docs(kanban): spec task 121 WASM store telemetry export to DevTools

[StevenTCramer]

Summary

TimeWarp.State.DevTools.Wasm posts TimeWarp.State activities from the browser to the existing ingest document. The server stamps timewarp.state.runtime=server when that tag is absent. The browser exporter stamps wasm. The inspector log copies that field onto the row and shows srv or wasm.

The browser learns the origin from TimeWarp:State:DevTools:Endpoint, then TIMEWARP_STATE_DEVTOOLS_ENDPOINT, then GET /_timewarp/state-devtools (MapTimeWarpStateDevToolsClientConfig, Development only). WithTimeWarpStateDevTools sets TIMEWARP_STATE_DEVTOOLS_CORS_ORIGINS on the inspector from the inspected app's http and https endpoints. CORS is registered only in Development and only when that list has an absolute http(s) origin.

Packages are 12.0.0-beta.15. A published app keeps the assembly out with a Debug-only PackageReference and #if DEBUG around the call. The telemetry sample keeps the reference so /counter-wasm stays visible.

./bin/dev build exited 0 with 0 compiler errors. The log still prints pre-existing NuGet warnings (NU1510, NU1902) that this change did not add. ./bin/dev test exited 0, including DevTools (89) and DevTools isolation (4). The telemetry sample server, which hosts the WASM client, builds with 0 warnings.

Review round 1 is addressed on this branch. Run mode sets ASPNETCORE_ENVIRONMENT=Development on the packaged inspector, so ingest CORS is registered under Aspire. Allow headers are on POST /ingest/spans only, and the private-network header is added only after the policy has allowed the origin. Discovery joins a relative path onto the host base, so a path base is kept. Each WithTimeWarpStateDevTools adds origins to one callback. FlushTask is public because InternalsVisibleTo would also expose the internal copies of the ingest document and collide with the public exporter types. Dispose still does not wait on it. The release note names the Microsoft.AspNetCore.App shared framework. timewarp-state.slnx lists Debug and Release again.

The sample server was only calling UseStaticFiles, which serves wwwroot and not the framework manifest. /counter-wasm then 404s _framework/blazor.web.js and the WASM counter never starts. The host now calls UseStaticWebAssets and MapStaticAssets, the same pair the inspector uses.

dotnet test tests/timewarp-state-devtools-tests/timewarp-state-devtools-tests.csproj passed 94, failed 0. ./bin/dev test exited 0. ./bin/dev build exited 0 with 0 errors. Warnings in that log are pre-existing and outside the DevTools projects and sample 04 (nullable warnings in clone tests, TW0007, RS0030, plus NU1510 and NU1902).

Test plan

Smoke: dotnet run --project samples/04-telemetry/apphost/sample-04-apphost.csproj. Open the sample at http://localhost:5086/counter-wasm (that origin is the one Aspire puts in TIMEWARP_STATE_DEVTOOLS_CORS_ORIGINS). Click Click me. Open the inspector URL from GET http://localhost:5086/_timewarp/state-devtools.

Expect: the count increases by 5. The inspector shows WasmCounterState with a wasm badge, including IncrementCountActionSet.Action. OPTIONS /ingest/spans from http://localhost:5086 returns 204 with Access-Control-Allow-Origin: http://localhost:5086. GET / on the inspector does not send that header.

Observed on 2026-10-16: the count went from 3 to 8. The inspector listed live wasm init WasmCounterState and live wasm IncrementCountActionSet.Action WasmCounterState. The preflight returned 204. GET / had no allow-origin header.

Kanban task 121
Session: 3911642