booth

3 Commits

Include renames

Author SHA1 Message Date

Author	SHA1	Message	Date
vh	397ea89795	fix(u7): six defects from the heid bug-hunt panel, and five vacuous falsifiers Cross-frontier panel (Gróa/Hulda/Regin/Kimi) on U7's diff, thread 01M368G2Y0JMTJ2T7M3JMTXV5Z. Four of the six fixes are for defects no test in this repo could have caught, and the panel's guard-strength passes found five of my own falsifiers green under the exact change they forbade. THE 4-OF-4 FINDING — the group anchor could land on the WRONG artifact. The anchor was the raw rel spliced into an href fragment while the tile id was equally raw. A browser matches a fragment against ids RAW FIRST and only then percent-decoded, so raw-on-both-sides is not merely unencoded, it is AMBIGUOUS: with `a b.png` and `a%20b.png` in one booth, the first's href resolves to the fragment `item-a%20b.png` and the raw pass matches the SECOND file's id. That is the misfiled-judgment failure invariant 6 exists to prevent, arriving through a path invariant 6 never looked at. Both sides now use `Item.url` (`quote(rel, safe="/")`), which is injective here and is the convention booth_flag has always used. The original test asserted the href occurred as SOME id on the page — true while pointing at the wrong one. GRÓA'S STRONGEST SOLO — a zero-hit filter removed the way back. The rail was gated on the FILTERED list, so a valid filter with no matches removed the rail, the filter links and the route back to `all`, while the empty-booth branch announced the booth was empty with rail.total still holding the real count. No recovery without editing the address bar, and it degraded the same way with JavaScript off, on the surface the operator actually reviews on. Gated on all_items now, with an explicit no-match row. HULDA — one unrepresentable filename took out the INDEX, not just its booth. A non-UTF-8 filename reaches CPython as a surrogate and quote() raises on it, outside any per-item handler. booth_items feeds list_booths, so one 0xff byte in one booth's filename 500s every booth's card. Such a file cannot be linked, served or zipped, so it is skipped like a dotfile. HULDA — the `f` shortcut has never worked. The selector named `.flagbtn`, which nothing in this repo emits, so it fell through to the hidden target input; clicking a hidden input does not submit its form, and the handler called preventDefault anyway. Now clicks the flag form's real button, verified end to end in a real browser. GRÓA — a group jump was undone by the next keypress. The jump scrolls, the cursor stayed at -1, and the next arrow focused tile 0 and scrolled back. The cursor now picks up from the viewport, which also fixes the general scroll-then-arrow case. Asserted on real scroll geometry in Chromium. HULDA — the caption sidecar was read whole before being truncated, so a pathological file was a MemoryError the OSError handler does not catch. Bounded at the read, and deliberately NOT by st_size: a FIFO reports 0. ACCEPTED KNOWN RISKS, both now documented rather than implied: no cap on rail row count (1,000 groups of two would render 1,000 rows; the largest live booth is 66 items and picking a cap without a booth that needs one is invented work), and Item.group sits mid-dataclass (one construction site, keyword-only, grepped). The docstring now names the UPPER median explicitly — two arms flagged that "the middle group" admits both readings for an even count. FIVE VACUOUS FALSIFIERS, found by the arms and not by me: the anchor test survived v[0]->v[-1]; the informativeness guard survived sizes[-1]; the group count survived len(v)+1; the zero-hit filter test used a fixture that HAD hits; and the escaping test asserted over the whole page, so it went red on a code comment. All rewritten, all mutation-proved. The table is up to 20 rows and one drifted when I changed the line under it — reported by the harness, not silently skipped, which is the behaviour tests/test_mutation_check.py exists to hold. 660 green; 20/20 proved. Deployed; 21/21 booths 200. Held for design-dev, not fixed here: Gróa's finding that the sticky rail has no scroll-margin, so a fragment jump tucks the target under it. It is one line in base.html, the file he is rewriting from scratch.	2026-09-23 00:04:59 -07:00
vh	5c20e2f4d5	fix(u3): seven defects two cold panels found in the declared seam The /heid-code-review and /heid-bug-hunt panels, artifact-only over the U3 diff, between them found four real defects and three vacuous falsifiers. Both snapshots predate the contract-review fixes, so two of their findings were already closed; the rest are here. Prototype pollution in the placement maps. A mark id and a question key are both [A-Za-z0-9][A-Za-z0-9._-]*, so `toString` and `constructor` are legal in each. Against a plain `{}` an anchor naming NO mark returned an inherited function, passed the guard meant to reject it, and threw on .questions.length -- aborting placement before the tail, so one typo in author markup cost the page every ask. The `placed` set had the mirror bug: inherited `got.constructor` read as already-placed and silently dropped a question. Object.create(null), three times. Found independently by both panels. A declaring page was not served as written. read_text() opens in universal-newline mode, so a CRLF report came back LF, and errors="replace" replaced every byte that was not valid UTF-8. That is this unit's headline promise, broken by the read itself, and the test could not see it because its fixture was LF-only ASCII. The verbatim branch reads and serves bytes now; the decoded copy answers only "does it declare the seam?". A submit anchor inside the author's own <form> lost ours -- the parser drops a nested form element outright -- while the code still recorded the pick as submitted, so no fallback was appended. Every control's form= pointed at nothing and the button did nothing. It counts as submitted only if the form survived. A broken pick's diagnostic never rendered from a submit-only anchor: an errored pick's submit block is empty, and mounting that then marking it placed made the tail skip the "broken ask" box entirely. The anchor is left alone instead. An author's own element could hijack the open-ask chip -- id="bk-ask-winner- background" satisfies any prefix rule, hyphen boundary included. The chip now searches only elements this script mounted, which is the identity the deleted bk-ask-<id>-top anchor used to guarantee, and takes the earliest by compareDocumentPosition. No error boundary around fragment rendering. A .marks.json that is well-formed JSON with a wrong-shaped answer hydrates with no error and then raises in the macro; this endpoint renders every pick on every load of the report, so that was the whole seam gone while hold_read called the file readable. Reproduced before building for it. _safe_fragments gives it the per-mark leniency _hydrate_safe already applies one layer down. The gallery and marks pages still 500 on that same entry. Measured at `42ea67f` -- it predates this unit, they render the same macro with no guard, and the gallery is named out of scope in the contract. Recorded, not quietly widened: persistent-memory.d/2026-09-22-a-wrong-shaped-answer-500s-the-gallery.md Also corrected: several comments claimed a multi-question pick POSTs a 400 unless every question is answered. It does not -- an empty submission is refused, a partial one is recorded on purpose. The real reason an unplaced question must still be appended is that a question which never reaches the page cannot be answered at all. Vacuity pass rebuilt around the rule this session learned: the mutation comes from the invariant's claim, never from the falsifier's example. 21 mutations, 21 caught, unmutated control green. Getting there took three rounds -- it passed INV-3 with the contract's own mutation, then found its own fix's hole, then flagged seven stale mutations and one genuinely vacuous fixture whose sibling-mark arrangement made the right answer also the first answer. 444 tests. Deployed and verified: 23/23 booths 200, and all four live verbatim reports served at exactly +46 bytes -- len(EMBED_SCRIPT_TAG) -- with the authors' own wrappers and headings intact and no console errors.	2026-09-22 11:22:37 -07:00
vh	87e2c5364c	feat(u3): a verbatim report declares the seam, the Booth mounts into it A booth that ships its own index.html was served through ten regular expressions applied to markup the Booth did not write: six in wrap_verbatim_html hunting for somewhere to hang a favicon and a chip, four in booth/inline.py substituting rendered ask markup into the author's own tags. Both worked. Both were the most fragile thing in the service, on the path the operator uses most. The whole class is replaced by a declared seam. A report carries one line — <script src="/_booth/embed.js" defer></script> — and the chrome mounts through DOM APIs. What the server does to author HTML is now, in full: return html if declares_embed(html) else html + EMBED_SCRIPT_TAG Two substring tests and a concatenation. Both of the old wrapper's hard constraints stop existing rather than being satisfied more carefully: nothing can displace a leading doctype into quirks mode and nothing can push the charset meta out of its detection window, because nothing in front of them ever moves. A page that declares the seam is served exactly as written. Fragments are still rendered by the _ask_inline.html macros and handed over GET /b/<name>/embed.json; embed.js places them and decides nothing. Openness comes from open_marks, order from (created, id), questions in declaration order. A single-question pick normalizes to key None, so the payload carries questions as a list rather than an object — keying by name would serialize that as the string "null". Placement is an anchor fill, not a replacement: el.insertAdjacentHTML( 'beforeend'), so an author's wrapper and its contents survive. The regex it replaces was eating the opening tag of dfa-concepts' styled .ask blocks and orphaning their headings, live, unreported. data-booth-mark is canonical; data-booth-ask stays a kept alias because two live reports use it. The comment placeholders are dropped — no users. Declared cost: the verbatim path now needs JavaScript. The never-invisible guarantee holds through the index badge and /b/<name>/marks, both of which render server-side. Deleted: booth/inline.py entire, wrap_verbatim_html and its six patterns, _BACK_CHIP, asks_chip, inject_asks, FAVICON_LINK, the styles() macro. Tests 410 -> 434. tests/test_embed_browser.py drives a real Chromium: the placement algorithm and the form= binding of a scattered multi-question form cannot be observed any other way, and that binding was measured rather than assumed (N=3 per condition, with a form-first positive control and a points-at-nothing negative control). Contract: docs/contracts/u3_declared_embed_seam.contract.md, with the in-session seam review and the cold contract panel both recorded. Two of the panel's findings were code fixes: a vacuous INV-3 falsifier that a renamed regex walked straight through, and a bare-substring seam detection that read a report merely quoting the path as declaring it and silently served it with no chrome.	2026-09-22 10:43:41 -07:00

vh

397ea89795

fix(u7): six defects from the heid bug-hunt panel, and five vacuous falsifiers

Cross-frontier panel (Gróa/Hulda/Regin/Kimi) on U7's diff, thread
01M368G2Y0JMTJ2T7M3JMTXV5Z. Four of the six fixes are for defects no test in
this repo could have caught, and the panel's guard-strength passes found five of
my own falsifiers green under the exact change they forbade.

THE 4-OF-4 FINDING — the group anchor could land on the WRONG artifact.
The anchor was the raw rel spliced into an href fragment while the tile id was
equally raw. A browser matches a fragment against ids RAW FIRST and only then
percent-decoded, so raw-on-both-sides is not merely unencoded, it is AMBIGUOUS:
with `a b.png` and `a%20b.png` in one booth, the first's href resolves to the
fragment `item-a%20b.png` and the raw pass matches the SECOND file's id. That is
the misfiled-judgment failure invariant 6 exists to prevent, arriving through a
path invariant 6 never looked at. Both sides now use `Item.url`
(`quote(rel, safe="/")`), which is injective here and is the convention
booth_flag has always used. The original test asserted the href occurred as SOME
id on the page — true while pointing at the wrong one.

GRÓA'S STRONGEST SOLO — a zero-hit filter removed the way back.
The rail was gated on the FILTERED list, so a valid filter with no matches
removed the rail, the filter links and the route back to `all`, while the
empty-booth branch announced the booth was empty with rail.total still holding
the real count. No recovery without editing the address bar, and it degraded the
same way with JavaScript off, on the surface the operator actually reviews on.
Gated on all_items now, with an explicit no-match row.

HULDA — one unrepresentable filename took out the INDEX, not just its booth.
A non-UTF-8 filename reaches CPython as a surrogate and quote() raises on it,
outside any per-item handler. booth_items feeds list_booths, so one 0xff byte in
one booth's filename 500s every booth's card. Such a file cannot be linked,
served or zipped, so it is skipped like a dotfile.

HULDA — the `f` shortcut has never worked. The selector named `.flagbtn`, which
nothing in this repo emits, so it fell through to the hidden target input;
clicking a hidden input does not submit its form, and the handler called
preventDefault anyway. Now clicks the flag form's real button, verified end to
end in a real browser.

GRÓA — a group jump was undone by the next keypress. The jump scrolls, the
cursor stayed at -1, and the next arrow focused tile 0 and scrolled back. The
cursor now picks up from the viewport, which also fixes the general
scroll-then-arrow case. Asserted on real scroll geometry in Chromium.

HULDA — the caption sidecar was read whole before being truncated, so a
pathological file was a MemoryError the OSError handler does not catch. Bounded
at the read, and deliberately NOT by st_size: a FIFO reports 0.

ACCEPTED KNOWN RISKS, both now documented rather than implied: no cap on rail
row count (1,000 groups of two would render 1,000 rows; the largest live booth
is 66 items and picking a cap without a booth that needs one is invented work),
and Item.group sits mid-dataclass (one construction site, keyword-only, grepped).
The docstring now names the UPPER median explicitly — two arms flagged that
"the middle group" admits both readings for an even count.

FIVE VACUOUS FALSIFIERS, found by the arms and not by me: the anchor test
survived v[0]->v[-1]; the informativeness guard survived sizes[-1]; the group
count survived len(v)+1; the zero-hit filter test used a fixture that HAD hits;
and the escaping test asserted over the whole page, so it went red on a code
comment. All rewritten, all mutation-proved. The table is up to 20 rows and one
drifted when I changed the line under it — reported by the harness, not silently
skipped, which is the behaviour tests/test_mutation_check.py exists to hold.

660 green; 20/20 proved. Deployed; 21/21 booths 200.

Held for design-dev, not fixed here: Gróa's finding that the sticky rail has no
scroll-margin, so a fragment jump tucks the target under it. It is one line in
base.html, the file he is rewriting from scratch.

2026-09-23 00:04:59 -07:00

vh

5c20e2f4d5

fix(u3): seven defects two cold panels found in the declared seam

The /heid-code-review and /heid-bug-hunt panels, artifact-only over the U3
diff, between them found four real defects and three vacuous falsifiers. Both
snapshots predate the contract-review fixes, so two of their findings were
already closed; the rest are here.

Prototype pollution in the placement maps. A mark id and a question key are
both [A-Za-z0-9][A-Za-z0-9._-]*, so `toString` and `constructor` are legal in
each. Against a plain `{}` an anchor naming NO mark returned an inherited
function, passed the guard meant to reject it, and threw on .questions.length
-- aborting placement before the tail, so one typo in author markup cost the
page every ask. The `placed` set had the mirror bug: inherited
`got.constructor` read as already-placed and silently dropped a question.
Object.create(null), three times. Found independently by both panels.

A declaring page was not served as written. read_text() opens in
universal-newline mode, so a CRLF report came back LF, and errors="replace"
replaced every byte that was not valid UTF-8. That is this unit's headline
promise, broken by the read itself, and the test could not see it because its
fixture was LF-only ASCII. The verbatim branch reads and serves bytes now; the
decoded copy answers only "does it declare the seam?".

A submit anchor inside the author's own <form> lost ours -- the parser drops a
nested form element outright -- while the code still recorded the pick as
submitted, so no fallback was appended. Every control's form= pointed at
nothing and the button did nothing. It counts as submitted only if the form
survived.

A broken pick's diagnostic never rendered from a submit-only anchor: an errored
pick's submit block is empty, and mounting that then marking it placed made the
tail skip the "broken ask" box entirely. The anchor is left alone instead.

An author's own element could hijack the open-ask chip -- id="bk-ask-winner-
background" satisfies any prefix rule, hyphen boundary included. The chip now
searches only elements this script mounted, which is the identity the deleted
bk-ask-<id>-top anchor used to guarantee, and takes the earliest by
compareDocumentPosition.

No error boundary around fragment rendering. A .marks.json that is well-formed
JSON with a wrong-shaped answer hydrates with no error and then raises in the
macro; this endpoint renders every pick on every load of the report, so that
was the whole seam gone while hold_read called the file readable. Reproduced
before building for it. _safe_fragments gives it the per-mark leniency
_hydrate_safe already applies one layer down.

The gallery and marks pages still 500 on that same entry. Measured at 42ea67f
-- it predates this unit, they render the same macro with no guard, and the
gallery is named out of scope in the contract. Recorded, not quietly widened:
persistent-memory.d/2026-09-22-a-wrong-shaped-answer-500s-the-gallery.md

Also corrected: several comments claimed a multi-question pick POSTs a 400
unless every question is answered. It does not -- an empty submission is
refused, a partial one is recorded on purpose. The real reason an unplaced
question must still be appended is that a question which never reaches the page
cannot be answered at all.

Vacuity pass rebuilt around the rule this session learned: the mutation comes
from the invariant's claim, never from the falsifier's example. 21 mutations,
21 caught, unmutated control green. Getting there took three rounds -- it
passed INV-3 with the contract's own mutation, then found its own fix's hole,
then flagged seven stale mutations and one genuinely vacuous fixture whose
sibling-mark arrangement made the right answer also the first answer.

444 tests. Deployed and verified: 23/23 booths 200, and all four live verbatim
reports served at exactly +46 bytes -- len(EMBED_SCRIPT_TAG) -- with the
authors' own wrappers and headings intact and no console errors.

2026-09-22 11:22:37 -07:00

vh

87e2c5364c

feat(u3): a verbatim report declares the seam, the Booth mounts into it

A booth that ships its own index.html was served through ten regular
expressions applied to markup the Booth did not write: six in
wrap_verbatim_html hunting for somewhere to hang a favicon and a chip, four
in booth/inline.py substituting rendered ask markup into the author's own
tags. Both worked. Both were the most fragile thing in the service, on the
path the operator uses most.

The whole class is replaced by a declared seam. A report carries one line —
<script src="/_booth/embed.js" defer></script> — and the chrome mounts
through DOM APIs. What the server does to author HTML is now, in full:

    return html if declares_embed(html) else html + EMBED_SCRIPT_TAG

Two substring tests and a concatenation. Both of the old wrapper's hard
constraints stop existing rather than being satisfied more carefully:
nothing can displace a leading doctype into quirks mode and nothing can push
the charset meta out of its detection window, because nothing in front of
them ever moves. A page that declares the seam is served exactly as written.

Fragments are still rendered by the _ask_inline.html macros and handed over
GET /b/<name>/embed.json; embed.js places them and decides nothing. Openness
comes from open_marks, order from (created, id), questions in declaration
order. A single-question pick normalizes to key None, so the payload carries
questions as a list rather than an object — keying by name would serialize
that as the string "null".

Placement is an anchor fill, not a replacement: el.insertAdjacentHTML(
'beforeend'), so an author's wrapper and its contents survive. The regex it
replaces was eating the opening tag of dfa-concepts' styled .ask blocks and
orphaning their headings, live, unreported.

data-booth-mark is canonical; data-booth-ask stays a kept alias because two
live reports use it. The comment placeholders are dropped — no users.

Declared cost: the verbatim path now needs JavaScript. The never-invisible
guarantee holds through the index badge and /b/<name>/marks, both of which
render server-side.

Deleted: booth/inline.py entire, wrap_verbatim_html and its six patterns,
_BACK_CHIP, asks_chip, inject_asks, FAVICON_LINK, the styles() macro.

Tests 410 -> 434. tests/test_embed_browser.py drives a real Chromium: the
placement algorithm and the form= binding of a scattered multi-question form
cannot be observed any other way, and that binding was measured rather than
assumed (N=3 per condition, with a form-first positive control and a
points-at-nothing negative control).

Contract: docs/contracts/u3_declared_embed_seam.contract.md, with the
in-session seam review and the cold contract panel both recorded. Two of the
panel's findings were code fixes: a vacuous INV-3 falsifier that a renamed
regex walked straight through, and a bare-substring seam detection that read
a report merely quoting the path as declaring it and silently served it with
no chrome.

2026-09-22 10:43:41 -07:00