From ffb802a4d0e8061f9df511930d31290f5473cc11 Mon Sep 17 00:00:00 2001
From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com>
Date: Thu, 22 Oct 2026 20:27:25 -0700
Subject: [PATCH 1/2] Make URL provenance lookup test independent of runner
 timing

Co-authored-by: forge <WyJmb3JnZSIsImRlZmF1bHQiXQ@agents.commonly.invalid>
Agent-Model: codex/gpt-6-sol/medium
---
 .../services/webAddressProvenance.test.js     | 45 +++++++++++++++++--
 1 file changed, 42 insertions(+), 3 deletions(-)

diff --git a/backend/__tests__/unit/services/webAddressProvenance.test.js b/backend/__tests__/unit/services/webAddressProvenance.test.js
index 13993e1dac..d12ddb68ea 100644
--- a/backend/__tests__/unit/services/webAddressProvenance.test.js
+++ b/backend/__tests__/unit/services/webAddressProvenance.test.js
@@ -149,9 +149,48 @@ describe('webAddressProvenance', () => {
       const page = Array.from({ length: 400 }, (_, i) => `https://h${i}.example/p${'!'.repeat(50)}x`).join(' ');
       [page, page, page].forEach((text) => given.add(text));
 
-      const started = process.hrtime.bigint();
-      for (let i = 0; i < 1000; i += 1) given.has(`https://attacker.example/c?d=${i}`);
-      expect(Number(process.hrtime.bigint() - started) / 1e6).toBeLessThan(50);
+      // Count work instead of wall time: a busy CI runner must not make an
+      // indexed lookup fail, and scanning 400 entries on each attempt must.
+      let indexed = 0;
+      let scanned = 0;
+      let rescannedPages = 0;
+      const addresses = given.given;
+      given.given = new Proxy(addresses, {
+        get(target, method) {
+          if (method === 'get') return (key) => { indexed += 1; return target.get(key); };
+          if ([Symbol.iterator, 'entries', 'keys', 'values'].includes(method)) {
+            return () => {
+              const iterator = target[method]();
+              return {
+                next() {
+                  const item = iterator.next();
+                  if (!item.done) scanned += 1;
+                  return item;
+                },
+                [Symbol.iterator]() { return this; },
+              };
+            };
+          }
+          if (method === 'forEach') {
+            return (callback) => target.forEach((...args) => { scanned += 1; callback(...args); });
+          }
+          const value = target[method];
+          return typeof value === 'function' ? value.bind(target) : value;
+        },
+      });
+      const split = String.prototype.split;
+      const splitSpy = jest.spyOn(String.prototype, 'split').mockImplementation(function countPageScans(...args) {
+        if (String(this) === page) rescannedPages += 1;
+        return split.apply(this, args);
+      });
+      try {
+        for (let i = 0; i < 1000; i += 1) expect(given.has(`https://attacker.example/c?d=${i}`)).toBe(false);
+      } finally {
+        splitSpy.mockRestore();
+      }
+      expect(scanned).toBe(0);
+      expect(rescannedPages).toBe(0);
+      expect(indexed).toBeLessThanOrEqual(2000);
     });
   });
 });

From b37df217b4e1c8f538d195e87396ee7e4841e708 Mon Sep 17 00:00:00 2001
From: Lily Shen <115414357+lilyshen0722@users.noreply.github.com>
Date: Thu, 22 Oct 2026 20:54:03 -0700
Subject: [PATCH 2/2] test: assert provenance lookup counter is active

Co-authored-by: forge <WyJmb3JnZSIsImRlZmF1bHQiXQ@agents.commonly.invalid>
Agent-Model: codex/gpt-6-sol/medium
---
 backend/__tests__/unit/services/webAddressProvenance.test.js | 1 +
 1 file changed, 1 insertion(+)

diff --git a/backend/__tests__/unit/services/webAddressProvenance.test.js b/backend/__tests__/unit/services/webAddressProvenance.test.js
index d12ddb68ea..689f76093c 100644
--- a/backend/__tests__/unit/services/webAddressProvenance.test.js
+++ b/backend/__tests__/unit/services/webAddressProvenance.test.js
@@ -190,6 +190,7 @@ describe('webAddressProvenance', () => {
       }
       expect(scanned).toBe(0);
       expect(rescannedPages).toBe(0);
+      expect(indexed).toBeGreaterThan(0);
       expect(indexed).toBeLessThanOrEqual(2000);
     });
   });