[MeharPro]

Status: needs owner decision. The fix, tests and drafts are ready. Grafana closes unsigned commits ("including pull requests that have been authored by Agents") and requires its CLA, so the sender has to re-sign the commit with their own key and sign the CLA.

What

Following the verifier's retarget in the brief, this hunt covered Grafana's three admin list pages (main at 98b10741; that day's head 6cf5131d does not build, and its public/ is identical). The server-admin users list, the service accounts list and the org users list each store whichever search response arrives last. So a slower response for an earlier page or search replaces the newer list. On paging, the pager also jumps back. On the org list, a new search word can end on "No users found". The fix passes a fixed requestId to getBackendSrv().get(...), which already cancels the earlier in-flight request. It changes +17 −6 lines in three action files, plus Jest tests in Grafana's style that fail before the fix and pass after.

Files (all under docs/adoption/hunts/):

• grafana-panel-refresh.md: the report (setup, how Grafana was driven, every scenario incl. negatives, finding, root cause, fix, tests, GenClass problems, time, sending steps)
• grafana-panel-refresh.patch: one commit against 98b10741, 7 files, +224 −6
• grafana-panel-refresh-issue.md: the issue (New Bug Report template) and the PR text (Grafana's template), with the disclosure paragraph and a "before sending" checklist
• grafana-panel-refresh/: seed.mjs, hunt.mjs (explore and plain modes), repro.mjs (standalone, no GenClass), summarise.mjs, results/
• README.md: new row

Measured (production frontend build, Chromium 1243; explore: 2 fifo baselines + 6 seeded loads per session)

scenario	300 ms	600 ms	900 ms
admin users, page 2→3	RACE 4 of 6	4 of 6	4 of 6
admin users, search	none	none	RACE 2 of 6
service accounts, page 2→3	RACE 5 of 6	5 of 6	5 of 6
service accounts, search	none	RACE 2 of 6	3 of 6
org users, page 2→3	RACE 3 of 6	3 of 6	3 of 6
org users, new search word	none	none	RACE 1 of 6
org users, refining search	none	none	none (a client-side filter hides it)
negatives: panel refresh, contact-point save	none, no findings	none	none

• Explore vs the harness's own DOM oracle: they named the same loads in all 45 comparable sessions (360 loads). No baseline was wrong, and no hold ran out.
• Without GenClass (page.route delays only the earlier request by 1.5 s, or 3 s for the service account search): 5 of 5 loads wrong on every list, 0 of 5 without the delay.
• Fixed build: explore found no race in 144 loads. The delayed reproductions were wrong in 0 of 30 loads.
• Jest: without the fix, 4 of 4 new tests fail in each of 3 runs. With it, 65 of 65 tests in the admin, serviceaccounts and users folders pass in each of 3 runs.
• Static checks: tsc --noEmit, ESLint and Prettier are clean on the changed files. knip can't run without Grafana's private enterprise repo.

To send (a person, personal account)

1. Work through the "Before sending" list in grafana-panel-refresh-issue.md: search for duplicates again, run repro.mjs yourself and paste your own output, run the tests, read the diff.
2. Fork grafana/grafana, then git am the patch onto current main.
3. Re-sign the commit with your own verified key: git commit --amend --no-edit --reset-author -S. The commit author is a placeholder.
4. File the issue first, then the PR with Fixes #<issue>, and sign the CLA when the assistant asks.
5. Don't link #133236 or #133596. GenClass is mentioned once, at the end. Grafana's own AGENTS.md wants a human approval before each push, so the push is yours.

Problems with GenClass itself (details in report §6)

• Request keys ignore <base href="/">, e.g. GET /admin/api/users/search where the real path is /api/users/search.
• The Redux Toolkit store showed up only as react-redux's external store (Connect_Component.external0.*), not as redux.*.
• At slow_ms: 300, debounced searches never overlap, and explore just says "No race found" there. A "requests never overlapped" note would help.
• On Grafana's dev build each click took about 2.5 s, which hid every race, and one load crashed with the runtime injected.
• Seeded names must have no digits, because explore blanks digit tokens.

Checks

• No change to packages/*/src, tests or model-visible text: docs/adoption only
• No dependency change
• Runtime typecheck/build/vitest: not applicable (nothing in packages/ changed). GenClass was only built (npm run build for the runtime and the MCP server) to run the hunt.

Notes for the reviewer

• Branch name: this branch is claude/adoring-pascal-ylf9ze, not adopt/grafana-panel-refresh, because the session was told to push only to it.
• Harness corrections: three org sessions opened the "All users" tab and were discarded. The first org search used -o, which the app regex-escapes. That session is kept as org-search-hyphen, and its oracle column is explained in the report.
• Not run: dashboard save, the alert-rule form and Explore history (negatives the brief named), and Enterprise's roles POST. That POST still has no requestId, which the PR draft says.
• Time: about 2 hours.

---

Generated by Claude Code