69 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
vh	e702be4e1a	fix: a wrong-shaped answer no longer 500s the gallery and the marks page ... Pre-existing, measured at 42ea67f, so it predates U3. `_hydrate` checked only that `answer` was a dict and never that `answer["answers"]` was one, so `marks_for` and `hold_read` both reported the mark healthy with no read error -- and `_ask_inline.html` then asked a list for `.get`. The v0.2.2 lesson was half-implemented: that outage was a file that could not be PARSED and the reader was made lenient, while this one parses perfectly and breaks one layer further in, at render, where no leniency existed. Closed at the hydration boundary rather than by a third copy of the guard -- one predicate, one place, every surface inherits it. Only the multi case is checked, because only the multi case indexes; requiring `answers` unconditionally would break every single-question pick, and that direction has its own test. Measured before and after: gallery and marks pages 500 -> 200, the error visible on the page, the booth's other healthy pick untouched. The placement was the one open operator question of the session. It was surfaced three times without a ruling, so it is taken under a stated assumption and is cheap to move: the whole fix is one condition in one function. Two things fell out of it worth more than the fix. `_safe_fragments` no longer has a reachable natural trigger. Probed every wrong answer shape a .marks.json can carry: `answers` as a list, a string or null all become hydration errors now, and a wrong-typed value INSIDE `answers` renders without raising, because Jinja absorbs attribute access on a non-mapping. U3's guard is a pure backstop, and its test now says so and trips it synthetically through the shared macro module rather than asserting a path nothing reaches. A guard tested by an unreachable input is an untested guard. And that guard's handler could not survive the failure it was handling: it caught a raising `_pick_fragments` and rebuilt the broken-ask box through the SAME macro module that had just raised, so whenever `whole` was the broken thing it re-raised and took the whole report. Found by accident while building the falsifier. Fixed, with its own test. Both new falsifiers were verified RED against their defeating change rather than assumed. 607 -> 611 tests.	2026-09-22 14:34:28 -07:00
vh	c5ac49356f	memory: snapshot — U6 released at v0.6.0, six of seven v1 units landed ... Nothing in flight. The in-flight section is rewritten to the post-release state and carries the five things a fresh session must not do: push (main is 8 ahead of origin/main), seed the registry, send the 17-handle note, run either dated prediction early, or start U7 without re-counting the booths first. Two new detail files: the release itself, and what each of the five review passes could only see alone -- the strongest evidence this repo has for running all of them rather than picking one. The earlier U6 entry is reconciled; it was written while the gates were still out and said NOT TAGGED. Restored in the rewrite: the warning that the 17 handles were never told `keep` stopped meaning "waiting on an answer", which is load-bearing for how the 2026-10-06 re-count reads, and the fact that a remote now exists.	2026-09-22 14:24:12 -07:00
vh	3296a868fa	chore(release): v0.6.0 — U6, benches ... The sixth of seven v1 units. A bench is a running thing, registered: identity is the normalized URL so re-posting updates the row instead of appending a fifth, `booth link` refuses the one shape that now has a better home, and the board marks the rows whose booths are gone without deleting a single one. Minor rather than patch, approved by the operator. Two capabilities arrived and one verb changed behaviour for seventeen agent handles, which is the push-notification bar in the tier test: `booth bench` is new, the board gained a dead marker, and `booth link` now refuses a booth URL and a credentialed one. 444 -> 607 tests across the unit and its three cold gates. All four review gates closed: an in-session seam review (three real contract defects, including one that would have 404'd the whole board page), an in-session adversarial pass (four defects, one of them this repo's own FIFO lesson recurring in a new file), and three cold cross-frontier panels -- contract paraphrase, code-vs- contract, and a diff-scoped bug hunt -- folded in full with exactly one finding declined and its reasoning recorded. Measured before contracted, and the measurement changed the unit: the design doc's headline 69% rot was two defects wearing one number, and U5 had already closed the larger half. Identity is the FULL normalized URL rather than the origin because origin identity merges eight distinct gitea repositories, three unrelated model cards, and the two LRPG surfaces the design doc itself names as an example of two real benches. v0.6.0	2026-09-22 14:21:23 -07:00
vh	8cb21193dc	fix(u6): fold the cold bug-hunt panel — a div in a span, a symlink split, and an append outside its lock ... /heid-bug-hunt panel 01M35CRRK2RTVWWF1BN09AFQG3, diff-scoped against 91fd8bc. The most severe of the three rounds, and three of its four convergent findings were already closed by our own adversarial pass before the reply landed. Three were not. - The benches panel was nested inside the booth header's <span class="sub">. The insertion had matched the first `{% if board %}` in the template rather than the block-level one. A div inside a span is invalid HTML: the parser closes the span implicitly and hoists the div out, orphaning the rest of the sub-line. Nothing 500s, which is precisely why no test in this suite could see it. Moved to block level, pinned by an offset assertion, and verified with a real HTML parser. - _booth_exists used a bare is_dir() while resolve_booth resolves and requires the parent to BE the data root. They disagreed on a symlink: the marker called a booth pointing outside the root alive while the page 404s it, so the row rendered healthy and the link was dead. Same containment now, and ValueError joins OSError in the guard -- one bad row must never cost the other 220. - The board append opened its fd OUTSIDE the lock. `flock LOCK printf ... >> board` reads as locked and is not: the shell opens the append fd while parsing, before flock acquires. A concurrent unlink replaces the inode via os.replace, the old fd still points at the unlinked one, and the append succeeds, reports success, and vanishes. Pre-existing rather than this unit's, but it is silent data loss in the file this unit lives in. Proved by holding the lock and asserting nothing is written. - The atomic write used a predictable .tmp.<pid> name; a pre-planted symlink there redirects the write straight through the replace. mkstemp with O_EXCL in the same directory, and an fsync before the replace -- os.replace orders the rename, not the data behind it. Declined and recorded: on a host where booth.links cannot be imported, `booth link` now refuses every URL rather than only booth ones. True, and kept. A guard that fails open is not a guard, and that state is a broken install in which most of the CLI is equally broken. The sharpest line in the reply is one three arms found independently: this repo had ALREADY paid for the RecursionError class in marks.py, and the new module re-introduced the unguarded parse. Reading the new module in isolation would never have surfaced that. 604 -> 607 tests.	2026-09-22 14:20:06 -07:00
vh	e3853e2692	docs(u6): the CLI usage strings carry the --apply <id> form ... The three places scripts/booth documents itself -- the header block and both usage lines -- still described a bare --apply, which is now refused. A usage string that names a form the script rejects is worse than none.	2026-09-22 14:13:41 -07:00
vh	32e3ed65e1	fix(u6): fold the cold contract panel — the import selection gap, and a document arguing with itself ... /heid-contract-review panel 01M35BWCJ806MT75NA630Y4WFH. The headline arrived from all four arms independently and it is a missing feature, not a wording problem. `bench import --apply` registered every candidate, while the same contract says roughly 14 of 35 are reference bookmarks that must stay on the board. There was no selection mechanism between the dry-run report and the write -- so the write path did the exact thing this unit's rationale calls impossible, tell a bench from a bookmark by its URL, silently, to rows that belong where they are. The report existed precisely because the decision is not mechanizable. `--apply` now takes the ids the operator names; a bare `--apply` is refused and an unknown id is refused, both writing nothing. Two solo findings, both real: - A successful registration could push the registry past the size its own reader refuses, so the LAST bench added would make every other bench invisible while reporting success. The writer now respects the reader's cap. - The credential ban covered bench URLs and not `booth link`, the door this unit did not touch -- and the board renders on an unauthenticated LAN surface. A password can no longer reach it through either door. A small deliberate widening, named rather than smuggled. Cap semantics were readable three ways (refuse / clip-for-display / truncate-and-store) with a different build behind each, 4-of-4. Now stated per field: name and owner truncate, url and state are refused at the write and are DAMAGE at the read. url is not a display budget -- INV-7 promises the click goes to the posted address byte for byte, and a clipped URL keeps that promise in the type system while breaking it in the browser. The code had been clipping it; fixed. Two passages disagreed about one character: INV-7's specimen named "a trailing slash on a non-empty path" as something normalization changes, while the rule list keeps it and INV-6 makes the two spellings two benches. The rule list is right; the specimen was wrong. Found by 3-of-4. Also: INV-6's component list was illustrative where it had to be exhaustive and was short scheme and port; "writes nothing" appeared twice with different lists; the dead marker's predicate was readable two ways with 221 rows riding on it; and INV-2's falsifier read as though three callers agreeing pinned something, when three callers of one wrong predicate agree perfectly -- the table's expected values are the real check and now say so. 597 -> 604 tests.	2026-09-22 14:12:36 -07:00
vh	8a7af3eb08	fix(u6): fold the cold code-review panel — four-arm convergence on three surface clauses ... /heid-code-review panel 01M35CK8YKEKMV7T15JXEF6A8N, verdict NOT drift-zero. Three findings arrived from all four arms independently, and they share a shape: a contract clause written as prose and never converted into an assertion. That is the lens working. - The panel dropped the added date the contract promised to show. - `bench ls` printed no ids, and the URL it printed was truncated to 52 columns so the line was not pasteable into `bench state|rm`. The test's docstring claimed it printed ids and asserted nothing of the kind. - `bench import` printed the description instead of the raw URL beside each normalized id, hiding the collapse the clause exists to expose. - An IPv6 literal lost its brackets: http://[::1]:8080/a normalized to http://::1:8080/a, a broken identity that no re-post can match. Bracketed literals are re-wrapped; an unbracketed one is refused rather than guessed. - A deeply-nested JSON RecursionError escaped read_benches' except pair. The byte cap does not help -- 200k open brackets is 200 KB. - An empty board hid the whole benches panel, registration form included. - The link refusal classified by captured-text emptiness, which bash can erase; it now answers with a B:/N sentinel so no name reads as "not a booth". INV-4's tie-break falsifier could not fail: _write_all serializes with sort_keys=True, so both insertion orders came back already id-sorted and removing the tie-break left the test green. It now calls order_benches directly. Same class as the five vacuous U4 falsifiers, found by a cold reader rather than by us. Also from the arms' per-invariant vacuity pass: INV-6 had no vector pinning a non-default port as part of the identity; INV-3 asserted only that links/ was absent; INV-8's hashed sequence omitted a read verb; INV-9's AST walk is defeated by a string import. All closed. Contract amended where the code was right: `updated` means last mutation, the id cap is write-only because the id is the locator controls post back, INV-8's file list includes the lock sidecar it always mandated. Every line number is out of the prose -- the panel found two already stale. 565 -> 593 tests. Nothing declined.	2026-09-22 13:50:40 -07:00
vh	0a2bb1d26c	fix(u6): the booth check fails closed with a reason, and a dead write leaves no scratch ... Two more from the in-session adversarial pass. `booth link`'s new booth-URL check shells out to booth/links.py. When that import cannot run, the command substitution under `set -e` aborted the script with a bare ModuleNotFoundError traceback: the right DIRECTION (no row was appended — a guard that fails open is not a guard) reached by accident, and unactionable when it fires. Handled explicitly now: exit 3, and a message naming what the check needs. The fail-closed direction is stated rather than inherited from shell semantics, and a test pins it — the defeating change in either direction goes red. _write_all's scratch file was stranded beside the registry if the write died between create and replace. Cleaned up on every exit path. The prior registry was never at risk either way: os.replace is the only thing that publishes. Also pins normalization idempotence, which `bench state <id|url>` and `bench rm <id|url>` both rely on: they normalize whatever they are handed, so an id that did not normalize to itself would miss the row it names.	2026-09-22 13:33:59 -07:00
vh	8c7f2127eb	fix(u6): a FIFO at the registry path hung the render, and unquote leaked control characters ... Both found by the in-session adversarial pass while the cold panels were still out. The first is this repo's own 2026-09-22 lesson recurring in a new file. _read_bytes bounded the READ and its docstring claimed that closed the named-pipe hole. It does not: open() blocks on a FIFO with no writer, before any byte cap can apply. read_benches runs on the board page's render path, so one FIFO there is a request that never returns and, with enough hits, the threadpool behind every route. Guarded with S_ISREG before the open, which is what marks.py has done since it learned the same thing. The bounded read stays for the case a stat cannot answer: a regular file that grew between the two. booth_target handed back whatever unquote produced, including NUL and newline. Neither can name a directory, and unfiltered they reach is_dir() -- which raises ValueError on an embedded NUL, and ValueError is not an OSError, so it escapes the dead marker's guard -- plus the refusal message the CLI prints and the marker the board renders. Both tests are written to go red under the exact change that defeats them: the FIFO test blocks rather than fails if the regular-file check is removed, and the control-character rows need their own case because %2e%2e and %2f stay green without the clause.	2026-09-22 13:30:22 -07:00
vh	1c3ce5ddb5	feat(u6): benches — a registry with identity, and the rule enforced ... The standing link board carried three jobs because only one of them had a surface. Re-measured before contracting, its 221 rows split into 178 booth announcements (156 already dead) and 43 non-booth rows, of which 8 are the same bench re-posted. U5 gave the booth announcement a home; this gives the running service one, and refuses the one shape that now has somewhere better to go. - booth/benches.py (new, stdlib-only and sibling-free): the Bench record, URL normalization as the identity, a lenient read on the render path and a strict read on the write path, atomic replace under an flock, and a stated total order (state rank, name casefolded, id). - links.booth_target: ONE predicate for "is this a booth URL", consumed by the CLI refusal, the board's dead marker and bench import. Host-agnostic, path-shaped, percent-decoded, never raises. - booth link refuses a booth URL, names `booth new --why`, and writes nothing — not the row, not the board directory, not the announcement. - The board marks rows whose booth has been swept. Nothing here deletes a row: removal stays the operator's two clicks through the existing bulk control. - booth bench add|ls|state|rm|import. import writes nothing without --apply and never edits links.md. - docs/archive/links-2026-09-22.md: the board archived verbatim into git. Identity is the FULL normalized URL, not the origin, and that was measured: origin identity collapses the 43 non-booth rows to 19 groups by merging eight distinct gitea repositories into one row, three unrelated HuggingFace model cards into one, and the two LRPG surfaces on 10.100.10.50:8321 — the design doc's own example of two real benches — into one. Full-URL identity still collapses both cases that doc names: talk 5 to 1, Peedlar 3 to 1. booth link is NOT deprecated. Roughly 14 of the 35 distinct non-booth targets are reference bookmarks for which the board is the right and only home; the design doc's plan to deprecate it would have evicted a third of its live content. Corrected there, along with what "normalized URL" means. The seam review found three real defects in the contract before any code: the claim that test_stdlib_only already forbids sibling imports (it exempts `booth` on purpose), naming resolve_booth as the dead marker's existence check (it raises HTTPException(404), so one swept booth would have 404'd the whole board page), and silence on percent-encoding (booth links are emitted through quote(name, safe=""), so a raw comparison marks every encoded booth dead forever). That both list_booths and sweep_once skip the registry was verified against the real functions rather than assumed. 444 -> 555 tests. Deployed and verified live: 23/23 booths 200, and the board renders 156 dead of 221 rows, matching an independent pre-implementation count. NOT TAGGED: both cold gates are in flight (contract review 01M35BWCJ806MT75NA630Y4WFH, code review 01M35CK8YKEKMV7T15JXEF6A8N) and the bug-hunt has not run. Per the v0.2.0 lesson, the tag waits for the gates.	2026-09-22 13:25:32 -07:00
vh	91fd8bc69d	memory: snapshot — U3 released at v0.5.0, pushed and deployed ... First push of this repo's history: main was 26 commits ahead of origin/main, so v0.2.0 through v0.5.0 all reached the Gitea remote in one motion. A future session can assume a remote exists, which no earlier one could. Records the open defect U3 found and deliberately did not fix -- a well-formed .marks.json with a wrong-shaped answer 500s the gallery and marks pages, measured at 42ea67f so it predates the unit -- and marks it explicitly as awaiting an operator decision with no issue filed, rather than letting it sit in a detail file nobody is routed to. No recommendation is recorded for the next unit. U6 and U7 are genuinely independent and close different defects; the last two before a 1.0 cut are a scope-direction call.	2026-09-22 13:00:34 -07:00
vh	7996fbd597	chore(release): v0.5.0 — U3, the declared embed seam ... Minor rather than patch, and the tie-break rule says default to patch, so the reason is worth stating: a capability arrived AND one left. Report authors gain a declared public API -- one line, `<script src="/_booth/embed.js" defer>`, plus the `data-booth-mark` anchor syntax -- and the verbatim path loses no-JavaScript operation, which it had since it existed. That asymmetry is what makes it not a tie. Either half alone would have been defensible as a patch. Operator approved 2026-09-22. v0.5.0	2026-09-22 12:58:35 -07:00
vh	5c20e2f4d5	fix(u3): seven defects two cold panels found in the declared seam ... The /heid-code-review and /heid-bug-hunt panels, artifact-only over the U3 diff, between them found four real defects and three vacuous falsifiers. Both snapshots predate the contract-review fixes, so two of their findings were already closed; the rest are here. Prototype pollution in the placement maps. A mark id and a question key are both [A-Za-z0-9][A-Za-z0-9._-]*, so `toString` and `constructor` are legal in each. Against a plain `{}` an anchor naming NO mark returned an inherited function, passed the guard meant to reject it, and threw on .questions.length -- aborting placement before the tail, so one typo in author markup cost the page every ask. The `placed` set had the mirror bug: inherited `got.constructor` read as already-placed and silently dropped a question. Object.create(null), three times. Found independently by both panels. A declaring page was not served as written. read_text() opens in universal-newline mode, so a CRLF report came back LF, and errors="replace" replaced every byte that was not valid UTF-8. That is this unit's headline promise, broken by the read itself, and the test could not see it because its fixture was LF-only ASCII. The verbatim branch reads and serves bytes now; the decoded copy answers only "does it declare the seam?". A submit anchor inside the author's own <form> lost ours -- the parser drops a nested form element outright -- while the code still recorded the pick as submitted, so no fallback was appended. Every control's form= pointed at nothing and the button did nothing. It counts as submitted only if the form survived. A broken pick's diagnostic never rendered from a submit-only anchor: an errored pick's submit block is empty, and mounting that then marking it placed made the tail skip the "broken ask" box entirely. The anchor is left alone instead. An author's own element could hijack the open-ask chip -- id="bk-ask-winner- background" satisfies any prefix rule, hyphen boundary included. The chip now searches only elements this script mounted, which is the identity the deleted bk-ask-<id>-top anchor used to guarantee, and takes the earliest by compareDocumentPosition. No error boundary around fragment rendering. A .marks.json that is well-formed JSON with a wrong-shaped answer hydrates with no error and then raises in the macro; this endpoint renders every pick on every load of the report, so that was the whole seam gone while hold_read called the file readable. Reproduced before building for it. _safe_fragments gives it the per-mark leniency _hydrate_safe already applies one layer down. The gallery and marks pages still 500 on that same entry. Measured at 42ea67f -- it predates this unit, they render the same macro with no guard, and the gallery is named out of scope in the contract. Recorded, not quietly widened: persistent-memory.d/2026-09-22-a-wrong-shaped-answer-500s-the-gallery.md Also corrected: several comments claimed a multi-question pick POSTs a 400 unless every question is answered. It does not -- an empty submission is refused, a partial one is recorded on purpose. The real reason an unplaced question must still be appended is that a question which never reaches the page cannot be answered at all. Vacuity pass rebuilt around the rule this session learned: the mutation comes from the invariant's claim, never from the falsifier's example. 21 mutations, 21 caught, unmutated control green. Getting there took three rounds -- it passed INV-3 with the contract's own mutation, then found its own fix's hole, then flagged seven stale mutations and one genuinely vacuous fixture whose sibling-mark arrangement made the right answer also the first answer. 444 tests. Deployed and verified: 23/23 booths 200, and all four live verbatim reports served at exactly +46 bytes -- len(EMBED_SCRIPT_TAG) -- with the authors' own wrappers and headings intact and no console errors.	2026-09-22 11:22:37 -07:00
vh	87e2c5364c	feat(u3): a verbatim report declares the seam, the Booth mounts into it ... A booth that ships its own index.html was served through ten regular expressions applied to markup the Booth did not write: six in wrap_verbatim_html hunting for somewhere to hang a favicon and a chip, four in booth/inline.py substituting rendered ask markup into the author's own tags. Both worked. Both were the most fragile thing in the service, on the path the operator uses most. The whole class is replaced by a declared seam. A report carries one line — <script src="/_booth/embed.js" defer></script> — and the chrome mounts through DOM APIs. What the server does to author HTML is now, in full: return html if declares_embed(html) else html + EMBED_SCRIPT_TAG Two substring tests and a concatenation. Both of the old wrapper's hard constraints stop existing rather than being satisfied more carefully: nothing can displace a leading doctype into quirks mode and nothing can push the charset meta out of its detection window, because nothing in front of them ever moves. A page that declares the seam is served exactly as written. Fragments are still rendered by the _ask_inline.html macros and handed over GET /b/<name>/embed.json; embed.js places them and decides nothing. Openness comes from open_marks, order from (created, id), questions in declaration order. A single-question pick normalizes to key None, so the payload carries questions as a list rather than an object — keying by name would serialize that as the string "null". Placement is an anchor fill, not a replacement: el.insertAdjacentHTML( 'beforeend'), so an author's wrapper and its contents survive. The regex it replaces was eating the opening tag of dfa-concepts' styled .ask blocks and orphaning their headings, live, unreported. data-booth-mark is canonical; data-booth-ask stays a kept alias because two live reports use it. The comment placeholders are dropped — no users. Declared cost: the verbatim path now needs JavaScript. The never-invisible guarantee holds through the index badge and /b/<name>/marks, both of which render server-side. Deleted: booth/inline.py entire, wrap_verbatim_html and its six patterns, _BACK_CHIP, asks_chip, inject_asks, FAVICON_LINK, the styles() macro. Tests 410 -> 434. tests/test_embed_browser.py drives a real Chromium: the placement algorithm and the form= binding of a scattered multi-question form cannot be observed any other way, and that binding was measured rather than assumed (N=3 per condition, with a form-first positive control and a points-at-nothing negative control). Contract: docs/contracts/u3_declared_embed_seam.contract.md, with the in-session seam review and the cold contract panel both recorded. Two of the panel's findings were code fixes: a vacuous INV-3 falsifier that a renamed regex walked straight through, and a bare-substring seam detection that read a report merely quoting the path as declaring it and silently served it with no chrome.	2026-09-22 10:43:41 -07:00
vh	42ea67f33f	memory: snapshot — U4 released at v0.4.0, next unit undecided ... Current state rewritten for the post-U4 position: 410 tests, v0.4.0 tagged, tree not pushed, all three gates closed. Carries the session's U3 recommendation with its three grounds AND its counter-argument, so the operator can take the call without reloading the unit. The methodology-proposals row goes from three to four and is now marked explicitly untracked by operator choice — the new one is the contract-time vacuity pass, which is the only one of the four with measured evidence behind it after five of seven U4 falsifiers turned out not to discriminate.	2026-09-22 10:06:30 -07:00
vh	8f81d8f9d0	memory: no fleetwide notice for U4, and the measurement caveat it creates ... Operator decision 2026-09-22: no broadcast to the 17 consuming handles. Same posture as U5 — adoption gets told apart from design because nobody was primed. The consequence is a measurement one and it needed writing down before it was lost. U4's two halves have different adoption costs: the hold rides for free (a session runs `booth ask` and its booth is held, knowing nothing), but NOT pressing `keep` has to be learned. So a flat `.forever` rate on 2026-10-06 is exactly what 'the mechanism works and nobody was told' looks like, and reading it as a falsification would retire a correct diagnosis on an uncontrolled measurement. Records the three counts to report instead, and states the sensitivity floor: only 4 of 24 booths carry marks at all, so the hold can touch at most a sixth of the fleet and an effect below one or two booths is not resolvable.	2026-09-22 10:04:51 -07:00
vh	c75d7a2797	fix: four defects the U4 bug-hunt panel found in code it did not add ... All four pre-date U4 and sit in files it touched, which is why a diff-scoped robustness lens saw them. They are separated from the unit's own commit so the feature history stays readable; the release tags both. * A booth name reached a JS string context. The confirm dialogs interpolated the name into a string literal inside `onsubmit`. Jinja's autoescape is HTML-attribute escaping, not JS-string escaping: the browser decodes the entity back to a quote before the JS parser sees it, so a name crafted to close the string executed on submit. Booth names are agent-authored — making a folder under the data dir is the whole API — so this was a live path, not a theoretical one. The name now travels as a data attribute to a delegated handler, where escaping is escaping. * An unreadable `links.md` returned 500 for the whole booth page. `is_file()` then an unguarded `read_text()`. The board is one tile on that page, and a page that will not load is worse than one missing a tile — the posture `read_blurred`, `marks_for` and `read_manifest` already take. * The index order had no tie-breaker, which violates the deterministic-order invariant. Equal-mtime booths fell back to whatever `iterdir()` yielded, and two booths landed by one `rsync` batch share an mtime exactly. Now `(mtime, name)` reverse: newest first, then name. The operator refers to cards positionally, so a sequence that moves between renders misfiles his judgment rather than crashing. * `/b/<n>/marks.json` reported damage as empty success. `booth marks` exits 3 on an unreadable file precisely so a caller can tell "not yet" from "broken"; the HTTP mirror — the only reader a remote session has — returned the same empty list for both. It now carries `error` and `detail`. The status stays 200 deliberately: reads are lenient here, and a pinned status code is a promise to remote clients this fix has no business breaking. Each has a regression test. 410 tests. v0.4.0	2026-09-22 09:51:14 -07:00
vh	c3a97c1b64	feat(u4): a booth's lifetime is derived from its state, not from a boolean ... `.forever` was the only way to say three different things — "this is durable", "I have not answered yet", "I am still looking" — and the census said it was carrying all three: 17 of 24 live booths (70%, up from 54% the day before). Three of the four booths in the fleet awaiting an answer had been pinned by hand as well, and 10 of the 17 were younger than the TTL, so the sentinel had bought them nothing and was pressed pre-emptively. Only the first meaning is what `keep` means. The other two are facts the service already held and did not consult. KEPT `.forever` present never swept (unchanged) HELD an open pick, or marks we cannot read never swept (new) EPHEMERAL everything else 24h (unchanged) Viewing is activity: a deliberately-served response from a booth's own page route writes `.viewed`, which is a dotfile and not a `.lock` dotfile, so `_newest_mtime` already counts it. There is no new arithmetic — `booth_age_seconds`, `is_expired` and `expires_in` are unchanged. Machine reads are excluded on purpose: an agent must not be able to hold its own booth open by polling for the answer it is waiting on. The hold is unbounded, and what makes that safe is visibility plus two exits that already existed. Every surface whose chrome the Booth owns says `held until answered` where the countdown was, and `booth rm` / the UI x / `DELETE /b/<n>` take a held booth exactly as they take a kept one. A hold is protection from the timer, never from the operator. Three cross-frontier panels ran and each found a class the others could not: * the paraphrase panel found that two reads of one file are not one read of one state — the contract's `is_held(marks_for(c), read_error(c))` could resolve to `([], None)`, the pair that deletes. `hold_read` is one read. * the code-review panel found, 4-of-4, that the booth header's board branch rendered no lifetime at all; and that five of seven invariant tests passed under the change that defeats them. * the bug-hunt panel found four more paths where a failed read still authorized a delete, and a `record_view` that followed a planted symlink. `is_held` became `hold_reason`, which returns the reason rather than a bool beside a string that can disagree with it. Prediction, to re-count on or after 2026-10-06: the `.forever` rate falls to the booths that are genuinely durable references. Only 4 booths carry marks at all, so this rests on both halves of the unit; a null result cannot distinguish a wrong diagnosis from a habit that outlived its need. 406 tests (341 before). Contract: docs/contracts/u4_derived_lifetime.contract.md	2026-09-22 09:44:25 -07:00
Vuong Hoang	d37b81ab9f	memory: snapshot — U5 released at v0.3.0, and the index goes two-tier ... The two dated log sections had never been split, so every one of their 29 entries sat inline and the startup index had grown to 372 lines — which is the cost the two-tier scheme exists to remove, paid on every session that reads the file. 27 entries were over threshold. All 29 now have a detail file under persistent-memory.d/ and a one-line index entry that routes rather than restates. Index: 372 -> 93 lines. No archival. The soft cap fired, but every entry in this repo is dated 2026-09-21 or later, so the under-14-days guard held all of them back — and the split alone took the index well under the target without moving anything out of the active file. The in-flight section is rewritten for the post-release state: nothing is in flight, no gate is outstanding, and the next unit is explicitly recorded as the operator's undecided call rather than as a plan. The session's recommendation (U4, on three grounds) is written down so it does not have to be re-derived, alongside the two alternatives and why they are alternatives. Two dated predictions are carried forward with their dates and their instruments: the U5 adoption re-measure on 2026-09-29, which already reads 3 of 24 announced and 2 with a why from peers told nothing, and the .forever re-count a fortnight AFTER U4 lands, which is U4's own success criterion and is destroyed by running it early.	2026-09-22 08:20:51 -07:00
Vuong Hoang	95beede3c3	fix(manifest)!: the size cap opened a service-wide hang; close it ... The diff-scoped bug-hunt panel, four arms, artifact-only. Its strongest finding is one I created two hours earlier while hardening the reader. `stat` reports size 0 for a FIFO and 0 for a symlink to /dev/zero, so both sail under the byte cap added for the RecursionError round — and then `read_text` either blocks in read() with no EOF, so the except never runs, or allocates until the kernel intervenes. `list_booths` reads every booth on every GET / and /healthz, so ONE such file stalls the front page for the whole service, with no error and no recovery short of a restart. Reproduced before believing it (timeout returned 124). S_ISREG is checked BEFORE the size in both modules now; verified against the live service with two FIFOs planted, which answered 200 in 36ms. The shape worth carrying: st_size answers a different question than "can this be read", and a bound that trusts it inherits everything it does not mean. A hardening fix opened a worse hole than the one it closed. THE UPLOAD PATH WROTE ABOVE ITS OWN CLEANUP GUARD (4/4) A failed manifest write orphaned a .uploaded half-booth with no files in it — and because the temp name now carries a random suffix, nothing ever overwrote the leak, and .booth.json.<hex>.tmp is not a .lock, so _newest_mtime counted it and kept that empty booth past every sweep. The uniqueness fix from the previous round is what made the leak permanent. Both writes moved inside the guard; the temp is removed on every exit path. DAMAGED BYTES ARE KEPT, NOT REPLACED (4/4, INV-6) Marks made this explicit in v0.2.1 and this write path contradicted it: a manifest that failed on ONE field lost the others with it, including a why the re-announcer may never have kept anywhere. It diverges from marks in HOW it honours the rule — marks refuse and answer 409 because the operator's judgment is not restatable; a manifest quarantines and proceeds, because refusing would fail `booth add` and lose the files it was copying. ONE OPENNESS PREDICATE, AS U2 SAID (2/4) `booth answer` spelled out `if m.answer is None` while `booth marks` asked `open_marks`, so a partially-answered pick read as done to one verb and open to the other — at the same instant, on the same booth. U2's INV-2 put openness in one function precisely so they could not drift. The mirror case is fixed too: a pick that hydrates broken is refused by the web route, so `answer --wait` polled an hour on a form nothing could ever land. ALSO - now_stamp was whole-second while the importer had moved to microseconds, and '-' sorts before '.', so a later mark came out ahead of an earlier import inside the same second. One format; the previous round's ordering fix had opened this one. - `_broken` was the third of three directory-name fallbacks and the one still handing a raw name into a card's sub-line. - An identical re-announce rewrote the file and reset the TTL. `booth link` does this on every post to the standing board. - The importer's return went through the bare _hydrate, not _hydrate_safe. - A marks document could be written larger than it can be read back, and then read as no marks at all. Refused at the write instead. - `choice` reached the answer builder raw while `notes` beside it did not. AND ONE FINDING DELIBERATELY NOT FULLY CLOSED The mtime-restore race is real. The clean fix — ignore a booth directory's own mtime whenever the booth holds anything — also silently retires the documented rule that releasing a kept board resets its clock, which the CLI header, the README and a deliberately-written test all pin. That is a TTL doctrine change, not a bug fix, and an existing test caught the attempt. The concrete half is fixed (a failing os.utime escaped and 500'd the route); the race is stated in the code where the next reader will meet it. 341 tests. Live service restarted, 24/24 booth pages verified. v0.3.0	2026-09-22 02:27:18 -07:00
Vuong Hoang	f3193fb054	fix(probe): the disclosure-opening loop was manufacturing its own findings ... `page.locator("details:not([open])").all()` hands back POSITIONAL locators that re-resolve against the current DOM, and `:not([open])` stops matching an element the moment it is opened — so opening them one at a time shrinks the set underneath the indices and leaves some closed. Those then report OCCLUDED, which is exactly the false-positive class the block was added to remove. One on booth-redesign, three on cr123a-to-d-sleeve, one on denoise-first-run, and invisible as a bug because a false positive is shaped like a finding. Measured both hypotheses rather than guessing between them: per-element loop against a single document-wide evaluate, at 150 ms and 1000 ms settle. The loop reports them at either wait; the single pass reports none at either. The variable was the method, not the timing. One evaluate over the whole document now. All three pages clean. Also carries the ROADMAP U5 row, the two-panel record in persistent-memory.d/, and the memory index line for it.	2026-09-22 01:39:43 -07:00
Vuong Hoang	c015a917ee	fix(manifest): fold in both cross-frontier panels — and a live hole in v0.2.2 ... Two four-arm artifact-only rounds landed together: the contract paraphrase (against the pre-seam-review capture) and the code-vs-contract conformance review (against the amended one), correctly firewalled from each other. The conformance round found ZERO drift in the strict sense — the code is a clause-for-clause implementation of the contract — and the weight of both rounds landed one layer down, in what green tests structurally cannot report. Full triage in persistent-memory.d/. A LIVE HOLE IN RELEASED CODE, FOUND ON THE SIBLING MODULE v0.2.2 adopted the RecursionError finding from the bug-hunt round and closed half of it: `_hydrate_safe` guards hydration, but `json.loads` runs above it in `_read_raw`, whose catch list covers neither RecursionError nor MemoryError. A 400 KB file of nothing but brackets in any ONE booth therefore still returned 500 for `/` and `/healthz` across every booth on the service. Confirmed by running it before believing it. Both modules now bound the read by `stat` before touching the bytes and catch both classes anyway, so raising a bound later cannot quietly re-open the hole. The strict half of the marks asymmetry refuses everything the lenient half tolerates, or a file that reads as "no marks" gets replaced by a write that believed it. THE WHY-WIPE `booth new x --why "..."` then `booth add x out/*.png` erased the sentence the first command existed to record. Omitted flags meant empty strings and empty strings overwrote. Two arms predicted it from the contract's wording alone; every test here passed --why on both calls and so could not see it. Omitted now means unchanged and an explicit --why "" still clears — the shell carries the distinction by leaving the variable UNSET, not empty. --title WAS WRITE-ONLY Stored, flag-surfaced, rendered nowhere. 4/4, and independently top-ranked by every arm of the paraphrase round. It lands on the booth page heading with the directory name beside it, because the directory name is the identity the operator navigates by and refers to positionally. THREE TESTS THAT COULD NOT FAIL - test_the_write_is_atomic asserted no *.tmp survived, which a plain write_text passes. It asserts the inode changes now. (The first replacement was ALSO vacuous — it spied on os.open, which Path.write_text reaches through io.open in C and never touches. Recorded in the test, because writing a second vacuous test while fixing the first is exactly the failure this round is about.) - The INV-3 preservation test passed against an implementation that regenerated `created` every time, because _now() is whole-second resolution and back-to-back writes share a stamp. Seeded from 2019 now. - test_announcing_is_activity passed whether or not _newest_mtime counted the manifest, because writing it bumps the directory mtime either way. The directory's clock is put back, leaving the file as the only thing that can keep the booth alive. ALSO - The title fallback skipped the normalizer the explicit value gets; a directory name may legally carry a newline and run to 255 bytes. - Every writer derived the same .booth.json.tmp. Marks are protected from that by their flock; the manifest has none, so uniqueness stands in. - test_stdlib_only was blind to relative imports in all four modules. - INV-1 had no guard at all; INV-5 named two different promises; the negative render states were asserted on the index only. Contract amended throughout: the 4 GB case is a stat-checked bound rather than a return constraint, every field of an error-carrying record has a stated value, INV-1 no longer contradicts INV-3, repo-wide rules are named in words instead of by a colliding number, and touches admits the macro partial the implementation added. 329 tests.	2026-09-22 01:29:27 -07:00
Vuong Hoang	fac83de8f4	docs(u5): name the verbatim-booth boundary as U3's, not a gap ... Five live booths serve the author's HTML raw and the Booth owns no header there to put a provenance line into — it reaches those pages through six regexes injected into arbitrary markup, which is the defect U3 exists to fix. Their index cards carry provenance like everything else. Written down so the boundary reads as a boundary rather than as something this unit forgot. Verified on pewpew-ui-brief.	2026-09-22 01:05:05 -07:00
Vuong Hoang	aa61fcf5fd	test(probe): teach the layout probe about <details>, and guard the flag parser ... THE PROBE. A control inside a CLOSED <details> is laid out but sits outside its collapsed parent's box, so elementFromPoint at its centre returns an ancestor and it reports OCCLUDED — 23 of them on sindra-set, every one a false positive. Verified both ways before believing it: closed, elementFromPoint returns div.gallery; opened, the button itself, and a real trial click lands on it. Opening every <details> rather than skipping them is the deliberate choice. Skipping would make the probe quiet by declaring put-away controls out of scope, and the add-note button inside details.item-addnote is exactly the class of control this instrument exists to check. Fourth false-positive class this probe has grown a guard for; the other three are already in its header. THE FLAG PARSER. Three cases that silently break and are cheap to pin: the flags on either side of the glob (a session should not have to remember which), a why carrying quotes, an em-dash, a newline and non-ASCII, and --why with no value after it, which must produce usage rather than eating the booth name and creating a booth called nothing. 313 tests.	2026-09-22 01:01:20 -07:00
Vuong Hoang	c9a175ba4a	memory: U5 adoption is a prediction with a re-measure date ... Operator declined the fleetwide announcement (2026-09-22) and chose to let the convention propagate through the README alone, specifically so adoption can be distinguished from design. Baseline 0 of 26 booths at landing; re-count 2026-09-29. Near-zero means nobody heard about it, which is a different failure from nobody wanting it.	2026-09-22 00:56:25 -07:00
Vuong Hoang	75dca53483	docs(probe): the probe covers the index only, and says so now ... The docstring claimed a no-argument run probes 'the booth index and every booth linked from it'. main() probes argv[1:] or the default URL and follows nothing — so a coverage claim that reads as 26 pages has always been one. A probe that overstates its reach is worse than one that states a small reach honestly, because this is the instrument standing in for a class of bug the test suite structurally cannot see. Also records the zsh trap that hid it: an unquoted $URLS holding twelve space-separated URLs arrives as ONE argument, and the probe cheerfully reports '2 page(s)' while covering two.	2026-09-22 00:54:54 -07:00
Vuong Hoang	67ab7d1cd5	docs(readme): --why, on the page the 17 consuming handles actually read ... The quickstart is where a session learns the CLI, so the announcement verb has to be in the first code block rather than in a section further down that nobody scrolls to. States the trade plainly: optional, nothing breaks without it, and a booth that cannot say what it is has no way to ask for attention except by posting its URL somewhere else.	2026-09-22 00:50:02 -07:00
Vuong Hoang	ac35f2441f	docs(u5): state what the contract deliberately leaves out ... The out-of-scope block is load-bearing for the cross-frontier review gates — without negative constraints their signal-to-noise drops sharply, and both /heid-code-review and /heid-bug-hunt refuse to fire without one. Written for the reviewer, but it is the same list the roadmap gate produced: the what-landed feed is parked for v1.1, nothing enforces that a booth must announce itself (rsync is a documented path and never runs the CLI), and the manifest describes rather than decides — U4 owns lifetime.	2026-09-22 00:49:22 -07:00
Vuong Hoang	a48ef83ef5	feat(manifest): U5 — booths that say who posted them and why ... The index card showed a name, an item count and a countdown, and nothing the poster chose. An agent with something to show therefore had no way to make the booth say "look at this" and posted a URL to the link board instead — which is why 145 of that board's 210 rows (69%) ended up pointing at booths that had already been swept. The board was absorbing a job it was never shaped for. This is the shape. Each booth carries `.booth.json` — {handle, title, why, created} — written by the CLI from $ALTHING_HANDLE, and the provenance line renders on both index lanes and on the booth page header. WHAT IS WHERE - booth/manifest.py, stdlib-only and importing nothing from booth.* either: scripts/booth imports it under the system python3 with no venv, and a cross-import between two stdlib-only modules is a second way for that invariant to break. It joins the shared test_stdlib_only list and keeps a stricter copy of its own. - The read is lenient and cannot raise. list_booths touches every booth on every index load, so a manifest that cannot be parsed costs that booth's provenance and nothing else. That is the v0.2.2 lesson applied before the same mistake rather than after it. - Absent and damaged render differently — `unannounced` and `unreadable`. Folding "cannot be read" into "never said" would hide the one case somebody has to go and fix. - Re-announcing preserves `created`. A second `booth add` sharpening the why is not a second appearance of the booth. - The write is atomic (invariant 5); the temp file is itself a dotfile, so no listing can see it mid-write. THREE OPERATOR CALLS, 2026-09-22 Flags on the existing new/add verbs rather than a separate `announce` verb (a second step is the step that gets forgotten, which is the rot's own mechanism). Unannounced booths get a quiet marker rather than nothing — the convention is only adoptable if the gap is visible. U5 adds provenance only and does NOT add a second index ordering keyed on announcement time; that is a different surface needing its own stated rule, parked for v1.1. NO EXEMPTION LIST A pickup booth and the standing link board are created by the service, so they announce themselves with handle `booth`, which is true rather than manufactured. One rule — a booth with no manifest is unannounced — instead of a growing set of special cases. ALSO tests/test_booth.py's keep/release assertion was slicing the page on the bare word `boothhead`, which has lived in the stylesheet far longer than the assertion has; it was reading CSS and passing on luck, and went red the first time a new rule landed above the old one. Same assertion, aimed at the markup. A U5 test had the mirror-image bug: pytest derives tmp_path from the test name and the index renders data_dir, so a test named `test_an_unannounced_booth_says_so` put the needle in the haystack itself and passed against a template that did not yet exist. 310 tests (304 before this unit's CLI half). Live service restarted, 26/26 booth pages verified 200, end-to-end smoke through the real CLI. NOT TAGGED. The cold contract-review panel is still in flight and the code-review and bug-hunt gates have not run. Tagging with a gate outstanding is what made v0.2.0 premature.	2026-09-22 00:48:41 -07:00
Vuong Hoang	109190b0d6	docs(u5): contract for self-announcing booths, plus its seam review ... Blast-radius pass first (graphify explain list_booths + grep over every mkdir and every dotfile skip), then the contract, then a caller-side seam review against the real sibling module surfaces. The seam review earned its place again: the contract asserted that the upload path's filename dedupe set must gain MANIFEST_FILE or an uploaded file could collide with the manifest. safe_upload_name strips leading dots, so that collision is unreachable — and the UPLOAD_MARKER entry already sitting in that set has never been able to matter either. A scope item the contract reasoned its way into and the sibling refutes. Operator calls settled 2026-09-22: flags on the existing new/add verbs rather than a second announce verb; unannounced booths get a quiet marker rather than nothing; U5 adds provenance only and does not add a second index ordering keyed on announcement time (parked for v1.1). Cold contract panel dispatched to heid before this landed; its findings fold in before any code ships.	2026-09-22 00:37:35 -07:00
Vuong Hoang	026a1fc392	fix(marks): v0.2.2 — nine findings from the cross-frontier bug-hunt panel ... `/heid-bug-hunt` on U2's diff, four arms, artifact-only. Eight findings were real against live code; a ninth was already closed by v0.2.1 and is recorded as declined. Full triage in persistent-memory.d/2026-09-22-bug-hunt-panel.md. THE LOCK LIFECYCLE (4/4 convergent, and two defects in one place) `_Locked.__exit__` unlinked `.marks.lock` on the no-op path so a booth that had never been marked was left exactly as it was found. `flock` binds to an INODE: unlinking it under a blocked waiter leaves that waiter holding an exclusive lock on a deleted file while the next writer creates a fresh lock and takes it immediately. Two processes then run the read-modify-write concurrently, the later os.replace drops the earlier one's mark, and both obeyed the protocol. The cleanup existed to protect the booth's TTL, and was failing at that too: creating or removing a directory entry bumps the DIRECTORY's mtime, which is what `_newest_mtime` seeds from. The guard's comment reasons about the lock file's own mtime and misses that the directory moved underneath it. One fix: never unlink the lock, exempt `.<name>.lock` dotfiles from `_newest_mtime`, and restore the directory's mtime after creating one. THE READ PATH'S BLAST RADIUS `_clean_text` did `(text or "").replace(...)` and `marks_for` sorts on `(created, id)`, so a stored `text` that was a dict or a `created` that was a number raised out of the read path. `list_booths` reads every booth's marks on every index load, so one hand-edited file returned 500 for `/` and `/healthz` across all 25 booths. Guarded in two layers — a named type check and a `_hydrate_safe` backstop that cannot raise — and an unreadable mark now renders as ⚠ broken rather than as an empty note. ALSO - import_legacy_asks stamped `created` at whole-second resolution, so two sidecars from the same second lost the ordering the importer had just established and re-sorted alphabetically. Microseconds, per the stated `(mtime, name)` rule. - The five mark-write routes ran a blocking flock on the event loop; they now dispatch through run_in_threadpool, asserted structurally like INV-1. - `/answer` 500'd on a non-string `notes` form value where `/note` handled it. - The inline-doc tile had a flag control and no note field. - The marks panel was suppressed on any booth carrying a links.md. - The viewer's arrow keys and Escape threw away a note being typed. CLI `booth marks` printed a traceback and exited 0 on a failed read, and `--wait` emitted a whole JSON document per poll. `booth answer --wait` read a damaged file as "not yet" and spun the full hour. Both now use real exit codes — 0 ok, 1 unanswered/timed-out, 2 no such pick, 3 unreadable — and `--wait` prints once. `marks.read_error()` lets the CLI ask what the page must not: the browser stays lenient, the machine consumer gets the truth. `scripts/booth` had no tests; it has five now, run against the real script under the system python3, which also makes them a live check on INV-1. 275 tests (253 before). Live service restarted, 25/25 booth pages verified 200. v0.2.2	2026-09-22 00:20:58 -07:00
vh	70fb15886b	memory: snapshot — U1 and U2 released at v0.2.1, U5 next ... Records what this session learned that the code does not say on its own: the read-lenient/write-strict asymmetry and why pointing both at one reader silently collapses them; that the seam review and the cold contract panel had zero overlap in BOTH directions on one unit, so neither substitutes for the other; that every code-changing panel finding came from the ambiguity pass rather than the paraphrase; and the timing lesson that a tag waits for an outstanding gate. In-flight is set up for U5 with the two things already settled about it, so the next session does not re-derive them: .booth.json is a dotfile and so is already excluded by booth_items, and the deterministic-order invariant applies to whatever it adds to the index card. No version bump — memory snapshot, on the SemVer skip list.	2026-09-21 23:58:25 -07:00
vh	a0448bdc24	fix(booth): list the deprecated asks alias in the usage string ... Reported by draupnir. The v0.2.0 note told consumers the alias survives, and the usage line is exactly where a session checks that claim — a deprecated-but-live verb that is invisible at its own discovery surface reads as removed.	2026-09-21 23:56:10 -07:00
vh	5e41108cd3	fix(marks): a write over a damaged mark file was wiping the booth's judgment ... Three defects and a missing test, all surfaced by the cross-frontier contract panel dispatched before implementation and triaged after it (heid, four arms, artifact-only, thread 01M33VSNFER4N1554G0Y0VC9C8). v0.2.0 was already tagged and announced to fifteen handles when they landed, which is the argument for running the gate at all. DATA LOSS. `marks_for` is deliberately lenient — an unparseable `.marks.json` reads as "no marks" so a review page still loads. The write path inherited that leniency through the same reader, so one flag click appended a single entry to an empty list and atomically replaced the file: every mark in the booth gone, silently, from a click. Reproduced first, then fixed. The fix is an asymmetry, not a retreat from leniency. Reads stay lenient; writes go strict through `_read_raw_strict`, which distinguishes bytes-present-but- unreadable from absent and valid-but-empty, and raises `MarksCorrupt`. The damaged bytes are left on disk. Routes answer 409 rather than 500 — the service is fine and the request was well-formed, the state on disk is not — and the body says what to do, because the alternative the operator reaches for otherwise is deleting the file, which is the thing being protected. The CLI says it in one line instead of a traceback. A PICK COULD NOT TARGET AN ITEM. `Mark.target` carried one, `marks_for_target` retrieved by it, and the panel already rendered "on <item>" — but `declare_pick` had no parameter for it, so no session could produce one. A question about one artifact is the whole point of the 2026-09-09 inline-placement ruling; the door was simply missing. THE IMPORTER STRANDED AN ANSWER. A stem already present as a mark was skipped wholesale. If a session had re-declared that stem through marks while the operator's choice sat in the legacy sidecar, that choice was lost permanently — reads are forbidden from looking at sidecars. The declaration is still skipped (idempotence holds) but a legacy answer is now adopted when the existing mark is an unanswered pick, and an answer made through marks is never overwritten. INV-3 NAMED A SURFACE NOTHING TESTED. All four arms converged on it: the rule protects gallery tile, zoom view and doc view; the falsifiable check covered one. The doc view was implemented and untested, so shipping it unmarked would have passed. Three tests now, one per surface. The contract carries the full triage, including two findings accepted and NOT closed: INV-2's and INV-5's checks comply in letter — openness can be re-derived without spelling the grepped pattern, and importlib inside a function defeats the AST walk. Both describe a future careless change, and the honest statement is that these checks raise the cost of drifting rather than making it impossible. Recorded rather than papered over. Also pins the three prose ambiguities the panel found, normatively and once each: what counts as open, the three distinct broken-declaration cases, and INV-6, which had named a helper that does not exist and forbidden the calls that helper must make. 253 tests. v0.2.1	2026-09-21 23:54:42 -07:00
vh	54c1e7c60f	feat(marks)!: v0.2.0 — marks replaces asks, and the CLI surface moves with it ... The release that closes U2. Consumers have to adapt, which is what makes this a minor rather than a patch: three things a scripted session can notice. * `booth asks <name>` now emits JSON, not the old aligned human table. Anything parsing those columns breaks. `booth marks <name>` is the name to use; `asks` survives as a deprecated alias for the muscle memory. * Polling `http://…/b/<n>/<stem>.answer.json` will 404 forever. There is no per-question answer sidecar any more. `GET /b/<n>/marks.json` replaces it and answers for the whole booth in one request — including an `open` list. * `#ask-<stem>` page anchors are now `#mark-<id>`, and `/b/<n>/asks` 308s to `/b/<n>/marks`. What a session GAINS: the operator can now attach a note to any item or to the booth, and flag individual items — both readable with `booth marks`. Selecting winners out of a set used to be a chat message. Nothing a session already wrote is lost. Legacy `*.ask.json` / `*.answer.json` sidecars are imported by `booth marks-import <name>`, idempotently, and are never deleted. No lockfile step: this repo tracks none (uv.lock is gitignored, 790d5ba). v0.2.0	2026-09-21 23:48:30 -07:00
vh	bb1e3cfcd7	fix(booth): templates were hot-reloading into a live service running older Python ... 19 of 25 live booths returned 500 with `UndefinedError: 'item_marks' is undefined`. Neither the old code nor the new code was broken — the service was running both at once. `booth.service` sets WorkingDirectory to this repo, so the repo IS the deployment root: no build step, no staging copy, the live service imports these files. Python is read once when the process starts. Jinja's FileSystemLoader re-reads a template on EVERY render. So the two halves of the service had different staleness rules, and editing booth.html deployed it instantly against Python from 22:03 that had never heard of the context the new markup wanted. The failure mode is worth naming precisely, because it is invisible to the suite by construction: the skew exists between a running process and the disk underneath it, so every test can pass against a tree that is simultaneously serving 500s. No amount of green catches this. The operator found it. Fixed at the source rather than with a reminder to restart. The template Environment is built here with auto_reload=False, so templates are cached at startup exactly like the Python, and there is ONE rule: nothing takes effect until you restart. The price is that template work needs a restart to see — that price is the entire point, and it is cheaper than a page of 500s while someone is reviewing. Building the Environment by hand means autoescape no longer comes from the Jinja2Templates constructor, so it is explicit and load-bearing: booth names, item names and mark text are all agent- or operator-authored strings that land in HTML. Verified escaped, not merely configured. Two tests hold the line — one on the snapshot property, one on the `dur` filter that is no longer incidental to the constructor. The environment is reachable at app.state.templates because a promise about the deployed service needs an assertion, and an assertion needs the env the app actually renders with. Also records the foot-gun in CLAUDE.md and persistent-memory: anyone editing this repo while the operator may be using the service is editing production. 244 tests. No version bump — the release tier for U2 is still the operator's call, and this rides with it.	2026-09-21 23:44:37 -07:00
vh	c7f9437a64	feat(marks): one primitive for operator judgment, so the loop stops running through chat ... Five mechanisms existed to get one question next to one artifact. Three of them were the same thing wearing different clothes, and the third of the three had no code at all: the operator picked winners out of a 270-image set and told the session in conversation. `sindra-finalists` is 86 items, every one captioned, with the selection encoded in the booth's NAME. A MARK is operator judgment attached to a target — the booth, or one item in it, addressed by the `rel` U1 established as item identity. Three shapes: pick — one of N options a session declared in advance (was: an ask) note — free text the operator volunteered (had nothing) flag — this one (had nothing) One file per booth, one read path, one place openness is computed, one slot beside the artifact. The storage shape is the operator's call (2026-09-21) and follows from U4: "does this booth still owe an answer?" gets asked per booth per sweep tick and per card per index render, so it has to be one read and not a walk of a booth holding 270 files. Marks are also not links.md — that is an O_APPEND content-hash log because 17 handles write it concurrently, whereas a booth's marks see one session and one operator, so locking the common path costs nothing. The 2026-09-09 pick semantics are preserved by NOT rewriting them: partial answers legal, a blank question lands in `unanswered`, `complete` false until every question has a pick, the only refusal a submission carrying nothing. `write_answer` split into the pure `build_answer` plus the storage that went away with the sidecar; `normalize_ask` untouched. Three findings worth naming, because each was caught by a gate rather than by reading the diff again: * The seam review found `inline.place` indexes asks by SUBSCRIPT — the only consumer in the service that does — so a frozen dataclass breaks it, and `inline.py` had been missing from the contract's scope entirely. * A retargeted test found a regression in the legacy importer: a malformed sidecar that renders "broken" today would have silently vanished on migration. It now imports carrying its reason. * A partially-answered pick counted as CLOSED on the index while the panel beside it rendered it "partial" — the two disagreed about one booth. Open is the reading U4 needs, and it is declared rather than smuggled in. `GET /b/<n>/marks.json` is new and load-bearing: sessions on other hosts polled `<stem>.answer.json` over HTTP, so removing the sidecar without it would have taken that capability away. `/b/<n>/asks` 308s to `/marks`. Legacy sidecars are imported, never deleted — four are live and unanswered. Also records the operator's deterministic-order directive as a cross-cutting v1 invariant, in ROADMAP.md with the per-collection rule table and as CLAUDE.md invariant 6. The Booth's job is comparison; an order that moves between renders does not crash, it misfiles the judgment. 242 tests. No version bump — a release tier for this is the operator's call.	2026-09-21 23:38:27 -07:00
vh	9272c9872e	docs: the conventions a fresh session can't infer, and the state it can't reconstruct ... The repo came out of eshpfi one day ago with neither piece of its house furniture, so everything non-obvious about it lived in docstrings inside a 998-line app.py — which is a bad place to keep an invariant that breaks silently on every fleet host when someone violates it. CLAUDE.md carries the five that do exactly that: * links.py and asks.py are stdlib-only because scripts/booth imports them under the system python3 with no venv, so one third-party import breaks `booth ask` everywhere and fails in an agent's session, not in ours * the filesystem is the state, and booth_items()'s dotfile skip is why a per-booth dotfile is the right shape for new operator state * booth_items() is the only thing that classifies a file or resolves a caption (U1's INV-1) — the zoom-loses-the-annotation bug was three readers of one truth, not a rendering bug * moved names stay importable from booth.app, asserted by a test * sidecar writes are atomic; render_doc returns raw text on purpose Plus the distinction that decided this session's storage call: links.md is an append log because 17 handles write it concurrently, and marks have one writer. Different problem, different shape — ask which you have first. persistent-memory.md carries what CLAUDE.md is structurally unable to: the dated decisions, the `.forever` prediction and its re-measure date, and the foot-gun log. Two entries are load-bearing for the next unit — the settled mark storage shape with the reasoning that picked it, and a measured correction to U7's premise: every booth that actually needs navigation is flat, so subfolder sections are worth shipping but are not the nav fix. No version bump — docs and memory, both on the SemVer skip list.	2026-09-21 22:58:00 -07:00
vh	ce598b3cf6	feat(items): one item record, so an annotation survives the zoom ... The operator reported that zoomed-in images lose their annotations. That was never a rendering bug. Three functions independently walked a booth and derived overlapping subsets of the same facts -- build_gallery (kind, caption, blur, doc), booth_view_file (kind, doc, image ring) and list_booths (kind counts, cover) -- and the zoom route's subset was the smallest. Caption resolution lived inside build_gallery's loop and nowhere else, so there was no code path by which a caption could reach the zoom template. It was never sent. booth/items.py is now the one truth: booth_items() returns the full record -- rel, kind, section, caption, blur, doc kind, size -- and the gallery, the zoom view, the doc view and the index all read it. Patching view.html would have fixed the symptom for images and left the next surface starting from the same missing truth. Two things fall out of the consolidation: - the index and the booth page now agree on what an item IS. list_booths counted every non-dot file, so an A/B pair with two caption sidecars read as 4 items on the index and showed 2 tiles when you opened it. - "section" (the item's subfolder) is computed and carried but nothing renders it yet. That is deliberate: it is U7's whole input, and shipping the field now makes U7 a template change rather than a resolver change. Doc bodies are NOT rendered by the resolver -- the index touches every booth on every page load, and rendering every markdown file in every booth would be the price of that convenience. render_doc_body is a separate step for the one surface that inlines them; an invariant test monkeypatches it to raise and loads the index. Verified beyond the suite, because this repo has shipped two dead controls that every test passed: the caption was measured in a real browser at 1280x41 px, visible, with elementFromPoint at its centre returning the caption itself. layout-probe reports all controls hittable across index, gallery, zoom and doc. 192 tests pass (173 before, 19 new). Contract: docs/contracts/u1_item_record.contract.md	2026-09-21 22:04:07 -07:00
vh	726822b2b9	docs: the information architecture, and a v1 target to gate it against ... The Booth was built as a file-shuttle on a whim and turned into the fleet's operator-review surface without anyone deciding that. This is the decision, written down, with the measurement that forced it. The defect behind every bolt-on: one lifetime and one shape serving five jobs. Five separate mechanisms exist to put one question next to one artifact. Numbers that drove the model, taken against the live service: - 211 link rows, 145 (69%) pointing at booths that no longer exist - 22 rows that are the same bench re-posted (talk 5x, peedlar 4x) - 13 of 24 booths (54%) on the .forever escape hatch - 270 images rendered as one flat wall, subfolders discarded at render - 5 commits in one day to ship the asks primitive Four nouns replace the accretion: booth (derived lifetime), item (one record), mark (pick/note/flag -- asks, comments and votes were always one thing), and bench (a registry, not an append log). v1 is seven capabilities, each closing a measured defect. Compare mode is the best idea in the set and is parked anyway, because it is the only one that is a new capability rather than a fix.	2026-09-21 21:57:21 -07:00
vh	5f2c9a6a60	fix(booth): release was painting over the delete ×, which was unclickable ... Operator: "release button covers delete button". Measured before touching anything: release 58x24 at (323,266), × 30x30 at (349,268) — 30x22 px of overlap on a 30px button, and `elementFromPoint` at the ×'s centre returned the release form. The × I added yesterday was 100% unclickable from the moment it shipped. Cause: both were `position:absolute` on the same corner, each with its own guessed offset, and `release` is the later sibling so it won. Replaced with one flex row positioned once — release left, × right at the card corner where the ephemeral lane's × already lives, so muscle memory transfers and neither can drift back on top of the other when a label changes width. Verified by measurement, not inspection: overlap 0 px, and clicks at each control's centre now land on that control. The ephemeral lane's × and ★ were re-checked and are unaffected. ADDS scripts/layout-probe.py, because markup inspection STRUCTURALLY cannot see this and I have now shipped two dead controls in two days by reading templates instead of rendering them. It asks a real browser what a click at each control's centre would hit. It took four iterations to become trustworthy and the failures are the point: 1. `top.contains(el)` counted an ANCESTOR overlay as a hit -- the exact case it exists to catch. Version one reported OK for a real overlay. 2. elementFromPoint is viewport-relative, so everything below the fold read as occluded and buried the real findings. 3. getBoundingClientRect() on a WRAPPED INLINE element is the union of its line boxes, whose centre lands in the gutter between them -- three zip links reported occluded by their own parent. Real geometry, wrong question. Only the fourth version fires on a genuine overlay while staying silent on the clean page. Both controls were run; a probe never seen to fail proves nothing. 173 tests pass.	2026-09-21 08:54:56 -07:00
vh	21f4afc033	fix(booth): the reveal button was inert; add kept-lane wipe and in-booth keep ... Three operator reports, one of them a real defect I had claimed was working. THE REVEAL BUTTON DID NOTHING, for a day. Its handler sat after the content block's closing tag, and a child template's out-of-block content is silently DISCARDED by Jinja. The button rendered. The handler never reached the browser. Two commits and a README paragraph said click-to-reveal worked, and the suite passed the entire time because nothing asserted against the SERVED page -- the template really did contain the code. Two guards, both confirmed to FAIL when the defect is reintroduced rather than merely added and assumed protective: * test_reveal_handler_actually_reaches_the_served_page greps the response * test_no_orphaned_markup_after_the_content_block guards the structure While moving it, caught a second instance of the same class: the explanatory comment I wrote for the fix contained a literal Jinja endblock tag, which Jinja would have parsed as a real tag and used to close the block early. KEPT-LANE ×. Wiping a kept booth required release-then-find-it-in-the-other- lane. That protected nothing and cost a hunt -- the board you just released is loose in a feed that turns over, and you have to go find it to finish a job you had already decided on. Protection now lives in the confirmation, which names the booth and says KEPT, instead of in the number of lanes you must traverse. Release stays as the reversible option. IN-BOOTH KEEP. `☆ keep` / `★ kept — release` beside "Wipe now", so promoting does not mean navigating back to the index. The booth page did not previously know its own kept state; it does now. Both post a `next` field to stay put -- and `next` is a form field, so it is attacker-controlled: only same-site absolute paths are honoured, with `//host`, schemes and backslashes refused, tested. 173 tests pass.	2026-09-21 08:40:26 -07:00
vh	59ba9f5c10	fix(booth): put the blur toggle on every item kind, and make it look like a control ... The operator asked "no UI option to blur/unblur?" and was right twice over. MISSING ENTIRELY ON TWO OF THREE BRANCHES. booth.html renders docs, media and everything-else through separate <figure> blocks. The toggle went into the media branch only, so inline docs -- the branch that puts readable text straight on the page, the one that needs blur most -- had no control at all, and `other` files only got a caption row if they happened to carry a caption. This is the SECOND time this feature shipped having patched some branches and not others; the blurred class itself had the same gap one commit ago. So the toggle is now a single Jinja macro called from all three sites, which makes "patched two of three" impossible rather than merely unlikely, and test_every_item_kind_gets_exactly_one_blur_toggle counts toggles against figures across mixed kinds so a fourth branch cannot quietly skip it. INVISIBLE WHERE IT DID RENDER. v1 was a bare `◌` at 0.78rem in --muted with no border, no label and no hover affordance. It now reads `◌ blur` / `◉ blurred` with a border, matching the other per-item controls. A control nobody can find is a control that is not there. Docs get it in the doc bar beside ⤢ ⬇ ✕, with stopPropagation so submitting it does not collapse the <details> it lives inside. Verified live on all three kinds: 3 figures, 3 toggles, and the POST round trip blurs and un-blurs. 167 tests pass.	2026-09-19 23:50:32 -07:00
vh	b569a5bb50	feat(booth): close the keep round trip, and add cosmetic per-item blur ... Two operator requests. KEEP, BOTH DIRECTIONS. The kept lane could already release a booth back to ephemeral, but an ephemeral booth could only be promoted from a shell -- so the round trip was closed only if you had ssh. The /keep route and the `booth keep` verb both already existed; only the button was missing. Adds ★ to the ephemeral card, mirroring × on the other shoulder. BLUR. Per-item cosmetic censoring: `booth blur <name> <file>...`, a ◌/◉ toggle in each caption row, and 👁 click-to-reveal. State is `.blurred` in the booth dir, one booth-relative path per line -- the same filesystem-is-the-state idiom as .pins and .forever. An empty set deletes the marker rather than leaving a zero-byte file, so `ls -a` tells the truth. ⚠ BLUR IS NOT ACCESS CONTROL, and the code, the docs and a test all say so on purpose. A blurred item is still served at its own URL, still in the zip, still on disk. The Booth has no auth by design. test_blur_is_cosmetic_the_file_is_ still_served asserts the 200 deliberately: if someone later "hardens" this into a 403 that test fails, and it should, because half-implemented access control is more dangerous than none. Reveal is per-viewer and never persisted; a reload re-hides. With JS off an item stays blurred, which is the safe direction to fail in. Two things the first pass got wrong, both caught by checking rather than assuming: * The cover thumb. index.html has IDENTICAL markup in the kept and ephemeral lanes, so a single-occurrence replace patched only the kept one and the ephemeral front page happily displayed the thing someone had hidden. The test that caught it was itself wrong first -- it matched the bare string "blurred-thumb", which is in base.html's stylesheet on every page and so passed in both states. It now asserts the attribute. * Inline docs render through their own <figure> branch and were left unblurred -- the branch that puts readable text straight on the page, so it needed blur more than images do. The suite passed; a live curl caught it. 165 tests pass (154 pre-existing, unchanged).	2026-09-19 23:47:18 -07:00
vh	88d3cf436e	fix(booth): a partial ask answer is recorded, not refused ... Operator: the form failed when a question was left blank. Refusing the whole submission over one blank threw away the picks that were made, and the HTML `required` on the radios blocked it in the browser before the server saw it. - answered questions recorded; blank ones land in `unanswered`; `complete` says whether the set is finished; a blank question carrying a note keeps the note - `required` dropped from both templates so the browser cannot block a partial - refused only when there is no pick anywhere AND no notes (a 400 — that would flip an open ask to answered with no decision recorded); a choice outside the option list is still an error - new ◐ partial state with an n/N count; skipped questions render as skipped - README + global CLAUDE.md tell reading sessions to check `complete` - 154 tests; v0.1.15	2026-09-09 15:05:18 -07:00
vh	6d36119bc5	docs(booth): record WHEN inline ask placement earns its markup — the artifact-in-working-memory test, not just the placement rule (framing from tts-dev)	2026-09-09 14:23:19 -07:00
vh	2206229ebf	docs: refresh what today's work made stale — booth asks (inline placement promoted to its own section), ana-ml2 nvme7 settled by the scrub result, nh3-dev booth entry + the CLI-on-PATH fix, run-07 runbook outcome + serving state	2026-09-09 14:18:34 -07:00
vh	d7361e8b44	feat(booth): asks render INLINE in a verbatim report, placed by the author ... Operator verdict on the separate /asks page: the question belongs with the artifact it is about. A four-voice audition wants each voice's radio group under that voice's audio, and one submit for the lot. - booth/inline.py: data-booth-ask="stem" | "stem:key" | data-booth-ask-submit, plus <!-- booth:ask ... --> comments; unknown stem left alone, not blanked - _ask_inline.html: self-contained fragments (own scoped styles, no JS), per-question groups bound to one form via the HTML5 form= attribute so a scattered multi-question ask still POSTs once - unplaced questions and a missing submit block are appended, so a partially marked-up page can never produce an unsubmittable 400 - chip becomes a jump link to the first open ask; /asks page kept as a fallback - 6 tests (one caught the partial-placement drop); v0.1.14	2026-09-09 14:16:03 -07:00
vh	f99faabb80	fix(booth): asks were invisible in a booth serving its own index.html ... A custom index.html is returned verbatim, so booth.html's asks panel never rendered there — a valid ask (emmie-anchor/anchor.ask.json) was listed by the CLI and shown nowhere, with nothing to say so. - panel extracted to _asks.html; new GET /b/<name>/asks standalone page - verbatim pages get an amber '? N open asks' chip beside the back chip - POST /answer honours back=asks so answering returns to that page - single-question asks now keep an optional 'title' (was silently dropped) - README + routes table; 8 regression tests; v0.1.12	2026-09-09 10:39:18 -07:00
vh	047749c3cf	fix(booth): CLI resolves its source through the ~/.local/bin symlink (readlink -f), so ask/asks/answer/unlink work from any cwd	2026-09-09 09:21:34 -07:00