fix: recover a wedged plugin tab; a search read must be our own search (0.3.3)

[mabry1985]

Follow-ups from review round 2 on #3 (non-blocking, confirmed with stubs)

• Wedged own tab. If the labelled ebaytab exists but won't take focus (hung/crashed), tab new --label is refused "already used" and every navigation failed until the operator closed it by hand. Now the plugin closes its own labelled tab and creates a fresh one.
• Wrong-search reads. The host check let an operator's own eBay search (a cmd-click in the shared window) answer ours — ok: true with prices for the operator's query. For a search request, a landed search page that states terms must state the same terms (_nkw on eBay /sch/, k on Amazon /s; normalized for case, +/%20, spacing, parameter order), and an item/product page answering a search is a hijack. Sign-in and challenge hops, and search pages that state no terms, are not judged.
• Docstring states the residual sub-second race honestly (0.27.1's open cannot name a tab; the read-side check catches it).

Tests

168 host-free (was 156): wedged-tab recovery closes only the labelled tab; reclaim through a blocked navigation with an operator Gmail and an operator eBay search open closes only the Gemini panel (locks in #3's round-1 fix through the real path); 10 same-search cases including eBay's re-encoded/reordered queries and a term-less rewrite.

Live context

0.3.2 (#3) is deployed on merchantAgent and verified: one ebay_session_status created tab t3 labelled ebaytab, navigated only that tab, returned signed_in: true; the operator's pre-existing tab kept its URL.

🤖 Generated with Claude Code

https://claude.ai/code/session_011UQ33xXfygwEkzbbJx3YwZ

[protoreview]

QA panel review — PASS

code-review-structural · head 0c72054fa839 · formal

⚠️ PR advanced 1 commit(s) during this round (0c72054fa839 → 724cab0b351a); 0 finding(s) in the delta were demoted to possibly addressed.

Overall risk is low: the diff is purely additive (new "recreated" return path in focus_own_tab, a _foreign_host split from _hijacked, expanded hijack-detection logic, and corresponding tests). No defects were flagged by any finder, and the verifier confirmed the characterization with no annotations to apply. Nothing to fix first. The panel did not disagree — there was nothing to disagree about. The structural verification pass ran but had an empty input to verify, so it contributed no independent signal; if the diff grows in subsequent rounds, a fresh structural pass would be worthwhile.

No findings — the review came back clean.

findings JSON (machine-readable)

[]

[mabry1985]

Gate for 724cab0: CI test pass on this head; Vera PASS on 0c72054 with the delta to 724cab0 covered in the same round ("PR advanced 1 commit during this round; 0 findings in the delta"); in-session adversarial review: MERGE, no blockers — its two confirmed follow-ups (only a different site counts as settled; compare normalised sites so domain: ebay.com keeps the same-search check) are the 724cab0 delta.