feat(u7): the rail, the filters and the grid keyboard — the ratified three

ROADMAP's U7 row names four components. Three of them -- a sticky rail,
filters, and grid keyboard -- are already ratified there and are implemented
here. The fourth, replacing directory sections with filename-derived groups, is
a scope DEPARTURE the operator has not ruled on and is deliberately not built;
test_no_group_rail_is_shipped_yet fails the moment somebody builds it anyway,
so it cannot arrive by accident while he is away.

Filters are links carrying a query parameter, resolved server-side, so the
gallery keeps working with JavaScript off -- U3 already cost the verbatim path
its no-JS operation and said so, and the gallery is the surface the operator
actually reviews on. An unknown filter falls back to `all` rather than indexing
a dict by a value that arrives from an operator-editable URL.

`unanswered` means HAS AN OPEN PICK, the U4 hold predicate that already exists.
The other reading is a real and different question and stays open on the
contract rather than being guessed at.

Filtering is a VIEW and never reorders. The grid renders `sorted(rel)` with
non-matching items removed, so "the third one" means the same thing with a
filter on as with it off, and the zoom ring is untouched by any filter -- a
ring that changed with the grid would make `next` depend on how the operator
arrived, which is the misfiled-judgment failure invariant 6 exists for.

⚠ The first version of that invariant's test was VACUOUS and the mutation run
caught it: it compared each filtered view against the unfiltered RESPONSE, so a
reversing mutation reversed both sides and it stayed green under the exact
change it forbade. Rewritten against an independent truth -- U1 INV-3 says the
order IS sorted(rel) -- and re-verified RED. Written an hour after the entry
describing this exact failure class, which is worth recording.

611 -> 623 tests.

docs/contracts/u7_navigation.contract.md

@@ -1,6 +1,6 @@
 ---
 contract_version: "0.1-PROPOSED"
-status: "PROPOSED — NOT APPROVED. The scope below departs from ROADMAP's U7 row on measured grounds and the operator has not ruled on it. Do not implement, and do not treat this as settled, until he has."
+status: "PARTIALLY LANDED. The three components ROADMAP already ratifies — rail, filters, grid keyboard — are implemented and deployed (tests/test_navigation.py, 12 tests). The FOURTH, replacing directory sections with filename-derived groups, is NOT built and is the one scope-direction call below. The scope below departs from ROADMAP's U7 row on measured grounds and the operator has not ruled on it. Do not implement, and do not treat this as settled, until he has."
 module: "booth.items + booth.app (gallery navigation)"
 purpose: "The last unit before the 1.0 cut. A gallery booth renders as one flat wall with no way to filter it, no way to move through it from the keyboard, and no grouping — so a review of sixty-odd renders is a scroll-and-squint. ROADMAP names four components: sections, a sticky rail, filters, grid keyboard. THE MEASUREMENT KILLS THE FIRST AND REPLACES IT: not one of the eleven live gallery booths has a subdirectory, so sections buy nothing, while a filename-prefix heuristic yields 5-16 sensible groups on four of the five large galleries. This unit ships the rail, the filters, the grid keyboard, and GROUPS DERIVED FROM FILENAMES rather than from a directory tree that does not exist."
 depends_on:
@@ -36,8 +36,18 @@ open_questions:
 
 # U7 — navigation at the size the booths actually are
 
-**⚠ PROPOSED. The scope departs from ROADMAP on measured grounds; the operator
-has not ruled. Nothing here is implemented.**
+**⚠ PARTIALLY LANDED, DELIBERATELY.**
+
+| component | ROADMAP says | state |
+|---|---|---|
+| sticky rail | ratified | **landed** — totals + per-filter counts, links not scripts |
+| filters | ratified | **landed** — all / flagged / annotated / unanswered |
+| grid keyboard | ratified | **landed** — `←/→ f n Enter Esc`, bound only when a grid exists |
+| **sections → filename groups** | **departs from it** | **NOT BUILT.** The one scope-direction call here, and it is the operator's. `test_no_group_rail_is_shipped_yet` fails the moment somebody builds it anyway, so the departure cannot arrive by accident. |
+
+`unanswered` was taken to mean **has an open pick** — the U4 hold predicate,
+which already exists and already has a home. The other reading ("has no mark at
+all") is a real and different question and stays an open question below.
 
 ## The defect, re-measured rather than inherited