3 files changed, 107 insertions, 6 deletions
diff --git a/packages/meshbay-hub/tests/harness/search_fanout_harness.mjs b/packages/meshbay-hub/tests/harness/search_fanout_harness.mjs
index 74b4bb3..c05e23b 100644
--- a/packages/meshbay-hub/tests/harness/search_fanout_harness.mjs
+++ b/packages/meshbay-hub/tests/harness/search_fanout_harness.mjs
@@ -78,7 +78,6 @@ const shown = [];   // [{ at, groups }] — one entry per render the reader gets
 
 const session = { bundleKey: 'k' };
 const _loadBundleKey = async () => 'k';
-const cacheGroupIndex = () => {};
 
 // One group's index, answered on the clock rather than over a network.
 const fetchGroupIndex = (groupId) => new Promise((resolve, reject) => {
@@ -106,7 +105,7 @@ const lift = (signature) => {
 };
 
 const make = new Function(
-  'session', '_loadBundleKey', 'cacheGroupIndex', 'fetchGroupIndex', 'localStorage',
+  'session', '_loadBundleKey', 'fetchGroupIndex', 'localStorage',
   `const MAX_IN_FLIGHT = ${ceiling[1]};
    const DOWN_KEY = 'harness';
    ${lift('function lastKnownDown(')}
@@ -116,7 +115,7 @@ const make = new Function(
    return fetchAllIndexes;`,
 );
 const fetchAllIndexes = make(
-  session, _loadBundleKey, cacheGroupIndex, fetchGroupIndex, globalThis.localStorage);
+  session, _loadBundleKey, fetchGroupIndex, globalThis.localStorage);
 
 // ── The scenario ─────────────────────────────────────────────────────────────
 
diff --git a/packages/meshbay-hub/tests/test_no_index_cache.py b/packages/meshbay-hub/tests/test_no_index_cache.py
new file mode 100644
index 0000000..c39bf00
--- /dev/null
+++ b/packages/meshbay-hub/tests/test_no_index_cache.py
@@ -0,0 +1,98 @@
+"""
+A group's index is never written to browser storage.
+
+`group_indexes` was an IndexedDB store holding a decrypted copy of every group's
+index — each file's name, path, size, hash and uploader — written on every index
+and every delta. The cross-group search of the time read it instead of dialling
+anything, which is what it was for.
+
+Search has dialled the nodes since 2026-08-28. That change removed the reader and
+kept the writers, so the browser went on building a cleartext file listing that
+nothing consulted, that no sign-out removed (the key database is a different
+one), and that grew with every group ever opened. **L7**, at rest.
+
+Showing a group's files while its node is unreachable is the only thing such a
+cache buys, and it is not wanted: a listing you cannot open is worse than an
+honest absence. So there is nothing left to read it with, and these tests keep it
+that way — a writer reintroduced without a reader would be invisible again, and
+the second time it would be invisible for the same reason as the first.
+"""
+
+import re
+from pathlib import Path
+
+STATIC = Path(__file__).resolve().parents[1] / "src" / "meshbay_hub" / "static"
+HUB_CLIENT = STATIC / "hub-client.js"
+APP = STATIC / "app.js"
+
+# The store name, read from the source rather than written down here: renaming it
+# must not quietly take these tests out of the picture.
+STORE = re.search(r"const IDB_STORE = '([^']+)';",
+                  HUB_CLIENT.read_text(encoding="utf-8")).group(1)
+
+
+def _functions(src: str) -> dict[str, str]:
+    """Every top-level function in a module, by name."""
+    out = {}
+    starts = [(m.start(), m.group(1)) for m in
+              re.finditer(r"^(?:async )?function (\w+)\(", src, re.M)]
+    for i, (at, name) in enumerate(starts):
+        end = starts[i + 1][0] if i + 1 < len(starts) else len(src)
+        out[name] = src[at:end]
+    return out
+
+
+def test_only_the_purge_touches_the_old_store():
+    """
+    Creating it and emptying it, and nothing else.
+
+    `openDB` still creates the store because dropping it needs a version bump,
+    and a version bump is an upgrade another tab can block — which would take
+    playlists down with it, since they share this database. An empty store costs
+    nothing; the point is that nothing writes to it.
+    """
+    fns = _functions(HUB_CLIENT.read_text(encoding="utf-8"))
+    touching = sorted(n for n, body in fns.items() if "IDB_STORE" in body)
+    assert touching == ["openDB", "purgeGroupIndexCache"], (
+        f"{touching} touch the {STORE!r} store; only creating and emptying it "
+        "are allowed, and a write to it is a file listing kept on disk that "
+        "nothing will ever read")
+
+
+def test_nothing_writes_a_group_index_to_the_store():
+    """Stated on the operation rather than on the callers, so a new one is caught."""
+    fns = _functions(HUB_CLIENT.read_text(encoding="utf-8"))
+    purge = fns["purgeGroupIndexCache"]
+    assert ".clear()" in purge
+    for write in (".put(", ".add(", ".putAll("):
+        assert write not in purge, f"the purge does a {write} — it must only clear"
+
+
+def test_no_module_carries_a_cache_writer_any_more():
+    """
+    The functions are gone, so the way this comes back is a new one. Any export
+    of hub-client.js whose name is about caching an index is refused here rather
+    than discovered months later with a store full of filenames.
+    """
+    src = HUB_CLIENT.read_text(encoding="utf-8")
+    for name in re.findall(r"^(?:async )?function (\w+)\(", src, re.M):
+        assert not re.search(r"cache.*index|index.*cache", name, re.I) \
+            or name == "purgeGroupIndexCache", (
+            f"{name} looks like an index cache again — the store it would write "
+            "to has no reader, and adding one was decided against")
+
+
+def test_the_purge_is_actually_called():
+    """
+    The defect being cleaned up was a function nobody called. A purge nobody
+    calls is the same defect wearing the opposite hat: the data stays on every
+    machine that already has it, and nothing says so.
+    """
+    app = APP.read_text(encoding="utf-8")
+    assert "purgeGroupIndexCache" in app, "app.js no longer imports the purge"
+    call = re.search(r"purgeGroupIndexCache\(\)", app)
+    assert call, "the purge is imported and never called"
+    mount = app.index("const mount = () => {")
+    assert "purgeOnce()" in app[mount:mount + 400], (
+        "the purge is no longer run at start-up, so a browser that still holds "
+        "the old store keeps it")
diff --git a/packages/meshbay-hub/tests/test_search_unlisted.py b/packages/meshbay-hub/tests/test_search_unlisted.py
index 67eb3e6..94f3aee 100644
--- a/packages/meshbay-hub/tests/test_search_unlisted.py
+++ b/packages/meshbay-hub/tests/test_search_unlisted.py
@@ -48,10 +48,14 @@ def test_an_unlisted_group_is_neither_indexed_nor_cached_nor_unreachable():
     body = _function(SEARCH_PAGE.read_text(encoding="utf-8"), "fetchAllIndexes")
     branch = body[body.index("result.unlisted"):]
     branch = branch[:branch.index("} else if (result)")]
-    for forbidden in ("results.set", "cacheGroupIndex", "unreachable.push"):
+    # `cacheGroupIndex` used to be on this list. The store it wrote to is gone
+    # (hub-client.js `purgeGroupIndexCache`), so the way an unlisted group's
+    # index could now be kept is by being written anywhere at all — which is
+    # what test_no_group_index_is_written_to_storage guards, for every group.
+    for forbidden in ("results.set", "unreachable.push"):
         assert forbidden not in branch, (
-            f"an unlisted group reaches `{forbidden}` — it would be shown, "
-            "cached, or reported as down")
+            f"an unlisted group reaches `{forbidden}` — it would be shown "
+            "or reported as down")
 
 
 def test_every_search_view_is_built_from_the_indexed_groups_only():