fix: lazy delivery survives flaky networks and stale caches (#353)

Network failure of the editor runtime is no longer terminal: the loader
re-arms to idle and the next explicit press starts a fresh cycle, while a
fingerprint mismatch on either attempt stays terminal. The toast now says
what actually helps — retry advice for the network, refresh advice for a
foreign build — via one shared lazyLoadFailureMessage helper (new i18n key
editor.retry_advice in en/ru/de).

The field smoke caught a second, deeper bug on the way: Chromium records a
FAILED module in the page module map permanently, so retrying the same URL
(even the cache-busted one) never touched the network again. Every retry
now carries a per-cycle nonce and becomes a genuinely new module request.

A proxy-cached stale entry no longer kills the card silently: the entry
facade is rewritten at build time from a static re-export into a top-level
`try{await import(...)}catch{...}` — importers keep the happy-path
guarantee (await import(entry) still resolves only after
customElements.define), and the catch defines a fallback element with a
localized "reload the page" panel. Content-hashed chunks are served with
`public, max-age=31536000, immutable`, and verifyBundleTree now fails on
orphan chunks that the manifest does not name.

Proofs: loader units for re-arm/terminality/toast wording + an AST check
that both loaders forward the terminality flag; smoke_entry_stale (en/ru)
against a tree without the main chunk; smoke_lazy_editor_chunk extended —
second press after network failure now really opens the editor; pytest for
the immutable header; orphan-tree unit; five new registry mutants.
TESTING.md budget line updated to the #352 ceiling alongside.

Issue: #353
User-Visible: yes

test/editor-runtime-loader.test.mjs

@@ -137,3 +137,106 @@ test('documentation capture materializes the complete bundle tree', () => {
   assert.match(capture, /import ['"]\.\.\/\.\.\/scripts\/bundle-sync\.mjs['"]/);
   assert.doesNotMatch(capture, /copyFileSync\(BUNDLE,\s*DEMO_BUNDLE\)/);
 });
+
+test('network failure re-arms the loader for the next explicit intent (#353 AC1)', async () => {
+  const attempts = [];
+  const failures = [];
+  let cycles = 0;
+  const loader = new EditorRuntimeLoader({
+    expectedFingerprint: 'same',
+    load: async (attempt) => {
+      if (attempt === 0) cycles++;
+      attempts.push(attempt);
+      if (cycles < 3) throw new Error('net::ERR_INTERNET_DISCONNECTED');
+      return { fingerprint: 'same', create: () => 'runtime' };
+    },
+    install: () => {},
+    failed: (error, info) => failures.push({ error: String(error), terminal: info.terminal }),
+  });
+
+  assert.equal(await loader.ensure(), false);
+  assert.equal(loader.state, 'idle', 'a network failure must not be terminal');
+  assert.deepEqual(attempts, [0, 1]);
+
+  assert.equal(await loader.ensure(), false, 'second press runs a fresh cycle');
+  assert.deepEqual(attempts, [0, 1, 0, 1]);
+  assert.equal(failures.length, 2, 'every failed cycle is reported');
+  assert.ok(failures.every((failure) => failure.terminal === false));
+
+  assert.equal(await loader.ensure(), true, 'third press succeeds');
+  assert.equal(loader.state, 'ready');
+  assert.equal(failures.length, 2);
+});
+
+test('fingerprint mismatch on either attempt is terminal (#353 AC2)', async () => {
+  const attempts = [];
+  const failures = [];
+  const loader = new EditorRuntimeLoader({
+    expectedFingerprint: 'entry',
+    load: async (attempt) => {
+      attempts.push(attempt);
+      if (attempt === 0) return { fingerprint: 'other', create: () => 'foreign' };
+      throw new Error('net::ERR_FAILED');
+    },
+    install: () => {},
+    failed: (error, info) => failures.push(info.terminal),
+  });
+
+  assert.equal(await loader.ensure(), false);
+  assert.equal(loader.state, 'failed', 'a foreign build was observed — only a refresh helps');
+  assert.deepEqual(failures, [true]);
+  assert.equal(await loader.ensure(), false);
+  assert.deepEqual(attempts, [0, 1], 'terminal failure never imports again');
+});
+
+test('lazy failure toast wording follows terminality (#353 AC5)', async () => {
+  const { lazyLoadFailureMessage } = await import('../test-build/editor-runtime-loader.js');
+  const t = (key) => `<${key}>`;
+  assert.equal(
+    lazyLoadFailureMessage(t, { terminal: true }),
+    '<editor.load_failed> <editor.refresh_advice>',
+  );
+  assert.equal(
+    lazyLoadFailureMessage(t, { terminal: false }),
+    '<editor.load_failed> <editor.retry_advice>',
+  );
+});
+
+test('both card loaders route their toast through lazyLoadFailureMessage (#353 AC5)', async () => {
+  const ts = (await import('typescript')).default;
+  const source = readFileSync(join(repoRoot, 'src', 'houseplan-card.ts'), 'utf8');
+  const file = ts.createSourceFile(
+    'houseplan-card.ts', source, ts.ScriptTarget.Latest, true, ts.ScriptKind.TS,
+  );
+  const callbacks = [];
+  const visit = (node) => {
+    if (ts.isPropertyAssignment(node)
+        && node.name.getText(file) === 'failed'
+        && ts.isArrowFunction(node.initializer)) {
+      callbacks.push(node.initializer);
+    }
+    ts.forEachChild(node, visit);
+  };
+  visit(file);
+  assert.equal(callbacks.length, 2, 'editor and onboarding loaders both declare failed callbacks');
+  for (const callback of callbacks) {
+    assert.equal(callback.parameters.length, 2, 'the failure info parameter must be declared');
+    const infoName = callback.parameters[1].name.getText(file);
+    let forwards = false;
+    const inspect = (node) => {
+      if (ts.isCallExpression(node)
+          && node.expression.getText(file) === 'lazyLoadFailureMessage'
+          && node.arguments.length === 2
+          && node.arguments[1].getText(file) === infoName) {
+        forwards = true;
+      }
+      ts.forEachChild(node, inspect);
+    };
+    inspect(callback.body);
+    assert.ok(
+      forwards,
+      'the failed callback must forward its info argument into lazyLoadFailureMessage — '
+        + 'a hardcoded terminality would show the wrong advice',
+    );
+  }
+});