groa's late retry on the blur bug-hunt, adjudicated against the landed code.
Its four bugs were already fixed, but a robustness note (mkstemp's 0600 locks
out a reader under another uid, which then "sees nothing and replaces it")
pointed at a real gap. set_blurred built on read_blurred, the renderer's
lenient reader, which turns an unreadable, oversized or malformed
`.blurred.json` into an empty set. The writer then replaced the file, and
whatever it held was gone. This is the `.marks.json` wipe of 2026-09-21 in a
new module, and it shipped for a night.
- `_load` is the one parse with two postures. read_blurred maps its refusal to
"nothing blurred" (a damaged file costs the blur, never the page).
set_blurred lets it raise BlurUnwritable, which the route answers with 409
and the CLI with exit 3, and changes nothing.
- It refuses only for a REGULAR file it cannot read. A link, a directory or a
FIFO at either name holds no set anyone wrote, so it reads as empty, and the
postcondition judges whether the write can land: a link is replaced, a
directory refused.
- The file is 0644 again, as the line-format writer left it (fchmod after
mkstemp).
The open flags in `_read_capped` became a second layer behind the new lstat
check, and the mutation run caught their rows VACUOUS through the public API.
They are now held to account by direct tests, because they still close the
lstat-to-open race. blur_storage.toml: 25/25. No second panel was run: this
folds one reviewer note plus the repo's own recorded lesson, with a test and
a proved row for each behaviour.
vh
8a78a9bd1d