booth

3 Commits

Include renames

Author SHA1 Message Date

Author	SHA1	Message	Date
vh	8a78a9bd1d	fix(blur): writes are strict, so a set the writer cannot read is never overwritten groa's late retry on the blur bug-hunt, adjudicated against the landed code. Its four bugs were already fixed, but a robustness note (mkstemp's 0600 locks out a reader under another uid, which then "sees nothing and replaces it") pointed at a real gap. set_blurred built on read_blurred, the renderer's lenient reader, which turns an unreadable, oversized or malformed `.blurred.json` into an empty set. The writer then replaced the file, and whatever it held was gone. This is the `.marks.json` wipe of 2026-09-21 in a new module, and it shipped for a night. - `_load` is the one parse with two postures. read_blurred maps its refusal to "nothing blurred" (a damaged file costs the blur, never the page). set_blurred lets it raise BlurUnwritable, which the route answers with 409 and the CLI with exit 3, and changes nothing. - It refuses only for a REGULAR file it cannot read. A link, a directory or a FIFO at either name holds no set anyone wrote, so it reads as empty, and the postcondition judges whether the write can land: a link is replaced, a directory refused. - The file is 0644 again, as the line-format writer left it (fchmod after mkstemp). The open flags in `_read_capped` became a second layer behind the new lstat check, and the mutation run caught their rows VACUOUS through the public API. They are now held to account by direct tests, because they still close the lstat-to-open race. blur_storage.toml: 25/25. No second panel was run: this folds one reviewer note plus the repo's own recorded lesson, with a test and a proved row for each behaviour.	2026-09-24 00:56:25 -07:00
vh	c1f5543b77	fix(blur): fold the heid bug-hunt: two file names, a reader-judged writer, one predicate The heid bug-hunt panel on `4cfbce5` (hulda, regin, kimi; groa timed out) found four real defects in the round-trip fix, and three of its arms converged on the worst: it re-created the bug it existed to fix. - Two names, never a sniffed file (3/3). JSON went into the OLD `.blurred`, and the reader guessed the format from the bytes, so a legacy file whose one line is an item named `["a.png"]` read as {"a.png"} and blurred the neighbour. The set now lives in `.blurred.json`, JSON only. The legacy `.blurred` is read as lines only, and only while `.blurred.json` is absent; the first write retires it, after the new file is in place. - A planted directory is a 409, not a 500 (2/3 plus a third angle, executed by the seat). The reader was hardened against it and the writer was not: os.replace and unlink raised IsADirectoryError through the route. Now the writer is judged by its reader: set_blurred re-reads after writing and raises BlurUnwritable unless the set on disk is the set asked for. That one check covers a directory at either name, a permission and a race. - A lone surrogate is dropped on read (hulda, executed). `"\ud800"` is a valid JSON string that no filename can produce, and the UTF-8 encode raised on it at every later write. - The writer respects the reader's size cap (2/3). Nothing capped the write, and the reader reads an oversized file as EMPTY, which reveals everything. - One predicate, check_rel, for the route and the CLI (2/3). The CLI's `..` substring guard refused `a..b.png`, which the route accepts. It also refuses an empty path now (regin, kimi), and every item is checked before any is written. - `booth blur` fails closed, with a message and exit 3, when its package is missing (kimi), as `link` already does. Declined, with reasons: the Item positional-constructor break (booth_items is the only constructor, INV-1), the fdopen fd leak and the short read (not constructible on a local filesystem, and the `.seen` shape), and unreadable-reads-as-revealed (blur is cosmetic; the `.seen` posture). blur_storage.toml: 20/20 proved. One row came back VACUOUS on its first run, because `set() or X` is X, and was rewritten before counting.	2026-09-23 23:01:18 -07:00
vh	4cfbce5109	fix(blur): .blurred round-trips any rel, and one writer serves both surfaces The heid bug-hunt on r2b merge 1 found the /blur route stripping `f` before writing, so the form for " a.png" blurred its neighbour "a.png". The route was only half of it: `.blurred` was one stripped rel per line, so no writer could store a rel with a leading space or a newline, whatever the route did. Operator-ruled 2026-09-23 ("fix the blur"). - booth/blur.py (new, stdlib-only): read_blurred / set_blurred / BLUR_FILE. `.blurred` is now a JSON array in sorted order, the `.seen` shape: opened O_NOFOLLOW \| O_NONBLOCK with an S_ISREG check and a 1 MiB cap, so a planted symlink is refused and a FIFO can no longer hang every Desk render (the old read_text() blocked on one). Writes go through mkstemp + os.replace. The legacy line format is still READ, so the 6 live line-format files keep their blur until their next write upgrades them. Measured before the change: 42 live rels, none with edge whitespace, so the defect had no live victims. - The route no longer strips `f`. - scripts/booth `blur`/`unblur` go through booth.blur.set_blurred instead of their own grep/printf line writer. Two writers of one format is how the formats drift, and after this change the shell writer would have appended a line to a JSON array. Every path is checked before anything is written. - Item.blurred_self (appended to the record): the item's own blur, resolved in booth_items from the same read as `blurred`. It replaces build_gallery's second read_blurred, which a write between the two reads could split (invariant 3). app.py no longer reads blur state at all, and a test asserts it. Names stay importable from booth.app and booth.items (invariant 4). blur joins test_stdlib_only. test_cli's per-item-survives test now reads through the reader rather than asserting the old byte format. The r2b contract and its mutation row follow blurred_self onto the record. tests/mutations/blur_storage.toml proves 12 falsifiers by running the change each forbids. Not in this change, and still ours: the "off"-means-ON idiom drift between /blur, /blurbooth and /flag (forms only ever send 0/1), and the CLI's `.blurbooth` touch following a symlink where the service no longer does.	2026-09-23 22:05:18 -07:00

vh

8a78a9bd1d

fix(blur): writes are strict, so a set the writer cannot read is never overwritten

groa's late retry on the blur bug-hunt, adjudicated against the landed code.
Its four bugs were already fixed, but a robustness note (mkstemp's 0600 locks
out a reader under another uid, which then "sees nothing and replaces it")
pointed at a real gap. set_blurred built on read_blurred, the renderer's
lenient reader, which turns an unreadable, oversized or malformed
`.blurred.json` into an empty set. The writer then replaced the file, and
whatever it held was gone. This is the `.marks.json` wipe of 2026-09-21 in a
new module, and it shipped for a night.

- `_load` is the one parse with two postures. read_blurred maps its refusal to
  "nothing blurred" (a damaged file costs the blur, never the page).
  set_blurred lets it raise BlurUnwritable, which the route answers with 409
  and the CLI with exit 3, and changes nothing.
- It refuses only for a REGULAR file it cannot read. A link, a directory or a
  FIFO at either name holds no set anyone wrote, so it reads as empty, and the
  postcondition judges whether the write can land: a link is replaced, a
  directory refused.
- The file is 0644 again, as the line-format writer left it (fchmod after
  mkstemp).

The open flags in `_read_capped` became a second layer behind the new lstat
check, and the mutation run caught their rows VACUOUS through the public API.
They are now held to account by direct tests, because they still close the
lstat-to-open race. blur_storage.toml: 25/25. No second panel was run: this
folds one reviewer note plus the repo's own recorded lesson, with a test and
a proved row for each behaviour.

2026-09-24 00:56:25 -07:00

vh

c1f5543b77

fix(blur): fold the heid bug-hunt: two file names, a reader-judged writer, one predicate

The heid bug-hunt panel on 4cfbce5 (hulda, regin, kimi; groa timed out) found
four real defects in the round-trip fix, and three of its arms converged on the
worst: it re-created the bug it existed to fix.

- Two names, never a sniffed file (3/3). JSON went into the OLD `.blurred`, and
  the reader guessed the format from the bytes, so a legacy file whose one line
  is an item named `["a.png"]` read as {"a.png"} and blurred the neighbour. The
  set now lives in `.blurred.json`, JSON only. The legacy `.blurred` is read as
  lines only, and only while `.blurred.json` is absent; the first write retires
  it, after the new file is in place.
- A planted directory is a 409, not a 500 (2/3 plus a third angle, executed by
  the seat). The reader was hardened against it and the writer was not:
  os.replace and unlink raised IsADirectoryError through the route. Now the
  writer is judged by its reader: set_blurred re-reads after writing and raises
  BlurUnwritable unless the set on disk is the set asked for. That one check
  covers a directory at either name, a permission and a race.
- A lone surrogate is dropped on read (hulda, executed). `"\ud800"` is a valid
  JSON string that no filename can produce, and the UTF-8 encode raised on it
  at every later write.
- The writer respects the reader's size cap (2/3). Nothing capped the write,
  and the reader reads an oversized file as EMPTY, which reveals everything.
- One predicate, check_rel, for the route and the CLI (2/3). The CLI's `*..*`
  substring guard refused `a..b.png`, which the route accepts. It also refuses
  an empty path now (regin, kimi), and every item is checked before any is
  written.
- `booth blur` fails closed, with a message and exit 3, when its package is
  missing (kimi), as `link` already does.

Declined, with reasons: the Item positional-constructor break (booth_items is
the only constructor, INV-1), the fdopen fd leak and the short read (not
constructible on a local filesystem, and the `.seen` shape), and
unreadable-reads-as-revealed (blur is cosmetic; the `.seen` posture).
blur_storage.toml: 20/20 proved. One row came back VACUOUS on its first run,
because `set() or X` is X, and was rewritten before counting.

2026-09-23 23:01:18 -07:00

vh

4cfbce5109

fix(blur): .blurred round-trips any rel, and one writer serves both surfaces

The heid bug-hunt on r2b merge 1 found the /blur route stripping `f` before
writing, so the form for " a.png" blurred its neighbour "a.png". The route was
only half of it: `.blurred` was one stripped rel per line, so no writer could
store a rel with a leading space or a newline, whatever the route did.
Operator-ruled 2026-09-23 ("fix the blur").

- booth/blur.py (new, stdlib-only): read_blurred / set_blurred / BLUR_FILE.
  `.blurred` is now a JSON array in sorted order, the `.seen` shape: opened
  O_NOFOLLOW | O_NONBLOCK with an S_ISREG check and a 1 MiB cap, so a planted
  symlink is refused and a FIFO can no longer hang every Desk render (the old
  read_text() blocked on one). Writes go through mkstemp + os.replace. The
  legacy line format is still READ, so the 6 live line-format files keep their
  blur until their next write upgrades them. Measured before the change: 42
  live rels, none with edge whitespace, so the defect had no live victims.
- The route no longer strips `f`.
- scripts/booth `blur`/`unblur` go through booth.blur.set_blurred instead of
  their own grep/printf line writer. Two writers of one format is how the
  formats drift, and after this change the shell writer would have appended a
  line to a JSON array. Every path is checked before anything is written.
- Item.blurred_self (appended to the record): the item's own blur, resolved in
  booth_items from the same read as `blurred`. It replaces build_gallery's
  second read_blurred, which a write between the two reads could split
  (invariant 3). app.py no longer reads blur state at all, and a test asserts
  it.

Names stay importable from booth.app and booth.items (invariant 4). blur joins
test_stdlib_only. test_cli's per-item-survives test now reads through the reader
rather than asserting the old byte format. The r2b contract and its mutation
row follow blurred_self onto the record. tests/mutations/blur_storage.toml
proves 12 falsifiers by running the change each forbids.

Not in this change, and still ours: the "off"-means-ON idiom drift between
/blur, /blurbooth and /flag (forms only ever send 0/1), and the CLI's
`.blurbooth` touch following a symlink where the service no longer does.

2026-09-23 22:05:18 -07:00