docs(sync): record the b24ui-only useTokenSearch divergence as a porting invariant

.sync/PORTING.md

@@ -102,6 +102,38 @@ material. Reproduce its *intent* in b24ui by editing files under `src/` only.
   `describe('grouped children (#51)')` in `test/components/NavigationMenu.spec.ts`;
   its horizontal case needs `unmountOnHide: false` to reach the second site at
   all.
+- **`highlight()` in `utils/search.ts` takes a fifth `useTokenSearch` argument,
+  and the token-search logic around it, that no port brought in.** `c502157b`
+  added the `tokens` / `minTokenLength` pair to what was then
+  `src/runtime/utils/fuse.ts`; `6743f793` added the parameter itself and gated
+  the tokenizer behind it. Both shipped in v2.8.0. Immediately before
+  `c502157b` the function took four parameters and computed no `minTokenLength`
+  at all — *that*, not the absence of an `Upstream:` trailer, is what marks the
+  divergence as locally authored: only 16 of ~3200 commits carry that trailer,
+  and `559a5cdb`, this file's own most recent port, is not one of them. The port
+  `557a5178` then renamed `fuse.ts` to `search.ts` and carried the divergence
+  across, so anyone auditing the current path is actively misdirected —
+  `git log -S useTokenSearch -- src/runtime/utils/search.ts` returns exactly one
+  commit, `557a5178`, which *is* a genuine upstream port. Pass `--follow` to see
+  the two that introduced it. The last recorded port of this file scoped its
+  equivalence claim accordingly:
+  `.sync/log/2a172ef187763c74d437a85fda3168e3f80ff00a.md` reads *"b24ui's
+  `highlight` matches upstream's behavior 1:1 (`minTokenLength =
+  searchTerm.length` without token search; early `return` when
+  `!item.matches?.length`), so the tests port verbatim"* — the "without token
+  search" carve-out is the divergence. (`.sync/nuxt-ui.json`'s summary for the
+  same port previously said "highlight signature matches 1:1" with no such
+  qualifier; corrected alongside this rule.) **Upstream has not been
+  re-inspected here** — treat "upstream has no such parameter" as an inference
+  from b24ui's own history rather than a verified fact, and re-check before
+  acting on it. What is certain is that replaying upstream's four-parameter
+  signature wholesale drops behaviour shipped in v2.8.0 while **nothing goes
+  red**: `useTokenSearch` appears nowhere under `test/`. (Reverting the signature
+  alone does fail `typecheck`, since `CommandPalette.vue` passes five arguments;
+  it is a port that replays both files that goes quiet.) Several §2 rules here
+  name a guarding spec and some — locales, playground-manifest mirroring — do
+  not; this one does not, and #363 tracks the gap. Port the intent, keep the
+  fifth argument, and prefer adding that coverage over trusting this paragraph.
 - **`skills/` is b24ui-authored — never replay upstream skill or doc prose into
   it.** The package was seeded from nuxt/ui's skill, and every defect the #93
   audit found was an inherited upstream idiom rather than an ordinary typo:
@@ -238,3 +270,4 @@ History of the maps lives in git; no separate version field.
 - 2026-08-09 — fix of #93 (PR #343): added the §2 **`skills/` is b24ui-authored** invariant. The AI skill package was seeded from nuxt/ui's and had drifted from both the codebase and its own manifest; notably, *every* defect found was an upstream idiom rather than a typo — dead routing targets, `UFieldGroup`, `variant="ghost"`, `color="neutral"`, `i-lucide-*` string icons, a fabricated `mode="drawer"`, and `.nuxt/ui/` for our `.nuxt/b24ui/`. Also fabricated icon imports (`LayoutGridIcon` and friends) in a recipe that had only just started shipping. Guarded by `test/utils/skill-manifest.spec.ts` — ten checks over names, icons, links, manifest parity and routing in both directions — but that guard covers identifiers, not props or paths, so the invariant still has to be read. No `src/` change, so nothing here is a runtime deviation. Last reviewed: 2026-08-09.
 - 2026-08-09 — follow-up to #93 (PR #346, refs #344): `skills/index.json` is now generated by `pnpm run skill:sync` (`scripts/lib/skill-manifest.mjs`), so the §2 **`skills/` is b24ui-authored** invariant gains one line: never hand-edit the manifest. The generator validates its own output — no traversal segment, no backslash in a name, no symlink, no entry that collides with another once installed on a case-insensitive filesystem, and no invisible character — because that file is what `npx skills add` reads as instructions for where to write. Generating the `components.md` table was measured and declined: four of twelve sections mix docs `category` values on purpose, since the skill groups by task and the docs by kind (recorded on #344). Still no `src/` change, so still not a runtime deviation. Last reviewed: 2026-08-09.
 - 2026-08-10 — fix of #99 §2/§3 (PR #351): added the §2 **`vue` is a peer dependency here** invariant and recorded that the `reka-ui` / `vaul-vue` exact pins are upstream's rather than ours. Upstream declares `tailwindcss` and `typescript` as required peers but not `vue`, which reads as an oversight rather than a decision — `reka-ui` declares it, and our own floor is higher than `reka-ui`'s, so the graph currently permits an install that cannot run. Guarded by `test/utils/peer-dependencies.spec.ts`, which derives the floor from the Vue APIs `src/` imports, so raising it cannot be forgotten and lowering it cannot be quiet. Adding a root peer needs no lockfile change — verified `pnpm install --frozen-lockfile` still passes untouched. Last reviewed: 2026-08-10.
+- 2026-08-11 — review of PR #347 (issue #339): added the §2 **`highlight()` takes a fifth `useTokenSearch` argument** invariant, and corrected the `.sync/nuxt-ui.json` summary for `2a172ef` that asserted "highlight signature matches 1:1". The divergence has been in the tree since v2.8.0 and was never recorded: `c502157b` added `tokens`/`minTokenLength` and `6743f793` the parameter itself, both to `src/runtime/utils/fuse.ts`, and the port in `557a5178` renamed the file to `search.ts` — so a pickaxe on the current path returns only `557a5178`, a genuine upstream port, unless you pass `--follow`. That rename, not the trailer convention, is what hid it; `Upstream:` trailers are too rare (16 of ~3200 commits) to carry an inference either way. It has no test coverage; #363 tracks that. Worth recording how the error was found: the "byte-identical with upstream" premise originated **here**, in `595923b9` (PR #338), was repeated in #339, and was inherited in good faith by the external contributor whose PR prompted the check — nuxt/ui itself has still not been inspected, so the divergence is established from b24ui's history alone. Last reviewed: 2026-08-11.

.sync/nuxt-ui.json

@@ -1136,7 +1136,7 @@
       "pr": 291,
       "b24ui_sha": "559a5cdbfa20d50e81c818022c4857598b134a33",
       "decision": "port",
-      "summary": "fix(CommandPalette): always escape search highlight to prevent XSS — src/runtime/utils/search.ts removed isAlreadyEscaped()/sanitize() (entity-detection bypass was the vuln) and replaced 3 sanitize() calls in highlight() with escapeHTML(). Added 4 upstream XSS regression tests to test/utils/search.spec.ts (highlight signature matches 1:1). sanitizeSnippet untouched. Normal-input output unchanged → no snapshot churn. Tests 5565 (+4 highlight)."
+      "summary": "fix(CommandPalette): always escape search highlight to prevent XSS — src/runtime/utils/search.ts removed isAlreadyEscaped()/sanitize() (entity-detection bypass was the vuln) and replaced 3 sanitize() calls in highlight() with escapeHTML(). Added 4 upstream XSS regression tests to test/utils/search.spec.ts (the XSS-relevant behavior matches 1:1; the signature does NOT — b24ui's `highlight` carries a fifth `useTokenSearch` argument, see PORTING.md §2). sanitizeSnippet untouched. Normal-input output unchanged → no snapshot churn. Tests 5565 (+4 highlight)."
     },
     "e931bdf79700b95fe6298ae015b5a08bd7c4f82c": {
       "pr": 292,