fix(desk): the heid bug-hunt panel on the row controls (round "Slate", 4/4)

- Touch: on a coarse pointer every row control is at least 28px square
  again (32px), and wipe stands clear of the zip link. The move onto the
  facts line had dropped the deliberate 28px floor to ~21px, 4-6px from
  zip; with scripts off no confirm fires, so a mis-tap on wipe is the
  delete. The zip link no longer breaks between its glyph and its word,
  and each separator is glued to the item after it.
- The wipe dialog shows the name as it should be read: control and bidi
  formatting characters in an agent-made name show as U+FFFD, so U+202E
  or a newline cannot rewrite what the operator approves. An unknown
  data-confirm word now prompts generically instead of submitting
  unguarded (fail closed).
- No page scrolls sideways: `code` wraps anywhere, so a long unbreakable
  install path in the footer or the empty Desk no longer widens every
  page. The overflow test now sweeps 390/720/850/1000/1400 with the
  heaviest row the Desk draws, and compares scrollWidth with the page's
  own clientWidth.

Its first fixture used a hyphenated path, which wrapped by itself; the
test passed with the bug present until the path became one unbreakable
run. r2_flow.toml: 27/27 proved. 749 passed.

tests/test_flow_browser.py

@@ -6,6 +6,7 @@ that a failure never re-POSTs. So: a real uvicorn, a real Chromium — the same
 harness as test_embed_browser.py, and like it this SKIPS, never fails, when no
 browser is available.
 """
+import contextlib
 import pathlib
 import socket
 import sys
@@ -34,15 +35,18 @@ def browser():
         b.close()
 
 
-@pytest.fixture
-def live(tmp_path):
+@contextlib.contextmanager
+def _serving(data_dir: pathlib.Path):
+    """A real uvicorn on a free port over `data_dir`. A context manager rather
+    than only a fixture, so a test can serve from a data dir of its own shape
+    (a long install path, say)."""
     import uvicorn
 
     sock = socket.socket()
     sock.bind(("127.0.0.1", 0))
     port = sock.getsockname()[1]
     sock.close()
-    app = create_app(tmp_path, ttl_hours=24, start_sweeper=False)
+    app = create_app(data_dir, ttl_hours=24, start_sweeper=False)
     server = uvicorn.Server(uvicorn.Config(app, host="127.0.0.1", port=port, log_level="error"))
     thread = threading.Thread(target=server.run, daemon=True)
     thread.start()
@@ -52,12 +56,18 @@ def live(tmp_path):
     if not server.started:
         pytest.skip("uvicorn did not come up")
     try:
-        yield f"http://127.0.0.1:{port}", tmp_path
+        yield f"http://127.0.0.1:{port}"
     finally:
         server.should_exit = True
         thread.join(timeout=10)
 
 
+@pytest.fixture
+def live(tmp_path):
+    with _serving(tmp_path) as base:
+        yield base, tmp_path
+
+
 def _set(root: pathlib.Path, n: int = 30) -> pathlib.Path:
     b = root / "g"
     b.mkdir()
@@ -413,22 +423,117 @@ def test_a_rows_keep_release_and_wipe_take_no_room_of_their_own(browser, live):
     assert gaps and max(gaps) <= 14, gaps
 
 
-def test_the_desk_never_scrolls_sideways_on_a_phone(browser, live):
+def test_the_desk_never_scrolls_sideways_at_any_width(browser, tmp_path):
     """The row-controls change made a Desk row a flex container, and a long
     provenance line (nowrap, ellipsised) then set the Desk column's MINIMUM
     width: at 390px the page scrolled sideways to 1029px. The column is capped
-    at the space it has; the ellipsis does the rest."""
+    at the space it has; the ellipsis does the rest.
+
+    Slate (heid bug-hunt) widened it three ways: the invariant is PAGE-level,
+    so a long install path — printed in the footer and the empty state — must
+    wrap too (groa); the widths between the two first tested (700-1000px, a
+    non-wrapping flex line) are swept with the heaviest row the Desk draws
+    (regin); and the page is compared with its OWN client width, never the
+    viewport's, which a vertical scrollbar would make a false failure (kimi)."""
     from booth.manifest import write_manifest
+    from booth.marks import declare_pick, set_flag
+    # ONE unbreakable run: a hyphen or a slash is a line-break opportunity, and
+    # the first draft of this fixture ("a-very-long-install-path-" * 9) wrapped
+    # all by itself — the test passed with the bug present.
+    root = tmp_path / ("averylonginstallpath" * 11)
+    root.mkdir()
+    over = {}
+    with _serving(root) as base:
+        for w in (390, 1400):                       # the empty Desk first
+            page = browser.new_page(viewport={"width": w, "height": 844})
+            page.goto(f"{base}/", wait_until="networkidle")
+            over[("empty", w)] = page.evaluate(
+                "document.documentElement.scrollWidth - document.documentElement.clientWidth")
+            page.close()
+        d = root / ("heavy-" + "x" * 60)
+        d.mkdir()
+        for i in range(12):
+            (d / f"{i:02d}.png").write_bytes(PNG)
+            set_flag(d, f"{i:02d}.png", True)
+        declare_pick(d, "q", {"prompt": "Which?", "options": ["x", "y"]})
+        (d / ".uploaded").write_bytes(b"")
+        write_manifest(d, "design-dev", title="A set with a long title " * 4,
+                       why="a reason long enough to overflow any phone " * 6)
+        for w in (390, 720, 850, 1000, 1400):
+            page = browser.new_page(viewport={"width": w, "height": 844})
+            page.goto(f"{base}/", wait_until="networkidle")
+            over[("heavy", w)] = page.evaluate(
+                "document.documentElement.scrollWidth - document.documentElement.clientWidth")
+            page.close()
+    assert all(v <= 0 for v in over.values()), over
+
+
+def test_on_a_touch_screen_the_row_controls_keep_their_tap_floor(browser, live):
+    """Slate T2 (kimi, groa): moving keep/release/wipe onto the facts line
+    dropped the deliberate 28px tap target (`height:28px;min-width:28px`) to
+    about 19px, 4-6px from the zip link. With scripts off no confirm fires, so
+    a mis-tap on wipe POSTs the delete. On a coarse pointer every row control
+    is at least 28px square again and wipe stands clear of the zip link; a
+    fine pointer keeps the compact line."""
+    import os
     base, root = live
-    d = root / "longwhy"
+    past = time.time() - 10_000
+    for name, kept in (("kept1", True), ("loose", False)):
+        d = root / name
+        d.mkdir()
+        (d / "a.png").write_bytes(PNG)
+        os.utime(d / "a.png", (past, past))
+        (d / ".viewed").write_bytes(b"")
+        if kept:
+            (d / ".forever").write_bytes(b"")
+    ctx = browser.new_context(viewport={"width": 390, "height": 844}, has_touch=True, is_mobile=True)
+    page = ctx.new_page()
+    page.goto(f"{base}/", wait_until="networkidle")
+    coarse = page.evaluate("matchMedia('(pointer: coarse)').matches")
+    boxes = page.evaluate("""() => [...document.querySelectorAll('.desk-facts form button')].map(b => {
+        const r = b.getBoundingClientRect(); return [Math.round(r.width), Math.round(r.height)]; })""")
+    gaps = page.evaluate("""() => [...document.querySelectorAll('.desk-row')].map(row => {
+        const z = row.querySelector('.dl-link').getBoundingClientRect(),
+              w = row.querySelector('form.wipe button').getBoundingClientRect();
+        // the clearance between the two boxes on whichever axis separates them:
+        // beside each other on one line, or wipe wrapped onto the next
+        return Math.round(Math.max(w.left - z.right, z.left - w.right, w.top - z.bottom, z.top - w.bottom)); })""")
+    ctx.close()
+    assert coarse, "the emulation must present a coarse pointer, or this test measures nothing"
+    assert len(boxes) == 4 and all(w >= 28 and h >= 28 for w, h in boxes), boxes
+    assert all(g >= 8 for g in gaps), gaps
+
+
+def test_the_wipe_dialog_shows_what_is_being_wiped_and_never_fails_open(browser, live):
+    """Slate T4 (groa): the booth name travels as data, never into a script —
+    but the confirm TEXT showed it raw, so a name carrying a bidi override
+    (U+202E) or a newline rewrote what the operator reads before approving a
+    wipe. Controls and bidi formatting show as U+FFFD instead. And (seat S1)
+    a `data-confirm` word the page does not know submitted with NO prompt; an
+    unknown word now asks generically — fail closed, never open."""
+    import os
+    base, root = live
+    name = "safe‮gnp.xe\nline2"
+    d = root / name
     d.mkdir()
     (d / "a.png").write_bytes(PNG)
-    write_manifest(d, "design-dev", title="A set with a long reason",
-                   why="a reason long enough to overflow any phone " * 6)
-    widths = {}
-    for w in (390, 1400):
-        page = browser.new_page(viewport={"width": w, "height": 844})
-        page.goto(f"{base}/", wait_until="networkidle")
-        widths[w] = page.evaluate("document.documentElement.scrollWidth")
-        page.close()
-    assert widths == {390: 390, 1400: 1400}, widths
+    past = time.time() - 10_000
+    os.utime(d / "a.png", (past, past))
+    (d / ".viewed").write_bytes(b"")
+    page = browser.new_page(viewport={"width": 1400, "height": 900})
+    said = []
+    page.on("dialog", lambda dlg: (said.append(dlg.message), dlg.dismiss()))
+    page.goto(f"{base}/", wait_until="networkidle")
+    page.locator("form.wipe button").first.click()
+    page.wait_for_timeout(300)
+    page.evaluate("""() => { const f = document.createElement('form');
+        f.method = 'post'; f.action = '/nowhere'; f.setAttribute('data-confirm', 'typo');
+        f.setAttribute('data-booth', 'x'); f.innerHTML = '<button>go</button>';
+        document.body.appendChild(f); f.querySelector('button').click(); }""")
+    page.wait_for_timeout(300)
+    page.close()
+    assert d.exists(), "a dismissed confirm must not wipe"
+    assert len(said) == 2, said
+    shown = said[0].split("\n\n")[0]
+    assert not any(c in shown for c in "‮\n"), repr(shown)
+    assert "safe�gnp.xe�line2" in shown, repr(shown)