A per-file sweep (local suite runs were reading the PIPE's exit code, not
npm's) surfaced four tests failing on HEAD:
- hash-change-handler: logged-out default is deliberately TRENDING since
04621efc; test still expected most-recent-videos
- session-actor / sessionActor / nsec-login: encoded the pre-fix "no-arg
clearStoredSessionActor wipes EVERY account" behavior that 2026-07-02
deliberately removed (one account's logout must not destroy other saved
accounts' keys). Replaced with stronger assertions: multi-account survival
on no-arg clear, targeted forget, and the blocked-key security property
asserted on the blocked account specifically.
Integrity notes in each file; TODO #11b addendum documents the pipe lesson.
Co-Authored-By: Claude Fable 5 <[email protected]>
- Added `tests/state/cache.test.mjs` to test profile persistence and URL health caching.
- Added `tests/nostr/sessionActor.test.mjs` to test session key encryption/decryption and storage.
- Added `tests/services/r2Service.test.mjs` to test R2 settings management and bucket configuration.
- Exposed `__testExports` in `js/nostr/sessionActor.js` to allow testing of private helper functions.
- Used `tests/test-helpers/setup-localstorage.mjs` to mock browser environments in all new tests.
