fix(u7): six defects from the heid bug-hunt panel, and five vacuous falsifiers

Cross-frontier panel (Gróa/Hulda/Regin/Kimi) on U7's diff, thread
01M368G2Y0JMTJ2T7M3JMTXV5Z. Four of the six fixes are for defects no test in
this repo could have caught, and the panel's guard-strength passes found five of
my own falsifiers green under the exact change they forbade.

THE 4-OF-4 FINDING — the group anchor could land on the WRONG artifact.
The anchor was the raw rel spliced into an href fragment while the tile id was
equally raw. A browser matches a fragment against ids RAW FIRST and only then
percent-decoded, so raw-on-both-sides is not merely unencoded, it is AMBIGUOUS:
with `a b.png` and `a%20b.png` in one booth, the first's href resolves to the
fragment `item-a%20b.png` and the raw pass matches the SECOND file's id. That is
the misfiled-judgment failure invariant 6 exists to prevent, arriving through a
path invariant 6 never looked at. Both sides now use `Item.url`
(`quote(rel, safe="/")`), which is injective here and is the convention
booth_flag has always used. The original test asserted the href occurred as SOME
id on the page — true while pointing at the wrong one.

GRÓA'S STRONGEST SOLO — a zero-hit filter removed the way back.
The rail was gated on the FILTERED list, so a valid filter with no matches
removed the rail, the filter links and the route back to `all`, while the
empty-booth branch announced the booth was empty with rail.total still holding
the real count. No recovery without editing the address bar, and it degraded the
same way with JavaScript off, on the surface the operator actually reviews on.
Gated on all_items now, with an explicit no-match row.

HULDA — one unrepresentable filename took out the INDEX, not just its booth.
A non-UTF-8 filename reaches CPython as a surrogate and quote() raises on it,
outside any per-item handler. booth_items feeds list_booths, so one 0xff byte in
one booth's filename 500s every booth's card. Such a file cannot be linked,
served or zipped, so it is skipped like a dotfile.

HULDA — the `f` shortcut has never worked. The selector named `.flagbtn`, which
nothing in this repo emits, so it fell through to the hidden target input;
clicking a hidden input does not submit its form, and the handler called
preventDefault anyway. Now clicks the flag form's real button, verified end to
end in a real browser.

GRÓA — a group jump was undone by the next keypress. The jump scrolls, the
cursor stayed at -1, and the next arrow focused tile 0 and scrolled back. The
cursor now picks up from the viewport, which also fixes the general
scroll-then-arrow case. Asserted on real scroll geometry in Chromium.

HULDA — the caption sidecar was read whole before being truncated, so a
pathological file was a MemoryError the OSError handler does not catch. Bounded
at the read, and deliberately NOT by st_size: a FIFO reports 0.

ACCEPTED KNOWN RISKS, both now documented rather than implied: no cap on rail
row count (1,000 groups of two would render 1,000 rows; the largest live booth
is 66 items and picking a cap without a booth that needs one is invented work),
and Item.group sits mid-dataclass (one construction site, keyword-only, grepped).
The docstring now names the UPPER median explicitly — two arms flagged that
"the middle group" admits both readings for an even count.

FIVE VACUOUS FALSIFIERS, found by the arms and not by me: the anchor test
survived v[0]->v[-1]; the informativeness guard survived sizes[-1]; the group
count survived len(v)+1; the zero-hit filter test used a fixture that HAD hits;
and the escaping test asserted over the whole page, so it went red on a code
comment. All rewritten, all mutation-proved. The table is up to 20 rows and one
drifted when I changed the line under it — reported by the harness, not silently
skipped, which is the behaviour tests/test_mutation_check.py exists to hold.

660 green; 20/20 proved. Deployed; 21/21 booths 200.

Held for design-dev, not fixed here: Gróa's finding that the sticky rail has no
scroll-margin, so a fragment jump tucks the target under it. It is one line in
base.html, the file he is rewriting from scratch.

tests/mutations/u7_navigation.toml

@@ -47,7 +47,7 @@ label = "the anchor names the group key instead of the tile id"
 file = "booth/app.py"
 test = "tests/test_navigation.py::test_every_group_anchor_lands_on_a_rendered_tile"
 old = '''
-{"key": k, "n": len(v), "anchor": f"item-{v[0]['name']}"}'''
+{"key": k, "n": len(v), "anchor": f"item-{v[0]['url']}"}'''
 new = '''
 {"key": k, "n": len(v), "anchor": f"group-{k}"}'''
 
@@ -118,3 +118,79 @@ old = '''
     {% if rail.groups %}'''
 new = '''
     {% if rail.groups is not none %}'''
+
+[[mutation]]
+label = "the anchor is built from the raw name instead of the encoded url"
+file = "booth/app.py"
+test = "tests/test_navigation.py::test_a_group_anchor_survives_a_filename_that_percent_decodes"
+old = '''
+{"key": k, "n": len(v), "anchor": f"item-{v[0]['url']}"}'''
+new = '''
+{"key": k, "n": len(v), "anchor": f"item-{v[0]['name']}"}'''
+
+[[mutation]]
+label = "the anchor names the LAST member instead of the first"
+file = "booth/app.py"
+test = "tests/test_navigation.py::test_a_group_anchor_names_the_FIRST_member"
+old = '''
+{"key": k, "n": len(v), "anchor": f"item-{v[0]['url']}"}'''
+new = '''
+{"key": k, "n": len(v), "anchor": f"item-{v[-1]['url']}"}'''
+
+[[mutation]]
+label = "a group row over-reports its own size"
+file = "booth/app.py"
+test = "tests/test_navigation.py::test_a_group_row_reports_its_own_size"
+old = '''
+{"key": k, "n": len(v), "anchor": f"item-{v[0]['url']}"}'''
+new = '''
+{"key": k, "n": len(v) + 1, "anchor": f"item-{v[0]['url']}"}'''
+
+[[mutation]]
+label = "the informativeness guard reads the LARGEST group, not the middle"
+file = "booth/app.py"
+test = "tests/test_navigation.py::test_the_informativeness_guard_reads_the_middle_not_the_largest"
+old = '''
+if len(sizes) < 2 or sizes[len(sizes) // 2] <= 1:'''
+new = '''
+if len(sizes) < 2 or sizes[-1] <= 1:'''
+
+[[mutation]]
+label = "the rail is gated on the FILTERED list, removing the way back"
+file = "booth/templates/booth.html"
+test = "tests/test_navigation.py::test_a_filter_that_matches_nothing_leaves_a_way_back"
+old = '''
+{% elif all_items %}'''
+new = '''
+{% elif items %}'''
+
+[[mutation]]
+label = "the keyboard flag selector names a class nothing emits"
+file = "booth/templates/booth.html"
+test = "tests/test_navigation.py::test_the_keyboard_flag_targets_a_real_button"
+old = '''
+case 'f': click('.flagtoggle button');'''
+new = '''
+case 'f': click('.flagbtn, [name="target"]');'''
+
+[[mutation]]
+label = "an unrepresentable filename is let through and 500s the booth"
+file = "booth/items.py"
+test = "tests/test_items.py::test_one_unrepresentable_filename_costs_its_own_tile_not_the_booth"
+old = '''
+        try:
+            quote(rel, safe="/")
+        except UnicodeEncodeError:'''
+new = '''
+        try:
+            pass
+        except UnicodeEncodeError:'''
+
+[[mutation]]
+label = "the grid cursor starts at tile 0, so an arrow undoes a group jump"
+file = "booth/templates/booth.html"
+test = "tests/test_embed_browser.py::test_an_arrow_after_a_group_jump_does_not_scroll_back"
+old = '''
+case 'ArrowRight': focus(at < 0 ? fromViewport() : at + 1);'''
+new = '''
+case 'ArrowRight': focus(at + 1);'''

tests/test_embed_browser.py

@@ -69,6 +69,7 @@ def live(tmp_path):
         thread.join(timeout=10)
 
 
+PNG = b"\x89PNG\r\n\x1a\n"
 SEAM = '<script src="/_booth/embed.js" defer></script>'
 
 
@@ -537,3 +538,71 @@ def test_the_chip_follows_a_payload_that_disagrees_with_the_fragments(browser, l
     page.wait_for_selector(".booth-nav-asks")
     assert page.locator(".booth-nav-asks").inner_text() == "? 2 open asks"
     page.close()
+
+
+# --- the grid keyboard, which is the OTHER thing no string assertion sees ----
+# Added 2026-09-22 after the heid bug-hunt panel found a defect whose entire
+# expression is viewport geometry: a group jump moves the scroll position, the
+# keyboard cursor does not know, and the next arrow key scrolls back.
+
+
+def _gallery(root, name="g"):
+    """Enough tiles that the grid must scroll, in two groups."""
+    b = root / name
+    b.mkdir()
+    for i in range(1, 13):
+        (b / f"aa{i:02d}.png").write_bytes(PNG)
+    for i in range(1, 13):
+        (b / f"zz{i:02d}.png").write_bytes(PNG)
+    return b
+
+
+def test_an_arrow_after_a_group_jump_does_not_scroll_back(browser, live):
+    """GRÓA's solo. The jump scrolled the viewport but left the cursor at -1,
+    so the next ArrowRight focused tile 0 and `scrollIntoView` yanked the page
+    back to the top — silently reversing the jump the operator just made.
+
+    The whole failure is geometry, so it is asserted on geometry: scroll
+    position after the arrow must stay near where the jump landed, not return
+    to the top. Defeating change: `focus(at + 1)` with `at` starting at -1."""
+    base, root = live
+    _gallery(root)
+    page = browser.new_page()
+    page.set_viewport_size({"width": 900, "height": 600})
+    page.goto(f"{base}/b/g/", wait_until="networkidle")
+
+    page.click('.rail-g[data-group="zz"]')
+    page.wait_for_timeout(250)
+    after_jump = page.evaluate("window.scrollY")
+    assert after_jump > 0, "the group jump did not scroll at all"
+
+    page.keyboard.press("ArrowRight")
+    page.wait_for_timeout(250)
+    after_key = page.evaluate("window.scrollY")
+    page.close()
+
+    assert after_key > after_jump / 2, (
+        f"the arrow key undid the jump: scrollY {after_jump} -> {after_key}"
+    )
+
+
+def test_the_keyboard_flag_actually_submits(browser, live):
+    """HULDA's solo. `f` selected `.flagbtn, [name="target"]`; nothing in this
+    repo emits `.flagbtn`, so it clicked the HIDDEN target input — and clicking
+    a hidden input does not submit its form. The shortcut never worked while
+    still swallowing the keystroke.
+
+    Asserted end to end: press f, and the flag must come back from the server
+    on the reloaded page."""
+    base, root = live
+    _gallery(root)
+    page = browser.new_page()
+    page.goto(f"{base}/b/g/", wait_until="networkidle")
+
+    page.keyboard.press("ArrowRight")   # cursor onto the first tile
+    with page.expect_navigation():      # the flag form POSTs and redirects back
+        page.keyboard.press("f")
+    flagged = page.locator("figure.item.is-flagged").count()
+    page.close()
+
+    assert flagged == 1, f"the f key flagged {flagged} items, expected 1"

tests/test_items.py

@@ -13,6 +13,7 @@ from fastapi.testclient import TestClient
 
 from booth.app import build_gallery, create_app, list_booths
 from booth.items import (
+    CAPTION_MAX,
     Item,
     booth_items,
     find_item,
@@ -316,3 +317,42 @@ def test_booth_items_carries_the_group(tmp_path):
     _touch(b / "99.png")
     got = {it.rel: it.group for it in booth_items(b)}
     assert got == {"ac01.png": "ac", "ac02.png": "ac", "99.png": None}
+
+
+def test_one_unrepresentable_filename_costs_its_own_tile_not_the_booth(tmp_path):
+    """HULDA, and it is worse than the bundle could see: `quote()` raises
+    UnicodeEncodeError on a surrogate from a non-UTF-8 filename, and
+    `booth_items` feeds `list_booths` — so ONE 0xff byte in ONE booth's
+    filename took out the INDEX for every booth, not just its own page.
+
+    The repo's standing posture is that a damaged file costs its own tile and
+    never the page. A file whose name cannot be percent-encoded cannot be
+    linked or served either, so it cannot be an item.
+
+    Defeating change: dropping the guard — this raises before it renders."""
+    import os
+
+    b = tmp_path / "b"
+    b.mkdir()
+    (b / "ok.png").write_bytes(b"\x89PNG")
+    (b / os.fsdecode(b"bad\xff.png")).write_bytes(b"\x89PNG")
+
+    got = booth_items(b)
+    assert [it.rel for it in got] == ["ok.png"]
+
+
+def test_a_huge_caption_sidecar_is_not_read_whole(tmp_path):
+    """HULDA: `read_text()` pulled the entire sidecar into memory before
+    `[:CAPTION_MAX]` trimmed it, and the handler catches only OSError — so a
+    pathological sidecar is a MemoryError, not a missing caption.
+
+    Bounded at the READ. Deliberately NOT bounded by st_size: a FIFO reports
+    st_size 0 and a bound that trusts it inherits what it does not mean —
+    persistent-memory.d/2026-09-22-size-cap-opened-a-hang.md."""
+    b = tmp_path / "b"
+    b.mkdir()
+    (b / "a.png").write_bytes(b"\x89PNG")
+    (b / "a.txt").write_text("x" * (CAPTION_MAX * 50))
+
+    cap = {it.rel: it.caption for it in booth_items(b)}["a.png"]
+    assert cap is not None and len(cap) <= CAPTION_MAX

tests/test_navigation.py

@@ -402,3 +402,150 @@ def test_a_group_key_is_never_the_empty_string(tmp_path):
     body = c.get("/b/g/").text
     assert 'data-group=""' not in body
     assert "" not in _groups(body)
+
+
+# --- from the heid bug-hunt panel, 2026-09-22 -----------------------------
+# 4-of-4 convergence on the anchor, two strong solos from Gróa, and three of
+# this file's own falsifiers shown vacuous by the arms' guard-strength passes.
+
+
+def test_a_group_anchor_survives_a_filename_that_percent_decodes(tmp_path):
+    """THE 4-OF-4 FINDING. The anchor was the RAW rel spliced into an href
+    fragment with no percent-encoding, while the tile id was equally raw.
+
+    A browser matches a fragment against ids RAW FIRST, then percent-decoded —
+    so the failure is not "goes nowhere", it is worse: with both `a b.png` and
+    `a%20b.png` in one booth, the first's href resolves to the fragment
+    `item-a%20b.png` and the raw pass matches the SECOND file's id. The jump
+    lands on the wrong artifact, which is the misfiled-judgment failure
+    invariant 6 exists to prevent, arriving through a path invariant 6 never
+    looked at.
+
+    Both sides now use the already-percent-encoded `Item.url`, which is
+    injective (`a b` -> `a%20b`, `a%20b` -> `a%2520b`) and is the convention
+    `booth_flag` has always used. Defeating change: building either side from
+    `name`."""
+    b = tmp_path / "g"
+    b.mkdir()
+    for n in ("a b-1.png", "a b-2.png", "a%20b-1.png", "a%20b-2.png"):
+        (b / n).write_bytes(PNG)
+    c = TestClient(create_app(tmp_path, ttl_hours=24, start_sweeper=False))
+    body = c.get("/b/g/").text
+
+    import re
+    hrefs = re.findall(r'class="rail-g"[^>]*href="#([^"]+)"', body, re.S)
+    assert len(hrefs) == 2, f"expected two groups, got {hrefs}"
+    # Every anchor names an id that exists AND no two anchors collide.
+    assert len(set(hrefs)) == len(hrefs), f"two groups share one anchor: {hrefs}"
+    for h in hrefs:
+        assert f'id="{h}"' in body, f"anchor #{h} names no element"
+    # and the raw form must NOT appear as an id, or the raw-first match steals it
+    assert 'id="item-a b-1.png"' not in body
+
+
+def test_a_group_anchor_names_the_FIRST_member(grouped):
+    """GRÓA + HULDA + REGIN all found the same hole independently: the original
+    anchor test only checked the href occurred as SOME id on the page, so a
+    `v[0]` -> `v[-1]` mutation survived it completely. Three arms, one gap,
+    and my own mutation table had no row for it — the fifth vacuous falsifier
+    of the day.
+
+    `a/x1.png` and `b/x2.png` are group x; the anchor must be the first."""
+    import re
+    c, _ = grouped
+    body = c.get("/b/g/").text
+    got = dict(re.findall(r'class="rail-g" data-group="([^"]+)"\s*\n?\s*href="#item-([^"]+)"', body))
+    assert got == {"x": "a/x1.png", "y": "a/y1.png"}, got
+
+
+def test_a_group_row_reports_its_own_size(grouped):
+    """HULDA's guard table: `len(v)` -> `len(v) + 1` survived every assertion.
+    The counts were rendered and never checked."""
+    import re
+    c, _ = grouped
+    body = c.get("/b/g/").text
+    counts = re.findall(r'class="rail-g"[^>]*>\s*(\S+)\s*<b>(\d+)</b>', body, re.S)
+    assert dict((k, int(v)) for k, v in counts) == {"x": 2, "y": 2}
+
+
+def test_the_informativeness_guard_reads_the_middle_not_the_largest(tmp_path):
+    """HULDA's guard table: `sizes[len(sizes)//2]` -> `sizes[-1]` survived,
+    because no fixture distinguished the middle group from the biggest one.
+
+    Three singletons and one group of four: the largest is 4, the upper median
+    is 1. The rail must be ABSENT — a rail whose rows are three-quarters
+    single tiles is the second-copy-of-the-grid degeneracy."""
+    b = tmp_path / "g"
+    b.mkdir()
+    for n in ("p1.png", "q1.png", "r1.png",
+              "z1.png", "z2.png", "z3.png", "z4.png"):
+        (b / n).write_bytes(PNG)
+    c = TestClient(create_app(tmp_path, ttl_hours=24, start_sweeper=False))
+    assert 'class="rail-groups"' not in c.get("/b/g/").text
+
+
+def test_a_filter_that_matches_nothing_leaves_a_way_back(tmp_path):
+    """GRÓA's strongest solo, and in her words the finding most likely to bite
+    users this week.
+
+    `{% elif items %}` gated the ENTIRE rail on the FILTERED list, so a valid
+    filter with zero hits removed the rail, the filter links, and the way back
+    to `all` — and the empty-booth branch then announced the booth was empty
+    while `rail.total` held the real count. No recovery without editing the
+    address bar, and it degraded the same way with JavaScript off.
+
+    ⚠ THE FIXTURE MUST ACTUALLY HAVE NO HITS. The first version of this test
+    used the shared `gallery` fixture, which carries one of each mark — so
+    `?filter=flagged` returned one tile and the test passed without ever
+    reaching the state it names. Four unmarked images; every filter but `all`
+    is empty.
+
+    Defeating change: gating the rail on `items` instead of `all_items`."""
+    b = tmp_path / "g"
+    b.mkdir()
+    for n in ("a.png", "b.png", "c.png", "d.png"):
+        (b / n).write_bytes(PNG)
+    c = TestClient(create_app(tmp_path, ttl_hours=24, start_sweeper=False))
+
+    for flt in ("flagged", "annotated", "unanswered"):
+        body = c.get(f"/b/g/?filter={flt}").text
+        assert _tiles(body) == [], flt
+        assert 'class="rail"' in body, f"{flt}: the rail vanished with the filtered list"
+        assert 'href="/b/g/"' in body, f"{flt}: no way back to `all`"
+        assert "This booth is empty" not in body, f"{flt}: an empty FILTER is not an empty booth"
+        assert "4 items" in body, f"{flt}: the rail must still report the real total"
+
+
+def test_an_empty_booth_still_says_it_is_empty(tmp_path):
+    """The negative control for the test above: the empty-booth message must
+    survive the fix that stops a filter from triggering it."""
+    b = tmp_path / "hollow"
+    b.mkdir()
+    c = TestClient(create_app(tmp_path, ttl_hours=24, start_sweeper=False))
+    body = c.get("/b/hollow/").text
+    assert "This booth is empty" in body
+    assert 'class="rail"' not in body
+
+
+def test_the_keyboard_flag_targets_a_real_button(gallery):
+    """HULDA: the `f` handler selected `.flagbtn, [name="target"]`. No element
+    in this repo has ever had class `flagbtn`, so it fell through to the HIDDEN
+    target input — and clicking a hidden input does not submit its form. The
+    shortcut has never worked, while still calling preventDefault and
+    swallowing the keystroke.
+
+    Asserted against the markup the macro actually emits."""
+    import re
+    c, _ = gallery
+    body = c.get("/b/g/").text
+    assert 'class="flagtoggle' in body, "the flag form is not what this thinks"
+
+    # THE SELECTOR ITSELF, not the whole page — the first version asserted
+    # `"flagbtn" not in body` and went red on the code COMMENT explaining the
+    # bug. An assertion that cannot tell markup from prose about markup is not
+    # asserting about markup.
+    sel = re.search(r"case 'f': click\((.*?)\);", body)
+    assert sel, "the `f` handler is gone"
+    assert "flagbtn" not in sel.group(1), "the selector names a class nothing emits"
+    assert ".flagtoggle button" in sel.group(1), \
+        "the key handler must click the flag form's real submit button"