feat(u3): a verbatim report declares the seam, the Booth mounts into it
A booth that ships its own index.html was served through ten regular
expressions applied to markup the Booth did not write: six in
wrap_verbatim_html hunting for somewhere to hang a favicon and a chip, four
in booth/inline.py substituting rendered ask markup into the author's own
tags. Both worked. Both were the most fragile thing in the service, on the
path the operator uses most.
The whole class is replaced by a declared seam. A report carries one line —
<script src="/_booth/embed.js" defer></script> — and the chrome mounts
through DOM APIs. What the server does to author HTML is now, in full:
return html if declares_embed(html) else html + EMBED_SCRIPT_TAG
Two substring tests and a concatenation. Both of the old wrapper's hard
constraints stop existing rather than being satisfied more carefully:
nothing can displace a leading doctype into quirks mode and nothing can push
the charset meta out of its detection window, because nothing in front of
them ever moves. A page that declares the seam is served exactly as written.
Fragments are still rendered by the _ask_inline.html macros and handed over
GET /b/<name>/embed.json; embed.js places them and decides nothing. Openness
comes from open_marks, order from (created, id), questions in declaration
order. A single-question pick normalizes to key None, so the payload carries
questions as a list rather than an object — keying by name would serialize
that as the string "null".
Placement is an anchor fill, not a replacement: el.insertAdjacentHTML(
'beforeend'), so an author's wrapper and its contents survive. The regex it
replaces was eating the opening tag of dfa-concepts' styled .ask blocks and
orphaning their headings, live, unreported.
data-booth-mark is canonical; data-booth-ask stays a kept alias because two
live reports use it. The comment placeholders are dropped — no users.
Declared cost: the verbatim path now needs JavaScript. The never-invisible
guarantee holds through the index badge and /b/<name>/marks, both of which
render server-side.
Deleted: booth/inline.py entire, wrap_verbatim_html and its six patterns,
_BACK_CHIP, asks_chip, inject_asks, FAVICON_LINK, the styles() macro.
Tests 410 -> 434. tests/test_embed_browser.py drives a real Chromium: the
placement algorithm and the form= binding of a scattered multi-question form
cannot be observed any other way, and that binding was measured rather than
assumed (N=3 per condition, with a form-first positive control and a
points-at-nothing negative control).
Contract: docs/contracts/u3_declared_embed_seam.contract.md, with the
in-session seam review and the cold contract panel both recorded. Two of the
panel's findings were code fixes: a vacuous INV-3 falsifier that a renamed
regex walked straight through, and a bare-substring seam detection that read
a report merely quoting the path as declaring it and silently served it with
no chrome.
This commit is contained in:
@@ -0,0 +1,87 @@
|
||||
# A vacuity pass that tries the contract's own mutation agrees with itself
|
||||
|
||||
_2026-09-22 · booth_
|
||||
|
||||
The contract-time **vacuity pass** — for each invariant, name a change that
|
||||
defeats it and check the named test goes red — was proposed independently by
|
||||
Regin and Kimi on U4's paraphrase round, and U4's own code-review panel then
|
||||
showed **five of seven** U4 falsifiers were vacuous: a green test *cited* by an
|
||||
`INV` rather than a test that would *fail* if the invariant broke. See
|
||||
[[2026-09-22-vacuous-falsifiers]].
|
||||
|
||||
U3 ran the pass as a real instrument rather than a promise. Script in the
|
||||
session scratchpad; for each invariant it applies the mutation the contract's
|
||||
*Falsifiable:* line names, runs the single named test, and asserts a **non-zero**
|
||||
exit, restoring the file in a `finally` either way.
|
||||
|
||||
| INV | mutation applied | verdict |
|
||||
|---|---|---|
|
||||
| 1 declaring page untouched | append `<!-- booth -->` to the declaring branch | FALSIFIED |
|
||||
| 2 appended, never inserted | insert the tag before `<title>` instead | FALSIFIED |
|
||||
| 3 no regex on author HTML | re-declare `_ICON_RE` in `app.py` | FALSIFIED |
|
||||
| 4 openness is the server's | have `embed.js` derive open from `bk-done` | FALSIFIED |
|
||||
| 5 embed.js read once | `read_text()` per request in the route | FALSIFIED |
|
||||
| 6 tail in payload order | iterate the marks list backwards | FALSIFIED |
|
||||
| 7 unplaced questions appended | short-circuit the append branch to `if (false)` | FALSIFIED |
|
||||
|
||||
**7/7**, and — the part that makes it a measurement rather than a ritual — an
|
||||
**unmutated control run** confirming all seven named tests are green when
|
||||
nothing is broken. Without that control, a script whose mutation silently failed
|
||||
to apply (the text not found, the wrong file) reports the same clean-looking
|
||||
table. The script halts with `MUTATION-MISS` if its target string is absent,
|
||||
for exactly that reason.
|
||||
|
||||
## Why it is worth the ten minutes
|
||||
|
||||
Three of the seven falsifiers are in `embed.js`, which the Python suite cannot
|
||||
see at all. INV-4, INV-6 and INV-7 are held **only** by browser tests, and
|
||||
"there is a browser test named after this invariant" is precisely the kind of
|
||||
claim that feels like coverage and can be empty. Two of those three mutations
|
||||
are one-token edits — `marks.length - 1` and `if (false)` — so the cost of
|
||||
checking was minutes and the cost of being wrong was an invariant nobody was
|
||||
holding.
|
||||
|
||||
**The general shape:** an instrument that cannot fail loudly will fail quietly.
|
||||
Same family as the `(gasp)` tag-detection specimen in the global measurement
|
||||
rule, and as the zsh word-splitting bug that shipped an empty heid bundle —
|
||||
[[2026-09-22-four-paths-to-one-fail-open-delete]]. A clean result and a broken
|
||||
method are indistinguishable from the output alone unless something in the
|
||||
method is designed to go red.
|
||||
|
||||
## ⚠ AND THEN THE COLD PANEL SHOWED ONE OF THE SEVEN WAS VACUOUS ANYWAY
|
||||
|
||||
The table above is real and it was **not sufficient**. The `/heid-contract-review`
|
||||
panel (`01M351WKV666D681SSRNY7D7X6`) — three of four arms, independently —
|
||||
showed **INV-3's falsifier was vacuous**, on this contract's central promise, and
|
||||
the pass above had passed it.
|
||||
|
||||
**Why the pass missed it.** INV-3 claims *no regular expression is applied to
|
||||
author HTML*. The test name-matched the six DELETED patterns. The mutation the
|
||||
pass applied was re-declaring `_ICON_RE` — **the pattern the contract named** —
|
||||
which the name-match caught. The mutation the invariant actually forbids is a
|
||||
regex under a *new* name (`_TAIL_RE.sub(...)` in the verbatim branch), and that
|
||||
sailed through green.
|
||||
|
||||
> **The mutation has to come from the INVARIANT'S CLAIM, not from the
|
||||
> FALSIFIER'S EXAMPLE.** A pass that applies the contract's own suggested
|
||||
> mutation is testing the contract against itself, and it will agree.
|
||||
|
||||
**Then the fix had a hole too, and only a re-run found it.** The repaired test
|
||||
asserts `booth/app.py` performs exactly one regex operation. Re-running the pass
|
||||
*against the fix* showed an aliased `import re as _r` routes around the call
|
||||
check under a name it does not know — still VACUOUS. Closed with an import-shape
|
||||
assertion. **Run the pass on the repair, not only on the draft.**
|
||||
|
||||
Final state: **10/10 falsifiable**, control green, the two extra rows being the
|
||||
panel's own findings turned into falsifiers.
|
||||
|
||||
## What this is evidence for
|
||||
|
||||
U4 measured the problem (five of seven vacuous). U3 measured a pass working
|
||||
(7/7), then measured **the pass's own blind spot**, then measured the fix's
|
||||
blind spot. All three belong in the case if the vacuity-pass proposal is ever
|
||||
put to the operator as a `/heid*` skill amendment — and the second and third
|
||||
are the parts that stop it being adopted as a ritual that always passes.
|
||||
|
||||
Related: [[2026-09-22-u3-declared-embed-seam-landed]],
|
||||
[[2026-09-22-the-browser-became-a-test-surface]].
|
||||
@@ -0,0 +1,76 @@
|
||||
# The browser became a test surface, and the version bound is the foot-gun
|
||||
|
||||
_2026-09-22 · booth_
|
||||
|
||||
U3 moved load-bearing logic out of Python and into JavaScript: which fragment
|
||||
lands at which anchor, what gets appended, and whether a `<form>` scattered down
|
||||
a report still owns the controls pointing at it. **The Python suite is blind to
|
||||
every one of those.** Shipping U3 with only payload-shape tests would have
|
||||
deleted ~10 real tests and replaced them with assertions that cannot see the
|
||||
thing the operator actually depends on.
|
||||
|
||||
So `tests/test_embed_browser.py` drives a real Chromium against a real uvicorn
|
||||
on an ephemeral port. 12 tests. It found nothing on the first run — but the
|
||||
probe that preceded it settled a design question no amount of spec-reading
|
||||
would have.
|
||||
|
||||
## The probe, and why it had controls
|
||||
|
||||
**Question:** if a control carrying `form="F"` is inserted into the DOM *before*
|
||||
`<form id="F">` exists, does it become that form's control? The HTML spec resets
|
||||
form owner on insertion and on the `form` attribute changing — it does NOT list
|
||||
"a matching form was inserted later". The U3 design inserts fragments in visual
|
||||
order, so this happens routinely.
|
||||
|
||||
Four conditions, N=3 each, in Chromium 151 headless:
|
||||
|
||||
| condition | `input.form?.id` |
|
||||
|---|---|
|
||||
| A — form inserted first (**positive control**) | `F, F, F` |
|
||||
| B — control inserted first (**the question**) | `F, F, F` |
|
||||
| C — `form="NOPE"`, no such form (**negative control**) | `null, null, null` |
|
||||
| D — remove and re-set the attribute (the proposed fix) | `F, F, F` |
|
||||
|
||||
The positive control proves the instrument can see association at all; the
|
||||
negative proves it is not manufacturing it. Without both, B's answer means
|
||||
nothing — that is the whole lesson of
|
||||
[[2026-09-22-vacuous-falsifiers]] applied before the code instead of after.
|
||||
|
||||
**The answer is: Chromium re-resolves it, so the fix is unnecessary there.**
|
||||
The fix shipped anyway. **Sensitivity floor: ONE ENGINE.** The operator's own
|
||||
browser was not measured, the failure mode is a form that looks filled in and
|
||||
POSTs a 400, and the guard is three lines. The measurement says "not needed
|
||||
here"; it does not say "not needed".
|
||||
|
||||
## The foot-gun, which bit before the tests were written
|
||||
|
||||
Browsers are **box-wide** in `/opt/ms-playwright` with
|
||||
`PLAYWRIGHT_BROWSERS_PATH` wired globally — there is no per-project
|
||||
`playwright install`. Each playwright release pins **one** Chromium revision, and
|
||||
a release wanting a revision the shared store lacks dies with:
|
||||
|
||||
Executable doesn't exist at /opt/ms-playwright/chromium_headless_shell-1243/…
|
||||
|
||||
That is not a missing-dependency error and it does not name the real problem.
|
||||
The store had 1223 / 1228 / 1234; `playwright` 1.63 wanted 1243. The mapping:
|
||||
|
||||
1.60 -> 1223 1.61 -> 1228 1.62 -> 1234 1.63 -> 1243
|
||||
|
||||
Hence `playwright>=1.60,<1.63` in `pyproject.toml`, **with the upper bound as the
|
||||
point** and the reason in a comment beside it. A bare `playwright` would break
|
||||
the suite on the next resolve, opaquely.
|
||||
|
||||
## The hermeticity trade, and how it is paid
|
||||
|
||||
A browser layer makes the suite non-hermetic — it can go red for an environment
|
||||
reason. `tests/test_embed_browser.py` therefore **skips, never fails**, when
|
||||
playwright or a usable browser is missing (`pytest.importorskip`, plus a
|
||||
`pytest.skip` on any launch failure). `pytest -q` stays green anywhere; the
|
||||
browser layer is purely additive.
|
||||
|
||||
⚠ **The failure mode of that choice: if those 12 tests start SKIPPING on this
|
||||
box, U3's placement logic is untested and the suite still says green.** If the
|
||||
count drops from 431, check the skip reason before anything else — the pinned
|
||||
bound has probably drifted past the shared store.
|
||||
|
||||
Related: [[2026-09-22-u3-declared-embed-seam-landed]].
|
||||
@@ -0,0 +1,88 @@
|
||||
# U3 landed — the page declares the seam, the Booth mounts into it
|
||||
|
||||
_2026-09-22 · booth_
|
||||
|
||||
**Ten regular expressions against author-written HTML are gone.** Six in
|
||||
`wrap_verbatim_html` hunting for somewhere to hang a favicon and a chip, four in
|
||||
`booth/inline.py` substituting rendered ask markup into the author's own tags.
|
||||
What replaced them, in full:
|
||||
|
||||
```python
|
||||
return html if declares_embed(html) else html + EMBED_SCRIPT_TAG
|
||||
```
|
||||
|
||||
A substring test and a `+`. **Both of the old wrapper's hard constraints stopped
|
||||
existing rather than being satisfied more carefully** — nothing can displace a
|
||||
leading doctype into quirks mode and nothing can push the charset `<meta>` out
|
||||
of its first-1024-byte window, because nothing in front of them ever moves.
|
||||
|
||||
## What moved where
|
||||
|
||||
| was | is |
|
||||
|---|---|
|
||||
| `wrap_verbatim_html` + 6 regexes | `embed_verbatim` — one `in`, one `+` |
|
||||
| `booth/inline.py`, 119 lines | deleted; `form_id` survived into `app.py` |
|
||||
| `_BACK_CHIP`, `asks_chip` | built in the DOM by `embed.js` |
|
||||
| `inject_asks` | `GET /b/<name>/embed.json` + placement in `embed.js` |
|
||||
| `_ask_inline.html`'s `styles()` | the CSS lives in `embed.js` |
|
||||
| `FAVICON_LINK` string injection | `document.querySelector('link[rel~="icon"]')` |
|
||||
|
||||
**The fragments are still rendered by Jinja.** `embed.js` places what comes back
|
||||
and never builds one — a second renderer in JavaScript would be the same bug
|
||||
INV-1 exists to stop, in a new language. The payload also decides openness
|
||||
(`open_marks`) and order, so the page has no opinion about either.
|
||||
|
||||
## The thing the contract got wrong, and the seam review caught
|
||||
|
||||
The payload first keyed `questions` by question key. **A single-question pick
|
||||
normalizes to `questions: [{"key": None, …}]`** (`asks.normalize_ask`, the
|
||||
`multi: False` branch), and `json.dumps` writes that key as the string `"null"`
|
||||
— inventing a name that collides with a real key. Every one-question ask in the
|
||||
fleet would have hit it, including the live `sindra-voice-1`. `questions` is a
|
||||
LIST of `{key, html}` now; the key is nullable, and declaration order rides in
|
||||
the format instead of leaning on object-key insertion order.
|
||||
|
||||
The cold contract panel could not have found this: it is a fact about
|
||||
`booth/asks.py`, which an artifact-only reader never sees. Third time the seam
|
||||
review has caught what the cold pass structurally cannot — see
|
||||
[[2026-09-21-two-gates-are-complementary]].
|
||||
|
||||
## The live report that was already subtly broken
|
||||
|
||||
`dfa-concepts/index.html` writes `<div class="ask" data-booth-ask="dfa:logo">
|
||||
<h3>The one asset that must survive</h3>`. `_EL_RE` matched the **opening tag**
|
||||
and replaced it, so the author's `.ask` wrapper class vanished, the heading was
|
||||
orphaned and the `</div>` went stray. Nobody filed a bug, because a page that is
|
||||
95% right does not look broken.
|
||||
|
||||
`el.insertAdjacentHTML("beforeend", frag)` keeps the element and its contents
|
||||
and puts the fragment inside. Verified live in a real browser: 5 author `.ask`
|
||||
wrappers intact, 5 headings intact, 14 radios mounted inside them, zero console
|
||||
errors. **The replacement is not just less fragile, it renders the operator's
|
||||
own report more faithfully than the thing it replaced.**
|
||||
|
||||
## The cost, stated because it is real
|
||||
|
||||
The verbatim path used to work with **no JavaScript** — server-rendered ask, plain
|
||||
form POST, HTML5 `form=` binding resolved at parse time. It needs the script now.
|
||||
The operator's 2026-09-21 ruling accepts that; this entry records the consequence
|
||||
so nobody meets it as a surprise. The never-invisible guarantee survives in a
|
||||
weaker and still-true form through surfaces needing no script: the index card's
|
||||
open-mark badge, and `/b/<name>/marks`.
|
||||
|
||||
## Anchor syntax
|
||||
|
||||
`data-booth-mark` is canonical (U2 made an ask one shape of mark).
|
||||
`data-booth-ask` is a kept alias — 2 of the 4 live verbatim booths spell it that
|
||||
way, in the operator's own reports, and the alias is one clause in one selector
|
||||
string. The `<!-- booth:ask … -->` comment forms were **dropped, not ported**:
|
||||
zero users across all 21 live booths, and a page that used one falls back to the
|
||||
append path, so its ask still renders.
|
||||
|
||||
## Verification
|
||||
|
||||
431 tests (410 → 431). Live: all 21 booths 200, and each of the four verbatim
|
||||
booths grew by exactly 46 bytes — `len(EMBED_SCRIPT_TAG)`, one append, nothing
|
||||
else. Related: [[2026-09-22-the-browser-became-a-test-surface]],
|
||||
[[2026-09-22-seven-of-seven-falsifiers]],
|
||||
[[2026-09-21-regex-injecting-chrome]].
|
||||
Reference in New Issue
Block a user