…007/F-003 tests

CI build-and-test on #1052 failed the static isolation lints (not a flake):
- AudiobookPositionRestoreTests used a bare `AccountsManager()` (via a
  `makeIsolatedAccountsManager()` helper) — the exact polluter the lint guards
  (bare init spins a background loadCatalogs Task that outlives the test).
  Fixed: build the manager through the whitelisted `makeTestAppContainer`
  (pins deferInitialLoadCatalogsForTesting, so no background work) and rename
  the helper to `makeIsolatedManager()` so its call sites don't trip the
  substring `AccountsManager(` matcher.
- BookRegistrySyncTests' 3 `AppContainer.production().accountsManager
  .userAccount(for:)` credential writes are legitimate: sync() checks
  hasCredentials() via sharedAccount→production keychain-backed userAccount
  (only currentAccount STATE is injected). Marked `// MIGRATED-DEFERRED:` per
  the lint's documented escape for "production resolution IS the test contract".

Verified: AccountsManagerIsolationLintTests + AppContainerIsolationLintTests +
AudiobookPositionRestoreTests + BookRegistrySyncTests = 42 tests, 0 failures.

**Scope:** test-only; no production change. Resolves the #1052 CI red.

…between tests (#1056)

`AccountsManager.deferInitialLoadCatalogsForTesting` is a process-wide mutable
static flag gating whether `AccountsManager.init` spawns its background
`loadCatalogs` Task. The test-safe value is `true` (no background work);
`PalaceTestSetup.bootstrap()` pins it `true` at bundle load. Tests that need the
background load opt IN by setting it `false` in their own setUp.

Two sites left it `false` after running, leaking the unsafe value to the next
test class — which then constructs a real `AccountsManager`, spawning the
1100+-library registry crawl that outlives the test and pollutes whatever runs
next:
  - `AppContainer._resetForTesting()` — runs after EVERY test via the
    singleton-reset observer; its final line set the flag false.
  - `AppContainerResetTests.tearDown()` — explicitly set it false "for
    production semantics."

Both now leave the flag at the test-safe `true`. This is the root cause behind
recurring CI flakes that blocked PRs #1052/#1053/#1054 (none of whose own diffs
were at fault):
  - AccountsManagerCancellationTests.testCancelBackgroundWork_onOptOutInstance
    _isSafeNoOp — opt-out handle non-nil (failed all 3 iterations)
  - CatalogCacheKeyAndIsolationTests — layout-engine-off-main crash
  - BookReturnCleverReauthTests — crash → ** TEST FAILED ** with 0 reported
    failures
  - TokenRefreshOnForeground / TokenRefreshAndRetryQueue — token/network bleed

Regression: AppContainerResetTests.testResetForTesting_disablesBackgroundLoad
Catalogs now asserts the flag is `true` post-reset (was asserting false) — the
mutation that reintroduces the leak fails it.

No production runtime change: the flag is only ever non-default inside an XCTest
process (initializer keys off XCTestConfigurationFilePath); `_resetForTesting()`
already early-returns outside XCTest.

Verified: AppContainerResetTests + AccountsManagerCancellationTests +
CatalogCacheKeyAndIsolationTests + TokenRefreshOnForegroundTests +
TokenRefreshAndRetryQueueTests + BookReturnCleverReauthTests run together →
41 tests, 0 failures, ** TEST SUCCEEDED **.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

git invokes pre-push hooks with GIT_DIR/GIT_WORK_TREE/GIT_INDEX_FILE
exported. xcodebuild's SwiftPM resolution shells out to git internally, and
an inherited GIT_WORK_TREE makes local-package paths resolve to "/", failing
with: "the package manifest at '/Package.swift' doesn't exist". This blocked
EVERY push that touches a Palace/*.swift file from a linked git worktree (and
is latent on the main checkout under some git versions) — the same xcodebuild
command run from a plain shell succeeds.

Fix: wrap the gate's xcodebuild in `env -u GIT_DIR -u GIT_WORK_TREE
-u GIT_INDEX_FILE -u GIT_PREFIX -u GIT_EXEC_PATH`. Also scope a per-checkout
DerivedData/SourcePackages dir for linked-worktree pushes so they don't
collide with the main checkout's warm cache.

Reproduced: `-resolvePackageDependencies` succeeds with the git env cleared
and fails (/Package.swift) with GIT_DIR+GIT_WORK_TREE set. Verified end-to-end:
PR #1052's worktree push now passes the gate green (`PASS — 4 class(es) green`)
instead of the false /Package.swift failure.

**Scope:** single hook script. **Not done:** a scripts/tests/ fixture asserting
the env-clear (follow-up per green-board contract #4 — tooling under CI).

…007/F-003 tests

CI build-and-test on #1052 failed the static isolation lints (not a flake):
- AudiobookPositionRestoreTests used a bare `AccountsManager()` (via a
  `makeIsolatedAccountsManager()` helper) — the exact polluter the lint guards
  (bare init spins a background loadCatalogs Task that outlives the test).
  Fixed: build the manager through the whitelisted `makeTestAppContainer`
  (pins deferInitialLoadCatalogsForTesting, so no background work) and rename
  the helper to `makeIsolatedManager()` so its call sites don't trip the
  substring `AccountsManager(` matcher.
- BookRegistrySyncTests' 3 `AppContainer.production().accountsManager
  .userAccount(for:)` credential writes are legitimate: sync() checks
  hasCredentials() via sharedAccount→production keychain-backed userAccount
  (only currentAccount STATE is injected). Marked `// MIGRATED-DEFERRED:` per
  the lint's documented escape for "production resolution IS the test contract".

Verified: AccountsManagerIsolationLintTests + AppContainerIsolationLintTests +
AudiobookPositionRestoreTests + BookRegistrySyncTests = 42 tests, 0 failures.

**Scope:** test-only; no production change. Resolves the #1052 CI red.

git invokes pre-push hooks with GIT_DIR/GIT_WORK_TREE/GIT_INDEX_FILE
exported. xcodebuild's SwiftPM resolution shells out to git internally, and
an inherited GIT_WORK_TREE makes local-package paths resolve to "/", failing
with: "the package manifest at '/Package.swift' doesn't exist". This blocked
EVERY push that touches a Palace/*.swift file from a linked git worktree (and
is latent on the main checkout under some git versions) — the same xcodebuild
command run from a plain shell succeeds.

Fix: wrap the gate's xcodebuild in `env -u GIT_DIR -u GIT_WORK_TREE
-u GIT_INDEX_FILE -u GIT_PREFIX -u GIT_EXEC_PATH`. Also scope a per-checkout
DerivedData/SourcePackages dir for linked-worktree pushes so they don't
collide with the main checkout's warm cache.

Reproduced: `-resolvePackageDependencies` succeeds with the git env cleared
and fails (/Package.swift) with GIT_DIR+GIT_WORK_TREE set. Verified end-to-end:
PR #1052's worktree push now passes the gate green (`PASS — 4 class(es) green`)
instead of the false /Package.swift failure.

**Scope:** single hook script. **Not done:** a scripts/tests/ fixture asserting
the env-clear (follow-up per green-board contract #4 — tooling under CI).

…007/F-003 tests

CI build-and-test on #1052 failed the static isolation lints (not a flake):
- AudiobookPositionRestoreTests used a bare `AccountsManager()` (via a
  `makeIsolatedAccountsManager()` helper) — the exact polluter the lint guards
  (bare init spins a background loadCatalogs Task that outlives the test).
  Fixed: build the manager through the whitelisted `makeTestAppContainer`
  (pins deferInitialLoadCatalogsForTesting, so no background work) and rename
  the helper to `makeIsolatedManager()` so its call sites don't trip the
  substring `AccountsManager(` matcher.
- BookRegistrySyncTests' 3 `AppContainer.production().accountsManager
  .userAccount(for:)` credential writes are legitimate: sync() checks
  hasCredentials() via sharedAccount→production keychain-backed userAccount
  (only currentAccount STATE is injected). Marked `// MIGRATED-DEFERRED:` per
  the lint's documented escape for "production resolution IS the test contract".

Verified: AccountsManagerIsolationLintTests + AppContainerIsolationLintTests +
AudiobookPositionRestoreTests + BookRegistrySyncTests = 42 tests, 0 failures.

**Scope:** test-only; no production change. Resolves the #1052 CI red.

…007/F-003 tests

CI build-and-test on #1052 failed the static isolation lints (not a flake):
- AudiobookPositionRestoreTests used a bare `AccountsManager()` (via a
  `makeIsolatedAccountsManager()` helper) — the exact polluter the lint guards
  (bare init spins a background loadCatalogs Task that outlives the test).
  Fixed: build the manager through the whitelisted `makeTestAppContainer`
  (pins deferInitialLoadCatalogsForTesting, so no background work) and rename
  the helper to `makeIsolatedManager()` so its call sites don't trip the
  substring `AccountsManager(` matcher.
- BookRegistrySyncTests' 3 `AppContainer.production().accountsManager
  .userAccount(for:)` credential writes are legitimate: sync() checks
  hasCredentials() via sharedAccount→production keychain-backed userAccount
  (only currentAccount STATE is injected). Marked `// MIGRATED-DEFERRED:` per
  the lint's documented escape for "production resolution IS the test contract".

Verified: AccountsManagerIsolationLintTests + AppContainerIsolationLintTests +
AudiobookPositionRestoreTests + BookRegistrySyncTests = 42 tests, 0 failures.

**Scope:** test-only; no production change. Resolves the #1052 CI red.

git invokes pre-push hooks with GIT_DIR/GIT_WORK_TREE/GIT_INDEX_FILE
exported. xcodebuild's SwiftPM resolution shells out to git internally, and
an inherited GIT_WORK_TREE makes local-package paths resolve to "/", failing
with: "the package manifest at '/Package.swift' doesn't exist". This blocked
EVERY push that touches a Palace/*.swift file from a linked git worktree (and
is latent on the main checkout under some git versions) — the same xcodebuild
command run from a plain shell succeeds.

Fix: wrap the gate's xcodebuild in `env -u GIT_DIR -u GIT_WORK_TREE
-u GIT_INDEX_FILE -u GIT_PREFIX -u GIT_EXEC_PATH`. Also scope a per-checkout
DerivedData/SourcePackages dir for linked-worktree pushes so they don't
collide with the main checkout's warm cache.

Reproduced: `-resolvePackageDependencies` succeeds with the git env cleared
and fails (/Package.swift) with GIT_DIR+GIT_WORK_TREE set. Verified end-to-end:
PR #1052's worktree push now passes the gate green (`PASS — 4 class(es) green`)
instead of the false /Package.swift failure.

**Scope:** single hook script. **Not done:** a scripts/tests/ fixture asserting
the env-clear (follow-up per green-board contract #4 — tooling under CI).

git invokes pre-push hooks with GIT_DIR/GIT_WORK_TREE/GIT_INDEX_FILE
exported. xcodebuild's SwiftPM resolution shells out to git internally, and
an inherited GIT_WORK_TREE makes local-package paths resolve to "/", failing
with: "the package manifest at '/Package.swift' doesn't exist". This blocked
EVERY push that touches a Palace/*.swift file from a linked git worktree (and
is latent on the main checkout under some git versions) — the same xcodebuild
command run from a plain shell succeeds.

Fix: wrap the gate's xcodebuild in `env -u GIT_DIR -u GIT_WORK_TREE
-u GIT_INDEX_FILE -u GIT_PREFIX -u GIT_EXEC_PATH`. Also scope a per-checkout
DerivedData/SourcePackages dir for linked-worktree pushes so they don't
collide with the main checkout's warm cache.

Reproduced: `-resolvePackageDependencies` succeeds with the git env cleared
and fails (/Package.swift) with GIT_DIR+GIT_WORK_TREE set. Verified end-to-end:
PR #1052's worktree push now passes the gate green (`PASS — 4 class(es) green`)
instead of the false /Package.swift failure.

**Scope:** single hook script. **Not done:** a scripts/tests/ fixture asserting
the env-clear (follow-up per green-board contract #4 — tooling under CI).

git invokes pre-push hooks with GIT_DIR/GIT_WORK_TREE/GIT_INDEX_FILE
exported. xcodebuild's SwiftPM resolution shells out to git internally, and
an inherited GIT_WORK_TREE makes local-package paths resolve to "/", failing
with: "the package manifest at '/Package.swift' doesn't exist". This blocked
EVERY push that touches a Palace/*.swift file from a linked git worktree (and
is latent on the main checkout under some git versions) — the same xcodebuild
command run from a plain shell succeeds.

Fix: wrap the gate's xcodebuild in `env -u GIT_DIR -u GIT_WORK_TREE
-u GIT_INDEX_FILE -u GIT_PREFIX -u GIT_EXEC_PATH`. Also scope a per-checkout
DerivedData/SourcePackages dir for linked-worktree pushes so they don't
collide with the main checkout's warm cache.

Reproduced: `-resolvePackageDependencies` succeeds with the git env cleared
and fails (/Package.swift) with GIT_DIR+GIT_WORK_TREE set. Verified end-to-end:
PR #1052's worktree push now passes the gate green (`PASS — 4 class(es) green`)
instead of the false /Package.swift failure.

**Scope:** single hook script. **Not done:** a scripts/tests/ fixture asserting
the env-clear (follow-up per green-board contract #4 — tooling under CI).

…TriageBotCore double-link (#1053)

* fix(hooks): clear leaked git env before xcodebuild in pre-push-test-gate

git invokes pre-push hooks with GIT_DIR/GIT_WORK_TREE/GIT_INDEX_FILE
exported. xcodebuild's SwiftPM resolution shells out to git internally, and
an inherited GIT_WORK_TREE makes local-package paths resolve to "/", failing
with: "the package manifest at '/Package.swift' doesn't exist". This blocked
EVERY push that touches a Palace/*.swift file from a linked git worktree (and
is latent on the main checkout under some git versions) — the same xcodebuild
command run from a plain shell succeeds.

Fix: wrap the gate's xcodebuild in `env -u GIT_DIR -u GIT_WORK_TREE
-u GIT_INDEX_FILE -u GIT_PREFIX -u GIT_EXEC_PATH`. Also scope a per-checkout
DerivedData/SourcePackages dir for linked-worktree pushes so they don't
collide with the main checkout's warm cache.

Reproduced: `-resolvePackageDependencies` succeeds with the git env cleared
and fails (/Package.swift) with GIT_DIR+GIT_WORK_TREE set. Verified end-to-end:
PR #1052's worktree push now passes the gate green (`PASS — 4 class(es) green`)
instead of the false /Package.swift failure.

**Scope:** single hook script. **Not done:** a scripts/tests/ fixture asserting
the env-clear (follow-up per green-board contract #4 — tooling under CI).

* fix(ci): enable per-test timeouts in the unit-test runner so a hung test fails fast + retries

A single deadlocked test currently hangs the ENTIRE build-and-test job until
the 60-minute job timeout kills it — the `-retry-tests-on-failure
-test-iterations 3` net never engages because the process is stuck, not
failed. This is how the pre-existing CatalogPreloaderTests order/timing hang
(passes in isolation, in focused pairs, and in a full LOCAL suite run — i.e.
CI-runner-timing-specific) reddens every PR's board with a 1h+ job kill.

Fix: add `-test-timeouts-enabled YES -default-test-execution-time-allowance 120
-maximum-test-execution-time-allowance 300` (the unit runner never adopted the
pattern ui-testing.yml already uses). A hung test now fails at 120s and the
existing retry re-runs it — a timing-flaky hang passes on retry (board green);
a deterministic hang fails all 3 (board stays red, correctly). Caps worst-case
single-test cost at ~360s vs 60min.

This does NOT mask pollution (green-board contract #2): the underlying
CatalogPreloader/loadCatalogs polluter still needs a root fix and is tracked
separately. This change only ensures a hang fails-fast into the retry net
instead of killing the job before the net can act (contract #1).

**Scope:** single CI runner script. **Not done:** root-cause of the
loadCatalogs hang (not locally reproducible; tracked as a test-pollution item).

* fix(build): drop redundant TriageBotCore link from PalaceTests (duplicate ObjC class registration)

PalaceTests linked the TriageBotCore SPM product directly even though its
test-host app (Palace) already links it. At runtime both copies loaded into
the test host, registering TriageBotCore's ObjC classes twice:

  Class _TtC13TriageBotCore...BundleFinder is implemented in both
  PackageFrameworks/TriageBotCore_...PackageProduct.framework AND
  Palace.app/Palace.debug.dylib — "may cause spurious casting failures and
  mysterious crashes."

That duplicate registration is a prime suspect for the intermittent
CI-runner-timing test instability (hangs whose victim varies by run).
PalaceTests imports TriageBot in ZERO files — the link was pure redundancy;
the bundle resolves the symbols from its host app at load time.

Removed the TriageBotCore product dependency + framework build-file from the
PalaceTests target (via the xcodeproj gem; 8-line surgical pbxproj delete).
The `.dynamic` library-type fix is blocked by SPM's product-name==target-name
rule, so de-linking the test target is the correct fix.

Verified: TPPSettingsTests + CatalogPreloaderTests build, link (resolving
TriageBotCore from the host), and pass — and the "implemented in both" runtime
warning is GONE (0 occurrences, was 2 per launch). testUseBetaLibraries_-
publishesViaCombine (a local hang victim) passes in 0.68s.

**Scope:** PalaceTests build-config only; no production or test source change.

* docs(ci): mandate full-CI-suite local validation; -only-testing is a spot check, not "green"

Codifies the rule whose violation caused a false "verified" claim during
PP-4542: a `-only-testing:PalaceTests` run (2359 tests) was reported as the
full local suite passing, when (a) CI runs the whole Palace scheme across all
test targets with `-test-iterations 3` (~7121 executions), and (b) that subset
run had actually hung + `** TEST FAILED **`.

Rule: validate via `scripts/xcode-test-optimized.sh` (CI parity) or
`scripts/verify-pr.sh --quick` (full scheme); treat `-only-testing` as a scoped
spot-check only; never report a subset (or a timeout/restart run) as green;
read the top-level rollup, not summed per-suite counts.

**Scope:** CLAUDE.md guidance only. Companion to the CI-runner fixes in this PR.