# `[2026-09-21]` The Booth gained blur and a closed keep round trip — after shipping two controls that did nothing

**Shipped** (2e7fd71, 271cb11, 751eecb, 07c9cb2): per-item cosmetic blur
(`.blurred` marker, CLI `blur`/`unblur`, caption toggle, click-to-reveal, cover
thumbs inheriting it), the ephemeral→kept `★` button closing a round trip that
previously needed a shell, a direct `×` on kept cards, and in-booth
keep/release with an open-redirect-safe `next`.

⚠ **BLUR IS NOT ACCESS CONTROL** and the code, docs and a test all say so
deliberately. A blurred item is still served at its own URL, still in the zip.
`test_blur_is_cosmetic_the_file_is_still_served` asserts the **200** on
purpose: if someone later "hardens" it into a 403 that test fails, and it
should — half-implemented access control is more dangerous than none.

⚠ **Two controls shipped INERT, both found by the operator, both by me reading
templates instead of rendering them:**

- **The reveal button.** Its handler sat **after `{% endblock %}`**, which
  Jinja DISCARDS in a child template. The button rendered; the handler never
  reached the browser. Two commits and a README claimed click-to-reveal worked,
  and the suite passed throughout because nothing asserted against the SERVED
  page. Guards added and **confirmed to fail on reintroduction**.
- **The kept-card `×`.** Both it and `release` were `position:absolute` on the
  same corner with independently guessed offsets; `release` is the later
  sibling so it won. Measured **30×22 px overlap on a 30 px button**, and
  `elementFromPoint` at the ×'s centre returned the release form. Unclickable
  from the moment it shipped. Replaced with one flex row positioned once.

⚠ **The blur feature itself was shipped twice having patched only SOME of
booth.html's three item branches** (doc / media / other) — first the blurred
class, then the toggle. The toggle is now ONE Jinja macro called from all three
sites, and `test_every_item_kind_gets_exactly_one_blur_toggle` counts toggles
against figures so a fourth branch cannot quietly skip it.

⭐ **`scripts/layout-probe.py`** exists because markup inspection structurally
cannot see occlusion. It took **four iterations** to become trustworthy and the
failures are the point: (1) `top.contains(el)` counted an ANCESTOR overlay as a
hit — the exact case it exists to catch; (2) `elementFromPoint` is
viewport-relative, so everything below the fold read as occluded; (3)
`getBoundingClientRect()` on a WRAPPED INLINE element is the union of its line
boxes, whose centre lands in the gutter, on the parent. Only the fourth version
fires on a real overlay while staying silent on a clean page. **Both controls
were run** — my first attempt at validating it was itself invalid.

See [[2026-09-21-ops-log-and-the-instruments-that-lied]].