test(player): pin the stop URL's ids, the beacon's settle, the kept point's edges

The stop-URL contract passed with the two ids swapped and read the backend
from the working directory; nothing called a real beacon's onSettled or its
library pass-through; the kept-point rule was held by its constants only.

backend/tests/test_library_progress.py

@@ -6,9 +6,11 @@ there. Too early or too close to the end clears it. Nobody else's checkpoint, an
 cannot reach, is ever read or written. DB-backed (real Postgres).
 """
 
+import pytest
 from sqlalchemy import select
 
 from app.models import DownloadJob, DownloadShare, LibraryState
+from app.routes._common import ProgressIn, kept_position
 
 
 def _done_job(db, user) -> DownloadJob:
@@ -87,6 +89,18 @@ def test_too_early_or_near_the_end_clears_it(db, make_user, as_user):
     assert _checkpoint(c, job.id, 0) == 0
 
 
+# The edges themselves, one second either side — the same rows as the client's
+# frontend/src/lib/resume.dom.test.ts: the rule must be applied alike on both sides, and the shared
+# constants alone (resume.contract.test.ts) would not see a `>=` that became `>` on one side.
+@pytest.mark.parametrize(
+    ("position", "duration", "kept"),
+    [(4, 3000, 0), (5, 3000, 5), (2990, 3000, 2990), (2991, 3000, 0)],
+)
+def test_the_kept_point_at_its_exact_edges(position, duration, kept):
+    body = ProgressIn(position_seconds=position, duration_seconds=duration)
+    assert kept_position(body) == kept
+
+
 def test_a_recipient_keeps_their_own_place_in_a_shared_item(db, make_user, as_user):
     owner, friend = make_user(), make_user()
     job = _done_job(db, owner)