Overnight loop iteration 3. api-content.ts was the highest-churn untested lib
module (7 commits; the command layer tests mock it, so nothing exercised it).
Nine tests over the REAL path — no module mocks (bun mock.module leaks across
files), just a globalThis.fetch override + the documented BUNDLE_PUBLIC_KEYSET
dev override with a generated ed25519 key, so real api-client envelope and real
crypto run: valid triad accepted, fail-closed on tampered body / unknown key /
invalid signature / incomplete headers / missing signatures, API error envelopes
pass through, path+query encoding pinned.
LATENT BUG FOUND (pinned, not fixed — flagged for morning review): fetchHealth's
documented `code: "timeout"` is dead code — apiGet collapses the AbortError to
network_error first, so doctor.ts:159's timeout branch can never fire; on a hung
API doctor shows the generic network diagnostic instead of the timeout one.
Gate: typecheck OK; oxlint 2 warnings (baseline); bun test 463 pass (+9), exactly
the 8 pinned pre-existing failures. Map refreshed.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01GpGAGRG6UpHpCzxzgqXgMt
Marcin Czarkowski