test(web): a Node suite between the boundaries, Playwright only on them

E2E and integration tests are rare and pin boundary contracts; unit tests
assume those contracts and test between them (user, 2026-09-20). The browser
half has four boundaries — RenderModel→DOM, JS→wasm, page→peer, worker→OPFS —
and everything between them needed no browser at all.

`web/shell.js` and `web/serial.js` are the seams: pure modules that RETURN A
DESCRIPTION rather than take a DOM double. `gridPlan(model)` answers every
question `gridTable` used to answer while creating elements — the data-row
index across group headers, what a group header spans, a null group label
against an empty one, an empty edit buffer against no editor — and `app.js` is
now a loop that builds elements from it. Painting stays untested by Node; what
to paint stopped being untestable.

26 tests in `node --test web/tests` (0.12s, no Rust toolchain, no wasm bundle,
no npm install), plus three in `web/tests/bundle/` that read the generated
.d.ts and so run in the browser job. Playwright goes from 29 tests/36.9s to
16/15.5s on one machine: `widgets.spec.js` and `pointer.spec.js` are gone,
replaced by `contract.spec.js`, which asserts that EVERY field the render model
projects reaches the screen. The four widgets those specs were written for were
one failure at one boundary, and one assertion catches the fifth.

It caught it: `doc_name`/`doc_dirty`/`doc_stored_as` reach no element
(improvise-5jna, already open). They are named in `UNPAINTED` with the ticket,
so the list is the debt written down rather than an exemption.

Thirteen faults injected into the Node suite and eight into the served page,
each watched to fail the test it names; the last of those was strengthened
because the first version passed. `web/assemble.sh` grew an import-completeness
guard whose own first version was blind to the multi-line import it exists for.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

web/tests/bundle/wasm_surface.test.js

@@ -0,0 +1,101 @@
+// The JS↔wasm boundary: every call the page makes is declared by the bundle,
+// with the arity it declares. Needs `web/build.sh` to have run.
+
+import { test } from "node:test";
+import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+
+const web = (name) => fileURLToPath(new URL(`../../${name}`, import.meta.url));
+
+/// Declared methods and free functions, as `name -> [min, max]` arity. A
+/// missing bundle is a FAILURE and never a skip: this file exists to be run
+/// after `web/build.sh`, and a silent pass would report exactly nothing.
+function declarations(dts) {
+  const text = readFileSync(web(dts), "utf8");
+  const found = new Map();
+  const decl = /(?:^|\n)\s*(?:export function |static )?([a-z_][A-Za-z0-9_]*)\(([^)]*)\)\s*:/g;
+  for (const [, name, params] of text.matchAll(decl)) {
+    const list = params.trim() === "" ? [] : params.split(",");
+    const required = list.filter((p) => !p.includes("?:")).length;
+    found.set(name, [required, list.length]);
+  }
+  assert.ok(found.size > 0, `${dts} declares nothing — was web/build.sh run?`);
+  return found;
+}
+
+/// Every `<receiver>.<name>(...)` call in a source file, with how many
+/// top-level arguments it passes.
+function callsOn(file, receiver) {
+  const text = readFileSync(web(file), "utf8");
+  const calls = [];
+  const head = new RegExp(`${receiver}\\.([a-z_][A-Za-z0-9_]*)\\(`, "g");
+  for (const match of text.matchAll(head)) {
+    let depth = 1;
+    let i = match.index + match[0].length;
+    let commas = 0;
+    let body = "";
+    while (depth > 0 && i < text.length) {
+      const ch = text[i];
+      if ("([{".includes(ch)) depth += 1;
+      else if (")]}".includes(ch)) depth -= 1;
+      else if (ch === "," && depth === 1) commas += 1;
+      if (depth > 0) body += ch;
+      i += 1;
+    }
+    assert.equal(depth, 0, `unbalanced call to ${match[1]} in ${file}`);
+    calls.push({ name: match[1], args: body.trim() === "" ? 0 : commas + 1 });
+  }
+  return calls;
+}
+
+test("every client call web/app.js makes is declared, with that arity", () => {
+  const declared = declarations("pkg/improvise_wasm_client.d.ts");
+  const calls = callsOn("app.js", "client");
+  assert.ok(calls.length >= 6, `found only ${calls.length} client calls`);
+  for (const call of calls) {
+    const arity = declared.get(call.name);
+    assert.ok(arity, `web/app.js calls client.${call.name}, which the bundle does not declare`);
+    const [min, max] = arity;
+    assert.ok(
+      call.args >= min && call.args <= max,
+      `client.${call.name} takes ${min}..${max} arguments; app.js passes ${call.args}`,
+    );
+  }
+});
+
+test("the page still reaches the client through a handful of calls", () => {
+  const names = new Set(callsOn("app.js", "client").map((c) => c.name));
+  // The named surface, so a call added without an argument fails here and
+  // has to come and say so. `viewport` is deliberately absent: `set_viewport`
+  // is the one that records the window (gotcha 47).
+  assert.deepEqual(
+    [...names].sort(),
+    [
+      "click_category",
+      "click_cell",
+      "click_tile",
+      "on_frame",
+      "on_key_event",
+      "render_model",
+      "set_viewport",
+      "typed_cell",
+    ],
+  );
+});
+
+test("every worker call web/worker.js makes is declared, with that arity", () => {
+  const declared = declarations("worker-pkg/improvise_worker_server.d.ts");
+  const calls = callsOn("worker.js", "server");
+  assert.ok(calls.length >= 2, `found only ${calls.length} server calls`);
+  for (const call of calls) {
+    const arity = declared.get(call.name);
+    assert.ok(arity, `web/worker.js calls server.${call.name}, undeclared by the bundle`);
+    assert.ok(
+      call.args >= arity[0] && call.args <= arity[1],
+      `server.${call.name} takes ${arity[0]}..${arity[1]}; worker.js passes ${call.args}`,
+    );
+  }
+  // `start` is a free function rather than a method, and takes the seed.
+  assert.deepEqual(declared.get("start"), [1, 2]);
+});