fix: four defects the U4 bug-hunt panel found in code it did not add

All four pre-date U4 and sit in files it touched, which is why a diff-scoped
robustness lens saw them. They are separated from the unit's own commit so the
feature history stays readable; the release tags both.

* A booth name reached a JS string context. The confirm dialogs interpolated
  the name into a string literal inside `onsubmit`. Jinja's autoescape is
  HTML-attribute escaping, not JS-string escaping: the browser decodes the
  entity back to a quote before the JS parser sees it, so a name crafted to
  close the string executed on submit. Booth names are agent-authored — making
  a folder under the data dir is the whole API — so this was a live path, not a
  theoretical one. The name now travels as a data attribute to a delegated
  handler, where escaping is escaping.

* An unreadable `links.md` returned 500 for the whole booth page. `is_file()`
  then an unguarded `read_text()`. The board is one tile on that page, and a
  page that will not load is worse than one missing a tile — the posture
  `read_blurred`, `marks_for` and `read_manifest` already take.

* The index order had no tie-breaker, which violates the deterministic-order
  invariant. Equal-mtime booths fell back to whatever `iterdir()` yielded, and
  two booths landed by one `rsync` batch share an mtime exactly. Now
  `(mtime, name)` reverse: newest first, then name. The operator refers to
  cards positionally, so a sequence that moves between renders misfiles his
  judgment rather than crashing.

* `/b/<n>/marks.json` reported damage as empty success. `booth marks` exits 3
  on an unreadable file precisely so a caller can tell "not yet" from "broken";
  the HTTP mirror — the only reader a remote session has — returned the same
  empty list for both. It now carries `error` and `detail`. The status stays
  200 deliberately: reads are lenient here, and a pinned status code is a
  promise to remote clients this fix has no business breaking.

Each has a regression test. 410 tests.

booth/app.py

@@ -487,7 +487,12 @@ def list_booths(data_dir: Path, ttl_seconds: float, now: float | None = None) ->
                 "mtime": mtime,
             }
         )
-    booths.sort(key=lambda b: b["mtime"], reverse=True)
+    # Newest first, NAME as the tie-break. Sorting on mtime alone left equal-mtime
+    # booths ordered by whatever `iterdir()` yielded, which is not a rule — and
+    # invariant 6 is not "usually stable", it is a sentence you can write down.
+    # Two booths created by one `rsync` batch share an mtime exactly, and the
+    # operator refers to cards positionally.
+    booths.sort(key=lambda b: (b["mtime"], b["name"]), reverse=True)
     return booths
 
 
@@ -914,13 +919,13 @@ def create_app(
                 # Ordered pinned-first then newest-first, each row stamped with a
                 # `pinned` flag. Empty list for every other booth, so the template
                 # branch simply does not fire.
-                "board": (
-                    order_for_display(
-                        parse_link_entries((booth / LINKS_FILE).read_text()),
-                        read_pins(booth),
-                    )
-                    if (booth / LINKS_FILE).is_file() else []
-                ),
+                # `is_file()` then an UNGUARDED read was a 500 waiting on a
+                # mode change or an EIO: the board is one tile on this page, and
+                # a page that will not load is worse than one missing a tile —
+                # the same posture `read_blurred`, `marks_for` and
+                # `read_manifest` already take. A booth whose `links.md` cannot
+                # be read renders as a booth with no board.
+                "board": _board_rows(booth),
                 # Marks: operator judgment attached to this booth or to one of
                 # its items — a session's question (`pick`), the operator's own
                 # remark (`note`), the operator's selection (`flag`). Rendered
@@ -947,6 +952,21 @@ def create_app(
             },
         )
 
+    def _board_rows(booth: Path) -> list[dict]:
+        """The link board's rows, or [] for a board that cannot be read.
+
+        NEVER RAISES, for the reason every other read on this page does not:
+        one damaged file must cost its own tile, not the booth page."""
+        try:
+            if not (booth / LINKS_FILE).is_file():
+                return []
+            return order_for_display(
+                parse_link_entries((booth / LINKS_FILE).read_text()),
+                read_pins(booth),
+            )
+        except (OSError, ValueError, UnicodeDecodeError):
+            return []
+
     def _mark_redirect(name: str, form, anchor: str) -> RedirectResponse:
         """Land where the form was: the standalone marks page for a verbatim
         booth (its own index.html cannot show the recorded judgment), else the
@@ -1197,12 +1217,29 @@ def create_app(
         the whole booth instead of one question at a time.
         """
         booth = resolve_booth(name)
-        marks = marks_for(booth)
-        return JSONResponse({
+        marks, read_err = hold_read(booth)
+        body = {
             "booth": name,
             "marks": [as_dict(m) for m in marks],
             "open": [m.id for m in open_marks(marks)],
-        })
+        }
+        # A DAMAGED file used to come back as an empty list and nothing else,
+        # which is indistinguishable from "you were never asked anything" — and
+        # this endpoint is the ONLY reader a remote session has. Its filesystem
+        # sibling has told the truth since U2: `booth marks` exits 3 on an
+        # unreadable file precisely so a caller can tell "not yet" from
+        # "broken". One question, two surfaces, two answers.
+        #
+        # The STATUS stays 200 and that is deliberate. Reads are lenient here —
+        # the same rule that keeps a poisoned booth from 500ing the index — and
+        # a pinned status code is a promise to remote clients this fix has no
+        # business breaking. The information goes in the body instead: a client
+        # that wants the CLI's exit-3 parity reads `error`, and one that does
+        # not behaves exactly as it does today.
+        if read_err is not None:
+            body["error"] = "this booth's .marks.json cannot be read"
+            body["detail"] = read_err
+        return JSONResponse(body)
 
     @app.get("/b/{name}/view", response_class=HTMLResponse)
     def booth_view_file(request: Request, name: str, f: str):

booth/templates/index.html

@@ -70,11 +70,11 @@
          a label changes width. #}
       <div class="kept-actions">
       <form class="release" method="post" action="/b/{{ b.name_url }}/unkeep"
-            onsubmit="return confirm('Release \u201c{{ b.name }}\u201d?\n\nIt moves to the ephemeral lane so you can wipe it from there. Nothing is deleted by this step.')">
+            data-booth="{{ b.name }}" data-confirm="release">
         <button title="release this board so it can be wiped">release</button>
       </form>
       <form class="wipe wipe-kept" method="post" action="/b/{{ b.name_url }}/delete"
-            onsubmit="return confirm('WIPE the KEPT booth \u201c{{ b.name }}\u201d?\n\nThis deletes it and its files immediately. Kept booths are the ones nothing else will clean up, so nobody else is going to do this for you — and nothing brings it back.')">
+            data-booth="{{ b.name }}" data-confirm="wipe-kept">
         <button title="wipe this KEPT booth now" aria-label="wipe kept booth">×</button>
       </form>
       </div>
@@ -124,7 +124,7 @@
         <button title="keep — exempt from the {{ ttl_hours }}h sweep" aria-label="keep booth">★</button>
       </form>
       <form class="wipe" method="post" action="/b/{{ b.name_url }}/delete"
-            onsubmit="return confirm('Wipe booth “{{ b.name }}”?')">
+            data-booth="{{ b.name }}" data-confirm="wipe">
         <button title="wipe now" aria-label="wipe booth">×</button>
       </form>
     </article>
@@ -161,5 +161,39 @@
       }
     });
   })();
+
+  /* Destructive-action confirmation, delegated and DATA-DRIVEN.
+     These were an inline onsubmit calling confirm() with the booth NAME
+     interpolated straight into the JS string literal. Jinja's autoescape is
+     HTML-attribute escaping, not JS-string escaping: the browser decodes the
+     entity back to a quote before the JS parser ever sees it, so a booth name
+     crafted to close that string executed on submit. Booth names are
+     agent-authored — making a folder under the data dir is the whole API — so
+     that is a live path, not a theoretical one.
+
+     The name now travels as a DATA ATTRIBUTE, where escaping is escaping, and
+     never reaches a JS string literal. Same pattern the board controls already
+     use. With JS off the form submits without a prompt, which is what every
+     no-JS browser here already did. */
+  (function () {
+    var WORDS = {
+      release: function (n) {
+        return 'Release \u201c' + n + '\u201d?\n\nIt moves to the ephemeral lane so you '
+             + 'can wipe it from there. Nothing is deleted by this step.';
+      },
+      'wipe-kept': function (n) {
+        return 'WIPE the KEPT booth \u201c' + n + '\u201d?\n\nThis deletes it and its files '
+             + 'immediately. Kept booths are the ones nothing else will clean up, so nobody '
+             + 'else is going to do this for you \u2014 and nothing brings it back.';
+      },
+      wipe: function (n) { return 'Wipe booth \u201c' + n + '\u201d?'; }
+    };
+    document.addEventListener('submit', function (ev) {
+      var form = ev.target.closest ? ev.target.closest('form[data-confirm]') : null;
+      if (!form) return;
+      var word = WORDS[form.getAttribute('data-confirm')];
+      if (word && !confirm(word(form.getAttribute('data-booth') || ''))) ev.preventDefault();
+    }, true);
+  })();
 </script>
 {% endblock %}