fix(r3): fold heid's bug hunt — no link offers a pair that 404s, NUL booth names, a FIFO marker, encoded view-state names

Navigation was built from the review ring while the compare GET also demands
containment, so an outside symlink (which stays in the ring) was offered by
the strip, the steps, the review's Compare control and the flag landing, and
404ed on arrival. Every one is now built from the compare ring (the review
ring filtered by the same conjunction, _in_booth).

Two pre-existing gaps compare inherits, fixed at the source: resolve_booth
caught only OSError, so a NUL in the booth segment was a 500; record_view
opened its marker blocking, so a planted FIFO hung every look. Plus: the page
treats %73ide=a as side=a, and the subgrid engine floor is stated. Two
findings refuted (a chorded click mid-drag never fires pointerup, measured;
booth_items never yields an unquotable rel). r3.toml: 57 rows.

tests/test_compare.py

@@ -120,6 +120,51 @@ def test_an_outside_symlink_in_the_ring_is_404(tmp_path):
         assert c.get(f"/b/g/compare?a=p.png&b={rel}").status_code == 404, rel
 
 
+def test_no_navigation_offers_a_pair_that_404s(tmp_path):
+    """An outside symlink stays in the review ring, and compare 404s it. So no
+    compare link may offer it: not the strip, not a step, not the review's
+    Compare control, not the JS-off flag landing (heid bug hunt, 3 of 4)."""
+    b = _booth(tmp_path, "g", {"a.png": PNG, "c.png": PNG})
+    outside = tmp_path / "elsewhere.png"
+    outside.write_bytes(PNG)
+    (b / "b-link.png").symlink_to(outside)
+    c = _client(tmp_path)
+    body = c.get("/b/g/compare?a=a.png&b=c.png").text
+    assert list(_frames(body)) == ["a.png", "c.png"], _frames(body)
+    for h in _compare_links(body):
+        q = parse_qs(urlsplit(h).query)
+        assert "b-link.png" not in (q["a"][0], q["b"][0]), h
+    assert _step(body, "a-next") == ("c.png", "c.png")          # steps over it
+    assert _compare_href(c.get("/b/g/view?f=a.png").text) == ("a.png", "c.png")
+    r = c.post("/b/g/flag", data={"target": "a.png", "on": "1", "back": "compare",
+                                  "a": "a.png", "b": "b-link.png"})
+    assert r.headers["location"] == "/b/g/#item-a.png", r.headers["location"]
+
+
+def test_hostile_booth_names_are_404_not_500(tmp_path):
+    """A NUL in the booth segment makes Path.resolve raise ValueError, which
+    is not an OSError: it must still be a 404 (heid bug hunt, hulda)."""
+    _four(tmp_path)
+    c = _client(tmp_path)
+    for path in ("/b/g%00/compare?a=p.png&b=q.png", "/b/g%00/view?f=p.png", "/b/g%00/"):
+        assert c.get(path).status_code == 404, path
+
+
+def test_a_planted_fifo_marker_cannot_hang_a_look(tmp_path):
+    """Recording a look never costs the page: a FIFO planted at `.viewed` must
+    not block the open that touches it (heid bug hunt, hulda)."""
+    import os
+    import threading
+    b = _four(tmp_path)
+    os.mkfifo(b / ".viewed")
+    got = []
+    t = threading.Thread(target=lambda: got.append(
+        _client(tmp_path).get("/b/g/compare?a=p.png&b=q.png").status_code), daemon=True)
+    t.start()
+    t.join(10)
+    assert got == [200], "a planted FIFO held the look open"
+
+
 def test_a_look_records_both_seen(tmp_path):
     """A compare GET is a look at both sides; a 404 records nothing."""
     import json