fix(manifest)!: the size cap opened a service-wide hang; close it

The diff-scoped bug-hunt panel, four arms, artifact-only. Its strongest
finding is one I created two hours earlier while hardening the reader.

`stat` reports size 0 for a FIFO and 0 for a symlink to /dev/zero, so both
sail under the byte cap added for the RecursionError round — and then
`read_text` either blocks in read() with no EOF, so the except never runs,
or allocates until the kernel intervenes. `list_booths` reads every booth
on every GET / and /healthz, so ONE such file stalls the front page for the
whole service, with no error and no recovery short of a restart.
Reproduced before believing it (timeout returned 124). S_ISREG is checked
BEFORE the size in both modules now; verified against the live service with
two FIFOs planted, which answered 200 in 36ms.

The shape worth carrying: st_size answers a different question than "can
this be read", and a bound that trusts it inherits everything it does not
mean. A hardening fix opened a worse hole than the one it closed.

THE UPLOAD PATH WROTE ABOVE ITS OWN CLEANUP GUARD (4/4)

A failed manifest write orphaned a .uploaded half-booth with no files in
it — and because the temp name now carries a random suffix, nothing ever
overwrote the leak, and .booth.json.<hex>.tmp is not a .lock, so
_newest_mtime counted it and kept that empty booth past every sweep. The
uniqueness fix from the previous round is what made the leak permanent.
Both writes moved inside the guard; the temp is removed on every exit path.

DAMAGED BYTES ARE KEPT, NOT REPLACED (4/4, INV-6)

Marks made this explicit in v0.2.1 and this write path contradicted it: a
manifest that failed on ONE field lost the others with it, including a why
the re-announcer may never have kept anywhere. It diverges from marks in
HOW it honours the rule — marks refuse and answer 409 because the
operator's judgment is not restatable; a manifest quarantines and proceeds,
because refusing would fail `booth add` and lose the files it was copying.

ONE OPENNESS PREDICATE, AS U2 SAID (2/4)

`booth answer` spelled out `if m.answer is None` while `booth marks` asked
`open_marks`, so a partially-answered pick read as done to one verb and
open to the other — at the same instant, on the same booth. U2's INV-2 put
openness in one function precisely so they could not drift. The mirror case
is fixed too: a pick that hydrates broken is refused by the web route, so
`answer --wait` polled an hour on a form nothing could ever land.

ALSO

- now_stamp was whole-second while the importer had moved to microseconds,
  and '-' sorts before '.', so a later mark came out ahead of an earlier
  import inside the same second. One format; the previous round's ordering
  fix had opened this one.
- `_broken` was the third of three directory-name fallbacks and the one
  still handing a raw name into a card's sub-line.
- An identical re-announce rewrote the file and reset the TTL. `booth link`
  does this on every post to the standing board.
- The importer's return went through the bare _hydrate, not _hydrate_safe.
- A marks document could be written larger than it can be read back, and
  then read as no marks at all. Refused at the write instead.
- `choice` reached the answer builder raw while `notes` beside it did not.

AND ONE FINDING DELIBERATELY NOT FULLY CLOSED

The mtime-restore race is real. The clean fix — ignore a booth directory's
own mtime whenever the booth holds anything — also silently retires the
documented rule that releasing a kept board resets its clock, which the CLI
header, the README and a deliberately-written test all pin. That is a TTL
doctrine change, not a bug fix, and an existing test caught the attempt.
The concrete half is fixed (a failing os.utime escaped and 500'd the
route); the race is stated in the code where the next reader will meet it.

341 tests. Live service restarted, 24/24 booth pages verified.

tests/test_cli.py

@@ -285,3 +285,64 @@ def test_an_explicitly_empty_why_still_clears_it(tmp_path):
                    capture_output=True, timeout=30, env=env)
 
     assert _manifest(tmp_path / "b").why == ""
+
+
+def test_answer_and_marks_agree_about_what_open_means(tmp_path):
+    """U2 made `_is_open` THE openness predicate — "nothing else may spell this
+    out" — and `booth answer`'s reader spelled it out anyway, as
+    `if m.answer is None`. So a PARTIALLY answered pick read as done to
+    `answer` and still-open to `marks --wait`: one verb returns the half-filled
+    form and the other blocks on the same booth at the same instant.
+
+    Found 2/4. The two verbs are the session's whole view of the loop, and a
+    session that asks both gets two answers.
+    """
+    import sys
+    sys.path.insert(0, str(pathlib.Path(__file__).parent.parent))
+    from booth.marks import answer_pick, declare_pick
+
+    b = tmp_path / "b"
+    b.mkdir()
+    declare_pick(b, "batch", {
+        "title": "R18",
+        "questions": [
+            {"key": "q1", "prompt": "One?", "options": ["keep", "drop"]},
+            {"key": "q2", "prompt": "Two?", "options": ["keep", "drop"]},
+        ],
+    })
+    answer_pick(b, "batch", {"q1": "keep", "q2": None})      # partial
+
+    env = {**os.environ, "BOOTH_DATA_DIR": str(tmp_path),
+           "BOOTH_URL": "http://booth.invalid"}
+    marks = subprocess.run([str(SCRIPT), "marks", "b"], capture_output=True,
+                           text=True, timeout=30, env=env)
+    answer = subprocess.run([str(SCRIPT), "answer", "b", "batch"],
+                            capture_output=True, text=True, timeout=30, env=env)
+
+    still_open = "batch" in json.loads(marks.stdout)["open"]
+    assert still_open, "a partial answer stopped counting as open"
+    assert answer.returncode == UNANSWERED, (
+        "`answer` called a partially-answered pick done while `marks` called it open"
+    )
+
+
+def test_answer_does_not_poll_forever_on_a_pick_that_cannot_be_answered(tmp_path):
+    """The mirror failure. A pick whose declaration went bad hydrates with
+    `error` set, which makes it NOT open — so `marks --wait` returns at once
+    while `answer --wait` polled the full hour against a form the web route
+    refuses with a 400. Nothing was ever going to land."""
+    b = tmp_path / "b"
+    b.mkdir()
+    (b / ".marks.json").write_text(json.dumps({
+        "version": 1,
+        "marks": [{"id": "broken", "shape": "pick", "declaration": {},
+                   "error": "pick has no declaration",
+                   "created": "2026-09-21T00:00:00.000000+00:00"}],
+    }))
+
+    r = subprocess.run([str(SCRIPT), "answer", "b", "broken", "--wait", "8"],
+                       capture_output=True, text=True, timeout=40,
+                       env={**os.environ, "BOOTH_DATA_DIR": str(tmp_path),
+                            "BOOTH_URL": "http://booth.invalid"})
+    assert r.returncode != 0
+    assert "broken" in r.stderr.lower() or "cannot" in r.stderr.lower()