fix(u7): six defects from the heid bug-hunt panel, and five vacuous falsifiers

Cross-frontier panel (Gróa/Hulda/Regin/Kimi) on U7's diff, thread
01M368G2Y0JMTJ2T7M3JMTXV5Z. Four of the six fixes are for defects no test in
this repo could have caught, and the panel's guard-strength passes found five of
my own falsifiers green under the exact change they forbade.

THE 4-OF-4 FINDING — the group anchor could land on the WRONG artifact.
The anchor was the raw rel spliced into an href fragment while the tile id was
equally raw. A browser matches a fragment against ids RAW FIRST and only then
percent-decoded, so raw-on-both-sides is not merely unencoded, it is AMBIGUOUS:
with `a b.png` and `a%20b.png` in one booth, the first's href resolves to the
fragment `item-a%20b.png` and the raw pass matches the SECOND file's id. That is
the misfiled-judgment failure invariant 6 exists to prevent, arriving through a
path invariant 6 never looked at. Both sides now use `Item.url`
(`quote(rel, safe="/")`), which is injective here and is the convention
booth_flag has always used. The original test asserted the href occurred as SOME
id on the page — true while pointing at the wrong one.

GRÓA'S STRONGEST SOLO — a zero-hit filter removed the way back.
The rail was gated on the FILTERED list, so a valid filter with no matches
removed the rail, the filter links and the route back to `all`, while the
empty-booth branch announced the booth was empty with rail.total still holding
the real count. No recovery without editing the address bar, and it degraded the
same way with JavaScript off, on the surface the operator actually reviews on.
Gated on all_items now, with an explicit no-match row.

HULDA — one unrepresentable filename took out the INDEX, not just its booth.
A non-UTF-8 filename reaches CPython as a surrogate and quote() raises on it,
outside any per-item handler. booth_items feeds list_booths, so one 0xff byte in
one booth's filename 500s every booth's card. Such a file cannot be linked,
served or zipped, so it is skipped like a dotfile.

HULDA — the `f` shortcut has never worked. The selector named `.flagbtn`, which
nothing in this repo emits, so it fell through to the hidden target input;
clicking a hidden input does not submit its form, and the handler called
preventDefault anyway. Now clicks the flag form's real button, verified end to
end in a real browser.

GRÓA — a group jump was undone by the next keypress. The jump scrolls, the
cursor stayed at -1, and the next arrow focused tile 0 and scrolled back. The
cursor now picks up from the viewport, which also fixes the general
scroll-then-arrow case. Asserted on real scroll geometry in Chromium.

HULDA — the caption sidecar was read whole before being truncated, so a
pathological file was a MemoryError the OSError handler does not catch. Bounded
at the read, and deliberately NOT by st_size: a FIFO reports 0.

ACCEPTED KNOWN RISKS, both now documented rather than implied: no cap on rail
row count (1,000 groups of two would render 1,000 rows; the largest live booth
is 66 items and picking a cap without a booth that needs one is invented work),
and Item.group sits mid-dataclass (one construction site, keyword-only, grepped).
The docstring now names the UPPER median explicitly — two arms flagged that
"the middle group" admits both readings for an even count.

FIVE VACUOUS FALSIFIERS, found by the arms and not by me: the anchor test
survived v[0]->v[-1]; the informativeness guard survived sizes[-1]; the group
count survived len(v)+1; the zero-hit filter test used a fixture that HAD hits;
and the escaping test asserted over the whole page, so it went red on a code
comment. All rewritten, all mutation-proved. The table is up to 20 rows and one
drifted when I changed the line under it — reported by the harness, not silently
skipped, which is the behaviour tests/test_mutation_check.py exists to hold.

660 green; 20/20 proved. Deployed; 21/21 booths 200.

Held for design-dev, not fixed here: Gróa's finding that the sticky rail has no
scroll-margin, so a fragment jump tucks the target under it. It is one line in
base.html, the file he is rewriting from scratch.
This commit is contained in:
vh
2026-09-23 00:04:59 -07:00
parent 6042d10bf3
commit 397ea89795
7 changed files with 433 additions and 15 deletions
+29 -5
View File
@@ -1036,7 +1036,11 @@ def create_app(
insertion order, so walking `shown` once IS the rule.
⚠ THE RAIL IS ABSENT UNLESS GROUPING IS INFORMATIVE: two or more
groups, and the middle group holding more than one item. TWO
groups, and the UPPER MEDIAN group holding more than one item — for an
even count that is the larger of the two central sizes, so `[1, 2]`
renders and `[1, 1, 2]` does not. Named precisely because "the middle
group" admitted both readings and two panel arms flagged the ambiguity.
TWO
degeneracies, not one. The contract named only the first --
`sindra` and `sc-iso-spread` put every file in ONE group, and a rail
with a single row cannot navigate. The second is the one the live set
@@ -1051,13 +1055,33 @@ def create_app(
if it["group"] is not None:
by_group.setdefault(it["group"], []).append(it)
sizes = sorted(len(v) for v in by_group.values())
# `sizes[len(sizes) // 2]` is the UPPER median; the `< 2` term
# short-circuits, so the index is always valid. No upper bound on the
# ROW COUNT: 1,000 groups of two pass this and render a 1,000-row rail.
# Accepted known risk — the largest live booth is 66 items and picking
# a cap without a booth that needs one is the invented work the roadmap
# gate exists to prevent. Raised 2-of-4 by the panel, 2026-09-22.
if len(sizes) < 2 or sizes[len(sizes) // 2] <= 1:
return []
return [
# The anchor is the FIRST member's existing tile id. The template
# already stamps `id="item-<rel>"` on every figure; minting a
# parallel `#group-<key>` would be a second identity for one tile.
{"key": k, "n": len(v), "anchor": f"item-{v[0]['name']}"}
# THE ANCHOR IS BUILT FROM `url`, NOT `name`, and the template
# stamps the tile id from `url` too. Both sides must use the same
# percent-encoded string or the jump lands on the wrong artifact.
#
# A browser matches a fragment against ids RAW FIRST and only then
# percent-decoded, so a raw rel on both sides is not merely
# "unencoded" — it is AMBIGUOUS. With `a b.png` and `a%20b.png` in
# one booth, the first's href resolves to the fragment
# `item-a%20b.png` and the raw pass matches the SECOND file's id.
# `Item.url` is `quote(rel, safe="/")`, which is injective here
# (`a b` -> `a%20b`, `a%20b` -> `a%2520b`), and it is the convention
# `booth_flag` has always used for exactly this reason.
#
# Found 4-of-4 by the heid bug-hunt panel, 2026-09-22. The original
# anchor test could not see it: it asserted the href occurred as
# SOME id on the page, which stayed true while pointing at the wrong
# one.
{"key": k, "n": len(v), "anchor": f"item-{v[0]['url']}"}
for k, v in by_group.items()
]
+28 -2
View File
@@ -197,7 +197,18 @@ def _resolve_captions(by_rel: dict[str, Path]) -> tuple[dict[str, str], set[str]
if target is not None:
try:
caption[target] = p.read_text(errors="replace").strip()[:CAPTION_MAX]
# BOUNDED AT THE READ. `read_text()` pulled the whole sidecar
# into memory before the slice trimmed it, so a pathological
# file was a MemoryError — which the OSError handler below does
# not catch — rather than a missing caption.
#
# Deliberately NOT bounded by st_size: a FIFO reports 0 and a
# bound that trusts it inherits what it does not mean, which is
# the hang in persistent-memory.d/2026-09-22-size-cap-opened-a-hang.md.
# The factor of 4 is UTF-8's worst case, so CAPTION_MAX
# characters always survive the byte bound.
with p.open("r", errors="replace") as fh:
caption[target] = fh.read(CAPTION_MAX * 4).strip()[:CAPTION_MAX]
except OSError:
pass
sidecars.add(rel)
@@ -222,7 +233,22 @@ def booth_items(booth: Path) -> list[Item]:
continue
if is_ask_file(p.name) or is_answer_file(p.name):
continue
by_rel[p.relative_to(booth).as_posix()] = p
rel = p.relative_to(booth).as_posix()
try:
quote(rel, safe="/")
except UnicodeEncodeError:
# A non-UTF-8 filename reaches CPython as a surrogate escape, and
# `quote` raises on it. This used to happen at Item construction,
# OUTSIDE any per-item handler — so one 0xff byte in one filename
# took out that booth's page AND the index for every booth, because
# `list_booths` calls this too. The repo's posture is that a damaged
# file costs its own tile and never the page.
#
# Skipped rather than rescued: a name that cannot be percent-encoded
# cannot be linked, served or zipped either, so there is no item to
# render. Found by the heid bug-hunt panel (hulda), 2026-09-22.
continue
by_rel[rel] = p
caption, sidecars = _resolve_captions(by_rel)
blurred = read_blurred(booth) # ONE read per call, not one per item
+43 -7
View File
@@ -237,9 +237,19 @@
</form>
{% endif %}
{% if not items and not board and not marks %}
{# ⚠ THE RAIL IS GATED ON `all_items`, NOT `items`, AND THAT IS THE WHOLE
POINT. `items` is the FILTERED list, so gating on it meant a valid filter
with zero hits removed the rail, the filter links and the only way back to
`all` — while the empty-booth branch below announced the booth was empty
with `rail.total` still holding the real count. No recovery without editing
the address bar, and it failed the same way with JavaScript off, on the
surface the operator actually reviews on.
Found by the heid bug-hunt panel (gróa, 2026-09-22), whose own note called
it the finding most likely to bite users this week. #}
{% if not all_items and not board and not marks %}
<div class="empty">This booth is empty.</div>
{% elif items %}
{% elif all_items %}
{# `elif items` and not a bare `else`: a board booth has NO gallery items (its
links.md is rendered as the board above and filtered out), so a plain else
would emit an empty <div class="gallery"> under the board. #}
@@ -276,6 +286,12 @@
</nav>
{% endif %}
</div>
{% if not items %}
{# An empty FILTER, not an empty booth. The rail above is still rendered, so
the way back to `all` is one click. #}
<div class="empty">No items match the <b>{{ filter }}</b> filter.
<a href="/b/{{ name_url }}/">show all {{ rail.total }}</a></div>
{% endif %}
<div class="gallery" id="grid" tabindex="-1">
{% for it in items %}
{% if it.doc and it.rendered is not none %}
@@ -283,7 +299,7 @@
separate page. <details open> is native collapse (works with JS off);
the ✕ hides the item for the session (JS, progressive enhancement).
The item spans the full grid width so prose has room to read. #}
<figure class="item item-doc{% if it.blurred %} blurred{% endif %}" data-name="{{ it.name }}" data-item="{{ it.name }}" id="item-{{ it.name }}">
<figure class="item item-doc{% if it.blurred %} blurred{% endif %}" data-name="{{ it.name }}" data-item="{{ it.name }}" id="item-{{ it.url }}">
{% if it.blurred %}
{# Inline docs need this MORE than images, not less: a rendered doc puts
its text straight on the page, so "blur the picture" logic that skips
@@ -316,7 +332,7 @@
</details>
</figure>
{% else %}
<figure class="item item-{{ it.kind }}{% if it.blurred %} blurred{% endif %}{% if item_marks.get(it.name, []) | selectattr('shape', 'equalto', 'flag') | list %} is-flagged{% endif %}" data-item="{{ it.name }}" id="item-{{ it.name }}">
<figure class="item item-{{ it.kind }}{% if it.blurred %} blurred{% endif %}{% if item_marks.get(it.name, []) | selectattr('shape', 'equalto', 'flag') | list %} is-flagged{% endif %}" data-item="{{ it.name }}" id="item-{{ it.url }}">
{% if it.blurred %}
{# Click-to-reveal is per-viewer and client-side: nothing is persisted, so
a reload re-hides it. No-JS degrades to STAYS BLURRED, which is the
@@ -386,6 +402,22 @@
t[at].scrollIntoView({ block: 'nearest' });
}
function current() { var t = tiles(); return at >= 0 && at < t.length ? t[at] : null; }
/* WHERE THE CURSOR STARTS WHEN THERE ISN'T ONE. Starting at tile 0
unconditionally meant the first arrow key after ANY scroll yanked the
viewport back to the top — and a group jump is a scroll, so `→` right
after a jump silently undid it. Found by the heid bug-hunt panel (gróa),
2026-09-22; the general scroll-then-arrow case is the same defect.
The first tile whose bottom edge clears the sticky rail is the one the
reader is looking at, so that is where the cursor picks up. */
function fromViewport() {
var t = tiles(), rail = document.querySelector('.rail');
var top = rail ? rail.getBoundingClientRect().bottom : 0;
for (var i = 0; i < t.length; i++) {
if (t[i].getBoundingClientRect().bottom > top) return i;
}
return 0;
}
function click(sel) {
var el = current(); if (!el) return;
var b = el.querySelector(sel); if (b) b.click();
@@ -396,9 +428,13 @@
if (tag === 'input' || tag === 'textarea' || e.target.isContentEditable) return;
if (e.metaKey || e.ctrlKey || e.altKey) return;
switch (e.key) {
case 'ArrowRight': focus(at + 1); e.preventDefault(); break;
case 'ArrowLeft': focus(at <= 0 ? 0 : at - 1); e.preventDefault(); break;
case 'f': click('.flagbtn, [name="target"]'); e.preventDefault(); break;
case 'ArrowRight': focus(at < 0 ? fromViewport() : at + 1); e.preventDefault(); break;
case 'ArrowLeft': focus(at < 0 ? fromViewport() : at - 1); e.preventDefault(); break;
/* `.flagbtn` never existed in this repo, so this fell through to the
HIDDEN target input — and clicking a hidden input does not submit its
form. `f` has never worked, while still swallowing the keystroke.
Found by the heid bug-hunt panel (hulda), 2026-09-22. */
case 'f': click('.flagtoggle button'); e.preventDefault(); break;
case 'n': var el = current();
if (el) { var f = el.querySelector('input[type=text], textarea');
if (f) { f.focus(); e.preventDefault(); } }