fix(r3): fold heid's bug hunt — no link offers a pair that 404s, NUL booth names, a FIFO marker, encoded view-state names

Navigation was built from the review ring while the compare GET also demands
containment, so an outside symlink (which stays in the ring) was offered by
the strip, the steps, the review's Compare control and the flag landing, and
404ed on arrival. Every one is now built from the compare ring (the review
ring filtered by the same conjunction, _in_booth).

Two pre-existing gaps compare inherits, fixed at the source: resolve_booth
caught only OSError, so a NUL in the booth segment was a 500; record_view
opened its marker blocking, so a planted FIFO hung every look. Plus: the page
treats %73ide=a as side=a, and the subgrid engine floor is stated. Two
findings refuted (a chorded click mid-drag never fires pointerup, measured;
booth_items never yields an unquotable rel). r3.toml: 57 rows.

docs/contracts/r3_compare.contract.md

@@ -57,9 +57,14 @@ assumptions:
 - **A look records both.** `record_view(booth)` once, and `record_seen` for `a`
   and then for `b`, below the 404s and gated on the records, as the view route
   gates it. Both calls never raise.
+- **The compare ring** is the review ring filtered by that same conjunction:
+  item order, media only, less anything compare would 404 (an outside symlink
+  stays in the review ring). EVERY compare link is built from it: the strip,
+  the steps, the review's Compare control and the `back=compare` landing. So
+  no navigation offers a pair that 404s, and a step walks over such an item.
 - The response carries, per side: the rel, its quoted url, ordinal, kind,
-  caption, blurred, flagged and thumb. It also carries the ring as a filmstrip
-  in RING ORDER (the view route's `film`, one line in the route's docstring),
+  caption, blurred, flagged and thumb. It also carries the compare ring as a
+  filmstrip in RING ORDER (the view route's `film`, one line in the route's docstring),
   the linked and per-side step targets (C3), the back link (the review of `a`,
   which is also where `Esc` goes), and `ord_width`.
 
@@ -256,9 +261,10 @@ assumptions:
 
 - **INV-1 — rel identity.** The pair is two rels, in the URL, always. Nothing
   about the pair is stored, and no ordinal ever addresses an item.
-- **INV-2 — ring only.** Both sides are media in the review ring. Every
-  server-computed link (the steps, the filmstrip, the flag landing) stays inside
-  it.
+- **INV-2 — ring only.** Both sides are media in the review ring that pass the
+  view route's containment. Every server-computed link (the steps, the
+  filmstrip, the review's Compare control, the flag landing) stays inside the
+  compare ring (C1).
 - **INV-3 — no new storage and no new mark.** The judgment is the existing flag,
   through the existing route and the existing in-place path.
 - **INV-4 — JS-off parity.** Without JS (and so without the head script that