ident

8.6 KB

1. # Report 009: ident code order, no behaviour change
3. **Where:** commits on main in loreana:/media/STORAGE/projects/ident.worldapi.org:
4. - `9101716`: file moves (1/4)
5. - `d2e7f91`: topics, map and thin wrappers (2/4)
6. - `fe18351`: `let` (3/4)
7. - the docs + tests commit (4/4), which also holds this report and the mission brief
9. Not pushed, not deployed. No `.env` read (the real-data runs use code-only copies without `.env`). Only ports 8750–8759 were used. Every server was stopped by its PID; nothing of mine is still running, and 8750–8759 are free.
11. ## Counts (before → after; `python3 tests/letcount.py .`)
13. | | before (f8bdcbc) | after |
14. |---|---|---|
15. | `.hl` files in the root | 10 | **1** (project.hl) |
16. | project.hl lines | 338 | **132** (index comment, PWA config, routes, mailer, audience, server, one hook) |
17. | `let` total | 453 | 164 |
18. | `let` never reassigned | **290** | **0** |
20. The 164 `let`s left are all needed:
21. - 99 are reassigned;
22. - 49 are in a loop body (Hybriel refuses a plain declaration there on the 2nd pass);
23. - 14 have the name of a member of the file: `me` in the faces, which is also a component member;
24. - 2 are declared twice in one function (see "Found").
26. `tests/letcount.py` (from gitoria) now has the kinds `member` and `twice` too, so "never" means "should be plain".
28. ## Layout
30. The full file map is in README "Files". Imports go one way only:
31. - util ← identities-helpers ← identities ← accounts ← login-helpers ← login
32. - util ← apps-helpers ← invites-helpers ← invites ← apps ← selector / notify ← api-helpers ← api ← project.hl
34. **Topic files** (each holds its central logic and every write to its tables):
35. - **`lib/login.hl`**: the code tables otp / sends / ipsends, the limits, `checkCode` and the pending sign-in.
36. - It gained `signInWithCode`, the logic of the verifyCode face.
37. - Helpers: `lib/login-helpers.hl` (`newOtp`, `otpHash`, `ipBucket`).
38. - **`lib/accounts.hl`**: the accounts table, the sessions and sign out everywhere.
39. - It gained `createAccount`, which before was inside `checkCode`.
40. - `dropUserSessions` moved here from project.hl. project.hl hands it the server by reference.
41. - **`lib/identities.hl`**: the identities table, the short ids and the identity CRUD.
42. - It gained `addDefaultIdentity` (was in `checkCode`) and `identityRecord` / `accountOfIdentity` (were in notify.hl).
43. - Helpers: `lib/identities-helpers.hl` (fields, avatar, label, the short id's alphabet).
44. - **`lib/apps.hl`**: apps, connections, requests, grants, the login button and the exchange.
45. - `appOfSecret` moved here from notify.hl.
46. - The person's side of an invite moved here (`openInvite`, `grantInvite`), because it creates and uses login requests.
47. - `grantRequest` is the dispatch that was in the chooseIdentity face.
48. - Helpers: `lib/apps-helpers.hl` (app form, origins, return URL, keys).
49. - **`lib/invites.hl`** now owns its table. `invitesTable` was declared in apps.hl, and apps.hl deleted invites directly.
50. - Now `deleteApp` calls `dropInvitesOf`, and `acceptInvite` writes the acceptance.
51. - Helpers: `lib/invites-helpers.hl`.
52. - **`lib/selector.hl`**: the pick ids, the list and `codeOfPick` (was a loop inside the endpoint).
53. - **`lib/notify.hl`**: kinds, effective settings, sending, the inbox and the per-app page.
54. - Helpers: `lib/notify-helpers.hl` (checks, stamp, the two hand sorts, on/off).
56. **Shared and routes:**
57. - **`lib/util.hl`**: `dir`, `envNumber`, `countOf` / `first` / `merged`, `str`, `isId` / `isList` / `isObject`, `oldestFirst`, `hasControl`, `urlChars`, `normEmail` / `validEmail`, `checkTimeZone`.
58. - Before, `isList`, `isObject` and `str` existed twice (apps / notify / store).
59. - **`lib/api.hl`**: every function route from project.hl, as thin wrappers.
60. - Also the selector's two CORS endpoints (were in selector.hl).
61. - Also `codePage(route, req, &srv, Home)`.
62. - **`lib/api-helpers.hl`**: the old api.hl, plus `inviteCaller`, `field`, `baseOf`, `hexId` and the selector's CORS answers and caller check.
64. **Moved, unchanged:**
65. - `mail.hl` → `lib/mail.hl`
66. - `jsoncheck.hl` → `lib/jsoncheck.hl`
67. - `styles.hl` → `components/styles.hl`
68. - `tools/` import from `lib/`
70. **Faces made thin:**
71. - verifyCode → `signInWithCode`
72. - chooseIdentity → `grantRequest`
74. The one-line `signOut` session write stays in its face. A face's `session` is the framework's own (as gitoria did it).
76. ## Tests
78. | test | result |
79. |---|---|
80. | gate `tests/browser.mjs` (8750, 8751, Chrome 8752–8759) | **152 passed, 0 failed** before and after each step |
81. | apps / selector / migration / iplimit / notify | **107 / 99 / 33 / 39 / 130, 0 failed** before and after each step |
82. | hardening / signoutall / shortid / invites | **17 / 6 / 19 / 44, 0 failed** before and after each step |
83. | live-data reads + writes, old vs new | **291 / 291 the same** |
85. How the other nine gates run: `.scratch/m009/runall.mjs` runs them as temporary port-remapped copies (8750–8757), one by one. Outputs are in `.scratch/m009/gate-<name>-<before|step1|step2|step3>.txt`. The commands are in README "Test" → "Same output".
87. **Live-data comparison** (new `tests/realdata-baseline.mjs` + `tests/realdata-compare.py`):
88. - **Data:** a copy of Byrodin's `storage/mpackdb`, taken 2026-10-03. Each run gets a fresh copy.
89. - **Code:** each tree runs from a code-only copy without `.env`. Mail goes to a sink file.
90. - **Reads (187):**
91. - every page, signed in as az5b2 (session file for account 0mufd5afy0xm) and signed out: `/`, `/start`, `/apps`, `/inbox`, the 8 live connection pages, `/code`, `/signin/…`;
92. - the browser modules, the worker and the manifest;
93. - every live app's `/login` variants and selector calls (in / out / foreign origin / preflight);
94. - the refused API calls.
95. - **Writes (104):**
96. - identities and the time zone;
97. - a new app with its secret and new secret;
98. - the login button and the exchange, the selector choose and exchange;
99. - kinds and notifications (also urgent, unregistered and refused ones);
100. - inbox mark, switches and override;
101. - invites (create, mail, list, open, accept, get, revoke) and migrate-ids;
102. - the OTP login of a new address and of the creator's: wrong code, right code, the code page before and after;
103. - the app login on `/signin/<rid>/code` and "Other address";
104. - the address and IP limits;
105. - sign out everywhere, disconnect, app delete;
106. - finally the whole stored state (`tools/dump-store.hl` on a copy).
107. - **Masks:** only what changes per run (times, random ids, codes, keys, short ids of new identities, source positions, module hashes). Two runs of the OLD tree compare clean (291/291).
108. - **After step 2:**
109. - 4 browser modules differ, but only in source positions and the import tables (the comparator checks the code and the imported functions);
110. - the worker's `hl-shell-<hash>` cache name differs (it follows the code hash).
111. - **After step 3:**
112. - also `var` → `const` in the client code of main.hl;
113. - 0 real differences.
115. ## Found (in STATUS "Lessons")
117. 1. **A plain declaration may not repeat a name inside one function.** In `lib/notify.hl sendNotification`, both `if` blocks declare `c` (`checkUrl` of the icon, then of the link). As plain declarations, the second one aborts with "Cannot reassign immutable variable 'c'". It showed up as notify gate 45/3 and a 500 on the real-data `w-notify`. Both stay `let`. `.scratch/m009/twice.py` searched every file: this was the only case.
118. 2. **A `let` with a member's name must stay.** Without `let`, `me = accountOfSession(session)` in a face would assign the component's member. gitoria's `unlet.py` already refuses these (CLASH, 14 cases).
119. 3. Moving statics between lib files did not change the browser modules at all; only the component's own line shifts move source positions.
121. ## Open
123. - **Not deployed** (that is the architect's job). Use the normal `./deploy.sh`. There is no data change.
124. - deploy.sh's rsync does not delete, so the 9 old root files stay on Byrodin: api.hl, apps.hl, invites.hl, jsoncheck.hl, mail.hl, notify.hl, selector.hl, store.hl, styles.hl. They are unused; delete them by hand after the deploy.
125. - **Long files left as they are:**
126. - `components/home.hl` (587 lines; it is UI);
127. - `lib/notify.hl` (384);
128. - `lib/apps.hl` (276).
129. - **Not touched:** `testapp/` (a test app with its own project.hl). It is outside the scan, like in tickets and gitoria.
130. - **Scratch** (gitignored) in `.scratch/m009/`. The folder also holds the 2026-09-24 UUID-migration files (old mission 009: deploy-*, rehearsal-*, cmp009.py …); they were not touched. Mine:
131. - `old/` (the old tree, code only);
132. - `gates.sh`, `runall.mjs`, `step.sh`;
133. - `unlet.py`, `twice.py`, `letcount.py`;
134. - the gate outputs.
135. - **Deleted after the run:** the live-data copy, the dump and every baseline output (they hold live data).