feat: harden support, localize knowledge and add operator availability [skip ci]

Source-only publication of reviewed commit 64e96a7f423673dc29ad56485be9fc79bce8af1c.

Passed in isolation: focused frontend/backend tests, race checks, TypeScript typecheck, lint, Go compilation, Flowgram build, and deterministic SDK build/tests.

Not accepted as a production release: Next.js export/native assembly remains blocked by environment memory limits; browser interaction and MySQL staging acceptance remain unverified. No production server, database/schema, runtime configuration, deployment, release tag, or workflow execution was performed.

Expected source tree: 0a4a7528e9.

web/lib/realtime-connection.test.mjs

@@ -1,4 +1,4 @@
-// Modified for targeted chat realtime recovery; see docs/fixes/chat-realtime-recovery.md.
+// Modified for hardening and realtime recovery; see docs/hardening/README.md and docs/fixes/chat-realtime-recovery.md.
 import assert from "node:assert/strict"
 import test from "node:test"
 
@@ -208,3 +208,41 @@ test("becoming ineligible during authentication clears the opening deadline", as
   t.mock.timers.tick(200)
   assert.equal(errors, 0)
 })
+
+test("disconnect invalidates a pending beforeConnect even across reconnect", async () => {
+  let resolveOld
+  let attempts = 0, created = 0
+  const old = new Promise((resolve) => { resolveOld = resolve })
+  const manager = createRealtimeConnectionManager({
+    beforeConnect: () => ++attempts === 1 ? old : Promise.resolve(),
+    createSocket: () => { created++; return new MockWebSocket() },
+  })
+  const first = manager.connect()
+  manager.disconnect()
+  await manager.connect()
+  resolveOld()
+  await first
+  assert.equal(created, 1)
+  manager.disconnect()
+})
+
+test("late old socket close cannot clear current connection or notify current owner", async () => {
+  let closed = 0
+  const sockets = []
+  const manager = createRealtimeConnectionManager({
+    createSocket: () => {
+      const socket = new MockWebSocket()
+      // Simulate an asynchronously arriving close event after replacement.
+      socket.close = () => { socket.readyState = MockWebSocket.CLOSED }
+      sockets.push(socket)
+      return socket
+    },
+    onClose: () => { closed++ },
+  })
+  await manager.connect()
+  await manager.connect()
+  sockets[0].emit("close", {})
+  assert.equal(manager.getSocket(), sockets[1])
+  assert.equal(closed, 0)
+  manager.disconnect()
+})