booth

2 Commits

Include renames

Author SHA1 Message Date

Author	SHA1	Message	Date
vh	e702be4e1a	fix: a wrong-shaped answer no longer 500s the gallery and the marks page Pre-existing, measured at `42ea67f`, so it predates U3. `_hydrate` checked only that `answer` was a dict and never that `answer["answers"]` was one, so `marks_for` and `hold_read` both reported the mark healthy with no read error -- and `_ask_inline.html` then asked a list for `.get`. The v0.2.2 lesson was half-implemented: that outage was a file that could not be PARSED and the reader was made lenient, while this one parses perfectly and breaks one layer further in, at render, where no leniency existed. Closed at the hydration boundary rather than by a third copy of the guard -- one predicate, one place, every surface inherits it. Only the multi case is checked, because only the multi case indexes; requiring `answers` unconditionally would break every single-question pick, and that direction has its own test. Measured before and after: gallery and marks pages 500 -> 200, the error visible on the page, the booth's other healthy pick untouched. The placement was the one open operator question of the session. It was surfaced three times without a ruling, so it is taken under a stated assumption and is cheap to move: the whole fix is one condition in one function. Two things fell out of it worth more than the fix. `_safe_fragments` no longer has a reachable natural trigger. Probed every wrong answer shape a .marks.json can carry: `answers` as a list, a string or null all become hydration errors now, and a wrong-typed value INSIDE `answers` renders without raising, because Jinja absorbs attribute access on a non-mapping. U3's guard is a pure backstop, and its test now says so and trips it synthetically through the shared macro module rather than asserting a path nothing reaches. A guard tested by an unreachable input is an untested guard. And that guard's handler could not survive the failure it was handling: it caught a raising `_pick_fragments` and rebuilt the broken-ask box through the SAME macro module that had just raised, so whenever `whole` was the broken thing it re-raised and took the whole report. Found by accident while building the falsifier. Fixed, with its own test. Both new falsifiers were verified RED against their defeating change rather than assumed. 607 -> 611 tests.	2026-09-22 14:34:28 -07:00
vh	5c20e2f4d5	fix(u3): seven defects two cold panels found in the declared seam The /heid-code-review and /heid-bug-hunt panels, artifact-only over the U3 diff, between them found four real defects and three vacuous falsifiers. Both snapshots predate the contract-review fixes, so two of their findings were already closed; the rest are here. Prototype pollution in the placement maps. A mark id and a question key are both [A-Za-z0-9][A-Za-z0-9._-]*, so `toString` and `constructor` are legal in each. Against a plain `{}` an anchor naming NO mark returned an inherited function, passed the guard meant to reject it, and threw on .questions.length -- aborting placement before the tail, so one typo in author markup cost the page every ask. The `placed` set had the mirror bug: inherited `got.constructor` read as already-placed and silently dropped a question. Object.create(null), three times. Found independently by both panels. A declaring page was not served as written. read_text() opens in universal-newline mode, so a CRLF report came back LF, and errors="replace" replaced every byte that was not valid UTF-8. That is this unit's headline promise, broken by the read itself, and the test could not see it because its fixture was LF-only ASCII. The verbatim branch reads and serves bytes now; the decoded copy answers only "does it declare the seam?". A submit anchor inside the author's own <form> lost ours -- the parser drops a nested form element outright -- while the code still recorded the pick as submitted, so no fallback was appended. Every control's form= pointed at nothing and the button did nothing. It counts as submitted only if the form survived. A broken pick's diagnostic never rendered from a submit-only anchor: an errored pick's submit block is empty, and mounting that then marking it placed made the tail skip the "broken ask" box entirely. The anchor is left alone instead. An author's own element could hijack the open-ask chip -- id="bk-ask-winner- background" satisfies any prefix rule, hyphen boundary included. The chip now searches only elements this script mounted, which is the identity the deleted bk-ask-<id>-top anchor used to guarantee, and takes the earliest by compareDocumentPosition. No error boundary around fragment rendering. A .marks.json that is well-formed JSON with a wrong-shaped answer hydrates with no error and then raises in the macro; this endpoint renders every pick on every load of the report, so that was the whole seam gone while hold_read called the file readable. Reproduced before building for it. _safe_fragments gives it the per-mark leniency _hydrate_safe already applies one layer down. The gallery and marks pages still 500 on that same entry. Measured at `42ea67f` -- it predates this unit, they render the same macro with no guard, and the gallery is named out of scope in the contract. Recorded, not quietly widened: persistent-memory.d/2026-09-22-a-wrong-shaped-answer-500s-the-gallery.md Also corrected: several comments claimed a multi-question pick POSTs a 400 unless every question is answered. It does not -- an empty submission is refused, a partial one is recorded on purpose. The real reason an unplaced question must still be appended is that a question which never reaches the page cannot be answered at all. Vacuity pass rebuilt around the rule this session learned: the mutation comes from the invariant's claim, never from the falsifier's example. 21 mutations, 21 caught, unmutated control green. Getting there took three rounds -- it passed INV-3 with the contract's own mutation, then found its own fix's hole, then flagged seven stale mutations and one genuinely vacuous fixture whose sibling-mark arrangement made the right answer also the first answer. 444 tests. Deployed and verified: 23/23 booths 200, and all four live verbatim reports served at exactly +46 bytes -- len(EMBED_SCRIPT_TAG) -- with the authors' own wrappers and headings intact and no console errors.	2026-09-22 11:22:37 -07:00

vh

e702be4e1a

fix: a wrong-shaped answer no longer 500s the gallery and the marks page

Pre-existing, measured at 42ea67f, so it predates U3. `_hydrate` checked only
that `answer` was a dict and never that `answer["answers"]` was one, so
`marks_for` and `hold_read` both reported the mark healthy with no read error
-- and `_ask_inline.html` then asked a list for `.get`. The v0.2.2 lesson was
half-implemented: that outage was a file that could not be PARSED and the
reader was made lenient, while this one parses perfectly and breaks one layer
further in, at render, where no leniency existed.

Closed at the hydration boundary rather than by a third copy of the guard --
one predicate, one place, every surface inherits it. Only the multi case is
checked, because only the multi case indexes; requiring `answers`
unconditionally would break every single-question pick, and that direction has
its own test. Measured before and after: gallery and marks pages 500 -> 200,
the error visible on the page, the booth's other healthy pick untouched.

The placement was the one open operator question of the session. It was
surfaced three times without a ruling, so it is taken under a stated assumption
and is cheap to move: the whole fix is one condition in one function.

Two things fell out of it worth more than the fix.

`_safe_fragments` no longer has a reachable natural trigger. Probed every wrong
answer shape a .marks.json can carry: `answers` as a list, a string or null all
become hydration errors now, and a wrong-typed value INSIDE `answers` renders
without raising, because Jinja absorbs attribute access on a non-mapping. U3's
guard is a pure backstop, and its test now says so and trips it synthetically
through the shared macro module rather than asserting a path nothing reaches.
A guard tested by an unreachable input is an untested guard.

And that guard's handler could not survive the failure it was handling: it
caught a raising `_pick_fragments` and rebuilt the broken-ask box through the
SAME macro module that had just raised, so whenever `whole` was the broken
thing it re-raised and took the whole report. Found by accident while building
the falsifier. Fixed, with its own test.

Both new falsifiers were verified RED against their defeating change rather
than assumed.

607 -> 611 tests.

2026-09-22 14:34:28 -07:00

vh

5c20e2f4d5

fix(u3): seven defects two cold panels found in the declared seam

The /heid-code-review and /heid-bug-hunt panels, artifact-only over the U3
diff, between them found four real defects and three vacuous falsifiers. Both
snapshots predate the contract-review fixes, so two of their findings were
already closed; the rest are here.

Prototype pollution in the placement maps. A mark id and a question key are
both [A-Za-z0-9][A-Za-z0-9._-]*, so `toString` and `constructor` are legal in
each. Against a plain `{}` an anchor naming NO mark returned an inherited
function, passed the guard meant to reject it, and threw on .questions.length
-- aborting placement before the tail, so one typo in author markup cost the
page every ask. The `placed` set had the mirror bug: inherited
`got.constructor` read as already-placed and silently dropped a question.
Object.create(null), three times. Found independently by both panels.

A declaring page was not served as written. read_text() opens in
universal-newline mode, so a CRLF report came back LF, and errors="replace"
replaced every byte that was not valid UTF-8. That is this unit's headline
promise, broken by the read itself, and the test could not see it because its
fixture was LF-only ASCII. The verbatim branch reads and serves bytes now; the
decoded copy answers only "does it declare the seam?".

A submit anchor inside the author's own <form> lost ours -- the parser drops a
nested form element outright -- while the code still recorded the pick as
submitted, so no fallback was appended. Every control's form= pointed at
nothing and the button did nothing. It counts as submitted only if the form
survived.

A broken pick's diagnostic never rendered from a submit-only anchor: an errored
pick's submit block is empty, and mounting that then marking it placed made the
tail skip the "broken ask" box entirely. The anchor is left alone instead.

An author's own element could hijack the open-ask chip -- id="bk-ask-winner-
background" satisfies any prefix rule, hyphen boundary included. The chip now
searches only elements this script mounted, which is the identity the deleted
bk-ask-<id>-top anchor used to guarantee, and takes the earliest by
compareDocumentPosition.

No error boundary around fragment rendering. A .marks.json that is well-formed
JSON with a wrong-shaped answer hydrates with no error and then raises in the
macro; this endpoint renders every pick on every load of the report, so that
was the whole seam gone while hold_read called the file readable. Reproduced
before building for it. _safe_fragments gives it the per-mark leniency
_hydrate_safe already applies one layer down.

The gallery and marks pages still 500 on that same entry. Measured at 42ea67f
-- it predates this unit, they render the same macro with no guard, and the
gallery is named out of scope in the contract. Recorded, not quietly widened:
persistent-memory.d/2026-09-22-a-wrong-shaped-answer-500s-the-gallery.md

Also corrected: several comments claimed a multi-question pick POSTs a 400
unless every question is answered. It does not -- an empty submission is
refused, a partial one is recorded on purpose. The real reason an unplaced
question must still be appended is that a question which never reaches the page
cannot be answered at all.

Vacuity pass rebuilt around the rule this session learned: the mutation comes
from the invariant's claim, never from the falsifier's example. 21 mutations,
21 caught, unmutated control green. Getting there took three rounds -- it
passed INV-3 with the contract's own mutation, then found its own fix's hole,
then flagged seven stale mutations and one genuinely vacuous fixture whose
sibling-mark arrangement made the right answer also the first answer.

444 tests. Deployed and verified: 23/23 booths 200, and all four live verbatim
reports served at exactly +46 bytes -- len(EMBED_SCRIPT_TAG) -- with the
authors' own wrappers and headings intact and no console errors.

2026-09-22 11:22:37 -07:00