- Touch: on a coarse pointer every row control is at least 28px square
again (32px), and wipe stands clear of the zip link. The move onto the
facts line had dropped the deliberate 28px floor to ~21px, 4-6px from
zip; with scripts off no confirm fires, so a mis-tap on wipe is the
delete. The zip link no longer breaks between its glyph and its word,
and each separator is glued to the item after it.
- The wipe dialog shows the name as it should be read: control and bidi
formatting characters in an agent-made name show as U+FFFD, so U+202E
or a newline cannot rewrite what the operator approves. An unknown
data-confirm word now prompts generically instead of submitting
unguarded (fail closed).
- No page scrolls sideways: `code` wraps anywhere, so a long unbreakable
install path in the footer or the empty Desk no longer widens every
page. The overflow test now sweeps 390/720/850/1000/1400 with the
heaviest row the Desk draws, and compares scrollWidth with the page's
own clientWidth.
Its first fixture used a hyphenated path, which wrapped by itself; the
test passed with the bug present until the path became one unbreakable
run. r2_flow.toml: 27/27 proved. 749 passed.
Operator, on the live Desk: "release and x take up space whether or not
they're visible." They sat in a side column at opacity 0, which hides a
control and still reserves its box, and hover-only never worked on
touch.
Each control now sits on the facts line beside the state it changes:
release after "kept", keep after a countdown or hold, wipe last. They
are always visible and quiet, and wipe turns danger only under the
pointer or focus. The side column renders only when the row carries a
badge. The row is flex, so an absent column costs no gap. Forms, POST
targets and data-confirm wording are unchanged.
The flex row exposed a latent sizing bug: the stacked Desk column was a
bare 1fr, whose minimum is its content's, so a long nowrap provenance
line scrolled the page sideways at phone width (1029px at 390). It is
now minmax(0,1fr).
Both behaviours have browser tests, mutation-proved (r2_flow.toml:
21/21). Contract C4 amended.
tests/mutations/r2_flow.toml: 18 falsifiers, each proved RED under its
change by scripts/mutation_check.py (18/18). Its first run found three
vacuous proofs, now resolved:
- landed_at's per-entry skip: the symlink-loop fixture stopped raising
once the clock moved to lstat. New fixture: a folder that lists but
cannot be searched.
- the Desk's bench URL guard: the test covered bookmarks only. A
hand-edited registry bench now rides with it.
- flagged_targets' `error is None`: defence in depth (hydration already
strips a damaged mark's target), so no single-guard row; named in the
table header instead.
The rail's flagged filter and the orphan-flag list read flagged_targets
rather than restating it; no reachable behaviour changes.
vh