memory: snapshot — U5 released at v0.3.0, and the index goes two-tier
The two dated log sections had never been split, so every one of their 29 entries sat inline and the startup index had grown to 372 lines — which is the cost the two-tier scheme exists to remove, paid on every session that reads the file. 27 entries were over threshold. All 29 now have a detail file under persistent-memory.d/ and a one-line index entry that routes rather than restates. Index: 372 -> 93 lines. No archival. The soft cap fired, but every entry in this repo is dated 2026-09-21 or later, so the under-14-days guard held all of them back — and the split alone took the index well under the target without moving anything out of the active file. The in-flight section is rewritten for the post-release state: nothing is in flight, no gate is outstanding, and the next unit is explicitly recorded as the operator's undecided call rather than as a plan. The session's recommendation (U4, on three grounds) is written down so it does not have to be re-derived, alongside the two alternatives and why they are alternatives. Two dated predictions are carried forward with their dates and their instruments: the U5 adoption re-measure on 2026-09-29, which already reads 3 of 24 announced and 2 with a why from peers told nothing, and the .forever re-count a fortnight AFTER U4 lands, which is U4's own success criterion and is destroyed by running it early.
This commit is contained in:
Vuong Hoang
@@ -0,0 +1,11 @@
|
||||
# Every code-changing finding came from the AMBIGUITY pass
|
||||
|
||||
_2026-09-21 · booth_
|
||||
|
||||
**Every one of the panel's code-changing findings came from the
|
||||
AMBIGUITY pass, none from a paraphrase divergence** — and two arms independently
|
||||
proposed cutting the paraphrase to a drift-check for narrative-heavy contracts,
|
||||
because this contract's own frontmatter carries a plain-language narrative and the
|
||||
paraphrase was partly reading my framing back to me. That is a finding about the
|
||||
`/heid-contract-review` **skill**, not about this repo, and it was reported back
|
||||
to heid. Recorded here only so a future session does not rediscover it.
|
||||
@@ -0,0 +1,11 @@
|
||||
# A boolean escape hatch as the lifetime mechanism
|
||||
|
||||
_2026-09-21 · booth_
|
||||
|
||||
**A boolean escape hatch as the lifetime mechanism.**
|
||||
`.forever` was added because a 24h TTL genuinely did not fit some booths —
|
||||
and then 56% of live booths ended up on it, which means it is not "ephemeral
|
||||
with an exception", it is two lifetimes wearing one lifetime's clothes, with
|
||||
the operator doing the sorting by hand. Replaced at U4 by lifetime derived
|
||||
from state (an open mark pins; viewing is activity; `keep` survives as an
|
||||
explicit reasoned pin rather than the only way to say "not yet").
|
||||
@@ -0,0 +1,16 @@
|
||||
# Deterministic order is a cross-cutting v1 invariant
|
||||
|
||||
_2026-09-21 · booth_
|
||||
|
||||
**Deterministic order is a cross-cutting v1 invariant** —
|
||||
operator directive, mid-implementation. Every ordered collection the Booth
|
||||
renders must have a *stated* rule producing the same sequence on every render
|
||||
of the same state; the rule can be anything defensible (byte order, time, an
|
||||
explicit number, an arbitrary-but-recorded sequence), but no rule at all is
|
||||
forbidden. It binds harder here than elsewhere because the Booth's job is
|
||||
**comparison** — the operator judges tile 47 against tile 47 and refers to
|
||||
artifacts positionally, so an order that moves between renders misfiles a flag
|
||||
or a note rather than crashing. Recorded as `ROADMAP.md` § "Cross-cutting
|
||||
invariant" (with the per-collection table) and `CLAUDE.md` invariant 6, and
|
||||
tested. Still undecided and must be settled before those units ship: **U7's
|
||||
section ordering and compare pairing**, and **U6's bench listing**.
|
||||
@@ -0,0 +1,7 @@
|
||||
# Extracted from `eshpfi` into its own repo
|
||||
|
||||
_2026-09-21 · booth_
|
||||
|
||||
**Extracted from `eshpfi` into its own repo.** The accreted
|
||||
service came over whole, tests included, so `tests/test_booth.py` (1581 lines)
|
||||
is the regression net the v1 rewrite is checked against.
|
||||
@@ -0,0 +1,13 @@
|
||||
# Five mechanisms to get one question beside one artifact
|
||||
|
||||
_2026-09-21 · booth_
|
||||
|
||||
**Five separate mechanisms to get one question next to one
|
||||
artifact** — `.forever`, the link board, `inline.py`'s placeholder DSL,
|
||||
`wrap_verbatim_html`'s six regexes, and the floating amber asks chip plus
|
||||
`/b/<n>/asks`. Every one is a *correct local fix* to the same global
|
||||
mismatch, which is exactly why they accumulated without anyone making a bad
|
||||
call. **The foot-gun is the sixth one:** the next "just add a small thing for
|
||||
this case" reads as reasonable and is the pattern. The git log carries the
|
||||
signature — every feature ships, then takes 2–5 patches for cases the single
|
||||
shape did not anticipate. Check the ROADMAP gate before adding a mechanism.
|
||||
@@ -0,0 +1,10 @@
|
||||
# The `.forever` diagnosis is a falsifiable prediction
|
||||
|
||||
_2026-09-21 · booth_
|
||||
|
||||
**The `.forever` diagnosis is a stated, falsifiable
|
||||
prediction.** U4 (derived lifetime) predicts the kept-rate falls to the
|
||||
genuinely-durable booths. Re-measured today: **14 of 25 booths kept (56%)**,
|
||||
against the 54% the IA doc recorded. **Re-count a fortnight after U4 lands.**
|
||||
If it does not move, the diagnosis was wrong and the boolean was doing
|
||||
something else. Tracked in the IA doc's Booth section and by this entry.
|
||||
@@ -0,0 +1,11 @@
|
||||
# The information architecture and the v1 gate landed
|
||||
|
||||
_2026-09-21 · booth_
|
||||
|
||||
**The information architecture and the v1 gate landed**
|
||||
(`726822b`): `docs/design/information-architecture.md` names the single
|
||||
defect — *one lifetime (24h from last touch) and one shape (a folder),
|
||||
serving five jobs with different lifetimes and different shapes* — and
|
||||
`ROADMAP.md` gates v1 on seven units, each closing a **measured** defect
|
||||
rather than a wish. Both were written after a measurement pass over the live
|
||||
service, and the measurements are the load-bearing part.
|
||||
@@ -0,0 +1,24 @@
|
||||
# Letting Jinja hot-reload templates in the deployment root
|
||||
|
||||
_2026-09-21 · booth_
|
||||
|
||||
**Letting Jinja hot-reload templates while the repo is the
|
||||
deployment root** — the cause of a live outage the same day U2 landed, and the
|
||||
sharpest foot-gun in the repo. `booth.service` sets `WorkingDirectory` to this
|
||||
repo, so the running service imports these files with no build step and no
|
||||
staging copy. Python is read once at process start; Jinja's `FileSystemLoader`
|
||||
re-reads a template **on every render**. Editing `booth.html` therefore
|
||||
deployed it instantly against Python from 22:03 that knew nothing about
|
||||
`item_marks`, and **19 of 25 live booths returned 500** with
|
||||
`UndefinedError: 'item_marks' is undefined`. Neither the old code nor the new
|
||||
code was broken — the service was running both at once.
|
||||
**The lesson that generalises:** a skew between a process and the disk under it
|
||||
is invisible to the test suite by construction, so no amount of green tests
|
||||
would have caught it; the operator found it. Fixed at the source rather than
|
||||
with a reminder — the `Environment` is hand-built with `auto_reload=False`, so
|
||||
there is now ONE staleness rule (nothing takes effect until you restart) and
|
||||
the running process is always a coherent snapshot of one commit. Asserted by
|
||||
`test_templates_do_not_hot_reload_from_disk`. Watch the second-order risk the
|
||||
fix introduces: a hand-built `Environment` does not inherit `autoescape` from
|
||||
the `Jinja2Templates` constructor, and booth names, item names and mark text
|
||||
are all agent-authored strings landing in HTML.
|
||||
@@ -0,0 +1,12 @@
|
||||
# Letting the link board absorb the announce job
|
||||
|
||||
_2026-09-21 · booth_
|
||||
|
||||
**Letting the link board absorb the announce job.** `booth
|
||||
link` is an `O_APPEND` write with no identity and no stated rule, so
|
||||
re-announcing a bench appends a row instead of updating one, and a booth URL
|
||||
rots the moment its booth is swept — **145 of 211 rows (69%) pointed at
|
||||
nothing**, and 22 were the same target re-posted (talk 5×, peedlar 4×). The
|
||||
rot is **structural, not drift**. The lesson that cost the most: enforcing
|
||||
the link rule without first giving the announce job a home (`.booth.json`
|
||||
provenance on the index, U5) just makes it homeless.
|
||||
@@ -0,0 +1,21 @@
|
||||
# Marks are one `.marks.json` per booth
|
||||
|
||||
_2026-09-21 · booth_
|
||||
|
||||
**Marks are stored as one `.marks.json` per booth**, atomic
|
||||
temp-file + `os.replace`, `fcntl` lock on the read-modify-write — operator
|
||||
decision, this session. Two alternatives were weighed and lost: a sidecar
|
||||
per item (`<rel>.marks.json`) and extending the existing `<stem>.ask.json`
|
||||
shape. Rationale, and the reason it is not `links.md`-shaped: **(a)** U4
|
||||
makes *"does this booth owe an answer?"* a hot question — the sweep asks it
|
||||
per booth per tick and the index asks it per card per page load, so per-item
|
||||
sidecars turn it into a full walk of all 25 booths, one of which holds 270
|
||||
files; **(b)** `links.md` is an `O_APPEND` content-hash log because **17
|
||||
agent handles write it concurrently**, whereas marks have exactly one writer
|
||||
(the operator, in one browser) and many readers — a different problem that
|
||||
must not inherit the append-log design; **(c)** `.blurred` / `.pins` /
|
||||
`.forever` already establish the per-booth dotfile as the house shape for
|
||||
operator state, and `booth_items()`'s dotfile skip means it costs nothing in
|
||||
counts, galleries or zips. Accepted cost: a corrupt `.marks.json` loses that
|
||||
booth's marks rather than one item's. Implementation deferred to U2 —
|
||||
tracked at `ROADMAP.md` U2 and by this entry.
|
||||
@@ -0,0 +1,15 @@
|
||||
# A write over a damaged `.marks.json` wiped the booth
|
||||
|
||||
_2026-09-21 · booth_
|
||||
|
||||
**A write over a damaged `.marks.json` was wiping every mark in
|
||||
the booth.** Shipped in `v0.2.0`, found by the panel (Kimi, converged with
|
||||
Hulda), fixed in `v0.2.1`. `marks_for` is deliberately lenient — unparseable
|
||||
reads as `[]` so a review page still loads — and the write path inherited that
|
||||
leniency through the same reader, so one flag click appended to an empty list and
|
||||
atomically replaced the file. The fix is an **asymmetry**, which is the reusable
|
||||
part: reads stay lenient, writes go strict (`MarksCorrupt`), damaged bytes stay
|
||||
on disk, routes answer 409 not 500. A page that renders without an annotation is
|
||||
recoverable; a file that overwrote the operator's judgment is not. Kimi also
|
||||
named the class correctly — "an author steeped in the design conversation would
|
||||
likely read past" it — and that was accurate.
|
||||
@@ -0,0 +1,10 @@
|
||||
# A partially-answered pick counts as OPEN
|
||||
|
||||
_2026-09-21 · booth_
|
||||
|
||||
**A partially-answered pick now counts as OPEN** — declared, not
|
||||
smuggled. The old index badge tested `answer is None`, so a half-answered
|
||||
four-question ask read as closed on the index while the panel beside it
|
||||
rendered `◐ partial`: the two disagreed about the same booth. Open is the
|
||||
reading that makes U4 correct — a lifetime rule that unpinned a booth on the
|
||||
first radio click would sweep a review in flight.
|
||||
@@ -0,0 +1,14 @@
|
||||
# Regex-injecting chrome into arbitrary author HTML
|
||||
|
||||
_2026-09-21 · booth_
|
||||
|
||||
**Regex-injecting chrome into arbitrary author HTML**
|
||||
(`wrap_verbatim_html` + `_HEAD_CLOSE_RE`, `_HTML_OPEN_RE`, `_DOCTYPE_RE`,
|
||||
`_BODY_CLOSE_RE`, `_HTML_CLOSE_RE`, `_ICON_RE`, and the doctype/charset
|
||||
ordering constraints they thread). It works today and is **still live** —
|
||||
but it is the single most fragile thing in the service and it is load-bearing
|
||||
for the operator's most important workflow. Slated for deletion at U3 in
|
||||
favour of a declared seam (`/_booth/embed.js`, mounted through a real DOM
|
||||
API), which costs an author one line and removes the whole class. Do not
|
||||
extend the regex set in the meantime; if a verbatim page breaks, that is an
|
||||
argument for U3, not for a seventh pattern.
|
||||
@@ -0,0 +1,8 @@
|
||||
# `sindra-finalists` is U2's flag motivation, caught live
|
||||
|
||||
_2026-09-21 · booth_
|
||||
|
||||
**`sindra-finalists` is U2's `flag` motivation caught in the
|
||||
act** — 86 items, every one captioned, and the booth's entire name is "the
|
||||
ones the operator picked." That loop currently runs through chat, which is
|
||||
the defect `flag` closes. Evidence, not argument.
|
||||
@@ -0,0 +1,12 @@
|
||||
# Tagging a release while a review gate was in flight
|
||||
|
||||
_2026-09-21 · booth_
|
||||
|
||||
**Tagging a release while a review gate was still in flight.**
|
||||
`v0.2.0` was cut and announced to 15 consuming handles; the
|
||||
`/heid-contract-review` panel — dispatched BEFORE implementation, as the
|
||||
discipline says — replied afterwards with three defects in the code that had just
|
||||
shipped, one of them silent data loss. Nothing about the tier decision was wrong;
|
||||
the *timing* was. **If a gate is outstanding on the work being released, the tag
|
||||
waits for it.** The cost was a same-hour `v0.2.1` and a correction note to peers
|
||||
who had already verified against the broken version.
|
||||
@@ -0,0 +1,9 @@
|
||||
# Letting the write path share the read path's leniency
|
||||
|
||||
_2026-09-21 · booth_
|
||||
|
||||
**Letting the write path share the read path's leniency.** See the
|
||||
`MarksCorrupt` decision above. The general shape, worth carrying beyond marks:
|
||||
a tolerant reader and a tolerant writer over the same state are not the same
|
||||
decision, and pointing both at one function silently makes them one. Tolerate on
|
||||
read so the surface still renders; refuse on write so nothing is destroyed.
|
||||
@@ -0,0 +1,13 @@
|
||||
# Seam review and cold panel had zero overlap, twice
|
||||
|
||||
_2026-09-21 · booth_
|
||||
|
||||
**The two review gates are complementary, measured on one unit.**
|
||||
The caller-side **seam review** (nine findings, against the real sibling module
|
||||
surfaces) and the cold **`/heid-contract-review` panel** (four arms,
|
||||
artifact-only) had **zero overlap in both directions** on U2. The seam review
|
||||
found a scope miss the panel structurally could not see: the contract omitted
|
||||
`inline.py`, whose `place()` indexes by subscript, which a frozen dataclass
|
||||
refuses. The panel found three code defects and a missing test the seam review
|
||||
had no lens for. Matches heid's kvasir zero-overlap result on the
|
||||
conformance-versus-hunt axis. **Run both; neither substitutes.**
|
||||
@@ -0,0 +1,16 @@
|
||||
# U2 (marks) landed — one primitive for three mechanisms
|
||||
|
||||
_2026-09-21 · booth_
|
||||
|
||||
**U2 (marks) landed.** One primitive replacing three
|
||||
mechanisms. `pick` / `note` / `flag` in one `.marks.json` per booth, one read
|
||||
path (`marks_for`), one openness predicate (`open_marks`), rendered beside the
|
||||
artifact on the tile, at full size in the zoom, and in the panel. `flag` and
|
||||
`note` had no write path at all before this — the selection loop
|
||||
(`golden-candidates`, `sindra-finalists`, the `pancake-*` ladders) was running
|
||||
through chat. 242 tests. Details worth carrying: `asks.py` kept `normalize_ask`
|
||||
and gained `build_answer` (the 2026-09-09 partial-answer semantics preserved by
|
||||
moving, not rewriting) and LOST its five sidecar-storage functions;
|
||||
`GET /b/<n>/marks.json` was added because remote sessions polled
|
||||
`<stem>.answer.json` over HTTP and the sidecar's removal would have taken that
|
||||
capability with it; `/b/<n>/asks` 308s to `/marks`.
|
||||
@@ -0,0 +1,17 @@
|
||||
# The U2 seam review earned its place, and how
|
||||
|
||||
_2026-09-21 · booth_
|
||||
|
||||
**The U2 seam review earned its place, and the record should
|
||||
say how.** Nine findings against the real `booth.asks` / `booth.items` /
|
||||
`booth.inline` surfaces, two of which changed scope or behaviour: `inline.py`
|
||||
was missing from `touches` entirely (its `place()` indexes asks by
|
||||
**subscript**, which a frozen dataclass refuses — nothing else in the service
|
||||
does that), and the partial-answer inconsistency above. The cold
|
||||
`/heid-contract-review` pass is artifact-only by design and structurally
|
||||
cannot see a sibling module, so neither it nor a same-model self-review would
|
||||
have found either. Two more surfaced later and are worth the same note: a
|
||||
SECOND subscript in `inline.place` the seam review undercounted, and a
|
||||
regression in my own legacy importer that a retargeted test caught — a
|
||||
malformed sidecar that renders `⚠ broken` today would have silently vanished
|
||||
on migration.
|
||||
@@ -0,0 +1,19 @@
|
||||
# U7's section premise is half wrong
|
||||
|
||||
_2026-09-21 · booth_
|
||||
|
||||
**U7's section premise is half wrong, and it is the half that
|
||||
matters** — found by re-measuring `~/booth-data` rather than trusting the IA
|
||||
doc. The IA says sections come from subfolders that already exist on disk;
|
||||
true, but **every booth that actually needs navigation is flat**:
|
||||
`pancake-v3-full` (270 items, 0 subfolders), `pancake-v4-full` (270, 0),
|
||||
`sindra20-engines` (98 items + 99 caption sidecars, 0), `sindra-finalists`
|
||||
(86 + 87, 0). Subfolders exist on exactly two booths — `pewpew-ui-brief` (7,
|
||||
nested to `_ds/powerpellet-design-system-<uuid>/preview`) and `dfa-concepts`
|
||||
(1) — and **both are reports**, the job where grid navigation matters least.
|
||||
So sections stay worth shipping and `Item.section` stays right, but they are
|
||||
**not** "most of the navigation fix": the rail, the filters and grid keyboard
|
||||
are all of it. Worth noting for whoever writes U7: `sindra20-engines` encodes
|
||||
its structure in the **filename prefix** (`b2-s1-<subject>-<seed>`), which is
|
||||
where a grouping heuristic would actually pay. The IA doc's claim about what
|
||||
sections buy needs a line struck — not yet edited.
|
||||
@@ -0,0 +1,14 @@
|
||||
# v0.2.0 was tagged while a gate was in flight
|
||||
|
||||
_2026-09-21 · booth_
|
||||
|
||||
**v0.2.0 cut and announced; v0.2.1 fixed what the announcement
|
||||
was already wrong about.** Operator approved the minor (a v1 unit closed plus a
|
||||
CLI surface change for 17 consuming handles clears the release-note bar). The
|
||||
note went to 15 handles — the 17 link-board posters minus `nh3-dev`, a host
|
||||
label, and `heid`, an oracle that does not script these verbs. Then the
|
||||
cross-frontier contract panel landed and found **three defects in the code I had
|
||||
just released**, so `v0.2.1` shipped within the hour. Sequence worth remembering:
|
||||
the release was correct by the tier bar and still premature by the discipline —
|
||||
the panel had been dispatched BEFORE implementation and its reply arrived AFTER
|
||||
the tag. **If a gate is in flight, the tag can wait for it.**
|
||||
@@ -0,0 +1,14 @@
|
||||
# `booth marks` / `booth answer` got real exit codes
|
||||
|
||||
_2026-09-22 · booth_
|
||||
|
||||
**`booth marks` / `booth answer` got real exit codes**, because
|
||||
a read that CRASHED was indistinguishable from a read that said no. `marks`
|
||||
printed a traceback and exited 0 (a caller's `jq` saw success and got
|
||||
nothing); `answer --wait` read a damaged file as "not yet" and spun for the
|
||||
full hour before blaming the operator. Now `0 ok · 1 unanswered/timed-out ·
|
||||
2 no such pick · 3 unreadable`, and `read_error()` was added to `marks.py` so
|
||||
the CLI can ask the question the browser must not: the page stays lenient, the
|
||||
machine consumer gets the truth. Also `--wait` now prints ONCE — it was
|
||||
emitting a whole JSON document per poll, so a captured `--wait` held several
|
||||
concatenated values and parsed as none of them.
|
||||
@@ -0,0 +1,13 @@
|
||||
# An existing test stopped me retiring documented behaviour
|
||||
|
||||
_2026-09-22 · booth_
|
||||
|
||||
**An existing test stopped me retiring documented behaviour
|
||||
while fixing a race.** The mtime-restore race is real, and the clean fix —
|
||||
ignoring a booth directory's own mtime whenever the booth holds anything —
|
||||
would also have silently retired the rule that RELEASING a kept board resets
|
||||
its clock, which the CLI header, the README and a deliberately-written test
|
||||
all pin. That is a TTL doctrine change, not a bug fix. Fixed the concrete half
|
||||
(a failing `os.utime` used to escape and 500 the route), left the race stated
|
||||
in the code. **A fix that changes a documented rule is a proposal, not a
|
||||
patch.**
|
||||
@@ -0,0 +1,15 @@
|
||||
# The lenient reader's blast radius was the whole service
|
||||
|
||||
_2026-09-22 · booth_
|
||||
|
||||
**The lenient reader's blast radius was the whole service, not
|
||||
one booth.** `_clean_text` did `(text or "").replace(...)` and `marks_for`
|
||||
sorts on `(created, id)`, so a stored `text` that was a dict or a `created`
|
||||
that was a number raised out of the READ path — and `list_booths` reads every
|
||||
booth's marks on every index load. One hand-edited file 500'd `/` and
|
||||
`/healthz` for all 25 booths. Fixed in two layers, matching the house posture:
|
||||
a named type check (`_entry_type_error`) plus a `_hydrate_safe` backstop that
|
||||
cannot raise, and the panel now RENDERS an unreadable mark as ⚠ broken instead
|
||||
of as an empty note. **The general shape: a lenient reader is only lenient if
|
||||
the leniency is bounded by where it runs.** `marks_for` was written for one
|
||||
booth's page and is called in a loop over every booth.
|
||||
@@ -0,0 +1,11 @@
|
||||
# `scripts/booth` went from zero tests to five
|
||||
|
||||
_2026-09-22 · booth_
|
||||
|
||||
**`scripts/booth` had zero tests and now has five**
|
||||
(`tests/test_cli.py`). The panel's guard-strength tables returned UNVERIFIED
|
||||
for every CLI claim because nothing in the suite executed the script — two of
|
||||
the round's findings lived in exactly that gap. The new tests run the real
|
||||
script under the system `python3`, which makes them a live check on INV-1
|
||||
(stdlib-only) as a side effect: a third-party import in `marks.py` now fails
|
||||
in the suite the same way it would fail on a fleet host.
|
||||
@@ -0,0 +1,23 @@
|
||||
# The size cap opened a service-wide hang
|
||||
|
||||
_2026-09-22 · booth_
|
||||
|
||||
**The U5 bug-hunt panel found a service-wide hang that the
|
||||
SIZE CAP ITSELF opened — two hours after I added the cap.** `stat` reports
|
||||
size 0 for a FIFO and 0 for a symlink to `/dev/zero`, so both sail under a
|
||||
byte cap and then `read_text` blocks with no EOF or allocates until the kernel
|
||||
intervenes. `list_booths` reads every booth on every `GET /`, so ONE such file
|
||||
stalls the front page for the whole service with no error and no recovery
|
||||
short of a restart. Reproduced (`timeout` returned 124), fixed with an
|
||||
`S_ISREG` check BEFORE the size check in both modules, verified live: the
|
||||
index answered 200 in 36 ms with two FIFOs planted. **The reusable shape:
|
||||
`st_size` answers a different question than "can this be read", and a bound
|
||||
that trusts it inherits everything it does not mean — a hardening fix opened
|
||||
a worse hole than the one it closed.** Also adopted: the upload path wrote the
|
||||
manifest ABOVE its own cleanup guard (4/4), so a failure orphaned a half-booth
|
||||
whose uniquely-named leaked temp then kept it alive forever; replace-over-
|
||||
damaged destroyed recoverable bytes (4/4, now QUARANTINED rather than refused
|
||||
— marks refuse because judgment is not restatable, a booth's description is);
|
||||
and `booth answer` spelled out its own openness test, disagreeing with
|
||||
`booth marks` about a partially-answered pick, which is a direct violation of
|
||||
U2's INV-2. Full triage in `persistent-memory.d/2026-09-22-u5-panels.md`.
|
||||
@@ -0,0 +1,19 @@
|
||||
# The U2 bug-hunt panel was not ceremony
|
||||
|
||||
_2026-09-22 · booth_
|
||||
|
||||
**The U2 bug-hunt panel landed and it was not ceremony —
|
||||
`v0.2.2`.** Nine adopted findings across four arms; eight were real against
|
||||
live code and one was already fixed. The headline was **4/4 convergent from
|
||||
four different angles**: `_Locked.__exit__` unlinked `.marks.lock` on the no-op
|
||||
path, and `flock` binds to an INODE — so a writer blocked on the old inode
|
||||
proceeds while the next writer creates a fresh lock file and takes it at once.
|
||||
Two processes then run the read-modify-write concurrently and the later
|
||||
`os.replace` drops a mark, with both of them obeying the protocol. **The
|
||||
cleanup existed to protect the booth's TTL and it was failing at that too**:
|
||||
creating and removing a directory entry bumps the DIRECTORY's mtime, which is
|
||||
what `_newest_mtime` actually seeds from, so a no-op reset the clock it was
|
||||
written to leave alone. Same code region, two defects, one fix — never unlink
|
||||
the lock, exempt `.<name>.lock` dotfiles from `_newest_mtime`, and put the
|
||||
directory's mtime back after creating one. Full triage in
|
||||
`persistent-memory.d/2026-09-22-bug-hunt-panel.md`.
|
||||
@@ -0,0 +1,23 @@
|
||||
# U5's adoption prediction split in two
|
||||
|
||||
_2026-09-22 · booth_
|
||||
|
||||
**U5's adoption prediction, SPLIT IN TWO within an hour of
|
||||
landing — and the split is the interesting part.** The baseline was recorded as
|
||||
0 of 26. Fifty minutes after the deploy, `comfy-dev` created `muse-clothed-repro`
|
||||
and it announced itself: `{handle: comfy-dev, why: "", created: ...}`. That peer
|
||||
was told nothing. **The HANDLE propagates for free** — it rides on `booth new`
|
||||
and `booth add`, so every existing CLI caller starts announcing without learning
|
||||
anything, which is the flags-on-existing-verbs decision paying off on day zero.
|
||||
**The WHY does not** — it needs someone to know the flag exists, and this first
|
||||
one is empty.
|
||||
|
||||
So re-measure BOTH on **2026-09-29**, because they answer different questions:
|
||||
|
||||
find ~/booth-data -maxdepth 2 -name .booth.json | wc -l # free
|
||||
grep -l '"why": "[^"]' ~/booth-data/*/.booth.json 2>/dev/null | wc -l # learned
|
||||
|
||||
A high first count and a near-zero second is the predicted shape of "nobody was
|
||||
told", and it is the case the operator's no-announcement decision was designed
|
||||
to be able to see. Do not read the n=1 above as a rate — it is a code-path
|
||||
observation (every CLI caller writes a handle), not a sample.
|
||||
@@ -0,0 +1,21 @@
|
||||
# Two U5 panels, and prose reached a released outage
|
||||
|
||||
_2026-09-22 · booth_
|
||||
|
||||
**Two cross-frontier panels on U5, and a paraphrase panel reached
|
||||
a production outage two modules away.** 3-of-4 flagged the contract's "4 GB"
|
||||
case as letter-compliant but purpose-defeating; the conformance round found that
|
||||
unbounded read live in U5's code; walking it to the sibling found the SAME hole
|
||||
**live in released `v0.2.2`** — `marks._read_raw` catches `(OSError, ValueError,
|
||||
UnicodeDecodeError)` and `json.loads` on deep nesting raises **RecursionError**,
|
||||
which is none of them, so 400 KB of brackets in one booth returned 500 for `/`
|
||||
and `/healthz` across all 26. The v0.2.2 round HAD flagged it and I closed half:
|
||||
**a finding with two call sites is not closed when one is.** The reusable
|
||||
instruction — **walk a conformance finding to the sibling module even when the
|
||||
sibling is out of scope.** Five of ten conformance findings were tests of mine
|
||||
that pass on the regression they exist to catch, three of them asserting an
|
||||
ARTIFACT of the property rather than the property; that is three nights running
|
||||
on the same shape. Two real bugs neither my tests nor I could see: a bare
|
||||
`booth add` wiped the `why` on the one sequence the feature exists for, and
|
||||
`--title` was write-only. Full triage in
|
||||
`persistent-memory.d/2026-09-22-u5-panels.md`.
|
||||
Reference in New Issue
Block a user