flaky test fix: Track card-api and file-api deps directly in the render route

[habdelra]

Problem

Realm Server Tests on PR #4872 failed at:

not ok 70 prerendering-test.ts > prerender - non-mutating tests > runner behavior > file prerender returns extracted metadata
  message: deps include base file-api module
  severity: failed
  actual  : false
  expected: true

The file extract's returned deps is supposed to include https://cardstack.com/base/file-api — that's the public URL the indexer references when deciding whether to invalidate a previously-extracted file. The assertion was relying on the runtime-dependency tracker to surface that URL, but the path that actually placed it there was incidental: matrix-service.fileAPIModule = importResource(() => 'file-api') happens to call loader.import('file-api') during matrix-service construction, and trackRuntimeModuleDependency runs synchronously inside that call. Whether it landed inside the route's active tracking-session window depended on microtask scheduling — fine on a fresh page, flaky after a BrowserManager.restartBrowser() (prior test 68's recovery render) or any other timing perturbation.

The render route doesn't actually need matrix-service for anything; it only needed the dep recorded.

Solution

In RenderRoute.#buildModel, await Promise.all of this.loaderService.loader.import for both card-api and file-api. This records each as a runtime dep of the current render against the active tracking session. The loader caches the modules so subsequent renders re-track without re-evaluating, and putting the await inside #buildModel keeps the promise stored in #modelPromises covering the imports so concurrent same-key model() calls dedup correctly.

Files

• packages/host/app/routes/render.ts

Test plan

• CI passes on this branch
• Re-run of the original failure scenario (PR flaky test - wait-for-host-standby: retry puppeteer.launch with diagnostics #4872 realm-server tests) produces file-api in deps consistently

[github-actions]

Preview deployments

• Host staging preview

• Host production preview

[Copilot]

Pull request overview

This PR stabilizes file-extract dependency reporting by ensuring the base file-api module is always included as a dependency, instead of relying on runtime dependency tracking timing.

Changes:

• Adds baseRealm and a route-specific logger.
• Pins ${baseRealm.url}file-api into merged file-extract deps.
• Logs a warning when both runtime tracking and extractor deps missed file-api.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated 1 comment.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

Comments suppressed due to low confidence (1)

packages/host/app/routes/render.ts:199

• Setting __boxelRenderContext before restoreSessionsFromStorage() but registering the cleanup only afterward means any exception during session restore (for example, malformed JSON in the sessions localStorage entry) leaves the global render-context flag set after the transition aborts. Register cleanup or use a try/finally before calling code that can throw so later host behavior is not incorrectly treated as prerender context.

    this.#authGuard.register();

[habdelra]

this approach seems to have introduced a lot of instability. backing off on it