Merge remote-tracking branch 'gh/main' into feat/doc-site

.github/workflows/ci.yml

@@ -97,6 +97,25 @@ jobs:
       - name: improvise-gp
         run: cargo check -p improvise-gp --target wasm32-unknown-unknown
 
+  # ---------------------------------------------------------------------------
+  # The browser JavaScript's unit tests. Its own job, deliberately: a failure
+  # here is a decision `web/shell.js` or `web/serial.js` got wrong, and
+  # reporting that as "Browser harness" would put it behind an 80 MB browser
+  # download and two wasm-pack builds. It needs neither — `node --test` is in
+  # the runtime, and this job installs nothing at all.
+  js:
+    name: Browser JS unit tests (node --test)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-node@v4
+        with:
+          node-version: 22
+      # The glob is the SHELL's, not node's: `web/tests/bundle/` needs a built
+      # wasm bundle and runs in the browser job instead.
+      - name: What the page decides between its boundaries
+        run: node --test web/tests/*.test.js
+
   kb:
     name: Knowledge base consistency
     runs-on: ubuntu-latest
@@ -169,6 +188,12 @@ jobs:
       # `harness/serve` — the same tree `pages-build` publishes, plus /opfs/.
       - name: Build the harness
         run: ./harness/build.sh
+      # The JS↔wasm boundary: every call web/app.js makes is declared by the
+      # bundle, with that arity. It needs the bundle and nothing else, so it
+      # runs here rather than in the `js` job, and before Playwright — a
+      # renamed export is cheaper to read here than as a blank page.
+      - name: The page's calls match the bundle it calls
+        run: node --test web/tests/bundle/*.test.js
       - name: Run the harness
         working-directory: harness
         run: npx playwright test
@@ -249,7 +274,7 @@ jobs:
 
   pages-deploy:
     name: Deploy to GitHub Pages
-    needs: [test, wasm, browser, pages-build]
+    needs: [test, wasm, js, browser, pages-build]
     if: github.event_name == 'push' && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
     permissions: