Tests that found things reading did not

The testing pass: 2140 tests to 2283, and four bugs that no amount of
reading had turned up. Three came from driving the JavaScript under a
Node DOM stub, which is the practice CLAUDE.md sets out and this is the
reason it does.

The terminal dropped every keystroke after a reconnect. `onclose` closed
over the module-level socket rather than its own, and close() queues its
event -- so the old socket's close arrived after a new one was assigned
and nulled the live one. Output kept coming, because onmessage is bound
to the object, while every send gates on the variable. It also announced
"Disconnected" about a shell that had just reconnected.

Two scripts were loaded twice on /messages, once by base.html and again
by the page. Each is an IIFE with its own state, so four keyboard
shortcuts toggled their panel twice and therefore did nothing, /help
opened two dialogs, and an @ mention attached its file twice. A sweep
refuses any template re-loading what base.html has.

The microphone had no guard while the permission prompt was up, so each
click opened another stream and only the last was ever stopped. And a
skill shared with you took its name out of your own library: create
checked uniqueness against what is *visible* rather than what is owned,
against a (owner_id, name) constraint, and told you to edit a row you
cannot edit.

--ink-faint failed the contrast minimum in both themes -- 3.85 and 3.19
against 4.5 -- so the smallest text on every screen was the hardest to
read. Measured in a headless browser rather than judged by eye.

And the suite runs on 3.11 and 3.12 now as well as 3.14. It had only ever
run on 3.14 while the image ships 3.12 and the packaging claimed 3.11:
the interpreter most people would run was the one nothing had tested.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

src/lembas/services/library/skills.py

@@ -67,12 +67,39 @@ def get(db: DBSession, skill_id: str, user: User | None) -> Skill | None:
 
 
 def by_name(db: DBSession, name: str, user: User | None) -> Skill | None:
-    """Look one up the way the model refers to it."""
+    """Look one up the way the model refers to it.
+
+    Scoped to what this person can **see**, which is theirs plus anything
+    shared with them -- correct for `skill_get` and `skill_edit`, where a
+    skill somebody shared is exactly what the model is reaching for.
+
+    It is the wrong question for "is this name taken?"; see `owned_by_name`.
+    """
     if user is None:
         return None
     return db.scalar(visible(db, user).where(Skill.name == slugify(name)))
 
 
+def owned_by_name(db: DBSession, name: str, owner: User) -> Skill | None:
+    """One of *this person's own* skills by name.
+
+    The uniqueness check used `by_name`, which is scoped to what is visible --
+    so a skill somebody shared with you took that name out of your library.
+    Sharing a curated skill with a team is the intended use of `library.share`,
+    and doing it silently reserved the name for everyone it reached: creating
+    your own was refused with "a skill called 'weekly-report' already exists.
+    Edit it instead", naming a row you cannot edit, because sharing grants
+    reading only. The model's `skill_create` got the same dead end.
+
+    The table's constraint is `(owner_id, name)`, so the question the check
+    should have been asking was always this one. `documents.create_base` next
+    door asks it correctly.
+    """
+    return db.scalar(
+        select(Skill).where(Skill.owner_id == owner.id, Skill.name == slugify(name))
+    )
+
+
 def enabled_for(
     db: DBSession, user: User | None, *, exclude: Iterable[str] = ()
 ) -> list[Skill]:
@@ -155,7 +182,7 @@ def create(
             "A skill name must be two or more letters, numbers or hyphens, "
             "such as 'weekly-report'."
         )
-    if by_name(db, slug, owner) is not None:
+    if owned_by_name(db, slug, owner) is not None:
         raise SkillError(f"A skill called {slug!r} already exists. Edit it instead.")
     if not description.strip():
         raise SkillError(