Test the deadline is refreshed per-frame, not just extended (#87)

Gadfly re-review: the regression test proved the stream outlives the server
WriteTimeout, but its whole run was under a second — far below the 30s
sseWriteTimeout — so it could NOT tell a per-frame refresh from a deadline set
once at open. A revert to set-once would reintroduce the unbounded-block risk
the per-frame refresh exists to prevent, and sail through the test.

Make sseWriteTimeout a var (production never reassigns it) so a test can shrink
it, and split into two focused cases sharing a streamFrames helper:

- TestEventStreamOutlivesServerWriteTimeout — server WriteTimeout 300ms, frames
  straddling it, sseWriteTimeout left at 30s. Catches #78 (no deadline
  management → server cuts the stream). Huge margin, so CI slowness only makes
  it pass more surely — addresses the "timing margin tight" finding too.
- TestEventStreamRefreshesDeadlinePerFrame — sseWriteTimeout shrunk to 400ms,
  8 frames at a 100ms tick (800ms total, 4× margin per gap). A per-frame refresh
  delivers all 8; a set-once deadline expires mid-stream and cuts it.

Verified each fails against its own regression: removing the per-write refresh
gives 3/8 on the per-frame test (EOF at ~400ms); removing both deadline calls
gives 0/3 on the outlives test. Both pass on the real code, 3× under -count.

The "clear the deadline entirely" finding was already addressed by the previous
commit (per-frame refresh); this covers it against reintroduction.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01H3zbym8Doka2d7D48maSgZ

CLAUDE.md

@@ -85,6 +85,12 @@ Frontend: React 19 + Vite + Tailwind 4 + TanStack Router/Query, built into
   deliberately. `ErrForbidden` means "you can see it but may not do that".
 - **Plops (plantings) live in their parent object's local frame**, origin at the
   object's center, `-y` is north. Moving or rotating a bed moves its plants free.
+- **A plop is a clump, not a plant.** `defaultPlopRadius` is `1.5 × spacing`, so a
+  plop is three spacings across and holds `π·r²/spacing²` plants. Reasoning about
+  fills as if one plop were one plant gets the geometry wrong every time — which
+  is how #75 happened: requiring the whole circle inside the bed inset the outer
+  row by 1.5 spacings when the horticultural rule is *half* a spacing. Spacing is
+  a constraint between neighbouring plants; a bed edge is nobody's neighbour.
 - **Soft removal**: "clear bed" sets `removed_at`; the editor reads
   `removed_at IS NULL`. Hard delete is a different operation.
 - **Migrations** are numbered `.sql` files in `internal/store/migrations/`, run
@@ -123,6 +129,22 @@ fix what's real → merge when the pipeline is green. Do not grade Gadfly findin
 A push to `main` builds the image and deploys to Komodo; the live instance at
 `pansy.orgrimmar.dudenhoeffer.casa` updates a few minutes later.
 
+**Gadfly reviews the PR as opened, not as merged.** The workflow triggers on
+`opened`/`reopened`/`ready_for_review` — deliberately *not* `synchronize` — so
+every commit you push afterwards, including the ones you push in response to
+Gadfly itself, is unreviewed unless you ask. Once you've stopped pushing and
+before you merge, comment **`@gadfly review`** on the PR to re-trigger it. The
+phrase is required, and this is not hypothetical: on #76 the follow-up commit
+was the one that contained a real bug.
+
+**A skipped Gadfly run reports success.** A comment without the trigger phrase
+still starts the workflow, which logs `comment does not contain trigger phrase`
+and exits green in ~2 seconds. So "the pipeline is green" does NOT mean "this
+was reviewed". Confirm a re-review actually ran by its **duration** — a real
+pass takes ~10 minutes, a skip takes 2 seconds. Don't look for a new consensus
+comment: Gadfly EDITS its existing status-board and consensus comments in place,
+so their `created_at` stays at the first review and only `updated_at` moves.
+
 Workflow- and config-only changes (CI, this file, docs) go straight to `main`
 without the PR dance.
 

DESIGN.md

@@ -7,6 +7,7 @@ Work is tracked in Gitea issues; the tracking epic links every piece in dependen
 ## Decisions
 
 - **Placement model:** freeform plops (not a square-foot grid), scaled by real plant spacing. Grid snapping may come later as a toggle.
+- **Spacing is a plant-to-plant rule, so bed edges get half of it.** A bed edge is not a competitor for soil, light or water, so the outer row owes it half the spacing rather than a full one. `FillRegion` centres its lattice accordingly, and lets a plop — a *clump* three spacings across — cross the edge by up to half a spacing so its outermost plants land at that half-spacing. The rule, the square-foot-chart arithmetic behind it, and the failure mode it prevents are written out once in `hexCenters`; #75 is what getting it wrong looked like.
 - **Stack:** Go 1.26.x backend, module `gitea.stevedudenhoeffer.com/steve/pansy`; React + TypeScript + Vite + Tailwind frontend, production build embedded via `embed.FS` → one static binary (`CGO_ENABLED=0`).
 - **Users:** multi-user with ownership. Users own gardens; a garden can be shared with other users as viewer (read) or editor (edit content). Owner additionally shares/deletes.
 - **Auth:** OIDC-first (Authentik is the primary IdP), local argon2id passwords as an optional fallback.

internal/api/agent.go

@@ -108,6 +108,21 @@ func (h *handlers) agentChat(c *gin.Context) {
 	send(chatEvent{Done: turn})
 }
 
+// sseWriteTimeout bounds ONE write to the stream, not the stream itself.
+//
+// It is refreshed per frame, which is the only shape that satisfies both ends:
+// the server's absolute WriteTimeout would cut a long turn (#78), while removing
+// the deadline entirely would let a client that stops reading block a write
+// forever once the socket buffer fills — pinning the run goroutine and this
+// stream's mutex with it, and taking the keep-alive down too since it needs the
+// same lock. Generous, because it is a backstop against a stuck peer and not a
+// pacing mechanism.
+//
+// A var, not a const, ONLY so the test can shrink it to prove the deadline is
+// refreshed per frame rather than set once — a set-once 30s deadline would pass
+// a test whose whole run is under a second. Production never reassigns it.
+var sseWriteTimeout = 30 * time.Second
+
 // eventStream serializes writes to one SSE response.
 //
 // The mutex is load-bearing, not decoration: step events are sent from the
@@ -116,6 +131,7 @@ func (h *handlers) agentChat(c *gin.Context) {
 // frames long before it crashes anything.
 type eventStream struct {
 	c  *gin.Context
+	rc *http.ResponseController
 	mu sync.Mutex
 }
 
@@ -124,12 +140,34 @@ type eventStream struct {
 // Headers go out before the first write and the stream is flushed immediately,
 // so a proxy holding the response until it looks complete can't reintroduce
 // exactly the silence streaming exists to remove.
+//
+// Taking the write deadline off the server's absolute WriteTimeout and onto a
+// per-write one is what makes a turn longer than 30s possible at all (#78).
+// WriteTimeout is an ABSOLUTE deadline from when the request header was read,
+// not an idle timeout, so a streaming response is cut mid-turn however recently
+// it wrote. Without this the 4-minute runTimeout is unreachable and the
+// keep-alive below tops out at one tick — pacing a connection that is destroyed
+// underneath it.
+//
+// That failure is INVISIBLE from in here: writes past the deadline return
+// err == nil and their bytes are dropped, so there is nothing to detect on the
+// write path. Only the client sees it, as a truncated stream it reports as a
+// dropped connection. Hence a deadline set up front and refreshed per frame,
+// rather than anything checked after the fact.
 func openEventStream(c *gin.Context) *eventStream {
 	c.Header("Content-Type", "text/event-stream")
 	c.Header("Cache-Control", "no-cache")
 	c.Header("X-Accel-Buffering", "no")
+	s := &eventStream{c: c, rc: http.NewResponseController(c.Writer)}
+	// Probe once here rather than reporting per frame: a writer that can't take
+	// deadlines will fail identically on every write, and the operator needs to
+	// hear it once. If this fails the stream still works — it is just back to
+	// being cut at WriteTimeout, which is worth saying out loud.
+	if err := s.rc.SetWriteDeadline(time.Now().Add(sseWriteTimeout)); err != nil {
+		slog.Error("api: SSE write deadlines unavailable; long turns will be truncated at the server WriteTimeout", "error", err)
+	}
 	c.Writer.Flush()
-	return &eventStream{c: c}
+	return s
 }
 
 func (s *eventStream) send(ev chatEvent) {
@@ -144,6 +182,11 @@ func (s *eventStream) send(ev chatEvent) {
 func (s *eventStream) write(frame string) {
 	s.mu.Lock()
 	defer s.mu.Unlock()
+	// Refresh for THIS write, so the stream as a whole is unbounded but no single
+	// write is. Error deliberately unchecked: openEventStream already reported
+	// whether deadlines work at all, and this call can only fail the same way, so
+	// checking here would log once per frame to say the same thing.
+	_ = s.rc.SetWriteDeadline(time.Now().Add(sseWriteTimeout))
 	_, _ = io.WriteString(s.c.Writer, frame)
 	s.c.Writer.Flush()
 }

internal/api/sse_deadline_test.go

@@ -0,0 +1,101 @@
+package api
+
+import (
+	"bufio"
+	"net/http/httptest"
+	"strings"
+	"testing"
+	"time"
+
+	"github.com/gin-gonic/gin"
+)
+
+// streamFrames spins up a real http.Server with the given WriteTimeout and an
+// SSE handler that emits `frames` data frames, one every `tick`, then returns.
+// It reports how many frames the client actually received and any read error —
+// the only vantage point from which the deadline failures in #78/#87 are
+// visible, since the writes themselves return nil when the bytes are dropped.
+func streamFrames(t *testing.T, serverWriteTimeout, tick time.Duration, frames int) (int, error) {
+	t.Helper()
+	gin.SetMode(gin.TestMode)
+	r := gin.New()
+	r.GET("/stream", func(c *gin.Context) {
+		s := openEventStream(c)
+		for i := 0; i < frames; i++ {
+			time.Sleep(tick)
+			s.send(chatEvent{Error: "frame"})
+		}
+	})
+
+	srv := httptest.NewUnstartedServer(r)
+	srv.Config.WriteTimeout = serverWriteTimeout
+	srv.Start()
+	defer srv.Close()
+
+	resp, err := srv.Client().Get(srv.URL + "/stream")
+	if err != nil {
+		t.Fatalf("get: %v", err)
+	}
+	defer resp.Body.Close()
+
+	got := 0
+	sc := bufio.NewScanner(resp.Body)
+	for sc.Scan() {
+		if strings.HasPrefix(sc.Text(), "data: ") {
+			got++
+		}
+	}
+	return got, sc.Err()
+}
+
+// TestEventStreamOutlivesServerWriteTimeout is the regression test for #78.
+//
+// http.Server.WriteTimeout is an ABSOLUTE deadline measured from when the
+// request header was read — not an idle timeout — so a streaming response is cut
+// once it passes, however recently the handler wrote. pansy sets it to 30s while
+// an agent turn may run for minutes. openEventStream must override it.
+//
+// This has to be asserted from the CLIENT side because the failure cannot be
+// observed from the handler: writes made after the deadline return err == nil
+// and their bytes are silently discarded. A test that checked the return of
+// io.WriteString would pass against the bug.
+func TestEventStreamOutlivesServerWriteTimeout(t *testing.T) {
+	// sseWriteTimeout stays at its 30s default here, so the per-frame refresh
+	// keeps the stream alive with a huge margin — CI slowness only ever makes
+	// this pass more surely. The server's 300ms WriteTimeout is the thing being
+	// overridden; frames straddle it (300ms/600ms/900ms).
+	got, err := streamFrames(t, 300*time.Millisecond, 300*time.Millisecond, 3)
+	if err != nil {
+		t.Errorf("client read error after %d/3 frames: %v", got, err)
+	}
+	if got != 3 {
+		t.Errorf("client received %d frames, want 3 — the stream was cut at the server WriteTimeout", got)
+	}
+}
+
+// TestEventStreamRefreshesDeadlinePerFrame guards the #87 fix specifically: the
+// write deadline is refreshed on EVERY frame, not set once.
+//
+// A set-once deadline is a plausible "simplification" and it reintroduces the
+// unbounded-block risk the per-frame refresh exists to prevent — yet it would
+// sail through the test above, whose whole run is far under sseWriteTimeout. So
+// shrink sseWriteTimeout below the stream's total duration and send frames whose
+// gap stays comfortably under it: per-frame refresh delivers them all, while a
+// deadline set once at open would expire mid-stream and cut it short.
+func TestEventStreamRefreshesDeadlinePerFrame(t *testing.T) {
+	orig := sseWriteTimeout
+	sseWriteTimeout = 400 * time.Millisecond
+	t.Cleanup(func() { sseWriteTimeout = orig })
+
+	// The server WriteTimeout is generous (5s), so it isn't the limiter — the
+	// per-frame sseWriteTimeout is. 8 frames at a 100ms tick span 800ms, well past
+	// the 400ms deadline, but each 100ms gap is a 4× margin under it.
+	got, err := streamFrames(t, 5*time.Second, 100*time.Millisecond, 8)
+	if err != nil {
+		t.Errorf("client read error after %d/8 frames: %v", got, err)
+	}
+	if got != 8 {
+		t.Errorf("client received %d frames, want 8 — a set-once deadline would cut the stream at ~%v; the refresh must be per-frame",
+			got, sseWriteTimeout)
+	}
+}

internal/service/ops.go

@@ -28,13 +28,9 @@ type Region struct {
 	MinX, MinY, MaxX, MaxY float64
 }
 
-// contains reports whether a local point lies in the region.
-func (r Region) contains(x, y float64) bool {
-	return x >= r.MinX && x <= r.MaxX && y >= r.MinY && y <= r.MaxY
-}
-
 // clampTo intersects the region with an object's local bounds (±halfW, ±halfH),
-// so an oversized caller-supplied region can't make hexCenters loop forever.
+// so a fill can't plant outside the object it was aimed at. A region that misses
+// the object entirely comes back empty — see empty().
 func (r Region) clampTo(halfW, halfH float64) Region {
 	return Region{
 		MinX: math.Max(r.MinX, -halfW), MinY: math.Max(r.MinY, -halfH),
@@ -42,6 +38,16 @@ func (r Region) clampTo(halfW, halfH float64) Region {
 	}
 }
 
+// empty reports whether the region encloses nothing.
+//
+// This exists because clampTo expresses "no overlap" by INVERTING the region —
+// Max clamps below Min — rather than by zeroing it, which is not something a
+// reader guesses. Naming it once here beats a bare `MaxX < MinX` at each place
+// that has to care.
+func (r Region) empty() bool {
+	return r.MaxX < r.MinX || r.MaxY < r.MinY
+}
+
 // rect builds a rectangular region.
 func rect(minX, minY, maxX, maxY float64) Region {
 	return Region{MinX: minX, MinY: minY, MaxX: maxX, MaxY: maxY}
@@ -94,9 +100,11 @@ func defaultPlopRadius(spacingCM float64) float64 {
 // FillRegion lays a hex-packed field of plops of one plant across a region of a
 // plantable object the actor can edit. Plop radius comes from the plant's spacing
 // (or spacingOverride) via defaultPlopRadius; centers sit on a hex lattice at 2×
-// radius pitch, kept where the center is inside the region. A candidate is
+// radius pitch, centered in the region, and set in from each edge by the plop's
-// skipped when its plop would sit entirely inside an existing active plop (so
+// radius less half a spacing — see hexCenters for why that half-spacing is what
-// re-filling doesn't stack duplicates). Returns the plops it created.
+// the edge is owed. A candidate is skipped when its plop would sit entirely
+// inside an existing active plop (so re-filling doesn't stack duplicates).
+// Returns the plops it created.
 func (s *Service) FillRegion(ctx context.Context, actorID, objectID int64, region Region, plantID int64, spacingOverride *float64) ([]domain.Planting, error) {
 	o, _, err := s.objectForRole(ctx, actorID, objectID, roleEditor)
 	if err != nil {
@@ -106,9 +114,9 @@ func (s *Service) FillRegion(ctx context.Context, actorID, objectID int64, regio
 }
 
 // fillLoaded is the shared body of FillRegion/FillNamedRegion given an object
-// already loaded and authorized (roleEditor). It clamps the region to the
+// already loaded and authorized (roleEditor). It rejects a non-finite region,
-// object's bounds, refuses fills over maxFillPlops, and inserts the whole batch
+// clamps the region to the object's bounds, refuses fills over maxFillPlops, and
-// in one transaction rather than one round-trip per plop.
+// inserts the whole batch in one transaction rather than one round-trip per plop.
 func (s *Service) fillLoaded(ctx context.Context, actorID int64, o *domain.GardenObject, region Region, plantID int64, spacingOverride *float64) ([]domain.Planting, error) {
 	if !o.Plantable {
 		return nil, domain.ErrInvalidInput
@@ -129,9 +137,21 @@ func (s *Service) fillLoaded(ctx context.Context, actorID int64, o *domain.Garde
 		return nil, domain.ErrInvalidInput
 	}
 
+	// A caller-supplied region is arbitrary floats, and non-finite ones survive
+	// everything downstream: clamping keeps them, the inverted-region guard can't
+	// see NaN (it compares false both ways), and fitAxis centres on them happily.
+	// Nothing corrupt reaches the table — SQLite stores NaN as NULL and the NOT
+	// NULL constraint refuses it — but the caller gets an opaque store error for
+	// NaN, and for +Inf a silent zero-plop success. Both are lies about what went
+	// wrong; say "bad input" here instead.
+	if !isFinite(region.MinX) || !isFinite(region.MinY) ||
+		!isFinite(region.MaxX) || !isFinite(region.MaxY) {
+		return nil, domain.ErrInvalidInput
+	}
+
 	region = region.clampTo(o.WidthCM/2, o.HeightCM/2)
-	centers := hexCenters(region, radius)
+	centers, total := hexCenters(region, radius, spacing, maxFillPlops)
-	if len(centers) > maxFillPlops {
+	if total > maxFillPlops {
 		return nil, domain.ErrInvalidInput // region too large for this spacing; ask for less
 	}
 
@@ -169,32 +189,112 @@ func (s *Service) fillLoaded(ctx context.Context, actorID int64, o *domain.Garde
 
 type localPoint struct{ x, y float64 }
 
-// hexCenters returns hex-packed lattice centers whose center lies in the region.
+// hexCenters returns hex-packed lattice centers filling a region: rows radius·√3
-// Rows are spaced radius·√3 apart and every other row is offset by radius, the
+// apart, alternate rows offset by half a pitch, at a 2×radius pitch. The lattice
-// standard hexagonal packing at a 2×radius pitch. The lattice is anchored one
+// is CENTERED, so the leftover is shared between opposite edges instead of piling
-// radius inside the region's min corner so the first plop sits inside it.
+// up against the far one.
-func hexCenters(r Region, radius float64) []localPoint {
+//
+// # How close to the edge the outer row goes
+//
+// Spacing is a constraint BETWEEN NEIGHBOURING PLANTS competing for the same
+// soil, light and water. A bed edge is not a competitor, so the outer row only
+// owes it HALF the spacing — the half it would otherwise share with a neighbour.
+// That is the arithmetic inside every square-foot-gardening chart: 4 per square
+// is 6" apart and 3" from the square's edge; 9 per square is 4" apart and 2"
+// from the edge. Garlic at 9 per square goes in 2" from the frame, not 6".
+//
+// A plop is a CLUMP, not a plant — defaultPlopRadius makes it 1.5×spacing, so
+// three spacings across — and its plants sit out to its rim. So keeping the whole
+// circle inside the bed would inset the outer row by a full 1.5 spacings, three
+// times what the rule allows. Instead the clump may hang over the edge by up to
+// half a spacing, which puts its outermost plants exactly the half-spacing from
+// the edge that the rule asks for. Overhang is capped there and nowhere near the
+// full radius: a clump mostly outside the bed is a drawing of plants in the path.
+//
+// Do not "simplify" this back to anchoring at the region's min corner. That is
+// what #75 was: staggered rows start a full pitch in, and the leftover all lands
+// on the far edge, where clumps hang outside a bed that nothing clips them to.
+//
+// # Counting before building
+//
+// hexCenters returns the total alongside the points, and works that total out
+// BEFORE building anything: a fill large enough to be refused shouldn't allocate
+// its whole lattice first just to be counted and thrown away. Over `limit` it
+// returns (nil, total), so the caller can still refuse with the real number.
+func hexCenters(r Region, radius, spacing float64, limit int) ([]localPoint, int) {
 	if radius <= 0 {
-		return nil
+		return nil, 0
+	}
+	// An empty region has no inside to plant. The old loop-until-past-MaxX form
+	// got this for free by never entering the loop; counting positions up front
+	// does not, and would site a plop off the bed.
+	if r.empty() {
+		return nil, 0
 	}
 	pitch := 2 * radius
 	rowH := pitch * math.Sqrt(3) / 2
-	const eps = 1e-6
+
-	var pts []localPoint
+	// How far a clump's centre must stay inside the edge: its own radius, less the
-	row := 0
+	// half-spacing of overhang the rule allows. Never negative, and never past the
-	for y := r.MinY + radius; y <= r.MaxY+eps; y += rowH {
+	// centre of the clump.
-		xStart := r.MinX + radius
+	inset := math.Max(0, radius-math.Max(0, spacing)/2)
-		if row%2 == 1 {
+
-			xStart += radius
+	rows, y0 := fitAxis(r.MaxY-r.MinY, rowH, inset)
+	cols, x0 := fitAxis(r.MaxX-r.MinX, pitch, inset)
+
+	// Exact, not an upper bound: staggered rows hold one fewer, so rows*cols would
+	// over-reserve by ~12% — and, more to the point, allocating it is the thing we
+	// are trying to avoid when the answer is "too many".
+	staggered := cols
+	if cols > 1 {
+		staggered = cols - 1
 	}
-		for x := xStart; x <= r.MaxX+eps; x += pitch {
+	total := (rows+1)/2*cols + rows/2*staggered
-			if r.contains(x, y) {
+	if total > limit {
-				pts = append(pts, localPoint{x, y})
+		return nil, total
+	}
+
+	pts := make([]localPoint, 0, total)
+	for row := 0; row < rows; row++ {
+		y := r.MinY + y0 + float64(row)*rowH
+		n, x := cols, r.MinX+x0
+		// The stagger falls out of centering: an offset row holds one fewer plop,
+		// and centering THAT run puts it exactly half a pitch off its neighbours.
+		// A single-column region has nothing to stagger against.
+		if row%2 == 1 && cols > 1 {
+			n, x = staggered, r.MinX+x0+pitch/2
+		}
+		for i := 0; i < n; i++ {
+			pts = append(pts, localPoint{x + float64(i)*pitch, y})
 		}
 	}
-		row++
+	return pts, total
+}
+
+// fitAxis returns how many lattice positions fit along a span at `step`, keeping
+// at least `inset` from each end, and the offset from the span's start that
+// centers them — so the leftover is split between the two edges rather than all
+// landing on the far one.
+//
+// A span too small to hold even one position at that inset still gets one, in the
+// middle: filling a bed narrower than a single plop with one plop is a better
+// answer than refusing to plant it.
+//
+// The step<=0 half of that guard is currently unreachable — hexCenters, the only
+// caller, returns early unless radius > 0, which makes both steps it passes
+// positive. It stays because dividing by a non-positive step yields ±Inf and then
+// a garbage int conversion, and a helper this small should not require reading
+// its caller to know it is safe. Deliberate, not an oversight.
+func fitAxis(length, step, inset float64) (n int, start float64) {
+	if step <= 0 || length < 2*inset {
+		return 1, length / 2
 	}
-	return pts
+	// The epsilon keeps an exact fit from being lost to floating point — a 60cm
+	// span at a 30cm step should give 2 positions, not 1 because the division
+	// landed on 0.9999999.
+	const eps = 1e-9
+	n = int(math.Floor((length-2*inset)/step+eps)) + 1
+	return n, (length - float64(n-1)*step) / 2
 }
 
 // coveredByExisting reports whether a new plop (center, radius) would sit

internal/service/ops_test.go

@@ -3,6 +3,8 @@ package service
 import (
 	"context"
 	"errors"
+	"math"
+	"sort"
 	"testing"
 
 	"gitea.stevedudenhoeffer.com/steve/pansy/internal/domain"
@@ -71,6 +73,165 @@ func TestDefaultPlopRadius(t *testing.T) {
 	}
 }
 
+// TestHexCentersEdgeInset pins the spacing rule the packing exists to honour:
+// spacing is a constraint between neighbouring plants, so a bed edge — which is
+// nobody's neighbour — is owed half a pitch, not a whole one.
+//
+// The bug this guards against was visible to anyone who filled a bed: staggered
+// rows began a full pitch in, leaving a bare strip a whole plop wide down one
+// side of every other row, while the far edge had plops hanging off it.
+func TestHexCentersEdgeInset(t *testing.T) {
+	for _, tc := range []struct {
+		name                  string
+		w, h, radius, spacing float64
+		wantRowStarts         []float64 // x of the first plop in rows 0 and 1
+	}{
+		// 4ft × 8ft bed, garlic at 15cm spacing → radius 22.5, pitch 45. Three
+		// columns, the outer ones overhanging by 6.5cm — under the 7.5cm the rule
+		// allows. Anchored at the corner this row started at -38.5 and its
+		// staggered neighbour a full 45 further in still.
+		{"4ft bed of garlic", 122, 244, 22.5, 15, []float64{-45, -22.5}},
+		// An exact fit: 90 wide at pitch 30 → 3 columns, no overhang needed.
+		{"exact fit", 90, 90, 15, 10, []float64{-30, -15}},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			r := rect(-tc.w/2, -tc.h/2, tc.w/2, tc.h/2)
+			pts, total := hexCenters(r, tc.radius, tc.spacing, maxFillPlops)
+			if len(pts) == 0 {
+				t.Fatal("no centers")
+			}
+			// The count is derived up front so an oversized fill is refused without
+			// building its lattice — which only works if it matches what gets built.
+			if total != len(pts) {
+				t.Errorf("reported total %d, built %d", total, len(pts))
+			}
+
+			// A clump may cross the edge, but only by the half-spacing the rule
+			// allows — never enough to be mostly out in the path.
+			budget := tc.spacing / 2
+			for _, p := range pts {
+				over := math.Max(
+					math.Max(r.MinX-(p.x-tc.radius), (p.x+tc.radius)-r.MaxX),
+					math.Max(r.MinY-(p.y-tc.radius), (p.y+tc.radius)-r.MaxY),
+				)
+				if over > budget+1e-6 {
+					t.Errorf("plop at (%.1f,%.1f) overhangs by %.2f, budget %.2f", p.x, p.y, over, budget)
+				}
+			}
+
+			// The margins match on opposite edges: the leftover is shared, not piled
+			// against the far side.
+			minX, maxX, minY, maxY := pts[0].x, pts[0].x, pts[0].y, pts[0].y
+			for _, p := range pts {
+				minX, maxX = math.Min(minX, p.x), math.Max(maxX, p.x)
+				minY, maxY = math.Min(minY, p.y), math.Max(maxY, p.y)
+			}
+			if w, e := minX-r.MinX, r.MaxX-maxX; math.Abs(w-e) > 1e-6 {
+				t.Errorf("lopsided horizontally: west margin %.2f, east %.2f", w, e)
+			}
+			if n, s := minY-r.MinY, r.MaxY-maxY; math.Abs(n-s) > 1e-6 {
+				t.Errorf("lopsided vertically: north margin %.2f, south %.2f", n, s)
+			}
+
+			// The staggered row is offset by HALF a pitch, not a whole one.
+			starts := map[float64]float64{}
+			for _, p := range pts {
+				if x, ok := starts[p.y]; !ok || p.x < x {
+					starts[p.y] = p.x
+				}
+			}
+			ys := make([]float64, 0, len(starts))
+			for y := range starts {
+				ys = append(ys, y)
+			}
+			sort.Float64s(ys)
+			for i, want := range tc.wantRowStarts {
+				if i >= len(ys) {
+					t.Fatalf("only %d rows, want at least %d", len(ys), len(tc.wantRowStarts))
+				}
+				if got := starts[ys[i]]; math.Abs(got-want) > 1e-6 {
+					t.Errorf("row %d starts at x=%.2f, want %.2f", i, got, want)
+				}
+			}
+		})
+	}
+}
+
+// TestHexCentersTinyRegion covers a region too small to hold a plop at the
+// half-pitch inset: planting one in the middle beats refusing to plant at all.
+//
+// The off-centre case earns its place — a region symmetric about the origin
+// can't tell "the middle of the region" from "the origin", so on its own it
+// would pass for an implementation that just returned (0,0).
+func TestHexCentersTinyRegion(t *testing.T) {
+	for _, tc := range []struct {
+		name         string
+		r            Region
+		wantX, wantY float64
+	}{
+		{"centred on the origin", rect(-5, -5, 5, 5), 0, 0},
+		{"off in a corner", rect(20, -40, 30, -30), 25, -35},
+	} {
+		t.Run(tc.name, func(t *testing.T) {
+			pts, _ := hexCenters(tc.r, 15, 10, maxFillPlops)
+			if len(pts) != 1 || pts[0].x != tc.wantX || pts[0].y != tc.wantY {
+				t.Errorf("got %+v, want one plop at (%v,%v)", pts, tc.wantX, tc.wantY)
+			}
+		})
+	}
+}
+
+// TestFillRegionRejectsNonFiniteRegion: non-finite bounds survive clamping and
+// the inverted-region guard (NaN compares false both ways). Without the explicit
+// check, NaN surfaced as a raw store error ("NOT NULL constraint failed") and
+// +Inf as a silent success that planted nothing — neither of which tells the
+// caller what it actually did wrong.
+func TestFillRegionRejectsNonFiniteRegion(t *testing.T) {
+	ctx := context.Background()
+	s := newTestService(t, openConfig())
+	owner := seedUser(t, s, "[email protected]")
+	g, _ := s.CreateGarden(ctx, owner, GardenInput{Name: "Big", WidthCM: 2000, HeightCM: 2000})
+	bed := seedFillBed(t, s, owner, g.ID, 100, 100)
+	plant := seedOwnPlant(t, s, owner, 10)
+
+	nan := math.NaN()
+	for _, r := range []Region{
+		{MinX: nan, MinY: -50, MaxX: 50, MaxY: 50},
+		{MinX: -50, MinY: -50, MaxX: 50, MaxY: math.Inf(1)},
+	} {
+		created, err := s.FillRegion(ctx, owner, bed.ID, r, plant.ID, nil)
+		if !errors.Is(err, domain.ErrInvalidInput) {
+			t.Errorf("FillRegion(%+v) err = %v, want ErrInvalidInput", r, err)
+		}
+		for _, p := range created {
+			if !isFinite(p.XCM) || !isFinite(p.YCM) {
+				t.Errorf("persisted a plop with non-finite coordinates: %+v", p)
+			}
+		}
+	}
+}
+
+// TestFillRegionOutsideObjectPlantsNothing covers a region that misses the object
+// entirely. clampTo inverts such a region rather than emptying it, and an
+// inverted region must plant nothing — not one plop at some point off the bed.
+func TestFillRegionOutsideObjectPlantsNothing(t *testing.T) {
+	ctx := context.Background()
+	s := newTestService(t, openConfig())
+	owner := seedUser(t, s, "[email protected]")
+	g, _ := s.CreateGarden(ctx, owner, GardenInput{Name: "Big", WidthCM: 2000, HeightCM: 2000})
+	bed := seedFillBed(t, s, owner, g.ID, 100, 100) // local bounds ±50
+	plant := seedOwnPlant(t, s, owner, 10)
+
+	// Wholly east of the bed: clampTo gives MinX=500, MaxX=50.
+	created, err := s.FillRegion(ctx, owner, bed.ID, rect(500, -50, 600, 50), plant.ID, nil)
+	if err != nil {
+		t.Fatalf("FillRegion: %v", err)
+	}
+	if len(created) != 0 {
+		t.Errorf("filled %d plops for a region outside the bed, want 0: %+v", len(created), created)
+	}
+}
+
 // seedFillBed makes a plantable bed of the given size centered in a big garden.
 func seedFillBed(t *testing.T, s *Service, owner, gardenID int64, w, h float64) *domain.GardenObject {
 	t.Helper()
@@ -99,16 +260,24 @@ func TestFillRegionDeterministicPacking(t *testing.T) {
 	if err != nil {
 		t.Fatalf("FillRegion: %v", err)
 	}
-	// Hex lattice on [-30,30]² at pitch 30, rows ~26 apart → 4 plops (2 rows × 2).
+	// Hex lattice on [-30,30]² at pitch 30, rows ~26 apart, centered: a row of 2
-	if len(created) != 4 {
+	// (x=±15), then a staggered row of 1 (x=0) → 3 plops.
-		t.Fatalf("filled %d plops, want 4 (60×60 bed, radius 15)", len(created))
+	//
+	// This was 4 while the lattice was anchored at the min corner, and the fourth
+	// sat at x=30 — centred ON the east edge, so half of it lay outside the bed,
+	// well past the half-spacing (5cm here) the rule allows. Packing one fewer
+	// plop is the point of the fix, not a regression in it.
+	if len(created) != 3 {
+		t.Fatalf("filled %d plops, want 3 (60×60 bed, radius 15)", len(created))
 	}
 	for _, p := range created {
 		if p.RadiusCM != 15 || p.PlantedAt == nil || p.DerivedCount < 1 {
 			t.Errorf("unexpected created plop: %+v", p)
 		}
-		if p.XCM < -30 || p.XCM > 30 || p.YCM < -30 || p.YCM > 30 {
+		// This bed fits its lattice exactly, so nothing should need to overhang.
-			t.Errorf("plop center out of bed bounds: %+v", p)
+		if p.XCM-p.RadiusCM < -30 || p.XCM+p.RadiusCM > 30 ||
+			p.YCM-p.RadiusCM < -30 || p.YCM+p.RadiusCM > 30 {
+			t.Errorf("plop overhangs a bed it fits inside: %+v", p)
 		}
 	}