fix(blur): writes are strict, so a set the writer cannot read is never overwritten

groa's late retry on the blur bug-hunt, adjudicated against the landed code.
Its four bugs were already fixed, but a robustness note (mkstemp's 0600 locks
out a reader under another uid, which then "sees nothing and replaces it")
pointed at a real gap. set_blurred built on read_blurred, the renderer's
lenient reader, which turns an unreadable, oversized or malformed
`.blurred.json` into an empty set. The writer then replaced the file, and
whatever it held was gone. This is the `.marks.json` wipe of 2026-09-21 in a
new module, and it shipped for a night.

- `_load` is the one parse with two postures. read_blurred maps its refusal to
  "nothing blurred" (a damaged file costs the blur, never the page).
  set_blurred lets it raise BlurUnwritable, which the route answers with 409
  and the CLI with exit 3, and changes nothing.
- It refuses only for a REGULAR file it cannot read. A link, a directory or a
  FIFO at either name holds no set anyone wrote, so it reads as empty, and the
  postcondition judges whether the write can land: a link is replaced, a
  directory refused.
- The file is 0644 again, as the line-format writer left it (fchmod after
  mkstemp).

The open flags in `_read_capped` became a second layer behind the new lstat
check, and the mutation run caught their rows VACUOUS through the public API.
They are now held to account by direct tests, because they still close the
lstat-to-open race. blur_storage.toml: 25/25. No second panel was run: this
folds one reviewer note plus the repo's own recorded lesson, with a test and
a proved row for each behaviour.

tests/mutations/blur_storage.toml

@@ -33,29 +33,29 @@ label = "a JSON-only reader: every live line-format file un-blurs on deploy"
 file = "booth/blur.py"
 test = "tests/test_blur.py::test_the_legacy_line_format_still_reads"
 old = '''
-        return {ln.strip() for ln in text.splitlines() if ln.strip()}'''
+            return {ln.strip() for ln in text.splitlines() if ln.strip()}'''
 new = '''
-        return set()'''
+            return set()'''
 
 [[mutation]]
 label = "a legacy file that is not JSON reads as nothing instead of falling back"
 file = "booth/blur.py"
 test = "tests/test_blur.py::test_a_legacy_rel_that_starts_with_a_bracket_still_reads"
 old = '''
-        text = raw.decode("utf-8", "surrogateescape")
-        return {ln.strip()'''
+        if path is legacy:
+            return {ln.strip()'''
 new = '''
-        text = raw.decode("utf-8", "surrogateescape")
-        try:
-            json.loads(text)
-        except ValueError:
-            return set()
-        return {ln.strip()'''
+        if path is legacy:
+            try:
+                json.loads(text)
+            except ValueError:
+                return set()
+            return {ln.strip()'''
 
 [[mutation]]
 label = "a FIFO blocks the read (no O_NONBLOCK)"
 file = "booth/blur.py"
-test = "tests/test_blur.py::test_a_fifo_blur_file_does_not_block_the_read"
+test = "tests/test_blur.py::test_the_raw_read_never_blocks_on_a_fifo"
 old = '''
         fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)'''
 new = '''
@@ -64,7 +64,7 @@ new = '''
 [[mutation]]
 label = "the read follows a planted symlink (no O_NOFOLLOW)"
 file = "booth/blur.py"
-test = "tests/test_blur.py::test_a_symlinked_blur_file_is_not_followed_on_read"
+test = "tests/test_blur.py::test_the_raw_read_never_follows_a_link"
 old = '''
         fd = os.open(path, os.O_RDONLY | os.O_NOFOLLOW | os.O_NONBLOCK)'''
 new = '''
@@ -134,17 +134,17 @@ label = "the legacy file is sniffed for JSON again (a `[\"a.png\"]` line blurs t
 file = "booth/blur.py"
 test = "tests/test_blur.py::test_a_legacy_line_that_is_valid_json_still_reads_as_a_line"
 old = '''
-        text = raw.decode("utf-8", "surrogateescape")
-        return {ln.strip()'''
+        if path is legacy:
+            return {ln.strip()'''
 new = '''
-        text = raw.decode("utf-8", "surrogateescape")
-        try:
-            d = json.loads(text)
-            if isinstance(d, list):
-                return {r for r in d if isinstance(r, str)}
-        except ValueError:
-            pass
-        return {ln.strip()'''
+        if path is legacy:
+            try:
+                d = json.loads(text)
+                if isinstance(d, list):
+                    return {r for r in d if isinstance(r, str)}
+            except ValueError:
+                pass
+            return {ln.strip()'''
 
 [[mutation]]
 label = "no postcondition: a planted directory's OSError is swallowed as success"
@@ -169,9 +169,9 @@ label = "a lone surrogate from a planted file reaches the writer"
 file = "booth/blur.py"
 test = "tests/test_blur.py::test_a_lone_surrogate_in_the_file_is_skipped_and_writes_still_work"
 old = '''
-    return {r for r in data if isinstance(r, str) and r and _encodable(r)}'''
+        return {r for r in data if isinstance(r, str) and r and _encodable(r)}'''
 new = '''
-    return {r for r in data if isinstance(r, str) and r}'''
+        return {r for r in data if isinstance(r, str) and r}'''
 
 [[mutation]]
 label = "the writer writes a set the reader would refuse and read as nothing"
@@ -210,3 +210,51 @@ except ImportError as exc:
 new = '''
 except ZeroDivisionError as exc:
     src = os.environ["BOOTH_SRC"]'''
+
+# ---- reads lenient, writes strict (groa's retry; the .marks.json lesson) -------
+
+[[mutation]]
+label = "the writer builds on the lenient reader (an unreadable set is overwritten)"
+file = "booth/blur.py"
+test = "tests/test_blur.py::test_an_unreadable_blur_file_is_never_overwritten"
+old = '''
+    current = _load(booth)'''
+new = '''
+    current = read_blurred(booth)'''
+
+[[mutation]]
+label = "an unreadable or oversized regular file reads as empty for the writer"
+file = "booth/blur.py"
+test = "tests/test_blur.py::test_an_oversized_blur_file_is_never_overwritten"
+old = '''
+            raise BlurUnwritable(f"{path.name} in {booth.name!r} is not a readable file of sane size")'''
+new = '''
+            return set()'''
+
+[[mutation]]
+label = "a malformed set reads as empty for the writer"
+file = "booth/blur.py"
+test = "tests/test_blur.py::test_a_malformed_blur_file_is_never_overwritten"
+old = '''
+            raise BlurUnwritable(f"{BLUR_FILE} in {booth.name!r} is not JSON") from exc'''
+new = '''
+            return set()'''
+
+[[mutation]]
+label = "the set is written 0600 (mkstemp's default)"
+file = "booth/blur.py"
+test = "tests/test_blur.py::test_the_blur_file_is_world_readable_as_it_always_was"
+old = '''
+                os.fchmod(fd, 0o644)'''
+new = '''
+                pass'''
+
+[[mutation]]
+label = "a link or a FIFO at the name blocks the writer instead of reading as no set"
+file = "booth/blur.py"
+test = "tests/test_blur.py::test_a_write_replaces_a_planted_symlink_rather_than_writing_through_it"
+old = '''
+        if not stat.S_ISREG(st.st_mode):
+            return set()'''
+new = '''
+        pass'''