fix(playground): address Copilot review — guard reserved-key writes + worker teardown race (#19)

- put/delete now refuse reserved-namespace keys, matching import and Studio's
  CLI safety rule (the raw kv lens is unguarded, so a U+0000-prefixed key could
  otherwise overwrite/remove catalog entries and corrupt the sandbox)
- worker teardown: on 'close' the worker now db.close()s and self.close()s; the
  client no longer calls worker.terminate() on pagehide (it raced and usually
  won before the worker ran db.close(), so the OPFS lock wasn't released cleanly)
- pagehide skips bfcache (event.persisted) so a back/forward restore keeps a
  live worker
- tests: put/delete reserved-key refusal (58 total)

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: cevheri

src/scripts/playground/client.ts

@@ -135,10 +135,13 @@ function init(root: HTMLElement): void {
     }),
   );
 
-  // Free the exclusive OPFS lock so a reload reacquires cleanly.
-  window.addEventListener('pagehide', () => {
+  // Free the exclusive OPFS lock so a reload reacquires cleanly. The worker
+  // closes the db and self-terminates on 'close'; we must NOT terminate() here,
+  // or it would race (and usually win) before the worker runs db.close().
+  // Skip on bfcache (persisted) so a back/forward restore keeps a live worker.
+  window.addEventListener('pagehide', (e) => {
+    if (e.persisted) return;
     void call({ op: 'close' });
-    worker.terminate();
   });
 
   // First view: scan the seeded users namespace.

src/scripts/playground/db.worker.ts

@@ -86,11 +86,14 @@ self.onmessage = async (event: MessageEvent<WorkerRequest>) => {
         return;
       case 'close':
         try {
-          db.close();
+          db.close(); // flush WAL + release the exclusive OPFS sync-access handle
         } catch {
           /* already closed */
         }
         reply({ id: msg.id, kind: 'closed' });
+        // Self-terminate so the handle is released without the client racing us
+        // via worker.terminate() before this handler runs.
+        self.close();
         return;
     }
   } catch (e) {

src/scripts/playground/engine.test.ts

@@ -122,6 +122,13 @@ test('import refuses reserved-namespace keys', () => {
   expect(execute(db, { op: 'import', entries: { [reservedKey]: 'x' } }).kind).toBe('error');
 });
 
+test('put and delete also refuse reserved-namespace keys (parity with import)', () => {
+  const db = seeded();
+  const reservedKey = String.fromCharCode(0) + 'libredb:catalog:theme';
+  expect(execute(db, { op: 'put', key: reservedKey, value: 'x' }).kind).toBe('error');
+  expect(execute(db, { op: 'delete', key: reservedKey }).kind).toBe('error');
+});
+
 test('stats reports a byte size when the worker supplies one', () => {
   const db = seeded();
   const r = execute(db, { op: 'stats' }, 412);

src/scripts/playground/engine.ts

@@ -122,10 +122,14 @@ export function execute(db: Database, cmd: Command, fileSize?: number): RunResul
           : { kind: 'rows', columns: ['key', 'value'], rows: [{ key: cmd.key, value: renderValue(v) }] };
       }
       case 'put': {
+        if (isReservedKey(cmd.key))
+          return { kind: 'error', error: `refused: "${cmd.key}" is in the reserved namespace` };
         const r = kv(db).set(cmd.key, cmd.value);
         return { kind: 'message', message: `OK · changed ${r.changed}` };
       }
       case 'delete': {
+        if (isReservedKey(cmd.key))
+          return { kind: 'error', error: `refused: "${cmd.key}" is in the reserved namespace` };
         const r = kv(db).delete(cmd.key);
         return { kind: 'message', message: `OK · changed ${r.changed}` };
       }