fix(webui): keep Check-only tasks out of Load

audit/internal/webui/api_sat_runall_test.go

@@ -3,6 +3,7 @@ package webui
 import (
 	"context"
 	"reflect"
+	"strings"
 	"testing"
 	"time"
 
@@ -88,3 +89,21 @@ func TestPlanSATRunAllNoAcceleratorNoTPM(t *testing.T) {
 		t.Fatalf("expected a note about TPM being skipped")
 	}
 }
+
+func TestPlanSATRunAllLoadOmitsReadOnlyTPMCheck(t *testing.T) {
+	h := &handler{opts: HandlerOptions{App: app.New(&platform.System{})}}
+	specs, notes := h.planSATRunAll(context.Background(), satRunAllRequest{StressMode: true})
+
+	var targets []string
+	for _, s := range specs {
+		targets = append(targets, s.target)
+	}
+	if want := []string{"cpu", "memory", "storage"}; !reflect.DeepEqual(targets, want) {
+		t.Fatalf("targets=%v want %v", targets, want)
+	}
+	for _, note := range notes {
+		if strings.Contains(note, "TPM") {
+			t.Fatalf("load plan must not inspect or report TPM: notes=%v", notes)
+		}
+	}
+}