Coverage for the Rust and the page, and tests for the offline gaps (#390, #391)

Nothing measured what the tests reach. scripts/coverage.sh runs the
cargo tests under cargo-llvm-cov in the ipx-coverage image
(Dockerfile.coverage, built by build-image.sh coverage), in a container
held to the image builder's 6 GB and six threads, one crate at a time,
with the same room and load checks: an instrumented build rebuilds every
dependency, the kind of build that took Tower down on 2026-11-04. The
first run stayed under load 8 with 11 GB free; 69% of lines. web.rs and
daemon.rs read low because the browser suite drives them against a
daemon that is not instrumented.

npm run coverage:page runs the browser suite on a build of the page
(IPX_COVERAGE=1) whose script keeps a source map to each web/src file:
web/concat-map.mts maps the joined files line by line and swc takes it
as its input map. Each test's page records V8's coverage
(tests/ui/coverage.ts, which the specs now take test and expect from),
and monocart-coverage-reports writes it file by file: 73% of lines.
build.mjs requires the map helper only for that build, since
Dockerfile.web's Node does not run TypeScript, and not with a top-level
await, which stopped the CommonJS tests requiring build.mjs.

The offline tests move to offline.spec.ts, in TypeScript, and stand
alone (they add their feed and set the read state they need), with what
#391 found untested: another account signing in clears what was kept, a
position saved offline waits and is sent, and pictures past the budget
go oldest first (keepPictures takes the budget, and trims whether or
not anything new came). The fixture JPEGs were a few bytes no browser
could draw; they are real now, and the artwork test checks one draws.
tsconfig.tools.json type-checks the tests' and build's TypeScript, in
npm run typecheck.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

web/build.mjs

@@ -14,10 +14,16 @@ import fs from 'node:fs';
 import path from 'node:path';
 import zlib from 'node:zlib';
 import { fileURLToPath } from 'node:url';
+import { createRequire } from 'node:module';
 import swc from '@swc/core';
 import html from '@swc/html';
 
 const here = path.dirname(fileURLToPath(import.meta.url));
+// A build for measuring what the browser tests run (#390), IPX_COVERAGE=1: the script not minified
+// and with a source map back to each file of web/src, which concat-map.mts makes. Loaded only then:
+// it is TypeScript, which the Node of Dockerfile.web does not run.
+// Required, not imported with a top-level await, which would stop the tests require()ing this file.
+const coverageMap = process.env.IPX_COVERAGE ? createRequire(import.meta.url)('./concat-map.mts').concatMap : null;
 // The page's own version (package.json), given to its script in place of __WEB_VERSION__.
 const WEB_VERSION = JSON.parse(fs.readFileSync(path.join(here, '..', 'package.json'), 'utf8')).version;
 
@@ -85,9 +91,10 @@ export function buildWorker({ minify = true } = {}) {
 }
 
 /// The page and its script, built: { html, js, script }, where script is the file's name.
-export function buildPage(name, { minify = true } = {}) {
+export function buildPage(name, { minify = !coverageMap } = {}) {
   const { script, src: files } = PAGES[name];
-  const src = files.map(f => fs.readFileSync(path.join(here, 'src', f + '.ts'), 'utf8')).join('\n')
+  const parts = files.map(f => ({ name: `web/src/${f}.ts`, text: fs.readFileSync(path.join(here, 'src', f + '.ts'), 'utf8') }));
+  const src = parts.map(p => p.text).join('\n')
     .replaceAll('__HLS_JS__', HLS_URL)
     .replaceAll('__ICONS__', ICONS_URL)
     .replaceAll('__WEB_VERSION__', WEB_VERSION);
@@ -102,6 +109,7 @@ export function buildPage(name, { minify = true } = {}) {
     },
     isModule: false,
     minify,
+    ...(coverageMap ? { sourceMaps: 'inline', inputSourceMap: JSON.stringify(coverageMap(parts)) } : {}),
   }).code;
   const page = fs.readFileSync(path.join(here, name), 'utf8');
   const marker = /<script data-src="[^"]*"><\/script>/;