Unclaimed files left in the canonical checkout. Inventory: canonical-cleanup-inventory.md (commit-as-evidence groups). detect-secrets scan clean on 2026-11-02: hits are sha256 pins, git object ids, test sentinels already in tracked tests and unit-file lines.
3.9 KiB
Filbert review, row 154 round 3: approve
Candidate manifest cebca5145c899a362e938d36b26168070ad8cc01bfdc0c9f44a68eee07a005ca (195 paths), r3/candidate.patch (d709b2dd...) applied with --index to 850484a7d. The manifest matched before and after every run. Compared with r2, five paths changed: editor/BUILD.json, editor/model.mjs, src/public/editor.js, tests/docs-browser.test.mjs and tests/editor-browser.test.mjs.
My r2 change is fixed, and so are my non-blocking notes. No new findings.
Change from r2, fixed: BUILD.json records the shipped bundle
editor/BUILD.json:6-8recordssrc/public/editor.jsas9c881b13740fae2408717ad75fa1d85bfcfe3fa8b3af0f1b3f2e706c90e80fee, 758420 B. That is the shipped file.- I rebuilt with the pinned toolchain (lock
eb60a494..., esbuild 0.28.2 binarye1698a3d..., toolchain check rc=0 underMOSAIC_REQUIRE_EDITOR_BUILD=1), both to a scratch--outand in place. In both,editor.js,editor.css(8654ac57..., 4462 B) andBUILD.jsonare byte for byte the same as the shipped files. editor-provenance.test.mjspasses 6/6 underMOSAIC_REQUIRE_EDITOR_BUILD=1.
r2 notes, checked
- Title backslashes.
model.mjs:172:titleBackslashdoubles each backslash before the vendored link writer escapes", sox\")is written asx\\\")andend\asend\\.:193: the image title escapes both characters in one pass (/[\\"]/g).editor-browser.test.mjs:481-488adds four tests. They cover a quote after a backslash then a tag, and a trailing backslash, each for a link title and an image title. Each asserts the exact written string, then re-reads the saved text with a read-only mount (:454-465).
- g5.
:492pastes<pre data-params="ab">` and requires a bare fence on Save. My g5 is now killed by it. docs-browser.test.mjs:67. The explicitdocument.querySelector("#doc-commit")check is back, as at:65.- Tilde wording. BUILD.md
:419and:464now say a raw source block (pre.md-raw) inside the visual editor.
Non-blocking note
- The re-read asserts haven't been shown to fail on their own. BUILD.md
:490says this itself: on every backslash mutant (Researcher's and my g1, g8 and g9) the exact-string assert fails first. I read:454-465, and the re-read checks the right things: the parsed title equals the pasted value, and no<imgappears in the text. The exact-string assert already pins each written form, so the tests kill a wrong escape either way. I don't need that extra run.
Ran by me
Slot from sage-0858. The busy check was CLEAR before each step and after the last one. TMPDIR was in my own scratch, DOCKER_HOST was a dead socket, and MOSAIC_REQUIRE_EDITOR_BUILD=1 was set.
- Rebuild, 19:09:28Z to 19:09:29Z. Results as above. The shipped files were restored afterwards and the manifest re-matched.
- Singles, 19:09:35Z to 19:12:48Z.
- Every
packages/webui/tests/*.test.mjsfile was run singly: 32 files, 206/206 by awk sum, 0 skipped. - That includes editor-browser 16/16, editor-provenance 6/6, editor 5/5 and docs-browser 1/1.
- Every
- Mutants, 19:12:54Z to 19:15:58Z.
- Both controls (
editor-browser.test.mjs,editor.test.mjs) passed first. - Each
model.mjsmutant was rebuilt into the bundle before its run, and the files were restored after each one. - 9 run, 9 killed:
- g1 (link title not escaped at all): tests 7, 11, 13
- g2: test 8
- g3: test 9
- g4: test 10
- g5: test 15
- g6: test 16
- g7 (
docShownnever set,bus.js): tests 4, 5, 6 - g8 (link backslash not doubled): tests 11, 13
- g9 (image title escapes
"only): tests 12, 14
- Both controls (
Not mine
Researcher's r3 runs (BUILD.md "Round 3 results"): two byte-identical builds; singles 206/206; suite 206/206; 7 of 7 mutants killed; provenance 6/6 after the mutants; 195 of 195 manifest checks. I read the logs list and the mutant table, and did not rerun their script. My counts agree with theirs.