[major] DAG cycle detector false-positives on SPA in-place state changes (also causes mutation double-apply)

[tlemmonds]

Environment: kane-cli 0.4.10 · Node 24.14.1 · Windows 11 · single-page app at a stable URL

Summary
On a single-page app where actions change state but not the URL, the DAG cycle detector flags a "revisited self-loop" and force-stops runs that are actually progressing correctly (stuck.dag_cycle). The same misdetection drives mutation double-apply — the runtime re-clicks a button because it never registers the in-place state change.

Steps to reproduce (SPA, everything at /portal)

• Flow: login → access-denied → whitelist → retry → cash-advance → result panel. State changes in place; the URL stays constant.
• Run it via kane-cli testmd run.

Actual

• testmd run reports stuck.dag_cycle ("revisited self-loop: /portal") and fails, even though the steps were progressing. Reproduced 3×.
• Mutation double-apply: the "Take cash advance" button is clicked repeatedly — a single $500 advance ran the balance 9,500 → 11,500 (4×). Also seen from an explicit single-click objective ("click the button one time" → clicked twice).
• A long multi-action one-shot objective hit stuck.dag_cycle, failed at step 17, and burned ~97 credits / 268s.

Expected
In-place SPA state transitions at a stable URL should not be treated as cycles, and a completed action should not be silently re-applied.

Impact
The SPA hero flow is not reliably automatable via testmd run (free-form run tolerates it and passes; testmd cycles to failure), which in turn blocks the testmd export → portable-JS path. This is our single biggest reliability risk. Splitting into discrete _test.md steps reduces but does not eliminate the double-fire.

---