The connect-attempt window belongs to the forge it limits #861

Closes #685

The connect-attempt window (five connects per person per fifteen minutes) was a module-level map shared by every forge in the process, with resetConnectLimit exported for tests alone. The window now belongs to the App; a fresh createApp starts with a fresh one; the seam and its hollow allow-list entry are gone, and no test calls it.

Opened early. First commit: the window per forge, the seam removed from 17 test files; 14 of them pass as they are. Still to do in this pull: three suites (web-origins, origins-oauth, origins-security-auth) connect more than five times as one account in one forge and are restructured with a fixture helper that gives a second account or a fresh forge per phase, kept at least as strict. The limit keeps its own test: five connects pass, the sixth is refused.

🤖 Generated with Claude Code

Ready for review. resetConnectLimit is gone: nothing in src exports it and no test calls it; a suite that connects more than five times as one account in one forge now does so as more than one account.

What changed

• src/actions/origins.ts: the connect-attempt window is a WeakMap<App, Map<userId, attempts>>, the idiom the other per-forge limiters use. A fresh createApp starts with a fresh window. resetConnectLimit and its scripts/hollow-allow.ts entry are removed; the hollow check passes with the shorter list.
• 17 test files no longer import or call the seam; 14 of them needed nothing else.
• test/origins-oauth.test.ts: the cap has its own exact test on an account that has not connected: five pass, the sixth is 429, and another account's attempts are its own. Loosening the cap fails it (tried once). The revocation test connects as bob.
• test/web-origins.test.ts: the device-flow page tests run as carol (five flows, under the cap); alice keeps the token connects and the mirror, so the later tests that take listOrigins(alice)[0] get the mirror's origin as before.
• test/origins-security-auth.test.ts, code flow: each test starts its flows as an account of its own, made, proven and registered by a fresh() helper in a beforeEach; the test that starts six flows takes a fresh account per flow. The owner test asserts the owner by that account's name.

Every refusal, redirect and owner check those suites proved is still proved, on other names.

Ran, under a heavy slot on the merged head: tsc clean; the 17 changed test files plus reserved-names, studio, shards, check-list and hollow in one call, 550 pass, 0 fail.

🤖 Generated with Claude Code