{"body":"## Filbert review, row 154 round 2: changes\n\nCandidate manifest `1db8d410ca4d706a355ce3d1dec3e985ae058093a4a56f5a31521079a4cce017` (195 lines), `r2/candidate.patch` (`3c7c0114...`) applied with `--index` to `850484a7d`. The manifest matched before and after every run.\n\nOne change is requested: the candidate fails its own provenance test. My r1 change (a fallback test) is addressed, and the fixes for Dewey's r1 findings hold up. Deviations (i) to (iii) are Dewey's to rule on; I give no verdict on them.\n\n### Change: `editor/BUILD.json` records an `editor.js` that is not the shipped bundle, and `editor-provenance.test.mjs` fails\n\nThe candidate's `packages/webui/editor/BUILD.json` records `src/public/editor.js` as `73975eb2cdc4262c6b5488829ad5349e8ad1358ad6631fb51bc334d6c6bbbb80`, 758168 B. The shipped `src/public/editor.js` is `32fcaa18eaee2ff426c3c7e06038ee190f9fd7a332c9f3db349aa74df22c9fb5`, 758277 B. Manifest line 14 and BUILD.md (`:400`, `:428`) give that same value. The hash 73975eb2 appears nowhere in the packet's `.md` files.\n\nMy rebuild with the pinned toolchain (lock `eb60a494...`, esbuild 0.28.2 binary `e1698a3d...`, toolchain check rc=0 under `MOSAIC_REQUIRE_EDITOR_BUILD=1`) gives:\n- `editor.js` `32fcaa18...`, 758277 B, the same as the shipped file;\n- `editor.css` `8654ac57...`, 4462 B, the same as the shipped file;\n- a `BUILD.json` that differs from the committed one only in that `editor.js` entry (lines 7-8).\n\nSo the bundle is reproducible, but the record of it is stale. With the candidate as shipped, under `MOSAIC_REQUIRE_EDITOR_BUILD=1`, `editor-provenance.test.mjs` fails 4/6:\n- `:79` \"the bundle is the recorded build\" fails at `:89`: `src/public/editor.js is not the recorded build`, actual `32fcaa18...`, expected `73975eb2...`.\n- `:159` \"rebuilding from the source gives the same bytes\" fails: `src/public/editor.js rebuilt`, actual `32fcaa18...`, expected `73975eb2...`.\n\nThat conflicts with BUILD.md `:238`, `:405` and `:430` (editor-provenance 6/6, webui 201/201). The patch may have been cut from a tree whose `BUILD.json` was not the one tested; I can't tell which from the packet.\n\nRequested: regenerate `editor/BUILD.json` from the shipped sources (`node editor/build.mjs`), and confirm that `editor-provenance.test.mjs` passes 6/6 under `MOSAIC_REQUIRE_EDITOR_BUILD=1` on the tree the patch is cut from. Please include that log in the packet.\n\nA correction to my own earlier note to Sage: I said no test compares the shipped bundle with `BUILD.json`. That was wrong; `:79`/`:89` does, and it is the test that catches this.\n\n### Checked and correct\n\n- **Fallback, my r1 change.** `editor-browser.test.mjs:382` stubs `roundTrip` to disagree. It checks the Source page, the note, Save off, and the Visual button opening the editor with no new read once the file round-trips. It also checks `window.MosaicEditor = undefined`. My g7 (`docShown` never set, `bus.js`) is killed by tests 4, 5 and 6.\n- **`docShown` versus `docMode`.** The click handler returns only when the mode equals what is on screen, so Visual from a fallback acts and the user's preference survives the next fallback, as the test asserts.\n- **One-line sinks.**\n  - `oneLine` (`model.mjs:168`) clamps the link title, image alt and image title.\n  - `fenceInfo` (`:169`) cuts the info at the first line break and drops an info holding a backtick.\n  - The four paste tests wait for the pasted node to hold the hostile value before they save. g1 to g4 are each killed by their own test (7 to 10).\n- **Tilde fence with a backtick info.** `:150` sets `refused`, and the block stays as source. g6 is killed by `editor-browser.test.mjs` test 11.\n\n### Non-blocking notes\n\n- **g5 survived.** It removes the backtick drop in `fenceInfo` (`:171`, `return info;`). No test saves a block whose info holds a backtick on the save path; the load path refuses that case first (g6). A paste of `<pre data-params=\"a`b\">` followed by a save would cover it.\n- **Packet wording.** BUILD.md `:388`, `:390` and `:419` say the tilde backtick case \"opens as Source\". The code and test 11 show a raw source block (`pre.md-raw`) inside the visual editor, not the Source view. Dewey's ruling on (ii) should be read with that in mind.\n- **`docs-browser.test.mjs:67`.** The second wait dropped the explicit `#doc-commit` existence check that `:65` keeps, so `undefined !== \"\"` passes before the element exists. The `#doc-text` check in the same wait covers that in practice.\n- **A title ending in a backslash** (BUILD.md `:394`) is still unescaped for link and image titles. The save is corrupted but stays on one line, so no HTML block results. A follow-up is fine.\n\n### Ran by me\n\nSlot from sage-0828. The busy check was CLEAR before each step. TMPDIR was in my own scratch, DOCKER_HOST was a dead socket, and `MOSAIC_REQUIRE_EDITOR_BUILD=1` was set.\n\n- **Rebuild, 18:28:45Z.**\n  - `npm ci --ignore-scripts` in `packages/webui`, lock and binary shas as above.\n  - One build to a scratch `--out`, then one in place; the shipped files were restored afterwards and the manifest re-matched.\n  - Results as above.\n- **Singles, 18:29:03Z to 18:32:09Z.**\n  - Every `packages/webui/tests/*.test.mjs` file was run singly: 32 files, 199/201 by awk sum, 0 skipped.\n  - The two failures are the provenance tests above.\n  - I reran `editor-provenance.test.mjs` once with the spec reporter for the assertion text.\n  - All other files passed, including editor-browser 11/11, editor 5/5, docs-browser 1/1 and service 23/23.\n- **Mutants, 18:32:32Z to 18:34:30Z.**\n  - Both controls (`editor-browser.test.mjs`, `editor.test.mjs`) passed first.\n  - Each `model.mjs` mutant was rebuilt into the bundle before its run, and the files were restored after each one.\n  - 7 run, 6 killed (g1, g2, g3, g4, g6, g7), 1 survived (g5).\n\n### Not mine\n\nResearcher's r2 runs in BUILD.md: two byte-identical builds of `32fcaa18...`; singles 62/62 and webui 201/201; 3 mutants killed. I did not rerun them, and the provenance part of those counts doesn't match what I see on this candidate.\n"}