Tests that found things reading did not

The testing pass: 2140 tests to 2283, and four bugs that no amount of
reading had turned up. Three came from driving the JavaScript under a
Node DOM stub, which is the practice CLAUDE.md sets out and this is the
reason it does.

The terminal dropped every keystroke after a reconnect. `onclose` closed
over the module-level socket rather than its own, and close() queues its
event -- so the old socket's close arrived after a new one was assigned
and nulled the live one. Output kept coming, because onmessage is bound
to the object, while every send gates on the variable. It also announced
"Disconnected" about a shell that had just reconnected.

Two scripts were loaded twice on /messages, once by base.html and again
by the page. Each is an IIFE with its own state, so four keyboard
shortcuts toggled their panel twice and therefore did nothing, /help
opened two dialogs, and an @ mention attached its file twice. A sweep
refuses any template re-loading what base.html has.

The microphone had no guard while the permission prompt was up, so each
click opened another stream and only the last was ever stopped. And a
skill shared with you took its name out of your own library: create
checked uniqueness against what is *visible* rather than what is owned,
against a (owner_id, name) constraint, and told you to edit a row you
cannot edit.

--ink-faint failed the contrast minimum in both themes -- 3.85 and 3.19
against 4.5 -- so the smallest text on every screen was the hardest to
read. Measured in a headless browser rather than judged by eye.

And the suite runs on 3.11 and 3.12 now as well as 3.14. It had only ever
run on 3.14 while the image ships 3.12 and the packaging claimed 3.11:
the interpreter most people would run was the one nothing had tested.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

tests/test_ui_js.py

@@ -298,3 +298,33 @@ def test_turning_notifications_off_also_drops_the_registration():
     service for something the reader has switched off."""
     assert "/api/push/unsubscribe" in SOURCE
     assert "pushManager" in SOURCE
+
+
+def test_no_page_loads_a_script_that_the_base_template_already_loads():
+    """`/messages` listed `composer.js` and `commands.js` in its `scripts`
+    block, and `base.html` already loads both on every page -- so that screen
+    ran each of them twice.
+
+    Each is an IIFE with its own state, and `stopPropagation()` does not stop a
+    second listener already bound to the same node. Two composer menus stacked
+    on each other; one Enter on a highlighted `/` item ran the command twice, so
+    `/help` opened two dialogs and `/image` posted the message twice; an `@`
+    mention attached its file twice; and `Alt+B`, `Alt+E`, `Alt+T` and `Alt+I`
+    each toggled their panel twice, which is to say did nothing at all.
+
+    None of that looks like a script loaded twice, which is why this is a sweep
+    over every template rather than a note about one of them.
+    """
+    import re
+    from pathlib import Path
+
+    templates = Path(__file__).resolve().parents[1] / "src/lembas/web/templates"
+    pattern = re.compile(r"path='js/([a-z_]+\.js)'")
+    always = set(pattern.findall((templates / "base.html").read_text()))
+    assert always, "base.html stopped loading any script; this test is now blind"
+
+    for template in templates.rglob("*.html"):
+        if template.name == "base.html":
+            continue
+        again = set(pattern.findall(template.read_text())) & always
+        assert not again, f"{template.name} re-loads {sorted(again)}, which base.html has"