The markup and CSS half of the anti-slop interaction work. The in-place
client is untouched (that is S5b).
- Glyph-only controls carry a name: the withdraw ×s, downloads, open full
page, the viewers' ✕, the board's pin, copy and remove, the bench's
remove, the 1:1 toggle ("1:1, natural pixels"). Film-strip and tray
frames carry the file's name as sr-only text instead of reading "01".
A Desk row's wipe names its booth.
- Fields are named by aria-label, not by their placeholder.
- The inline ask's options are a radiogroup labelled by the prompt; a
single-question fieldset gets an sr-only legend; a titled ask's title
takes bk-ask-<id>-title (it duplicated the question's id).
- One h1 per page (sr-only on the Desk, review and compare), a skip link
to <main id="main">, theme-color for light and dark.
- The review tape is one picture (role=img); its segments leave the tab
order (the film strip holds the same links, named).
- Wipe now uses the Desk's delegated prompt, moved to base.html: it names
the booth and asks the kept-booth question for a kept booth.
- Embed focus rings of its own; rings drawn inside clipping containers;
the withdraw × at least 24px, 44px under a coarse pointer;
touch-action:manipulation; strips contain their overscroll; a long
slug wraps on a phone.
- A truncated why carries its full text in title; a countdown of 48h or
more reads in days.
Two r2_flow.toml rows for the confirm helper now name base.html, where
the helper moved (anchors unchanged; the gate found them drifted).
Contract: as_antislop S5a. Falsifiers: antislop.toml 86/86 proved (S1-S6, S5a);
all 12 tables 366/366 proved on this tree.
Operator report (via infra-ops): on a page with several asks, a submit
saved only the pressed one and the reload wiped the rest. Confirmed on
auk-audition: one POST at 15:02:23 saved the last ask on the page, then a
400 from the submit of an ask the reload had just blanked.
Client-side on both surfaces; /answer is unchanged. A submit on a pick
form, while another pick form on the page holds unsent input, sends every
changed ("dirty") pick form: one POST each, to its own action, with
Accept: application/json, in document order. A refusal stops nothing, and
untouched forms are never re-sent. With no other dirty form, a submit is
exactly what it was.
- embed.js (verbatim reports): reloads only when nothing was refused and
nothing of ours is dirty. Otherwise a server-rendered status line in the
submit block says what did not save, and input stays. A form the server
took gets a new baseline. A press during the flight is ignored.
- base.html (marks page, lightbox, review rail): one refresh in place. A
batch never reloads. Only forms the server took count as sent. In-flight
state and "just sent" are keyed by form identity (formKey) plus the fields
at the press, not the DOM node.
Two heid bug-hunt rounds: a four-arm panel on the first cut, then Hulda
alone on the fold. Ten findings reproduced red in a browser before their
fixes. Contracts: U3 "Submitting several asks at once" + INV-8, R2 C3
steps 2, 3 and 3a. Mutation tables u3_submit_all (15) and r2_submit_all
(11), all proved. Suite 928 -> 951.
- 1:1 start-aligns. The centred flex item overflowed both sides and the
start was unreachable; measured, a 3000px picture hid its leftmost
980px. Auto margins still centre a small picture.
- Drag lifecycle: a move with no button ends the drag, so a press
released outside the stage never pans on a later hover. Capture is now
load-bearing in a test. The threshold is 4px of total movement.
- A press on the stage's own scrollbar is never a pan. The arrows clamp
to the stage's client box, so they are never under a classic
scrollbar. The test runs a browser without --hide-scrollbars and
asserts the gutter exists.
- Stacked, the arrows' CSS spot is the stage's centre (30vh), set in
view.html because base.html lost to the page's later rule.
- The stage reveal is `hidden` until bound, and keeps Fit's drop shadow
when revealed. A blurred picture composes blur() drop-shadow().
- The mode follows another tab. A failed or unknown size returns the
arrows to their CSS spot.
- Tests: object-position, vertical centring, the Fit half of
aria-pressed, a storage read that throws, a large picture's toggle,
Fit forgetting 1:1, single-axis pan.
- Declared: the r2b reveal test reads "no blur" (the shadow stays), and
the r2_flow 360px-offset row is retired.
Mutation tables 137/137 across four. 810 passed.
The operator, on the live Desk: "how is this last activity first?" It was not,
usefully. The section sorted by `_newest_mtime`, which counts a look (`.viewed`),
so opening a booth moved it up. Tonight two post-deploy checks fetched every
booth page within half a second, which recorded 22 looks at once and collapsed
the section into reverse name order through the (mtime, name) tie-break.
Meanwhile each row shows "updated X ago", which is `landed_at`, a different
clock from the one the list was sorted by.
Operator ruling: "last activity can just be last time the booth was updated,
not necessarily operator's last activity." The section now sorts by
`(-landed_at, name)`, the date the row shows, labelled "last updated first".
Looking, flagging and blurring no longer move a booth. `list_booths` keeps its
own order for its other readers, and `_newest_mtime` still feeds lifetime.
The r2_flow contract (§3, the ordering table, INV-5) and ROADMAP's ordering row
are amended to match. Two tests and two r2_flow.toml rows cover it (25/25).
Operator rulings, 2026-09-23.
D1, the Desk row:
- Kept vs ephemeral reads at a glance: an always-visible lifetime pill in
the right column (sage ★ kept, amber held, ◷ counting down).
- The facts line is facts only.
- zip / keep|release / wipe are one cluster, with zip out of the middle.
Where a real hover exists it floats over the preview strip (covering
pictures, never information), appears on hover or keyboard focus, and
takes no room. Anywhere else (touch, any coarse pointer) it is the
row's last line, visible, with 32px controls. × hides too (the operator
answered yes).
D1b: "created 12 Sep" (filesystem birth time; nothing when unknown) and
"updated 5d ago" (the content clock), as <time> facts on the row and in
the booth header, from one macro and one clock per page.
D3, the theme toggle: System · Light · Dark in the top bar.
- Stored in localStorage and applied in <head> before any stylesheet.
- System removes data-theme, so the OS query follows the OS live, with
no listener.
- The token sheet is re-vendored at the same SVOS SHA with a scoping-only
transform (155 declarations, the same set, both directions), so forced
themes win over the OS and high contrast follows the theme in effect.
- The ask chrome inside verbatim pages follows the choice through
data-bk-theme on our own fragments, live across tabs. The host page's
<html> is never touched.
Declared test changes:
- two row tests replaced;
- the wipe-dialog test hovers first;
- four r2_flow rows retired, with successors in r2b.toml (45/45).
785 passed.
- Touch: on a coarse pointer every row control is at least 28px square
again (32px), and wipe stands clear of the zip link. The move onto the
facts line had dropped the deliberate 28px floor to ~21px, 4-6px from
zip; with scripts off no confirm fires, so a mis-tap on wipe is the
delete. The zip link no longer breaks between its glyph and its word,
and each separator is glued to the item after it.
- The wipe dialog shows the name as it should be read: control and bidi
formatting characters in an agent-made name show as U+FFFD, so U+202E
or a newline cannot rewrite what the operator approves. An unknown
data-confirm word now prompts generically instead of submitting
unguarded (fail closed).
- No page scrolls sideways: `code` wraps anywhere, so a long unbreakable
install path in the footer or the empty Desk no longer widens every
page. The overflow test now sweeps 390/720/850/1000/1400 with the
heaviest row the Desk draws, and compares scrollWidth with the page's
own clientWidth.
Its first fixture used a hyphenated path, which wrapped by itself; the
test passed with the bug present until the path became one unbreakable
run. r2_flow.toml: 27/27 proved. 749 passed.
Operator, on the live Desk: "release and x take up space whether or not
they're visible." They sat in a side column at opacity 0, which hides a
control and still reserves its box, and hover-only never worked on
touch.
Each control now sits on the facts line beside the state it changes:
release after "kept", keep after a countdown or hold, wipe last. They
are always visible and quiet, and wipe turns danger only under the
pointer or focus. The side column renders only when the row carries a
badge. The row is flex, so an absent column costs no gap. Forms, POST
targets and data-confirm wording are unchanged.
The flex row exposed a latent sizing bug: the stacked Desk column was a
bare 1fr, whose minimum is its content's, so a long nowrap provenance
line scrolled the page sideways at phone width (1029px at 390). It is
now minmax(0,1fr).
Both behaviours have browser tests, mutation-proved (r2_flow.toml:
21/21). Contract C4 amended.
tests/mutations/r2_flow.toml: 18 falsifiers, each proved RED under its
change by scripts/mutation_check.py (18/18). Its first run found three
vacuous proofs, now resolved:
- landed_at's per-entry skip: the symlink-loop fixture stopped raising
once the clock moved to lstat. New fixture: a folder that lists but
cannot be searched.
- the Desk's bench URL guard: the test covered bookmarks only. A
hand-edited registry bench now rides with it.
- flagged_targets' `error is None`: defence in depth (hydration already
strips a damaged mark's target), so no single-guard row; named in the
table header instead.
The rail's flagged filter and the orphan-flag list read flagged_targets
rather than restating it; no reachable behaviour changes.
vh