test(data,llm): pin error-graceful behavior on real data

TestSearchDocumentsBadSyntaxGraceful previously ran against an empty
store, so it only proved that malformed inputs do not error -- a
regression that broadened them into matching real terms would still
pass. Insert a document whose tokens share no prefix with any test
query so the no-match assertion is meaningful.

TestIsNetworkError gains an explicit case asserting that a bare error
whose message contains "connection refused" is NOT classified as a
network error, pinning the new contract that only wrapped syscall
sentinels qualify.

Author: cpcloud

internal/data/fts_test.go

@@ -172,13 +172,23 @@ func TestSearchDocumentsUpdateReflected(t *testing.T) {
 }
 
 // TestSearchDocumentsBadSyntaxGraceful verifies that inputs which would
-// be malformed FTS5 expressions if passed verbatim do not error out --
-// the phrase-wrap escape in prepareFTSQuery turns each token into a
-// quoted phrase, neutralizing the special characters.
+// be malformed FTS5 expressions if passed verbatim do not error out and
+// also do not accidentally match real documents. A document is inserted
+// so the no-match assertion is meaningful (an empty store would pass
+// even if the query rewrite broadened matches).
 func TestSearchDocumentsBadSyntaxGraceful(t *testing.T) {
 	t.Parallel()
 	store := newTestStore(t)
 
+	// Document content uses tokens that don't share any prefix with
+	// the test queries below, so any spurious match indicates a bug
+	// in the rewrite (e.g., a query collapsing to a bare wildcard).
+	require.NoError(t, store.CreateDocument(&Document{
+		Title:         "Zebra",
+		FileName:      "z.pdf",
+		ExtractedText: "rhinoceros giraffe leopard",
+	}))
+
 	bad := []string{
 		`"unclosed`,
 		`unclosed"`,
@@ -189,7 +199,7 @@ func TestSearchDocumentsBadSyntaxGraceful(t *testing.T) {
 		`***`,
 		`:::`,
 		`+++---`,
-		`(a AND)`,
+		`(b AND)`,
 	}
 	for _, q := range bad {
 		t.Run(q, func(t *testing.T) {

internal/llm/client_test.go

@@ -528,6 +528,15 @@ func TestIsNetworkError(t *testing.T) {
 		},
 		{"unrelated error", errors.New("something else broke"), false},
 		{"context.Canceled", context.Canceled, false},
+		// Pin the new contract: errors that contain "connection refused"
+		// in their message but do NOT wrap a syscall sentinel are not
+		// classified as network errors. The previous string-fallback
+		// implementation matched these by substring.
+		{
+			"bare string says connection refused",
+			errors.New("dial tcp: connection refused"),
+			false,
+		},
 	}
 	for _, tt := range cases {
 		t.Run(tt.name, func(t *testing.T) {