booth

2 Commits

Include renames

Author SHA1 Message Date

Author	SHA1	Message	Date
vh	c1f5543b77	fix(blur): fold the heid bug-hunt: two file names, a reader-judged writer, one predicate The heid bug-hunt panel on `4cfbce5` (hulda, regin, kimi; groa timed out) found four real defects in the round-trip fix, and three of its arms converged on the worst: it re-created the bug it existed to fix. - Two names, never a sniffed file (3/3). JSON went into the OLD `.blurred`, and the reader guessed the format from the bytes, so a legacy file whose one line is an item named `["a.png"]` read as {"a.png"} and blurred the neighbour. The set now lives in `.blurred.json`, JSON only. The legacy `.blurred` is read as lines only, and only while `.blurred.json` is absent; the first write retires it, after the new file is in place. - A planted directory is a 409, not a 500 (2/3 plus a third angle, executed by the seat). The reader was hardened against it and the writer was not: os.replace and unlink raised IsADirectoryError through the route. Now the writer is judged by its reader: set_blurred re-reads after writing and raises BlurUnwritable unless the set on disk is the set asked for. That one check covers a directory at either name, a permission and a race. - A lone surrogate is dropped on read (hulda, executed). `"\ud800"` is a valid JSON string that no filename can produce, and the UTF-8 encode raised on it at every later write. - The writer respects the reader's size cap (2/3). Nothing capped the write, and the reader reads an oversized file as EMPTY, which reveals everything. - One predicate, check_rel, for the route and the CLI (2/3). The CLI's `..` substring guard refused `a..b.png`, which the route accepts. It also refuses an empty path now (regin, kimi), and every item is checked before any is written. - `booth blur` fails closed, with a message and exit 3, when its package is missing (kimi), as `link` already does. Declined, with reasons: the Item positional-constructor break (booth_items is the only constructor, INV-1), the fdopen fd leak and the short read (not constructible on a local filesystem, and the `.seen` shape), and unreadable-reads-as-revealed (blur is cosmetic; the `.seen` posture). blur_storage.toml: 20/20 proved. One row came back VACUOUS on its first run, because `set() or X` is X, and was rewritten before counting.	2026-09-23 23:01:18 -07:00
vh	4cfbce5109	fix(blur): .blurred round-trips any rel, and one writer serves both surfaces The heid bug-hunt on r2b merge 1 found the /blur route stripping `f` before writing, so the form for " a.png" blurred its neighbour "a.png". The route was only half of it: `.blurred` was one stripped rel per line, so no writer could store a rel with a leading space or a newline, whatever the route did. Operator-ruled 2026-09-23 ("fix the blur"). - booth/blur.py (new, stdlib-only): read_blurred / set_blurred / BLUR_FILE. `.blurred` is now a JSON array in sorted order, the `.seen` shape: opened O_NOFOLLOW \| O_NONBLOCK with an S_ISREG check and a 1 MiB cap, so a planted symlink is refused and a FIFO can no longer hang every Desk render (the old read_text() blocked on one). Writes go through mkstemp + os.replace. The legacy line format is still READ, so the 6 live line-format files keep their blur until their next write upgrades them. Measured before the change: 42 live rels, none with edge whitespace, so the defect had no live victims. - The route no longer strips `f`. - scripts/booth `blur`/`unblur` go through booth.blur.set_blurred instead of their own grep/printf line writer. Two writers of one format is how the formats drift, and after this change the shell writer would have appended a line to a JSON array. Every path is checked before anything is written. - Item.blurred_self (appended to the record): the item's own blur, resolved in booth_items from the same read as `blurred`. It replaces build_gallery's second read_blurred, which a write between the two reads could split (invariant 3). app.py no longer reads blur state at all, and a test asserts it. Names stay importable from booth.app and booth.items (invariant 4). blur joins test_stdlib_only. test_cli's per-item-survives test now reads through the reader rather than asserting the old byte format. The r2b contract and its mutation row follow blurred_self onto the record. tests/mutations/blur_storage.toml proves 12 falsifiers by running the change each forbids. Not in this change, and still ours: the "off"-means-ON idiom drift between /blur, /blurbooth and /flag (forms only ever send 0/1), and the CLI's `.blurbooth` touch following a symlink where the service no longer does.	2026-09-23 22:05:18 -07:00

vh

c1f5543b77

fix(blur): fold the heid bug-hunt: two file names, a reader-judged writer, one predicate

The heid bug-hunt panel on 4cfbce5 (hulda, regin, kimi; groa timed out) found
four real defects in the round-trip fix, and three of its arms converged on the
worst: it re-created the bug it existed to fix.

- Two names, never a sniffed file (3/3). JSON went into the OLD `.blurred`, and
  the reader guessed the format from the bytes, so a legacy file whose one line
  is an item named `["a.png"]` read as {"a.png"} and blurred the neighbour. The
  set now lives in `.blurred.json`, JSON only. The legacy `.blurred` is read as
  lines only, and only while `.blurred.json` is absent; the first write retires
  it, after the new file is in place.
- A planted directory is a 409, not a 500 (2/3 plus a third angle, executed by
  the seat). The reader was hardened against it and the writer was not:
  os.replace and unlink raised IsADirectoryError through the route. Now the
  writer is judged by its reader: set_blurred re-reads after writing and raises
  BlurUnwritable unless the set on disk is the set asked for. That one check
  covers a directory at either name, a permission and a race.
- A lone surrogate is dropped on read (hulda, executed). `"\ud800"` is a valid
  JSON string that no filename can produce, and the UTF-8 encode raised on it
  at every later write.
- The writer respects the reader's size cap (2/3). Nothing capped the write,
  and the reader reads an oversized file as EMPTY, which reveals everything.
- One predicate, check_rel, for the route and the CLI (2/3). The CLI's `*..*`
  substring guard refused `a..b.png`, which the route accepts. It also refuses
  an empty path now (regin, kimi), and every item is checked before any is
  written.
- `booth blur` fails closed, with a message and exit 3, when its package is
  missing (kimi), as `link` already does.

Declined, with reasons: the Item positional-constructor break (booth_items is
the only constructor, INV-1), the fdopen fd leak and the short read (not
constructible on a local filesystem, and the `.seen` shape), and
unreadable-reads-as-revealed (blur is cosmetic; the `.seen` posture).
blur_storage.toml: 20/20 proved. One row came back VACUOUS on its first run,
because `set() or X` is X, and was rewritten before counting.

2026-09-23 23:01:18 -07:00

vh

4cfbce5109

fix(blur): .blurred round-trips any rel, and one writer serves both surfaces

The heid bug-hunt on r2b merge 1 found the /blur route stripping `f` before
writing, so the form for " a.png" blurred its neighbour "a.png". The route was
only half of it: `.blurred` was one stripped rel per line, so no writer could
store a rel with a leading space or a newline, whatever the route did.
Operator-ruled 2026-09-23 ("fix the blur").

- booth/blur.py (new, stdlib-only): read_blurred / set_blurred / BLUR_FILE.
  `.blurred` is now a JSON array in sorted order, the `.seen` shape: opened
  O_NOFOLLOW | O_NONBLOCK with an S_ISREG check and a 1 MiB cap, so a planted
  symlink is refused and a FIFO can no longer hang every Desk render (the old
  read_text() blocked on one). Writes go through mkstemp + os.replace. The
  legacy line format is still READ, so the 6 live line-format files keep their
  blur until their next write upgrades them. Measured before the change: 42
  live rels, none with edge whitespace, so the defect had no live victims.
- The route no longer strips `f`.
- scripts/booth `blur`/`unblur` go through booth.blur.set_blurred instead of
  their own grep/printf line writer. Two writers of one format is how the
  formats drift, and after this change the shell writer would have appended a
  line to a JSON array. Every path is checked before anything is written.
- Item.blurred_self (appended to the record): the item's own blur, resolved in
  booth_items from the same read as `blurred`. It replaces build_gallery's
  second read_blurred, which a write between the two reads could split
  (invariant 3). app.py no longer reads blur state at all, and a test asserts
  it.

Names stay importable from booth.app and booth.items (invariant 4). blur joins
test_stdlib_only. test_cli's per-item-survives test now reads through the reader
rather than asserting the old byte format. The r2b contract and its mutation
row follow blurred_self onto the record. tests/mutations/blur_storage.toml
proves 12 falsifiers by running the change each forbids.

Not in this change, and still ours: the "off"-means-ON idiom drift between
/blur, /blurbooth and /flag (forms only ever send 0/1), and the CLI's
`.blurbooth` touch following a symlink where the service no longer does.

2026-09-23 22:05:18 -07:00