test: replace the text checks with bindings, lint and parsed config

.github/workflows/test.yml

@@ -118,6 +118,12 @@ jobs:
       - name: check frontend
         run: npm run check
 
+      # The code conventions no type can express (one implementation of a fixed
+      # behaviour, Rust reached only through the generated bindings, ...), as
+      # lint rules in eslint.config.js. Each message says why.
+      - name: lint frontend conventions
+        run: npm run lint
+
       - name: run frontend behavior tests
         run: npm test
 
@@ -127,6 +133,17 @@ jobs:
       - name: run frontend behavior tests (vitest)
         run: npm run test:vitest
 
+      # Monaco is most of the app's JavaScript and only the editor needs it, so
+      # Editor.svelte loads it with `await import()`. A static import anywhere in
+      # the startup graph folds it back into the chunks every window parses on
+      # first paint, and nothing else fails. This builds the frontend and reads
+      # the Vite manifest (which chunks load at startup) and their source maps
+      # (which modules each chunk holds). Measured: about 6 seconds.
+      - name: monaco is not in the startup chunks
+        run: |
+          npx vite build --sourcemap
+          node scripts/check-startup-chunk.mjs
+
       # Nothing had ever checked Rust formatting, so master drifted to 47
       # rustfmt diffs across all six source files -- not because anyone
       # disagreed with the tool, but because `cargo fmt` is a thing you have to
@@ -143,10 +160,19 @@ jobs:
           cd src-tauri
           cargo fmt --check
 
+      # `--locked` fails the run when Cargo.lock no longer matches Cargo.toml
+      # (a version bump that skipped the lock), instead of rewriting it here.
       - name: run cargo test
         run: |
           cd src-tauri
-          cargo test
+          cargo test --locked
+
+      # `cargo test` just ran `export_bindings`, which rewrites
+      # src/lib/bindings.ts from the registered commands and events. A Rust
+      # command or event changed without the regenerated file committed leaves a
+      # diff here, before the frontend can drift from what Rust answers.
+      - name: check generated bindings are committed
+        run: git diff --exit-code src/lib/bindings.ts
 
       # `-D warnings` is only defensible because the count is currently zero:
       # the two that existed (a redundant `'static` on a const, a `push_str`
@@ -159,4 +185,4 @@ jobs:
       - name: run clippy
         run: |
           cd src-tauri
-          cargo clippy --all-targets -- -D warnings
+          cargo clippy --locked --all-targets -- -D warnings

AGENTS.md

@@ -143,10 +143,11 @@ src-tauri/
 - Export singleton instances (e.g., `export const tabManager = new TabManager()`)
 
 ### Tauri Invoke
-Use `invoke()` from `@tauri-apps/api/core` for Rust commands:
+Call Rust commands through the generated bindings (`cargo test` regenerates
+`src/lib/bindings.ts`); a raw `invoke` is a lint error:
 ```typescript
-import { invoke } from '@tauri-apps/api/core';
-const result = await invoke<string>('command_name', { arg: value });
+import { commands } from '../bindings.js'; // relative to the caller
+const result = await commands.commandName(value);
 ```
 
 ### File Operations
@@ -158,28 +159,28 @@ All file operations go through Rust commands - never use Node.js fs APIs.
 - **Frontend**: two runners, split by glob so a file belongs to exactly one.
   - `npm test` runs `scripts/*.test.ts` (`node --test --import tsx`).
   - `npm run test:vitest` runs `scripts/*.spec.ts` (vitest, jsdom, Svelte plugin).
-- **CI**: Runs `npm audit`, `npm run check`, `npm test`, `npm run test:vitest` and
-  `cargo test` on PRs
+- **CI**: Runs `npm audit`, `npm run check`, `npm run lint`, `npm test`,
+  `npm run test:vitest` and `cargo test` on PRs
 
 Tests run the real code and assert what it does. A test does not read source as text —
 no regex over a file, no slicing a function body, no cutting code out of a component and
 evaluating it: such a test guards a spelling, goes red on a rename and stays green on a
 regression. When the logic sits in a component where a test cannot call it, move it into a
 `.ts` or `.svelte.ts` module the component calls, and test the module.
 
-The `*.checks.*` files are the one exception, and are meant to shrink: they hold contract
-checks (a Tauri command or event name, a config key, an i18n key — the spelling that joins
-Rust and TypeScript) and convention checks ("one implementation of this behavior"), until
-those move to generated bindings and lint rules.
+What a run cannot show is held elsewhere. Command and event names, arguments and returns
+are generated from Rust into `src/lib/bindings.ts` (tauri-specta), so a mismatch is a
+`npm run check` error. Code conventions ("one implementation of this behavior", "call
+through this wrapper") are lint rules in `eslint.config.js` (`npm run lint`), plus
+`src-tauri/clippy.toml` and `scripts/conventions.test.ts` for the Rust ones clippy cannot
+express.
 
 ### Where a test goes
 
 Tests are grouped by feature, not by the fix that added them:
 
 - `scripts/<feature>.test.ts` and `scripts/<feature>.spec.ts` hold behavior tests (the
   runner rules below decide which of the two).
-- `scripts/<feature>.checks.test.ts` / `.checks.spec.ts` hold the cases that read source as
-  text, kept apart from the behavior tests.
 - `scripts/<feature>.<area>.test.ts` / `.spec.ts` is for a part of a feature that must run
   in its own process (module mocks, a process-wide shim such as `installShimDom()`) or would
   make the main file unreadable.
@@ -279,7 +280,7 @@ mandatory for `tauri-plugin-updater` to compare versions correctly.
 The lock file is the one that gets forgotten, because nothing in the editing
 loop reads it — a bump without it lands green and stays wrong until the next
 person's `cargo build` rewrites the line and leaves them a dirty working tree.
-`scripts/release.checks.test.ts` asserts the three agree.
+`scripts/release.workflows.test.ts` asserts the three agree.
 
 ## Releasing
 

RELEASING.md

@@ -44,7 +44,7 @@ If you ever lose the private key:
 
 ### 5. `alecdotdev/Markpad` is load-bearing
 
-The updater endpoint in `src-tauri/tauri.conf.json` points at **`sftwrdotdev/Markpad`**. (`scripts/release.checks.test.ts` holds that name and the endpoint together — if the repository ever moves again, this line moves with it.)
+The updater endpoint in `src-tauri/tauri.conf.json` points at **`sftwrdotdev/Markpad`**. (`scripts/release.workflows.test.ts` holds that name and the endpoint together — if the repository ever moves again, this line moves with it.)
 
 That only helps builds made from here on. The endpoint is compiled into the binary, so every copy up to and including v2.7.0 asks GitHub for `https://github.com/alecdotdev/Markpad/releases/latest/download/latest.json` and reaches the current feed only because GitHub answers with a 301. Those installs use that redirect for as long as they run.
 
@@ -112,7 +112,7 @@ Back it up in the same place as the minisign private key, and treat it with the
 
 ## Per-release workflow
 
-The workflow uses `npm ci`, so its installed dependency graph is exactly the committed lockfile. Do not replace it with `npm install` in release jobs. `scripts/release.checks.test.ts` guards that.
+The workflow uses `npm ci`, so its installed dependency graph is exactly the committed lockfile. Do not replace it with `npm install` in release jobs. `scripts/release.workflows.test.ts` guards that.
 
 [`snapcraft.yaml`](snapcraft.yaml) builds nothing. It packages the `.deb` the release already shipped (`plugin: dump`, `source-type: deb`), so the snap carries the same binary as the `.deb` and the AppImage. The same test asserts it is packaging rather than building.