stack/agents/filbert/work/queue-148/r3/body.md at dev-console

0 Fork 1

Files

T

jason.woltje b9ea9304fd lead: commit filbert's untracked evidence (273 files: queue-101 queue-102 queue-105 queue-107 queue-108 queue-109 queue-110 queue-112 queue-113 queue-114 queue-115 queue-116 queue-119 queue-120 queue-122 queue-123 queue-125 queue-126 queue-128 queue-129 queue-130 queue-131 queue-132 queue-133 queue-134 queue-135 queue-136 queue-137 queue-139 queue-140 queue-141 queue-142 queue-145 queue-146 queue-147 queue-148 queue-149 queue-150 queue-151 queue-152 queue-153 queue-154 queue-155 queue-156 queue-162 queue-163 queue-165 queue-166 queue-167 queue-169 queue-170 queue-175 queue-177 queue-181 queue-182 queue-184 queue-185 queue-186 queue-187 queue-188 queue-49 queue-64 queue-66 queue-70 queue-71 queue-80 queue-84 queue-85 queue-87 queue-88)

Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.

2026-11-02 15:05:14 -06:00

3.5 KiB

Raw Permalink Blame History

Filbert review, row 148 round 3: approve.

Candidate manifest 95ae4736227d1214516c1b3a158082a7ea54ea50572ba579a5636406c466c08f (packet agents/researcher/work/queue-148/, request 28830, note 28831).

Rebuild (run by me)

Detached worktree at base 18aee8fa1, with git apply --index of the packet patch. sha256sum -c passed against the manifest and git diff --cached --check is clean. The patch touches 27 files, +1749 -46, and the paths match changed-paths.txt.
No en or em dash or curly quote on any added line.
No drift: git diff --name-only 18aee8fa1 862af3079 on the 27 manifest paths is empty.
The round 2 patch is not in the packet any more, so I reviewed the changed files in full, not as an interdiff.

Round 2 finding: fixed

FENCE, ATX and ITEM now carry the s flag (markdown-preview.js:24, :25, :42). The closing (.*)$ matches through U+2028 and U+2029, so the greedy run before it never has to give back characters.
isRule (markdown-preview.js:30) replaces the thematic-break regex with one pass over the line. It allows up to three leading spaces, then one mark, then only that mark or blanks, and needs at least three marks. That is the old accept set. The test at markdown-preview.test.mjs:291 checks this exhaustively against the old regex.
The surviving mutant v21 (a fourth leading space) is equivalent: ITEM's ^( {0,3}) already refuses that line, so nothing changes downstream.

Probe (run by me, on Sage's slot, 22:12:43Z to 22:12:44Z)

40 cells, one process each, timeout 20, all rc 0. Each cell rendered one line through render() of the rebuilt module.

ITEM, ATX, FENCE: marker + 8, 16, 32 or 64 KiB run + U+2028, U+2029 or a letter control. The slowest cell was 2.2 ms (ITEM letter at 64 KiB). Round 2 took 2.25 s at 64 KiB with a separator.
isRule: "-" x N took 72 ms at 1 MiB and 251 ms at 4 MiB; "- " x N/2 took 71 and 266 ms, so the cost is linear.

Tests (run by me, singly)

markdown-preview.test.mjs: 19/19 pass.
docs-browser.test.mjs: 1/1 pass.

The other new pieces

The paintDoc guard (bus.js:692): if render throws or the preview script is missing, the page shows a fallback line and the draft is kept. The finally at bus.js:718 resets s.saving. docs-browser.test.mjs covers a throwing render while typing, a status setter that throws mid-save (lines 193 to 207) and a first paint under ?throwrender (line 242).
- Observation, not a finding: after a mid-save paint throw, the Save button stays disabled in the DOM until the next input repaints, because the paint that would turn it back on is skipped. The test pins this on purpose (one rejection, then typing turns Save back on). It needs a throwing DOM setter to happen, so I'm not asking for a change.
serve.mjs:
- The POST route checks the user header, the exact Origin and same-origin Fetch Metadata.
- It takes a 1 MiB JSON body with exactly the four string keys.
- The project and path are quoted and cut to 200 characters in the log, and the content is never logged.
- An unclear outcome is sent:"unknown", and an answer without a commit or for the wrong path is treated as unknown.
- /api/config edit uses the same test as the route.
README NUL change: correct. packages/project/src/read.mjs:14 refuses a NUL with project-read-content, and writeHumanFile refuses NUL content before writing.

Not run by me

The full gate, Researcher's mutant set (43 of 44 killed), the criterion runs and the stack audit come from Researcher's receipts in build.md.

Verdict: approve, no findings.

3.5 KiB Raw Permalink Blame History