Merge remote-tracking branch 'gh/main' into ci/build-once

# Conflicts:
#	.github/workflows/ci.yml

.github/workflows/ci.yml

@@ -198,6 +198,25 @@ jobs:
       - name: improvise-gp
         run: cargo check -p improvise-gp --target wasm32-unknown-unknown
 
+  # ---------------------------------------------------------------------------
+  # The browser JavaScript's unit tests. Its own job, deliberately: a failure
+  # here is a decision `web/shell.js` or `web/serial.js` got wrong, and
+  # reporting that as "Browser harness" would put it behind an 80 MB browser
+  # download and two wasm-pack builds. It needs neither — `node --test` is in
+  # the runtime, and this job installs nothing at all.
+  js:
+    name: Browser JS unit tests (node --test)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      # The glob is the SHELL's, not node's: `web/tests/bundle/` needs a built
+      # wasm bundle and runs in the browser job instead.
+      - name: What the page decides between its boundaries
+        run: node --test web/tests/*.test.js
+
   kb:
     name: Knowledge base consistency
     runs-on: ubuntu-latest
@@ -302,6 +321,20 @@ jobs:
         with:
           name: harness-serve
           path: harness/serve
+      # `web/pkg` and `web/worker-pkg` as wasm-pack left them, for the .d.ts
+      # the step below reads. The artifact's root is `web/`, so this restores
+      # both directories at the paths the test resolves relative to itself.
+      - name: Download the wasm bundles
+        uses: actions/download-artifact@v7
+        with:
+          name: wasm-bundles
+          path: web
+      # The JS↔wasm boundary: every call web/app.js makes is declared by the
+      # bundle, with that arity. It needs the bundle and nothing else, so it
+      # runs here rather than in the `js` job, and before Playwright — a
+      # renamed export is cheaper to read here than as a blank page.
+      - name: The page's calls match the bundle it calls
+        run: node --test web/tests/bundle/*.test.js
       - name: Run the harness
         working-directory: harness
         run: npx playwright test
@@ -338,7 +371,7 @@ jobs:
   # artifact is smaller. It does not close the race; it does not widen it.
   pages-deploy:
     name: Deploy to GitHub Pages
-    needs: [test, wasm, browser, harness-lint, build]
+    needs: [test, wasm, js, browser, harness-lint, build]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     permissions: