vh/booth
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix(asks): one submit saves every ask on the page

Browse Source 
Operator report (via infra-ops): on a page with several asks, a submit
saved only the pressed one and the reload wiped the rest. Confirmed on
auk-audition: one POST at 15:02:23 saved the last ask on the page, then a
400 from the submit of an ask the reload had just blanked.

Client-side on both surfaces; /answer is unchanged. A submit on a pick
form, while another pick form on the page holds unsent input, sends every
changed ("dirty") pick form: one POST each, to its own action, with
Accept: application/json, in document order. A refusal stops nothing, and
untouched forms are never re-sent. With no other dirty form, a submit is
exactly what it was.

- embed.js (verbatim reports): reloads only when nothing was refused and
  nothing of ours is dirty. Otherwise a server-rendered status line in the
  submit block says what did not save, and input stays. A form the server
  took gets a new baseline. A press during the flight is ignored.
- base.html (marks page, lightbox, review rail): one refresh in place. A
  batch never reloads. Only forms the server took count as sent. In-flight
  state and "just sent" are keyed by form identity (formKey) plus the fields
  at the press, not the DOM node.

Two heid bug-hunt rounds: a four-arm panel on the first cut, then Hulda
alone on the fold. Ten findings reproduced red in a browser before their
fixes. Contracts: U3 "Submitting several asks at once" + INV-8, R2 C3
steps 2, 3 and 3a. Mutation tables u3_submit_all (15) and r2_submit_all
(11), all proved. Suite 928 -> 951.
This commit is contained in:
vh
2026-09-27 17:05:11 -07:00
parent 34ac1683ee
commit 50bfc7b4ec
12 changed files with 1496 additions and 35 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/contracts/u3_declared_embed_seam.contract.md
+106
View File
@@ -235,6 +235,86 @@ It is three lines, it costs nothing, and the sensitivity floor of that probe is
guards against is a form the operator fills in whose controls reach no form,
so the button does nothing.
## Submitting several asks at once (amended 2026-09-27)
**The defect.** One pick is one `<form>` is one POST to `/answer`, and that
POST 303s back to the page. On a report carrying several picks, a submit sent
exactly ONE of them, and the reload that followed wiped every pick the operator
had made in the others. His report, relayed by infra-ops: *"I go through, submit
a question and it only submits the last one and clears out the top ones."*
Confirmed against the live `auk-audition` booth (three single-question picks,
no anchors, so all three in the tail) before any code: the access log shows one
POST at 15:02:23 that saved the LAST pick on the page, the reload, then a 400
four seconds later — the submit of a pick the reload had just blanked — and the
other two re-answered one at a time. **The server is not the defect**: every
POST did exactly what `/answer` promises. The page gave him one button per
form and no way to send them together.
**The rule.** embed.js listens for `submit` on the forms IT mounted (never an
author's form). A form is **dirty** when any control it owns — `form.elements`,
which includes every control bound to it by `form=` wherever it sits — differs
from its server-rendered default: a radio or checkbox whose `checked` differs
from `defaultChecked`, a textarea or text input whose `value` differs from
`defaultValue`.
```
submit on one of our forms F:
a batch is in flight -> preventDefault; nothing else (never the
browser's POST racing the batch)
no OTHER of our forms is dirty -> do nothing; the browser's own POST and 303,
exactly as before this amendment
otherwise -> preventDefault, and send EVERY dirty form of
ours, F included only if F is dirty
send: one POST per form, to that form's own action, carrying that form's own
FormData read AT THE PRESS, with `Accept: application/json` (the
route's 204, r2 C3), one after another, in DOCUMENT ORDER of the <form>
elements. A refused form does not stop the ones after it. A form the
server took (204) gets a new baseline: what it sent. From then on it is
dirty only if it differs from THAT.
then: no refusal AND nothing -> reload the page (a GET), so what shows is
of ours is dirty the server's record
otherwise -> NO reload. The pressed form's submit block
(a refusal, or a change says how many saved and what did not, with
made during the flight) the server's reason, and everything the
operator entered stays on the page.
A refusal blocks the reload ON ITS OWN: a refused form set back to its
first value reads clean, and "nothing dirty" alone reloaded over it.
```
Five consequences, each deliberate:
- **A blank pick is skipped, never refused.** A pick with nothing entered is not
dirty and is not sent, so pressing its button no longer produces the 400 page
the log shows. Blanks stay legal, as `build_answer` has held since 2026-09-09.
- **A pick nobody touched is not re-sent — including the one whose button was
pressed, and including one this page already saved.** Re-sending an answer
re-dates it, and a reading session would see a fresh answer that nobody gave.
The moved baseline is what keeps a retry after a partial refusal to exactly
the picks that did not save; it also means correcting a saved pick back to
its first-rendered value counts as a change and is sent.
- **One refused pick costs only itself.** A pick withdrawn or re-declared while
the page was open is refused (404 / 400); the rest are saved regardless. This
is the partial-answer ruling's reasoning applied one level up: refusing
everything because one was stale throws away the ones that were made.
- **The page is reloaded only when nothing would be lost by it.** The page
stays live while the batch is in flight; a pick made or a note typed in that
window is unsaved input, and a reload would clear it — the exact loss this
amendment exists to stop. So the reload waits on "every POST succeeded" AND
"nothing of ours is dirty" — each on its own. The saved picks' tags stay stale until he
reloads, and the message says so. Nothing is ever re-sent without a fresh
press; a press after a lost response may re-send (and re-date) a pick that
did land, which is the price of never retrying on our own.
- **A press during the flight is ignored.** Checked before anything else, so a
press on a form with no other dirty form beside it cannot fall through to the
browser's POST while the batch runs.
**What it does not change.** `/answer`, its fields, its 204 and its 303 are
untouched: the server has no batch endpoint and no new request shape. A page
whose only dirty form is the pressed one gets the plain form submission,
byte-identical to before. The status line is server-rendered, empty and
`hidden` in the `submit` macro; the script only sets its text, so embed.js
still renders no markup of an ask.
**Step 5 deletes an element.** Today `inject_asks` injects `<a id="bk-ask-<id>-top">`
before the first fragment of each pick so the chip has somewhere to jump. The
fragments already carry ids; document order in a live DOM is directly queryable;
@@ -336,6 +416,32 @@ rather than strict.
and `test_partially_marked_page_still_shows_every_question` fails in the browser
with 2 of 4 radio groups present.
**INV-8 — One submit saves every pick on the page the operator changed
(amended 2026-09-27).** Per "Submitting several asks at once": every dirty form
of ours is sent, in document order; a clean one never is, nor a saved one
again; a refused one stops nothing; the page reloads only when nothing was
refused and nothing of ours is left unsaved; a press during the flight is ignored; and with no other dirty
form the submit is the browser's own.
*Falsifiable*, one change per clause, each in `tests/mutations/u3_submit_all.toml`:
send only the pressed form and
`test_one_submit_saves_every_answered_ask_on_the_page` fails; send the pressed
form whether or not it is dirty and `test_a_blank_ask_is_skipped_never_refused`
fails; send every form regardless and `test_an_ask_nobody_touched_is_not_re_sent`
fails; intercept a lone dirty form and `test_one_changed_ask_still_submits_as_a_plain_form`
fails; send in reverse and `test_the_asks_are_sent_in_document_order` fails;
stop at the first refusal, reload on one, or never show the status line, and
`test_a_refused_ask_costs_only_itself_and_clears_nothing` fails; listen to every
form on the page, or trust our id prefix without the mounted-root check, and
`test_an_authors_own_form_is_never_taken_over` fails; let a press in flight fall
through and `test_a_press_inside_the_flight_never_fires_a_native_post` fails;
reload when every POST succeeded regardless of what changed meanwhile and
`test_input_made_during_the_flight_is_kept_and_saved_on_the_next_press` fails;
leave a saved form's baseline where it was and
`test_a_retry_after_a_refusal_sends_only_what_did_not_save` fails; drop the
class-level `[hidden]` rule and `test_the_empty_status_line_stays_hidden_under_host_css`
fails; let "nothing dirty" alone decide the reload and
`test_a_refusal_blocks_the_reload_even_when_nothing_reads_dirty` fails.
## Out of scope (deferred or never)
Named so a reviewer does not read them as drift.