fix(tests): repair stale pins surfaced by the Phase 6 full-suite run

Two suite failures, neither caused by scanner code (the Phase 6 diff
touches no handler):

- search_test invalid_library_id expected the pre-family-lens 404;
  7e586df4 shipped the AGENTS-mandated 403 for every out-of-set id
  (existence must not be enumerable) and docs/contract_pins.md:195
  documented it — this one subtest's expectation was missed. Pin
  widened to the shipped 403.
- TestWebSocketPingPong deleted: it asserted a text-level ping→pong
  exchange no server code has ever implemented and no client has ever
  sent; it passed vacuously through its read-timeout path until
  interleaved scan_progress broadcasts from the live server's scans
  reached the socket first. Keepalive is the standard protocol-level
  ping the hub already sends. Never-built behavior is not a pinnable
  contract.

Both recorded in docs/contract_pins.md. Full container suite is green
except the documented pre-existing TestAdminCreateUser red.

cmd/server/tests/search_test.go

@@ -413,10 +413,15 @@ func TestCollectionSearchLibraryFilter(t *testing.T) {
 			shouldContain: book2ID,
 		},
 		{
-			name:           "invalid library_id",
-			query:          "Harry",
-			libraryID:      "00000000-0000-0000-0000-000000000000",
-			expectedStatus: http.StatusNotFound,
+			name:      "invalid library_id",
+			query:     "Harry",
+			libraryID: "00000000-0000-0000-0000-000000000000",
+			// Family-lens standing rule (AGENTS.md): an explicit
+			// library_id outside the visible set is a 403, never a
+			// silent pass — and a nonexistent id is out-of-set too,
+			// so existence is not enumerable. Behavior shipped in
+			// 7e586df4 (Phase 1); this pin update was missed then.
+			expectedStatus: http.StatusForbidden,
 		},
 	}
 

cmd/server/tests/websocket_test.go

@@ -157,37 +157,14 @@ func TestWebSocketProgressBroadcast(t *testing.T) {
 	assert.Equal(t, "web", sourceDevice["type"])
 }
 
-// TestWebSocketPingPong tests that ping/pong messages work correctly
-func TestWebSocketPingPong(t *testing.T) {
-	setup := setupTestServer(t)
-
-	token := setup.Token
-
-	wsURL := strings.Replace(setup.Server.URL, "http", "ws", 1) + "/ws/sync?token=" + token
-	ws, _, err := websocket.DefaultDialer.Dial(wsURL, nil)
-	require.NoError(t, err)
-	defer ws.Close()
-
-	// Read initial message
-	ws.SetReadDeadline(time.Now().Add(5 * time.Second))
-	_, _, _ = ws.ReadMessage()
-
-	// Send a ping message (as a text message for testing)
-	err = ws.WriteMessage(websocket.TextMessage, []byte(`{"type":"ping"}`))
-	require.NoError(t, err)
-
-	// Server should respond with pong
-	ws.SetReadDeadline(time.Now().Add(2 * time.Second))
-	_, msg, err := ws.ReadMessage()
-	if err == nil {
-		var pongMsg map[string]interface{}
-		err = json.Unmarshal(msg, &pongMsg)
-		if err == nil {
-			// Server might respond with pong
-			assert.Equal(t, "pong", pongMsg["type"])
-		}
-	}
-}
+// TestWebSocketPingPong was deleted (2026-10-20, Phase 6 full-suite
+// repair): it asserted a TEXT-level {"type":"ping"} → {"type":"pong"}
+// exchange that no server code has ever implemented and no client
+// (web/src or Android) has ever sent — it passed vacuously through its
+// read-timeout path until interleaved scan_progress broadcasts started
+// failing the assert. Keepalive is the standard protocol-level ping the
+// hub already sends (websocket.go's ticker); if a text-level app ping
+// is ever wanted, build it server-side first, then re-pin it.
 
 // TestWebSocketConnectionLimit tests that the server handles multiple connections
 func TestWebSocketConnectionLimit(t *testing.T) {