Fix production ARR reads and add audited source field review

tests/javascript/helpers/arr_ui_harness.cjs

@@ -0,0 +1,39 @@
+// Exercise the actual UI functions with a synthetic API, without booting a browser.
+const assert = require('node:assert/strict');
+const fs = require('node:fs');
+const path = require('node:path');
+const vm = require('node:vm');
+const {webcrypto} = require('node:crypto');
+const source = fs.readFileSync(path.resolve(__dirname, '../../../arr_web/static/app.js'), 'utf8');
+const boot = '  boot();\n})();';
+assert(source.endsWith(boot+'\n') || source.endsWith(boot));
+
+function harness(respond) {
+  const elements=new Map(), storage=new Map(), storageReads=[], calls=[];
+  const element=selector => {
+    if (!elements.has(selector)) elements.set(selector,{value:'', disabled:false, hidden:false, textContent:'', innerHTML:'',
+      classList:{add(){},remove(){},toggle(){},contains(){return false;}},setAttribute(){},scrollIntoView(){},focus(){}});
+    return elements.get(selector);
+  };
+  const context=vm.createContext({Headers, console, Date, Intl, Uint8Array,
+    document:{hidden:false,querySelector:element},
+    window:{ARRI18n:{t:key=>key,text:value=>value,errorMessage:code=>code},crypto:webcrypto,
+      setTimeout(){return 1;},clearTimeout(){},location:{replace(){}}},
+    localStorage:{setItem:(k,v)=>storage.set(k,v),getItem:k=>{storageReads.push(k);return storage.get(k);},removeItem:k=>storage.delete(k)},
+    fetch:async (url, options) => {calls.push({url,method:options.method||'GET',body:options.body});return respond(url,options,calls);},
+  });
+  const exports='state, submitARRDownload, rememberARRIntent, acceptARRDownloadTask, handleARRDownloadDateChange, initARRDownload, loadARRDownloadTask, loadARRDataReview, renderARRDataReview, arrDataReviewCanFinalize, saveARRDataReviewItem, finalizeARRDataReview, trackARRDataReviewDraft, parseARRDataReviewValue';
+  vm.runInContext(source.replace(boot,`  globalThis.subject = {${exports}};\n})();`),context);
+  const subject=context.subject;
+  Object.assign(subject.state,{arrDownloadReady:true,arrDownloadLoaded:true,arrDownloadStorageKey:'test',arrDownloadUsername:'operator',csrf:'fixture'});
+  element('#arr-download-date').value='2026-09-16';
+  const row=(itemId,value='')=>{
+    const input={value,focus(){},closest:()=>node};
+    const node={dataset:{arrDataReviewItemId:itemId},querySelector:()=>input};
+    return {input,button:{closest:()=>node}};
+  };
+  return {...subject,calls,storage,storageReads,element,row,submit:()=>subject.submitARRDownload({preventDefault(){}})};
+}
+const response=(status,data,code) => ({status,ok:status<400,json:async()=>code?{ok:false,error:{code}}:{ok:true,data}});
+const scopedKey=(context='production',username='operator')=>`arr:last-download:v2:${encodeURIComponent(context)}:${encodeURIComponent(username)}`;
+module.exports={harness,response,scopedKey};