v0.2.12-pre.009

crates/ksp-app-solprices-desk/tests/desktop_security.rs

@@ -1,5 +1,5 @@
 // file: crates/ksp-app-solprices-desk/tests/desktop_security.rs
-// version: 7
+// version: 8
 
 //! Security, ownership and frontend instrumentation canaries for SOL Prices Desk.
 
@@ -186,3 +186,16 @@ fn pre_007_remains_manual_without_browser_persistence_or_price_scheduler() {
         assert!(!main.contains(forbidden), "pre.007 must remain manual and backend-owned: {forbidden}");
     }
 }
+
+#[test]
+fn pre_009_hardening_bounds_hostile_batches_and_preserves_manual_backend_owned_refresh() {
+    let root = app_root();
+    let runtime = read_text(root.join("src/market_price_runtime.rs").as_path());
+    assert!(runtime.contains("const MARKET_PRICE_REFRESH_MAX_PROVIDER_IDS: usize = 64;"));
+    assert!(runtime.contains("provider_ids.is_empty() || provider_ids.len() > MARKET_PRICE_REFRESH_MAX_PROVIDER_IDS"));
+    assert!(runtime.contains("ERROR_CODE_MARKET_PRICE_SELECTION_INVALID"));
+    let main = read_text(root.join("frontend/ts/main.ts").as_path());
+    for forbidden in ["setInterval(", "setTimeout(", "requestAnimationFrame(", "fetch(", "XMLHttpRequest", "localStorage", "sessionStorage"] {
+        assert!(!main.contains(forbidden), "release hardening must preserve manual backend-owned refresh: {forbidden}");
+    }
+}