memory: snapshot for shutdown — nothing in flight; the r3 seam pass and the upload-name lessons split to detail files

persistent-memory.md

@@ -1,6 +1,6 @@
 # Persistent memory — booth
 
-_Last updated: 2026-09-24_
+_Last updated: 2026-09-25_
 
 > **Always check for `/tmp/booth-dev-handoff.md`** — if it exists and its
 > `Written:` stamp is under 8 hours old, read it (it carries the in-flight
@@ -17,8 +17,12 @@ loop it turned out to actually be.
 
 ## Current state / in-flight
 
-_As of 2026-09-24:_
+_As of 2026-09-25:_
 
+- 🟢 **NOTHING IS IN FLIGHT** (shutdown snapshot, 2026-09-25). The tree is
+  clean, no branch or worktree is open, and no peer is waiting on booth-dev.
+  main is ONE memory commit ahead of origin (this snapshot), unpushed: the
+  push is the operator's call.
 - ✅ **r3 COMPARE IS LIVE AND PUSHED** (operator: "merge r3 once the mutation
   check is clean", then "merge and push", 2026-09-24). origin/main is the r3
   arc's tip: r3 (`f8d136a`), design-dev's race fix (`d54bb04`: one compare ring
@@ -29,17 +33,7 @@ _As of 2026-09-24:_
   contract caught 12 mismatches before code; the two that mattered were
   duplicate `data-region` ids (a save would have made B's flag button flag A)
   and 22 mutation-table rows anchored in the script that moved.
-- ⚠ **THE UPLOAD ROUTE HAS THREE KNOWN LIFECYCLE GAPS, unfixed on purpose**
-  (hulda, 2026-09-24; the operator was told and did not ask for them):
-  - the pickup-id `mkdir` sits outside the try, so a racing writer that
-    creates the same id first gives a FileExistsError, a 500;
-  - `rmtree(ignore_errors=True)` hides its own failure, so a failed cleanup
-    can leave a half-written booth;
-  - `except Exception` misses CancelledError, so a cancelled upload skips
-    cleanup.
-  All three are rare. The helper next to them, `safe_upload_name`, is done:
-  unencodable characters go first, the cap is in bytes, and a cut never
-  manufactures a kind.
+  → `persistent-memory.d/2026-09-24-r3-seam-pass-what-only-it-could-see.md`
 - ✅ **Pushed on 09-23 (`d5ead3f`, 888 green).** Landed that night, in
   order: r2b merge 1 (`b92b002`, reveal all + booth fog), r2b merge 2
   (`cce6a20`, Desk row + dates + theme toggle), the Desk sort (`64f6488`), the
@@ -91,8 +85,10 @@ _As of 2026-09-24:_
 
 ## Recent decisions
 
-- `[2026-09-24]` ✅ **Upload names: two crashes found, then two holes in the fix** — a NUL and a name over NAME_MAX in BYTES both 500'd /upload. Our first fix then dropped a lone surrogate AFTER the dot rule (`\ud800.forever` came out as the keep marker) and let a cut manufacture `.png`. A single hulda arm found both after heid's own read found nothing. READ BEFORE WRITING A SANITISER: drop everything droppable FIRST, then apply the structural rules. A NUL test through httpx `files=` sends a literal `%00` and proves nothing.
-- `[2026-09-24]` ✅ **r3 compare merged on the operator's word, gated by our own run** — fast-forward to `f8d136a` only after 918 green and 148/148 falsifiers on that exact commit, run here rather than taken from design-dev's report. The seam pass is what made the build clean: 12 contract-vs-code mismatches folded before a line was written.
+- `[2026-09-24]` ⏸ **The upload route's three lifecycle gaps: DEFERRED** — the pickup-id `mkdir` sits outside the try (a FileExistsError race), `rmtree(ignore_errors=True)` hides its own failure, and `except Exception` misses CancelledError. All three are rare; the operator was told and merged without them. Tracked in `225ba32`'s commit message.
+- `[2026-09-24]` ✅ **Upload names: two crashes found, then two holes in the fix** — READ BEFORE WRITING A SANITISER: drop everything droppable FIRST, then apply the structural rules; a NUL test through httpx `files=` proves nothing → `persistent-memory.d/2026-09-24-upload-names-two-crashes-then-two-holes.md`
+- `[2026-09-24]` ✅ **The r3 seam pass: what only it could see** — 12 contract-vs-code mismatches folded before code. READ BEFORE A CONTRACT THAT ADDS `data-region`S, MOVES TEMPLATE CODE, OR ADDS A `/b/{name}/<word>` ROUTE → `persistent-memory.d/2026-09-24-r3-seam-pass-what-only-it-could-see.md`
+- `[2026-09-24]` ✅ **r3 compare merged and pushed on the operator's word, gated by our own run** — fast-forward only to SHAs we had gated ourselves (`f8d136a`, then `225ba32`), never to design-dev's reported numbers.
 - `[2026-09-24]` ✅ **r3 compare ruled: pick two, flag the winner** — operator, in design-dev's session. No `booth_items` or marks work; the URL is rel-keyed. The A/same/B pairwise verdict is **PARKED (deferred)**, with our ordered-pair-of-rels note attached. Tracked in design-dev's r3 contract parked entry, althing thread `01M3952NCDRRJX5XDFSPMSP5HJ`.
 - `[2026-09-23]` ✅ **The Desk's "Everything else" sorts by last UPDATE, not last activity** — the operator chose the simple fix over repairing `.viewed` from the access log. READ BEFORE CHECKING THE LIVE SERVICE → `persistent-memory.d/2026-09-23-desk-sorts-by-last-update.md`
 - `[2026-09-23]` ✅ **The blur round-trip, and the migration that recreated the bug it fixed** — three rounds, and the third was our own 09-21 marks lesson repeated. READ BEFORE ANY DOTFILE FORMAT CHANGE → `persistent-memory.d/2026-09-23-blur-round-trip-and-the-migration-that-recreated-it.md`