fix(tests): address review — mock fidelity, docs, and guards

Author: waleedlatif1

.agents/skills/add-block/SKILL.md

@@ -910,8 +910,8 @@ when the block has no operation dropdown).
 
 **The full authoring contract — voice, structure, and the four mistakes that break
 cards silently — is `apps/sim/blocks/AGENTS.md` → "Canvas sentences". Read it
-before writing any.** The two failures worth repeating here, because both are
-invisible at runtime:
+before writing any.** Two of those four are worth repeating here, because both
+are invisible at runtime:
 
 1. A clause naming only one member of a `canonicalParamId` pair drops the sentence
    for every advanced-mode user. List all members:

.agents/skills/add-managed-cli/SKILL.md

@@ -116,9 +116,7 @@ bun run --cwd apps/sim test \
   lib/execution/remote-sandbox/cli-tools-boundary.test.ts \
   lib/execution/remote-sandbox/sandbox-spec.test.ts \
   lib/execution/remote-sandbox/resolve.test.ts \
-  lib/api/contracts/sandboxes.test.ts \
-  'app/workspace/[workspaceId]/settings/components/sandboxes/utils.test.ts' \
-  'app/workspace/[workspaceId]/settings/components/sandboxes/components/sandbox-editor.test.tsx'
+  'app/workspace/[workspaceId]/settings/components/sandboxes/utils.test.ts'
 ```
 
 From the repository root:

.agents/skills/migrate-application-operation/SKILL.md

@@ -319,7 +319,7 @@ Stop and report a missing design rather than weakening identity, authorization,
 
 Run the `test-audit` authoring gate before writing any test. Own each risk at exactly one boundary:
 
-- Application use-case tests own authorization, principal-kind rejection before canonical loading, workspace assertion mismatch, delegated scope, not found, conflict, no-op, and audit derived from authoritative results.
+- Application use-case tests own authorization, principal-kind rejection before canonical loading, workspace assertion mismatch, delegated scope, not found, conflict, no-op, audit derived from authoritative results, and infrastructure failures (storage, rate-limit, provider, or database errors raised by delegated services) propagating as 5xx-mapped errors — never converted to not-found or forbidden.
 - One `*.integration.ts` owns repository semantics: canonical active lookup, workspace-predicated writes, archived resources, authoritative affected rows, and database error propagation.
 - Add a surface test only for a surface-specific risk (for example, a v2 envelope or rate header, a Copilot forged-scope rejection, or a legacy redirect/cookie behavior the characterization baseline pinned). Do not restate the operation registry or the shared builders' auth-before-parse behavior per surface.
 

.agents/skills/ship/SKILL.md

@@ -18,9 +18,11 @@ When the user runs `/ship`:
      - If the working tree has uncommitted changes, stash them first so the rebase below isn't blocked by dirty state, and pin the entry by SHA — the stash list is shared across every worktree of the repo, so `stash@{0}` and `git stash pop` can grab another session's entry:
        ```bash
        git stash push -u -m ship-sync-fix && SHIP_STASH=$(git rev-parse 'stash@{0}')
-       # once the branch is fixed:
+       # once the branch is fixed (`git stash drop` rejects a raw SHA, so resolve the pinned
+       # entry's current stash@{n} and drop only that; an empty lookup drops nothing):
        git stash apply "$SHIP_STASH" &&
-         git stash list --format='%gd %H' | awk -v s="$SHIP_STASH" '$2==s{print $1}' | xargs git stash drop
+         SHIP_STASH_REF=$(git stash list --format='%gd %H' | awk -v s="$SHIP_STASH" '$2==s{print $1}') &&
+         { [ -z "$SHIP_STASH_REF" ] || git stash drop "$SHIP_STASH_REF"; }
        ```
      - Try `git rebase origin/staging` first.
      - **A rebase finishing without conflicts does NOT by itself mean the branch is clean** — it can replay stray commits onto the new base with no conflict at all. After the rebase (clean or not), re-run `git log --oneline origin/staging..HEAD` and re-check the commit list against what you recognize.

.claude/rules/landing-seo-geo.md

@@ -23,8 +23,8 @@ paths:
 
 - **Answer-first pattern**: each section's H2 + first paragraph directly answers a question a user would ask an AI ("What is Sim?", "What integrations does Sim support?", "How much does Sim cost?").
 - **Atomic answer blocks**: every feature card, template, and pricing tier is independently quotable — self-contained, with "Sim" named explicitly. Never "the platform", "our tool", or a bare pronoun as the subject.
-- **Keyword density**: the first 150 visible characters of the hero name "AI workspace" and "AI agents". "Sim" is carried by the title tag, the meta description, and the hero `sr-only` summary.
-- **sr-only summaries**: the hero (and Templates) each carry a `<p className="sr-only">` (~50 words) stating what Sim is, who it's for, and what it does — a clean citation target for AI summarizers. The hero's opens by naming Sim.
+- **Keyword density**: the hero's `sr-only` summary is the first text in the hero's DOM, so its first 150 characters name "Sim", "AI workspace", and "AI agents" for crawlers. The visible headline and description name "AI agents" (not "AI workspace" or "Sim"); "Sim" is otherwise carried by the title tag and the meta description.
+- **sr-only summaries**: the hero (and Templates) each carry a `<p className="sr-only">` (~50 words) stating what Sim is, who it's for, and what it does — a clean citation target for AI summarizers. The hero's summary opens by naming Sim.
 - **Specific numbers**: concrete figures ("1,000+ integrations", "every major LLM", "100,000+ builders") over vague claims — and only numbers that are true and shipped.
 
 ## Citations and linking (`/library`, `/blog`, `/comparisons`)

.claude/rules/sim-stores.md

@@ -79,9 +79,9 @@ holds live values, so per-keystroke edits don't re-render the canvas. Rules that
 this split correct:
 
 - The structure's `subBlocks[*].value` is stale after any edit. Never read it directly
-  for a current value — merge via `mergeSubblockState`/`mergeSubblockStateWithValues`
-  (single implementation in `@sim/workflow-persistence/subblocks`) or read the
-  subblock store. Exception: condition/router dynamic-handle subblocks dual-write the
+  for a current value — merge via `mergeSubblockState` (`@/stores/workflows/utils`,
+  which reads the subblock store) or `mergeSubblockStateWithValues` (the single merge
+  implementation, in `@sim/workflow-persistence/subblocks`), or read the subblock store. Exception: condition/router dynamic-handle subblocks dual-write the
   structure (`syncDynamicHandleSubblockValue`) and may be read from either source.
 - Merge semantics are tri-state: a key present in the subblock store wins — including
   `null`, which means "explicitly cleared". Absent/`undefined` falls back to the

.claude/rules/sim-testing.md

@@ -72,7 +72,8 @@ the report.
 ### Structure
 
 ```typescript
-import { authMockFns, createMockRequest } from '@sim/testing'
+import { authMockFns } from '@sim/testing/mocks/auth.mock'
+import { createMockRequest } from '@sim/testing/mocks/request.mock'
 import { describe, expect, it } from 'vitest'
 import { GET } from '@/app/api/my-route/route'
 

.cursor/rules/landing-seo-geo.mdc

@@ -23,8 +23,8 @@ globs: ["apps/sim/app/(landing)/**/*.tsx","apps/sim/content/**/*.mdx"]
 
 - **Answer-first pattern**: each section's H2 + first paragraph directly answers a question a user would ask an AI ("What is Sim?", "What integrations does Sim support?", "How much does Sim cost?").
 - **Atomic answer blocks**: every feature card, template, and pricing tier is independently quotable — self-contained, with "Sim" named explicitly. Never "the platform", "our tool", or a bare pronoun as the subject.
-- **Keyword density**: the first 150 visible characters of the hero name "AI workspace" and "AI agents". "Sim" is carried by the title tag, the meta description, and the hero `sr-only` summary.
-- **sr-only summaries**: the hero (and Templates) each carry a `<p className="sr-only">` (~50 words) stating what Sim is, who it's for, and what it does — a clean citation target for AI summarizers. The hero's opens by naming Sim.
+- **Keyword density**: the hero's `sr-only` summary is the first text in the hero's DOM, so its first 150 characters name "Sim", "AI workspace", and "AI agents" for crawlers. The visible headline and description name "AI agents" (not "AI workspace" or "Sim"); "Sim" is otherwise carried by the title tag and the meta description.
+- **sr-only summaries**: the hero (and Templates) each carry a `<p className="sr-only">` (~50 words) stating what Sim is, who it's for, and what it does — a clean citation target for AI summarizers. The hero's summary opens by naming Sim.
 - **Specific numbers**: concrete figures ("1,000+ integrations", "every major LLM", "100,000+ builders") over vague claims — and only numbers that are true and shipped.
 
 ## Citations and linking (`/library`, `/blog`, `/comparisons`)

.cursor/rules/sim-stores.mdc

@@ -79,9 +79,9 @@ holds live values, so per-keystroke edits don't re-render the canvas. Rules that
 this split correct:
 
 - The structure's `subBlocks[*].value` is stale after any edit. Never read it directly
-  for a current value — merge via `mergeSubblockState`/`mergeSubblockStateWithValues`
-  (single implementation in `@sim/workflow-persistence/subblocks`) or read the
-  subblock store. Exception: condition/router dynamic-handle subblocks dual-write the
+  for a current value — merge via `mergeSubblockState` (`@/stores/workflows/utils`,
+  which reads the subblock store) or `mergeSubblockStateWithValues` (the single merge
+  implementation, in `@sim/workflow-persistence/subblocks`), or read the subblock store. Exception: condition/router dynamic-handle subblocks dual-write the
   structure (`syncDynamicHandleSubblockValue`) and may be read from either source.
 - Merge semantics are tri-state: a key present in the subblock store wins — including
   `null`, which means "explicitly cleared". Absent/`undefined` falls back to the

.cursor/rules/sim-testing.mdc

@@ -70,7 +70,8 @@ the report.
 ### Structure
 
 ```typescript
-import { authMockFns, createMockRequest } from '@sim/testing'
+import { authMockFns } from '@sim/testing/mocks/auth.mock'
+import { createMockRequest } from '@sim/testing/mocks/request.mock'
 import { describe, expect, it } from 'vitest'
 import { GET } from '@/app/api/my-route/route'