snapshot-replay.ts's public/authenticated privacy boundary has zero test coverage

[JSONbored]

Context

apps/loopover-ui/src/lib/snapshot-replay.ts builds the "decision snapshot replay" view model (issue
#285) used by apps/loopover-ui/src/components/site/snapshot-replay.tsx's <SnapshotReplayCard> /
<SnapshotReplay> (wired into apps/loopover-ui/src/routes/app.runs.tsx). Its whole job is a privacy
boundary: buildSnapshotReplayView({ viewer, snapshot, counterfactuals }) takes a
viewer: "public" | "authenticated" and, for "public", strips reason/facts/assumptions off
every counterfactual alternative via projectCounterfactuals() (lines 195-213), replacing them with
null/[] and recording what was withheld in withheldPrivateFields. The component then renders an
explicit audience toggle (<SnapshotReplayCard authenticated publicSafe>) specifically so a reviewer
can visually confirm the public view never leaks the private detail the authenticated view shows (see
the component's own doc comment, lines 24-29).

Despite being the actual enforcement point for that privacy boundary, neither file has a test:
there is no snapshot-replay.test.ts next to the lib module and no snapshot-replay.test.tsx next to
the component (confirmed — no file matches either name anywhere under apps/loopover-ui/src, and
neither buildSnapshotReplayView nor SnapshotReplayCard/SnapshotReplay is referenced from any
*.test.ts* file in the repo). This is the kind of logic this repo otherwise tests heavily elsewhere
— e.g. apps/loopover-ui/src/lib/config-generator-yaml.test.ts,
apps/loopover-ui/src/lib/registration-workspace.test.ts — and the module's own header explicitly
calls out that it's "intentionally standalone (no imports) so it can be unit-tested directly," which
never actually happened.

Requirements

• Add apps/loopover-ui/src/lib/snapshot-replay.test.ts covering buildSnapshotReplayView's pure
  logic, in particular:
  • viewer: "public" strips reason/facts/assumptions from every counterfactual alternative and
    sets withheldPrivateFields to ["counterfactual_detail"] when any alternative actually carried
    private detail, and to [] when none did.
  • viewer: "authenticated" passes counterfactuals through unchanged with withheldPrivateFields: [].
  • Malformed/missing snapshot (not a record) returns the "missing" status view.
  • Missing snapshot.provenance returns the "missing" status view but still carries through
    snapshotId/actionType/target/generatedAt that were present on the snapshot itself.
  • status is "stale" when freshness !== "fresh", evidenceComplete === false, or
    evidenceGaps is non-empty (and "populated" when none of those hold) — test each trigger
    independently and the "all clear" case.
  • readCounterfactuals filters to the matching target.repoFullName (case-insensitively, per
    sameRepo) when one is present, and keeps all entries when targetRepoFullName is null.
  • Unknown/invalid confidence and freshness string values narrow to "unknown" rather than
    passing through arbitrary strings.
• Add apps/loopover-ui/src/components/site/snapshot-replay.test.tsx covering:
  • <SnapshotReplayCard> defaults to the "authenticated" view and switching the toggle to
    "public" renders the publicSafe view's content, not the authenticated view's — assert a
    private-only string (e.g. a reason) present in the authenticated fixture is absent from the
    rendered DOM after toggling to public.
  • <SnapshotReplay view={...}> with status: "missing" renders only the notice, none of the detail
    sections.
  • The withheldPrivateFields footer note only renders when the array is non-empty.

Deliverables

• apps/loopover-ui/src/lib/snapshot-replay.test.ts with the coverage listed above.
• apps/loopover-ui/src/components/site/snapshot-replay.test.tsx with the coverage listed above.

Test Coverage Requirements

apps/** is outside this repo's Codecov coverage.include (vitest.config.ts / codecov.yml's
ignore: ["apps/**", ...]), so this change owes no Codecov patch-coverage percentage — but that's
exactly why this gap existed undetected. Aim for genuine branch coverage of every conditional listed
in Requirements (both sides of each ? :/??/|| in buildSnapshotReplayView,
projectCounterfactuals, and resolveRegistrationWorkspaceFreshness-style staleness triggers), not
just line coverage. Run npx vitest run apps/loopover-ui/src/lib/snapshot-replay.test.ts apps/loopover-ui/src/components/site/snapshot-replay.test.tsx while iterating, and npm run ui:test
before opening the PR.

Expected Outcome

The public/authenticated privacy boundary this module exists to enforce has a real regression test
suite, so a future change to projectCounterfactuals or the component's viewer toggle that
accidentally leaked private reason/facts/assumptions text into the public view would be caught
by CI instead of only by manual review.

Links & Resources

• apps/loopover-ui/src/lib/snapshot-replay.ts (the view-model module to test)
• apps/loopover-ui/src/components/site/snapshot-replay.tsx (the component to test)
• apps/loopover-ui/src/routes/app.runs.tsx (the real call site)
• apps/loopover-ui/src/lib/registration-workspace.ts and its
  registration-workspace.test.ts for this repo's existing pattern of testing a similar
  payload-to-view-model + public-safe-sanitization module

[linear-code]

JSO-5886