, but the panel enumerates session-meter: keys with KV list(), which is eventually consistent on real Cloudflare KV — a fresh key can lag its own put by seconds (documented worst case 60s). wrangler dev's KV is immediate, so the single-shot read had only ever been exercised where it couldn't lose.

The diagnosis exposed a second, subtler hole: inside that same lag window the two .not.toContain() tests were vacuous — a leaked phantom meter (written before the 410 returns) wouldn't be visible in list() yet either, so they passed leak or no leak. Fixes:

• the positive containment and the post-teardown clearance now poll via toPass (90s ceiling, 2s intervals), with the mechanism explained inline;
• the two absence tests sample a sustained 45s window (expectNeverMetered) instead of reading once — absence under eventual consistency can't be proven with one read, and the positive control demonstrates a real key surfaces well within the same window.

Verified against prod from this branch (run 32492510913, full workflow green): all 3 leak tests + the authed share round-trip pass — 4/4 in 3.1m. The positive control took 50.6s where it used to fail instantly, i.e. the poll absorbed real, observed list() lag.

---

Note

Low Risk
Test-only change to polling/timeouts; no product, auth, or metering logic is modified.

Overview
Stops the abandoned-create leak spec from treating a single /admin panel read as proof. Production KV list() is eventually consistent (up to ~60s), so a one-shot .toContain() failed the positive control and a one-shot .not.toContain() could pass even if a phantom meter existed.

Absence checks now sample for 90s via expectNeverMetered (5s interval). The live-session and teardown assertions poll with toPass (90s, 2s). Tests get a 240s timeout so the window exceeds documented KV lag with margin.

^{Reviewed by Cursor Bugbot for commit 7acdc44. Bugbot is set up for automated code reviews on this repo. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

Want higher recall? High effort reviews run extra passes and find more bugs. A team admin can switch effort levels in the Cursor dashboard.

^{Reviewed by Cursor Bugbot for commit 593ae22. Configure here.}