ident

46.2 KB

1. # STATUS
3. ## 2026-10-03 — antcolony mission 074: re-vendor hybriel master 06617221 (plugin allocators 3a781359 + 413f60e4) — NOT deployed by me
4. bin sha256 21059cc7…d77bdb; old vendor (190aa11d) in `.scratch/pre-074/`. No app code change. Gates: browser 152/0 (8760–8769);
5. `node .scratch/w074/runall.mjs` apps 107/0, selector 99/0, migration 33/0, iplimit 39/0, notify 130/0, hardening 17/0,
6. signoutall 6/0, shortid 19/0, invites 44/0. Real-data copy (deleted), 0mufd5afy0xm signed in, Chrome: 200 loads new 211 → 211 MB,
7. old 211 → 217 MB (38 ms both); 2500 loads new 211 → 212 MB flat, old 211 → 246 MB. Load time rises 39 → 70 ms over 2500 loads on
8. BOTH binaries in Chrome; curl over the same pages stays 7–9 ms, so it is the browser tab.
10. ## 2026-10-02 — antcolony mission 072: re-vendor hybriel master 190aa11d (GC correctness fc838894, #127) — NOT deployed by me
11. bin sha256 860f5e61…0a23626, plugins = master's (no patch); old vendor (8efba065) in `.scratch/pre-072/`. No app code change
12. (no lambda semantics change since 8efba065). Gates: browser 152/0; runall (w072, 8720–8727) apps 107/0, selector 99/0,
13. migration 33/0, iplimit 39/0, notify 130/0, hardening 17/0, signoutall 6/0, shortid 19/0, invites 44/0. Real-data memory
14. (200 signed-in Chrome loads): RSS 211 → 216 MB (old 282 → 305 MB). Commands: README "Vendored Hybriel".
16. ## 2026-10-02 — antcolony mission 069: re-vendor hybriel master 8efba065 (#126 memory, #48 lambda copy) — NOT deployed, awaiting architect
17. bin sha256 ce4c7507…df4eb, plugins = master's (no patch); old vendor (73267707) in `.scratch/pre-069/`. #48 broke the
18. session writes: 5 lambdas in `store.hl` + 2 in `selector.hl` now take `&session` (README "Vendored Hybriel" → lesson).
19. Lambda audit: all 231 lambdas (`python3 .scratch/w069/lambdas.py`, `lambdas2.py`); only those 7 write a passed value the
20. caller relies on (testapp `logIn(data…)` writes a copy but saves it itself — left). Proof: browser gate without the fix
21. aborted at the code page; one-at-a-time reverts → beginSession aborts (24/1), dropPending 148/4, accountOfSession hardening 16/1.
22. Gates (Loreana): `IDENT_GATE_PORT=8760 IDENT_GATE_SHORT_PORT=8761 IDENT_GATE_CHROME=8762-8769 node tests/browser.mjs` →
23. 152/0; `node .scratch/w069/runall.mjs` → apps 107/0, selector 99/0, migration 33/0, iplimit 39/0, notify 130/0,
24. hardening 17/0, signoutall 6/0, shortid 19/0, invites 44/0. Memory on a live-storage copy (deleted), 200 signed-in Chrome
25. page loads (/, /apps, /inbox, /start): new RSS 311 → 354 MB, old binary 600 → 1287 MB.
27. ## 2026-10-01 — antcolony mission 048: re-vendor hybriel master 73267707 (incl. #122 = 4850d798) — NOT deployed, awaiting architect
28. bin sha256 55b85049…bdf4, plugins = master's (no patch); old vendor in `.scratch/pre-048/`. Fixes the re-vendor needed (README
29. "Vendored Hybriel" → lessons): `project.hl codePage` → `server.page(m, s, host, headers)` (#105 signature; /code was empty);
30. Home's pending address comes in as param `pending` from codePage (a session-reading member is re-synced after every face →
31. the code form vanished after the 5th wrong code); `tests/oldstore-009.hl` explicit ids from 0 (#4: fresh *id tables count
32. from 1). New "listed ONCE" checks (hybriel#121): identities (browser), apps ×2 (apps), invites (invites) — no list pushes rows.
33. No #115/#116/#118 workarounds existed; no browser-built SVG. Offline /start stays data-free (19 PWA checks).
34. Gates (Loreana): `IDENT_GATE_PORT=8750 IDENT_GATE_SHORT_PORT=8751 IDENT_GATE_CHROME=8752-8759 node tests/browser.mjs` →
35. 152/0; `node .scratch/w048/runall.mjs` → apps 107/0, selector 99/0, migration 33/0, iplimit 39/0, notify 130/0,
36. hardening 17/0, signoutall 6/0, shortid 19/0, invites 44/0. Live storage copy (deleted): 0 duplicate ids in all 13 tables
37. (accounts 2, apps 5, connections 8, identities 5, requests 10, sends 6, otp 2, ipsends 1, others 0) and the 8 old ident-* tables.
39. ## 2026-10-01 — antcolony mission 046: installable app (PWA) + own icons — NOT deployed, awaiting architect
40. `project.hl`: `appThemeColor = darker.value` (header colour), `appBackgroundColor = dark.value`, `appFavicon`,
41. `appTouchIcon`, `appIcons` (192/512 any + maskable), `offline = [ Start ]`, `appManifest = { start_url = '/start' }`, routes
42. `/start`, `/favicon.ico` (real ICO, was `direct ""`), `/icons/*`, `/api/online` (204). New: `icons/` (key in orange; README
43. "PWA" has the re-render commands), `components/start.hl`. `components/main.hl` + `styles.hl`: header note "Offline — …"
44. from a CSS-animation-timed probe of `/api/online` (no JS file; README "PWA"); on `/start` an answer → `/`.
45. NO PERSONAL DATA OFFLINE (architect): `/` is NOT kept (hl:web would cache its document as rendered for the signed-in user +
46. its state in IndexedDB); only the data-free `/start` is. Offline `/` = hl:web's "Unavailable offline".
47. Gate: `IDENT_GATE_PORT=8732 IDENT_GATE_SHORT_PORT=8733 IDENT_GATE_CHROME=8734-8739 node tests/browser.mjs` → 151 passed,
48. 0 failed (132 old + 19 PWA incl. the scan of every cache entry + IndexedDB for the signed-in email/identity). Other gates,
49. ports remapped into 8732-8739 by temporary copies (`node .scratch/w046-dev/runall.mjs [names]`): apps 105/0, selector 99/0,
50. migration 33/0, iplimit 39/0, notify 130/0, hardening 17/0, signoutall 6/0, shortid 19/0, invites 43/0.
51. Icon + screenshots: Loreana `/tmp/w046-ident.worldapi.org/`. Test offline for real: the TAB's CDP offline does not reach
52. the service worker — cut off its own target too (gate `swOffline`).
54. ## 2026-09-26 — ticket ident#23: one public short id per identity — NOT deployed, awaiting architect
55. Every identity has a `shortId` (5 chars, e.g. `a68sz`; digits 2-9 + letters without i/l/o = 31 chars, 28.6M ids), the same
56. in every app; `/api/exchange` answers it, `/api/notify` takes it (case-insensitive), the identity page shows it. Existing
57. identities get theirs at first start (`store.hl backfillShortIds`; statics are lazy, so `project.hl` touches it). New
58. `POST /api/migrate-ids {key, secret, finish?}` → old per-app id → short id; old ids keep working in notify until the app
59. sends `finish: true`, which drops them. Connections no longer carry an id (`!appIdentity` index gone); invites store short ids
60. (old entries still counted). README "One public short id", "Migration for the apps". Gates (remapped to 8700-8709 via
61. `.scratch/rungates.py`): migration 33/0, apps 105/0, selector 98/0 (the one "failure" is the remap renaming a cookie name
62. in the check itself), notify 130/0, browser 132/0, hardening 17/0, signoutall 6/0, iplimit 39/0, invites 43/0, new
63. `tests/shortid.mjs` 19/0. Existing gates changed: "another app → another id" now means the SAME id.
64. Not done: the apps themselves (tickets, gitoria, notes, calendar) still have to call migrate-ids and store short ids.
65. antcolony Mission 039 (2026-09-26): each app has `tools/migrate-short-ids.hl` + `tests/short-id-switch.mjs`; runbook Loreana
66. `antcolony-docs/docs/short-id-switch.md`. The pre-ident#23 build those gates start is frozen at `.scratch/pre-023-ident/`
67. (hl:web, no invites — a copy of gitoria's gate ident). Apps must accept non-hex exchange answers (tickets does not yet).
69. ## 2026-09-26 — ticket ident#22: invite service — NOT deployed, awaiting architect
70. Apps invite people by link (README "Invites"): `invites.hl` (new), `project.hl` (4 API routes + `/invite/:token`),
71. `apps.hl` (invites table, `invite` on a login request, app delete drops invites), `mail.hl` (`sendInvite`),
72. `components/home.hl` (accept branch in `chooseIdentity`, "You are invited to" banner), `docker-compose.yml`
73. (`IDENT_PUBLIC_URL`), testapp `/invites` + invite report on `/callback`. Gates: `tests/invites.mjs` 43 passed
74. (new, real Chrome: new address, same link again, revoked, expired, signed-in one click, two uses, race, mail, app page);
75. `tests/apps.mjs` 105 passed (ports remapped to 8702-8705). browser/selector/notify not re-run (no shared code changed but
76. `requestOf` gained a field). Hybriel note: `import { a as b }` is not supported.
78. ## 2026-09-26 — antcolony mission 036: on hybriel master 837fe120 (hl:web, no local patch) — NOT deployed, awaiting architect
79. Applied antcolony mission 035's switch (`.scratch/035-wip/`, see its entry below) on master 837fe120 (has #103/#104 fixes
80. d9aa12e7..0c285350; both 035 repros now pass: `~/scratch-036/repro/`). plugins/webex + both LOCAL PATCHes gone,
81. `'hl:web'` imports, `sessionCookie = 'identsid'`, HL_HOST read by hl:web, `req.session` in function routes,
82. `realSession()` → `session == null`, `Intl`, `a.id < b.id`, testapp `encodeURIComponent`. Gates: the 20 forged-session
83. checks now accept hl:web's own refusal (ack `ok:false`, "the `session` parameter is filled by the server").
84. Result: browser 132/0, apps 105/0, selector 99/0, migration 23/0, iplimit 39/0, notify 130/0, hardening 17/0,
85. signoutall 6/0; no Chrome left. Served page: `/__hl/{hl-runtime.js,web/client.js,app.css}?v=e8cc399c151c6b67`,
86. 0 unhashed refs, hashed = immutable, bare = no-cache; cookie `identsid; HttpOnly; SameSite=Lax` unchanged.
87. Backup of the old state: `.scratch/pre-036/` (bin, plugins, sources, tests). Session files: same format
88. (webex → web sessions.hl diff = only Secure/Domain options + skipping non-session files); migration gate 23/0 reads old cookies.
90. ## 2026-09-25 — antcolony mission 035: re-vendor to hybriel master 13ef4f9b STOPPED (Hybriel bug) — folder restored to pre-035
91. Converted (hl:webex → hl:web, plugins/webex gone, `sessionCookie`, HL_HOST, `req.session`, realSession() dropped, `Intl`,
92. `a.id < b.id`, tokens.hl hl:web copy, testapp `encodeURIComponent`); the WIP is in `.scratch/035-wip/` (`changes.diff`).
93. Gates on it: migration 23/0, iplimit 39/0; browser 55/1, apps 44/1, selector 88/9, notify 127/3. Causes: (1) HYBRIEL BUG —
94. `if (outer) { … if (inner) { … } <element> }` with outer AND inner turning false in one handler → client `NotFoundError:
95. insertBefore … not a child` in rebuildBranch (home.hl doSignOut: signedIn/manage/…); the page stops updating. Repro:
96. loreana `~/scratch-035/repro/` (`home-nested-if.hl`, `node tests/run.mjs <dir>`). (2) the forged-session checks expect an
97. app `{error}`; hl:web now refuses the extra argument itself (ack `ok:false`, "the `session` parameter is filled by the server")
98. → the checks must accept that. Kept on purpose: Mailer placeholder host (mail.hl needs a Mailer for deliver()/handlers),
99. jsoncheck, X-Client-IP, hand sorts, avatar.js guard. Restored bin/plugins/sources = pre-035 (webex e565176b); all six gates
100. green again (132/105/99/23/39/130). Next: when the bug is fixed, re-apply `.scratch/035-wip/`, fix (2), run all gates.
102. ## 2026-09-25 — ticket ident#21 (sign out everywhere, live logout + files deleted)
104. - Already built under ident#19 (see below); re-verified today: `tests/signoutall.mjs` 6 passed, `tests/hardening.mjs` 17 passed. No code change. Needs deploy.
106. ## 2026-09-25 — the code step is a page: /code (ticket ident#20, mission 008 (old 032)) — awaiting architect (deploy) / creator
108. - Creator's design ("just make a /code where it checks a pending code"): "Send me a code" → face
109. `rememberPending` (session `data.pendingEmail`, only while a code for it is waiting) → `/code`
110. (`/signin/<rid>/code` for an app). `project.hl codePage` renders Home's code form for the pending
111. address, else 302 back to `/` / `/signin/<rid>`. Cleared on sign-in, "Other address", expiry.
112. README "What it does" → "The code step is its own page". Changed: `store.hl`, `project.hl`,
113. `components/home.hl`, tests (browser, apps + login helpers of selector/notify/iplimit/signoutall).
114. - Gates (all on Loreana, own servers): browser 132, apps 105, selector 99, migration 23, notify 130,
115. iplimit 39, hardening 17, signoutall 6 — all passed. Screenshots `.scratch/gate-*-code-reloaded.png`,
116. `.scratch/apps-code-for-app-reloaded-*.png`. Pre-change copies: `.scratch/m032-backup/`.
117. - NOT deployed. By hand (never on :8351 — real mail): own server e.g.
118. `IDENT_PORT=8740 IDENT_STORAGE=$PWD/.scratch/m032-smoke/store IDENT_SESSIONS=$PWD/.scratch/m032-smoke/sess IDENT_MAIL_SINK=$PWD/.scratch/m032-smoke/mail.txt SMTP_HOST= ./bin/hybriel project.hl`
119. → http://127.0.0.1:8740 → send → `/code` → reload → code from `mail.txt` → signed in.
120. `curl -si localhost:8740/code` without a pending code → `302 Location: /`.
121. - Lesson: a component route cannot answer a redirect; a function route can resolve the session
122. (`server.sessions.resolve`) and render a component via `server.page(match, req, s)` with a
123. hand-made match `{route {component}, kind 'component', params, path}` (extra params reach the
124. component as construction arguments, e.g. `step`).
126. ## 2026-09-24 — avatar is an UPLOAD (ticket ident#15, second rework after the creator's rejection) — awaiting architect (deploy) / creator
128. - The URL field is gone: the identity form has a file chooser; `avatar.js` scales the picture to 128×128
129. in the browser; the server stores it as a checked data URL (`store.hl checkAvatarUrl`, ≤ 60000 chars).
130. Old link avatars are hidden and dropped on the next save. README "Avatar".
131. - Gates (port-remapped copies, 8700-8709): `tests/browser.mjs` 96 passed (upload, refusal of a text file,
132. scaled 128×128, colours, list, reopen, remove; server negatives), `tests/apps.mjs` 97 passed.
135. ## 2026-09-24 — sign out everywhere really ends every session (ticket ident#19) — awaiting architect (deploy) / creator
137. - `store.hl` `signOutEverywhere` now deletes every session of the account (memory + files) through the
138. hook `project.hl` `dropUserSessions`; the epoch bump stays as a second net. No vendored plugin changed.
139. - The face `signOutAll` emits `signedOutAll(accountId)` first; `project.hl` `audience` admits connections
140. whose session user is that account; `components/main.hl` (in every page) reloads → signed out, no click.
141. - Gates: `tests/hardening.mjs` 17 passed (new: session files gone); new `tests/signoutall.mjs` 6 passed
142. (device A home + apps pages switch by themselves, caller too, no session file left).
144. ## 2026-09-24 — design tokens AS DESCRIBED (ticket antcolony#3, antcolony mission 021) — awaiting architect (deploy) / creator
146. antcolony Mission 018 (generated `':root'` copy + sync.sh) was REJECTED by the creator; antcolony mission 021 replaces it.
147. Done (worker; developed in `.scratch/dev-m021`, copied back, NOT deployed):
148. - `shared/tokens.hl` = hand-written webex `var()` tokens (`static dark = var('rgb(25, 30, 35)')`, semantic
149. `colorText = var(light)` …, incl. `colorAccentText` moved here from the app), verbatim copy of
150. `/media/STORAGE/projects/worldapi-tokens/tokens.hl`. `styles.hl` member-imports them and uses them as
151. members; sets only `colorAccent = var(orange)`. README "Design tokens".
152. - webex LOCAL PATCH (antcolony mission 021, hybriel#39) in `plugins/webex/WebFramework.hl`; XSS patch kept.
153. - Old files: `.scratch/m021/pre-copy-backup/` (styles.hl, shared/tokens.hl, WebFramework.hl); antcolony mission 018's
154. worldapi-tokens folder (sync.sh, tokens.css, generated tokens.hl): `tickets.worldapi.org/.scratch/m021/worldapi-tokens-m018-backup/`.
155. - Rendered colours unchanged: `/__hl/app.css` after `:root` byte-identical old vs new (in `:root` only
156. the order of `--color-accent-text` / the app's `--color-accent` changed); Chrome computed colours
157. of every element + every token, tickets list/inbox/state/ticket/you + ident home/code/account/apps/inbox,
158. 390 + 1280: 23 passed, 0 failed.
159. - All 6 gates green (dev copy and main folder), port-remapped copies `.scratch/m021/gate-ident.sh`:
160. browser 83, apps 97, selector 99, migration 23, notify 130, iplimit 39.
161. - Deploy simulation (deploy.sh excludes + debian:12-slim container): same app.css, byte-identical.
163. How to verify (ports 8850-8879 only; scripts in tickets.worldapi.org/.scratch/m021 unless noted):
164. ```bash
165. cd /media/STORAGE/projects/tickets.worldapi.org
166. for a in tickets ident; do cmp /media/STORAGE/projects/worldapi-tokens/tokens.hl ../$a.worldapi.org/shared/tokens.hl && echo same $a; done
167. bash .scratch/m021/cmpup.sh up; node .scratch/m021/cmpstyles.mjs; bash .scratch/m021/cmpup.sh down # 23 passed (old code: <app>/.scratch/m021/old-<app>)
168. IDENT_GATE_DIR=/media/STORAGE/projects/ident.worldapi.org bash .scratch/m021/gate-tickets.sh .scratch/m021/g.txt; tail -2 .scratch/m021/g.txt # 402 passed
169. cd /media/STORAGE/projects/ident.worldapi.org; bash .scratch/m021/gate-ident.sh . .scratch/m021/gates-main # 6 suites green
170. bash /media/STORAGE/projects/tickets.worldapi.org/.scratch/m021/deploysim.sh <tickets dir> <ident dir> # needs cmpup's run/main-*.css
171. ps -eo pid,args | grep [h]l-browser-tier # empty
172. ```
173. Screenshots: `tickets.worldapi.org/.scratch/m021/shots/<app>-<old|new>-<page>-<390|1280>.png`.
174. Lesson: an imported `static` var() token works only with the antcolony mission 021 webex patch; tokens.hl changes need a restart.
176. ## 2026-09-24 — shared design tokens (ticket antcolony#3, antcolony mission 018) — REJECTED by the creator, superseded by antcolony mission 021
178. Done (worker; developed in `.scratch/dev-m018`, copied back, NOT deployed):
179. - Tokens now come from `shared/tokens.hl` (generated from layouts `tokens.css` by
180. `/media/STORAGE/projects/worldapi-tokens/sync.sh`, vendored like plugins/); `styles.hl` inherits it and
181. sets only the accent (README "Design tokens"). Old copy of `styles.hl`: `.scratch/m018/pre-copy-backup/`.
182. - Every rendered colour unchanged: `/__hl/app.css` after `:root` byte-identical old vs new; computed
183. colours of every element (tickets list/inbox/state/ticket/you, ident home/code/account/apps/inbox, 390 +
184. 1280) old == new in Chrome.
185. - All 6 gates green (dev copy and main folder): browser 83, apps 97, selector 99, migration 23,
186. notify 130, iplimit 39 — run as port-remapped copies (`.scratch/m018/gate-ident.sh`, 8850-8879).
188. How to verify (ports 8850-8879 only):
189. ```bash
190. cd /media/STORAGE/projects/tickets.worldapi.org
191. /media/STORAGE/projects/worldapi-tokens/sync.sh --check # ok ×3
192. bash .scratch/m018/cmpup.sh up; node .scratch/m018/cmpstyles.mjs; bash .scratch/m018/cmpup.sh down # 23 passed (old code in .scratch/m018/old-*)
193. IDENT_GATE_DIR=/media/STORAGE/projects/ident.worldapi.org bash .scratch/m018/gate-tickets.sh /tmp/g.txt; tail -2 /tmp/g.txt # 402 passed
194. cd /media/STORAGE/projects/ident.worldapi.org; bash .scratch/m018/gate-ident.sh . .scratch/m018/gates-main # 6 suites green (ports remapped copies)
195. bash /media/STORAGE/projects/tickets.worldapi.org/.scratch/m018/deploysim.sh <tickets dir> <ident dir> # deploy rsync + container: same app.css
196. ps -eo pid,args | grep [h]l-browser-tier # empty
197. ```
198. Screenshots: `tickets.worldapi.org/.scratch/m018/shots/<app>-<old|new>-<page>-<390|1280>.png`.
199. Lesson: a `var()` token of hl:webex/css can't cross an `inherit` (second instance) — use literal `':root'` strings.
201. ## 2026-09-24 — piece 4/6: notifications API + inbox (ticket ident#6, mission 007 (old 013)) — awaiting architect / creator
203. Done (worker, NOT confirmed by the creator; NOT deployed — the architect deploys with `./deploy.sh`):
204. - `notify.hl` + routes `POST /api/kinds`, `POST /api/notify` (key + secret + per-app identity id,
205. strict bodies) and pages `/inbox` (components/inbox.hl), `/inbox/<connection id>`
206. (components/appsettings.hl, the per-app page); nav link "Inbox". README "How apps send notifications".
207. - New tables only (`kinds`, `settings`, `notifications`; created empty at start, no migration).
208. Old tables untouched: upgrade check on a COPY of the stale dev storage → every old table SAME.
209. - Stored per notification: channels (`push`, `mail` = daily|now|none) + `pushSent`/`mailSent`
210. = false. Nothing is sent (delivery = ident#7 mail, ident#8 push).
211. - `api.hl strictBody` knows type `List`; `tools/dump-store.hl` dumps the 3 new tables;
212. `deploy.sh` runs the new gate too (six gates).
213. - Developed in `.scratch/dev-m013`; work scripts `.scratch/m013/` (`gates.sh`, `upgrade.sh`, `probe.mjs`).
215. How to verify:
216. ```bash
217. cd /media/STORAGE/projects/ident.worldapi.org
218. node tests/notify.mjs # 130 passed, 0 failed (~20 s; ident :8410, site :8413, Chromes 8740-8749)
219. .scratch/m013/gates.sh $PWD browser apps selector migration iplimit notify # 83/97/99/23/39/130, 0 failed
220. ps -eo pid,args | grep [h]l-browser-tier # must print nothing (of ours)
221. bash .scratch/m013/upgrade.sh # old code dump vs new code on a COPY: old tables SAME, 3 new empty
222. ```
223. Screenshots: `.scratch/notify-{inbox,inbox-read,appsettings,override}-{390,1280}.png`.
224. By hand (creator, after deploy): the test app / an app's server sends with curl (README "Try it"),
225. then https://ident.worldapi.org/inbox → the notification, "Mark read", the app link below →
226. per-app page → flip switches / "Override all".
228. Choices made (open questions for the creator, see mission report):
229. - unregistered name → allowed, stored as an unregistered kind: daily mail, no push, push switch "—".
230. - override for all = an on/off switch + its own push/email switches; while on it replaces every
231. kind's setting and locks the per-kind switches; the user's own switches are kept underneath.
232. - urgent: push if push is on and a device exists (never before piece 6), else mail now if push
233. or email is on for that kind, else inbox only.
234. - times in UTC (no zone support in hl:time); text shown as plain text (Markdown not rendered);
235. icon and link any http(s) URL (not limited to the app's origins); no send rate limit;
236. inbox shows the newest 200; no delete of notifications/kinds; a deleted app's notifications
237. stay ("a deleted app").
239. Lessons:
240. - Boolean HTML attributes (`checked`, `disabled`) can't be rendered conditionally by hl:webex
241. (it always writes `name="value"`): use buttons with `role="switch"` + `"aria-checked" = member`
242. (quoted attribute names work) and separate `if` branches for a locked state.
243. - A handler inside a `for` row gets the row's key via `value = row.x` / `e.target.value` and looks
244. the row up in the member list (as apps.hl does); using the loop variable inside the handler was
245. avoided, not tested.
246. - `find(null, null)` lists a whole table (connections has no identity index; the per-account list scans).
248. ## 2026-09-24 — per-IP limit + deploy readiness (mission 006 (old 010)) — awaiting creator / architect
250. Done (worker, NOT confirmed by the creator; NOT deployed to Byrodin — the architect does the first deploy):
251. - **Per-IP limit on code mails**: 10 per client IP per 10 min, 30 per 24 h (env `IDENT_IP_*`),
252. on top of 3 per address per 10 min. IP = `X-Client-IP` header only (nginx sets it); IPv6 per
253. /64; no header = one shared bucket `direct` (hl:webex exposes no peer address). Table `ipsends`.
254. - The code request moved from the face `requestCode` (removed — a face sees no headers, it
255. would bypass the limit) to **`POST /api/code {email}`**; the sign-in form fetches it; refusals
256. (400/429 `{error}`) show under the form as before.
257. - **Listener**: hl:webex ignores `HL_HOST` → `project.hl` builds the `NativeWebSocketServer`
258. itself (`http = …` pinned in the constructor), `HL_HOST=127.0.0.1` binds loopback, unset =
259. 0.0.0.0 (dev unchanged). `IDENT_WATCH=0` turns the dev watcher off (container).
260. - `docker-compose.yml` (127.0.0.1:45002) + `deploy.sh` (README "Deploy").
261. - Gates: the four old ones got `IDENT_IP_LIMIT/IDENT_IP_DAY_LIMIT=1000` on their servers;
262. `apps.mjs`/`selector.mjs` log in over `POST /api/code` instead of the face; `browser.mjs`
263. accepts Chrome's "Failed to load resource … 400/429 … /api/code" console line (the refusals).
264. New `tests/iplimit.mjs` (39 checks). `tools/dump-store.hl` also dumps `ipsends`.
265. - Developed in `.scratch/dev-m010`; work files in `.scratch/m010/` (local deploy test
266. `localdeploy.sh`, TLS proxy test `tlsproxy/`).
268. How to verify:
269. ```bash
270. cd /media/STORAGE/projects/ident.worldapi.org
271. node tests/iplimit.mjs && node tests/browser.mjs && node tests/apps.mjs && node tests/selector.mjs && node tests/migration.mjs # 39/83/97/99/23, 0 failed
272. ps -eo pid,args | grep [h]l-browser-tier # must print nothing
273. bash -n deploy.sh && ./deploy.sh --dry-run --target /tmp/identdeploy-test # gates + rsync -n preview into a LOCAL dir; never run without --target unless you deploy
274. ```
275. Deploy test done on Loreana ONLY (never Byrodin): `.scratch/m010/localdeploy.sh ident <src> 45002`
276. deploys into `.scratch/m010/fake-byrodin/ident.worldapi.org` (fake `storage/` + `.env` markers
277. survive, md5-checked), runs the container there with docker (only 127.0.0.1:45002 listens, LAN
278. refused), URL 200. `.scratch/m010/tlsproxy/run.sh`: nginx with TLS in front of the ident and
279. tickets containers + Chrome (`https.mjs`, 16 checks: wss socket, no http:// URLs, login +
280. cookie + reload over https, selector CORS for `https://tickets.worldapi.org`, forged
281. X-Client-IP overwritten by the proxy, watcher off). Containers/proxy removed afterwards.
282. By hand (creator): http://100.77.141.84:8351 → sign in as before (the form now POSTs /api/code).
284. For the architect (first deploy): the ident vhost needs `proxy_set_header X-Client-IP $client_ip;`
285. (and should drop the X-Forwarded-For/CF-Connecting-IP lines, ident ignores them), the WebSocket
286. Upgrade headers (`/__hl/socket`), and `proxy_pass http://127.0.0.1:45002` (today's
287. `worldapi.org/ident.conf` points to 44800 and has no Upgrade headers). `.env` on Byrodin: SMTP_*
288. (no IDENT_PORT — compose sets 45002; the real environment outranks `.env`).
290. Lessons:
291. - hl:webex ignores `HL_HOST`/`HOST` (it builds `new NativeWebSocketServer(port = port)`), hl:web
292. v1 read it. Workaround: pass `http = new NativeWebSocketServer(port, host)` to the constructor.
293. - A face has no request: anything that needs a header (client IP) must be a function route.
294. - A non-JSON file in the session directory crashes the server at boot (sessions.hl JSON.parse).
295. - Chrome logs every 4xx fetch as a console error — gates that check the console must expect them.
297. ## 2026-09-24 — UUID keys + storage/mpackdb/ (ticket ident #10 / old #39, mission 005 (old 009)) — awaiting creator
299. Done (worker, NOT confirmed by the creator):
300. - Every table (accounts, identities, otp, sends, apps, connections, requests, grants) has pk
301. `@id` (mpackdb UUID, 12 chars) and lives in `storage/mpackdb/<table>.*`; `IDENT_STORAGE` is now
302. a DIRECTORY. Public ids of accounts/identities/apps = the UUIDs (faces take strings; old numbers
303. find nothing). Default identity / app list = oldest by stored `created` (`store.hl oldestFirst`).
304. - Kept byte-identical: `apiKey`, `secretHash`, `appIdentity` (still a 32-hex FIELD, also for new
305. connections), `rid`, grant hashes. Selector pick ids changed once (derived from the identity id).
306. - `tools/migrate-009.hl` (idempotent via `oldId`, sessions `"user":{"id":n}` → account UUID),
307. `tools/dump-store.hl` (JSON of all tables, COPY only). Old tables `storage/ident-*` kept, unread.
308. - Deployed 12:02: backup `.scratch/storage-backup-20260924-120234/` (storage, .sessions,
309. testapp/storage); work dir `.scratch/m009/deploy-20260924-120234/` (before/after dumps, runs,
310. code-before). Migrated from a COPY twice (2nd: 0 new); `cmp009.py` → RESULT SAME (2 accounts,
311. 2 identities, 4 sends, 1 app, 1 connection); 6 sessions migrated → creator still signed in.
312. - Rehearsed twice on copies first (`.scratch/m009/rehearse.sh <n>`: migrate ×2, compare, serve
313. the copy with the new code on :8380 + Chrome: sessions signed in, test app key+secret exchange →
314. its stored id).
315. - Developed in `.scratch/dev` (old one moved to `.scratch/dev-m006`); scripts in `.scratch/m009/`.
317. How to verify:
318. ```bash
319. cd /media/STORAGE/projects/ident.worldapi.org
320. node tests/browser.mjs && node tests/apps.mjs && node tests/selector.mjs && node tests/migration.mjs # 83/97/99/23, 0 failed
321. ps -eo pid,args | grep [h]l-browser-tier # must print nothing
322. rm -rf /tmp/identcopy && cp -a storage/mpackdb /tmp/identcopy && IDENT_STORAGE=/tmp/identcopy ./bin/hybriel tools/dump-store.hl | python3 -m json.tool | less # COPY only (#40)
323. python3 .scratch/m009/cmp009.py .scratch/m009/deploy-20260924-120234/{before,after}.json # RESULT SAME
324. ```
325. By hand (creator): http://100.77.141.84:8351 still signed in (no new login), `/apps` shows the same
326. API key; http://100.77.141.84:8354 → "Log in with ident" / "choose ident" → the same identity id,
327. "welcome back" (no re-registering).
329. Lessons:
330. - `from` is a reserved word in Hybriel (a parameter/`let` named `from` fails to parse).
331. - `new MPackDB(..., compact = false)` still rewrites the index/meta files (only `.mpack` stays) —
332. #40 holds; migrate/dump COPIES only.
333. - `put()` on an `@id` table keeps an `id` the record already carries — copy rows WITHOUT `id`.
334. - Deploy scripts: `(cd x && cmd & echo $! > x.pid)` backgrounds the whole `&&` list — `$!` is a
335. subshell and the pid file lands in the wrong dir; use `cd x; cmd & echo $! > x.pid; cd ..`.
337. ## 2026-09-24 — piece 3/6: identity selector (ticket #26, mission 004 (old 007)) — awaiting creator
339. Done (worker, NOT confirmed by the creator):
340. - `/selector.js` (file `selector.js`): `<ident-selector key="pk_…">`, shadow DOM, ident's
341. colours; says "choose ident"; opening fetches the identities (credentials); choosing one
342. → one-time code → event `ident-login` (`detail.code`). `logged-in` attribute / `loggedIn`
343. property / `reset()` set by the host; no cookie of its own. Restyle: `--ident-*` custom
344. properties + `::part(button|panel|identity|status|message|link)` (README).
345. - `selector.hl`: `GET /api/selector/identities?key=`, `POST /api/selector/choose?key=`
346. (+ OPTIONS preflight). Answers only if `Origin` ∈ the app's origins AND key = that app's
347. (exact ACAO + credentials, `Vary: Origin`); else 403 without CORS headers. List ids =
348. sha256(app secretHash:identity)[0..32] (opaque, per app). Code via `apps.hl issueCode`
349. (shared with the login button: 48 hex, 60 s, single use).
350. - `testapp/`: selector next to the login button; `/selector-login` (exchange server side),
351. `/logout`; own session cookie `testapp<port>sid` → `/` renders `logged-in`.
352. - Ticket #37: `tests/browser.mjs` two obsolete checks replaced (old shapes → 400) → 81/0.
353. - Gates in the live folder: `selector.mjs` 97/0 (8 s), `apps.mjs` 94/0, `browser.mjs` 81/0.
354. - Deployed: backup `.scratch/storage-backup-20260924-112012/` (storage, .sessions,
355. testapp/storage); restarted :8351 and :8354; store checked on a copy
356. (`.scratch/m007/check-store.hl`): 2 accounts, 2 identities, app `tickets.worldapi.org`,
357. 0 connections — as before.
358. NOTE: check-store.hl was also run once directly on that backup by mistake: its accounts/
359. identities/apps/connections files were rewritten by the open (content = live, diff clean).
360. - Developed in `.scratch/m007/dev` (copy without `.env`/storage).
362. Running: ident :8351 (`server.pid`, `server.log`); test app :8354 (`testapp/testapp.pid`,
363. `testapp/testapp.log`). The test app is NOT set up (its `testapp/storage/` was empty):
364. register an app in ident with origin `http://100.77.141.84:8354`, paste key + secret.
366. How to verify:
367. ```bash
368. cd /media/STORAGE/projects/ident.worldapi.org
369. node tests/selector.mjs && node tests/apps.mjs && node tests/browser.mjs # 97 / 94 / 81, 0 failed
370. ps -eo pid,args | grep [h]l-browser-tier # must print nothing
371. curl -s -i 'http://127.0.0.1:8351/api/selector/identities?key=<pk>' -H 'Origin: <registered origin>' # 200 + ACAO
372. ```
373. By hand (creator): sign in at http://100.77.141.84:8351, set up the test app, open
374. http://100.77.141.84:8354 → "choose ident" → pick → "Logged in" without reload → Log out.
375. Screenshots: `.scratch/selector-{closed,open,loggedin,restyled-open,signedout,unregistered}-{390,1280}.png`.
377. Open:
378. - Signed out of ident: the selector links to ident's `/` in a new tab; after signing in
379. the user opens the selector again (it re-asks on every open). No auto-refresh.
380. - Same-site only (identsid is `SameSite=Lax`): a foreign-domain app gets
381. `signedIn:false` (out of scope by the brief).
382. - A registered page can call the two endpoints itself (no user click needed) — the host is
383. trusted for its own app; it still only gets its own per-app id via its secret.
384. - Opening an hl:mpackdb table rewrites its files (mtime, meta) — only check COPIES.
386. Lessons:
387. - hl:webex passes OPTIONS to function routes; request header names arrive lowercased.
388. - A file route (`{ pattern file headers }`) serves JS with the right type and extra headers.
389. - An hl string has no escapes: inline JS in an hl string uses double quotes only.
390. - Shadow-DOM elements: tests/cdp.mjs `click()` can't reach them — `tests/selector.mjs
391. shClick` computes the box inside the shadow root and dispatches real mouse events.
393. ## 2026-09-24 — piece 2/6: apps and login button (ticket #25, mission 003 (old 006)) — awaiting creator
395. Done (worker, NOT confirmed by the creator):
396. - `/apps`: register (name + origins), list, edit, new secret, delete. API key `pk_…` public,
397. secret `sk_…` shown ONCE (sha256 stored). Faces `appCreate/appUpdate/appNewSecret/appDelete`.
398. - One id per app: table `connections` (`pair` = app:identity, random 32-hex `appIdentity`,
399. `created`). Same identity + app → same id; other app / other identity → other id.
400. - Login button: `GET /login?key=&return=` → error page (400, no redirect) or `/signin/<rid>`
401. → ident login if needed → "Choose an identity" (face `chooseIdentity`) →
402. `<return>?ident_code=` (60 s, single use). `POST /api/exchange {key,secret,code}` →
403. `{identity}` only; 401 bad key/secret, 400 bad code/other app's code/JSON/fields.
404. - `testapp/` (separate hybriel app) on :8354; `tests/apps.mjs` gate → **94 passed, 0 failed**.
405. - Deployed to :8351 (storage backup `.scratch/storage-backup-20260924-092054/`); store
406. checked read-only after restart: the creator's account + its identity still there.
407. - Developed in `.scratch/dev` (copy without `.env`/storage), then copied over.
409. Running: ident :8351 (`server.pid`, `server.log`); test app :8354 (`testapp/testapp.pid`,
410. `testapp/testapp.log`, http://100.77.141.84:8354 — not set up: the creator registers it in
411. ident with origin `http://100.77.141.84:8354` and pastes key + secret into its form).
413. How to verify:
414. ```bash
415. cd /media/STORAGE/projects/ident.worldapi.org
416. node tests/apps.mjs # 94 passed (own servers, sink mail, no :8351)
417. node tests/browser.mjs # 79 passed + 2 OBSOLETE fails (below)
418. ps -eo pid,args | grep [h]l-browser-tier # must print nothing
419. curl -s -o /dev/null -w '%{http_code}\n' 'http://127.0.0.1:8351/login?key=pk_x&return=http://a.b/' # 400
420. ```
421. Screenshots: `.scratch/apps-*-{390,1280}.png`.
423. Open:
424. - ~~`tests/browser.mjs` two obsolete checks~~ — fixed in mission 004 (old 007) (ticket #37).
425. - Deleting an identity leaves its connections (ids) in place; the exchange of an already
426. issued code still works for 60 s. Deleting an app removes its connections.
427. - Expired `requests`/`grants` rows are removed only when looked up (no sweep).
429. ## 2026-09-24 — piece 1/6: account and identities (ticket #24, mission 002 (old 005)) — awaiting creator
431. Done (worker, NOT confirmed by the creator):
432. - Email OTP login to ident (mission-003 rules kept). No registration: first right code creates
433. the account + default identity (name `Default`), then the optional-names form (Save / Skip).
434. - Identities: list / new / edit / delete, all fields optional, last one cannot be deleted,
435. default = oldest remaining. Time zone from the browser at first login, shown, changeable.
436. - Removed the mission-003 app flow (`/login`, `/continue`, `/api/exchange`, allow list,
437. `testclient/` — its PID 161897 on :8354 stopped). Old code: `.scratch/removed-mission003/`.
438. - Old store (mission-003 test data) moved to `.scratch/storage-backup-20260924-060627/`
439. (storage + .sessions); started empty.
440. - Gate `node tests/browser.mjs` → **81 passed, 0 failed**; `node tests/dev-smoke.mjs` → SMOKE OK.
442. Running: ident :8351 (PID `server.pid`, log `server.log`). Dev store: [email protected]
443. (from dev-smoke; time zone Europe/Vienna, one identity `Default`).
445. ## How to verify
447. ```bash
448. cd /media/STORAGE/projects/ident.worldapi.org
449. node tests/browser.mjs && node tests/dev-smoke.mjs
450. ps -eo pid,args | grep [h]l-browser-tier # must print nothing
451. curl -s http://127.0.0.1:8351/api/exchange # {"error":"no such endpoint"}
452. .scratch/repro-session-forge/run.sh # the hybriel face-session repro (port 8359)
453. ```
454. By hand: http://100.77.141.84:8351 → email → `tail -1 storage/mail-sink.txt` → code →
455. welcome form (Skip or fill) → identities, time zone.
457. ## Open / next
459. - Pieces 2–6 (#25–#29): apps + API keys + app secret, per-app ids, login button flow,
460. selector, notifications. Tickets wiring waits for piece 2.
461. - Questions to the creator (mission 002 (old 005) report): default identity's name `Default`; blank
462. identity names shown as nickname / names / `Identity <n>`; default = oldest (no
463. "make default"); time zone as a free IANA text field.
464. - A mail bounce is only logged (`mail: FAILED`). No account deletion, no email change.
465. - Deploy (Byrodin container, nginx, DNS, real SMTP via mail.byrod.in) out of scope.
467. ## Lessons
469. - **A server face is found by its EVENT NAME across every file** (hl:webex `facesOf`): two
470. components with `on server save()` would BOTH run. apps.hl's faces are named `app…`.
471. - hl:webex needs at least one COMPONENT route (it reads the app dir off it): the test app
472. has `/about` only for that.
473. - Chrome may pre-fill a password field on a later visit: the gate types the test app's secret
474. with `clear: true` and checks the saved key after the submit.
475. - Develop in `.scratch/dev` (copy without `.env` and storage) — the :8351 watcher reloads on
476. every save in the app dir.
477. - **A face's `session` is POSITIONAL** (the framework appends it to the client's payload):
478. a hand-made frame with one argument too many puts the CLIENT's object in the session's
479. place. Every face goes through `store.hl accountOfSession`/`realSession`, which only accepts
480. `hlTypeName(session) == 'Instance'` (JSON is always `Hybrid`). Repro:
481. `.scratch/repro-session-forge/` (reported to hybriel).
482. - A face runs on a BLANK instance: component functions/members are null there (NotCallable);
483. use only arguments and imports.
484. - `if (!member)` in a View renders nothing, silently (repro `.scratch/repro-if-not/check.mjs`):
485. keep a separate member (`notWelcome`).
486. - `Intl` is not on the JS compiler's browser-global list; `window.Intl` works.
487. - Chrome canonicalises some zones (`America/Argentina/Buenos_Aires` → `America/Buenos_Aires`);
488. store what the browser reports.
489. - A NON-LITERAL static in the manifest reads null in the manifest's own function routes once
490. a component imports from project.hl (hybriel #16) — keep such values elsewhere.
491. - Function routes get no session (#18): `server.sessions.resolve(cookieHeader)`.
492. - `server.sessions.cookie = 'identsid'` after construction renames the cookie (#17).
493. - `styles = {}` boots but `/__hl/app.css` answers 500 (#19): every app needs a styles.hl.
494. - hl:smtp refuses a Mailer without a sender at construction (#20) → placeholders in mail.hl.
495. - `JSON.parse` on bad input aborts the request (#12): a future JSON API must check the body
496. first (copy tickets' `jsoncheck.hl`).
498. ## 2026-09-24 — real mail on (architect, creator asked)
499. - `.env` = copy of hybriel `projects/demo-social-network/.env` (SMTP via mail.byrod.in, user
500. [email protected], sender [email protected]) + `IDENT_PORT=8351`. The file sink is OFF
501. for the dev server. Backup of the old `.env` in `.scratch/env-backup-*`.
502. - Verified: creator logged in with a real code; mail server log shows delivery to [email protected]
503. (`docker logs mail | grep social.network` on Byrodin).
504. - **Tests must never send real mail**: the gate starts its own servers with `IDENT_MAIL_SINK`;
505. do NOT run `tests/dev-smoke.mjs` against :8351 any more (it would mail [email protected]).
506. - Creator: "looks ok for a first" — worker's default choices (Default name, label fallback, oldest =
507. default, free IANA time zone field, UTC fallback, 60 chars) accepted as built.
509. ## 2026-09-24 — dev hostname trap (creator testing #26)
510. - Selector said "not signed in" because ident was logged in under one host and the test app ran under the other.
511. The test app loads the selector from IDENT_URL=http://100.77.141.84:8351. Use ONE hostname for both:
512. http://100.77.141.84:8351 (ident) + http://100.77.141.84:8354 (test app). LAN IP 192.168.178.75 = different site.
514. ## 2026-09-24 — DEPLOYED (architect)
515. - LIVE is now https://ident.worldapi.org on Byrodin (/CONTAINERS/projects/ident.worldapi.org). The live data was moved there.
516. - This Loreana folder is DEVELOPMENT only; its storage/ is a stale copy. Dev servers were stopped. Update live with ./deploy.sh.
518. ## 2026-09-24 — session hardening (ticket #2, items 3+4): copied into the app
519. - Rescued antcolony mission 022's work-copy build from `.scratch/dev-m022/` (a prior worker ran out of
520. steps before reporting) and copied its 4 changed files into the real project root:
521. `store.hl`, `apps.hl`, `components/home.hl`, `components/appsettings.hl`. Not deployed
522. (out of scope for this worker; ./deploy.sh is the architect's).
523. - **Item 3 — the pending session's own expiry**: `store.hl` `beginSession`/`accountOfSession`
524. stamp `session.user.since` + `session.user.epoch` at sign-in; independent of the webex
525. session file's own idle/maxAge clock. `IDENT_SESSION_TTL_MS` (default 14 days). An OLDER
526. session (no `since`/`epoch` — before this ticket, or from the mission-009 migration) is
527. upgraded on its next use instead of being force-signed-out.
528. - **Item 4 — sign out for apps / sign out everywhere**: `store.hl` `signOutEverywhere` bumps
529. the account's `sessionEpoch`, which invalidates every session carrying the old epoch on its
530. next check (no per-session-file bookkeeping needed) — wired to a "Sign out everywhere"
531. button on `/` (`components/home.hl`). `apps.hl` `disconnectConnection` forgets one app
532. connection — wired to a "Sign out of this app" button on the per-app page
533. (`components/appsettings.hl`); a later login makes a fresh, unrelated per-app id.
534. - **Bug fixed in the mission-022 test** (`tests/hardening.mjs`, now copied to the real
535. `tests/`): its `signIn()` helper read the session cookie from `/api/code`'s response, but
536. that route sets no cookie at all (it's a plain function route, no session) — the real
537. cookie is minted by the following `/__hl/emit verifyCode` call. Also added a short poll
538. for the mail-sink code (the sink write can land just after the HTTP response). Not an app
539. bug — the 3 failing checks were the test's own cookie handling.
540. - **Lesson: kill your test servers even on a thrown error.** A crashed `tests/hardening.mjs`
541. run (before this fix) left two orphaned `bin/hybriel` processes bound to :8700/:8701; a
542. later debug run then hit those STALE servers (old per-address send-limits, wrong session
543. state) instead of a fresh one, which looked exactly like a cookie bug at first. Always
544. check `ps -eo pid,args | grep hybriel` for leftovers from a previous crashed run before
545. trusting a new test failure.
546. - Verified: `node tests/hardening.mjs` (copied into `tests/`) → **15 passed, 0 failed**.
547. Full regression re-run against the real project files after the copy — no regressions:
548. `tests/browser.mjs` 83/83, `tests/apps.mjs` 97/97, `tests/notify.mjs` 130/130,
549. `tests/selector.mjs` 99/99, `tests/migration.mjs` 23/23.
550. - Still open from ticket #2: item 2 (real mail — architect already reported done, not
551. re-verified this session, out of scope) and the session cookie's missing `Secure` flag
552. (hybriel #27, blocked on a hybriel fix, not app-side). `.scratch/dev-m022` and `.scratch/m022`
553. (prior worker's scratch) left in place, no longer needed for this ticket.
555. ## 2026-09-24 — identity avatars (ticket #15), continued and finished
557. A prior worker (session `s-20260924T1745-d1e933`) had already added the avatar field to
558. `store.hl`/`components/home.hl`/`styles.hl` but ran out of steps before testing any of it. This
559. session verified, fixed and tested it.
561. - **Found a real regression by running the gate, not by reading the code**: `node
562. tests/browser.mjs` failed 4 checks and then aborted (a later step depended on the failed
563. save) — editing an identity silently saved nothing.
564. Traced with throwaway probes (`.scratch/probe15/`, removed after): server-side `checkFields`
565. and `updateIdentity` were correct in isolation (confirmed with a standalone face call over
566. HTTP), but in the real browser, typing a SECOND character into any field of the edit form lost
567. focus — the DOM node was being replaced under the user's cursor.
568. - **Root cause (hybriel #32)**: the new avatar preview was `if (hasAvatarPreview) { img {...} }`
569. placed right after the avatar input, in the SAME `View` as the other four text inputs. Removing
570. just that `if` (nothing else) fixed typing immediately — confirmed with a minimal repro
571. (type one char, check focus survives) before and after. hl:webex recreates a View's elements on
572. re-render when it contains a conditional block, even one that never flips during the interaction.
573. - **Fix**: `img` is now always rendered; visibility toggles via a `hidden` CSS class driven by a
574. plain reactive field (`avatarPreviewClass = hasAvatarPreview ? 'avatar' : 'avatar hidden'`) —
575. no `if` in the view. `#avatarpreview.hidden { display: none }` added to `styles.hl`. An `img`
576. with an empty `src` issues no network request per the HTML spec (confirmed: no console errors).
577. - Avatar is stored as an http(s) URL (≤ 2000 chars), same shape as a notification's icon
578. (`notify.hl checkUrl`) — no upload infrastructure exists anywhere in this app, decided as the
579. smallest fit for the concept's silence on how the picture gets there.
580. - Extended `tests/browser.mjs` (83 → 92 checks) with: live preview on typing a valid URL, the saved avatar showing as a round
581. image in the identity list, reopening the edit form re-showing the saved URL, a two-keystroke
582. focus-survival check (guards the regression above from coming back unnoticed), clearing the
583. field hiding the preview, and four `checkFields` negatives (no scheme, non-http(s) scheme,
584. too long, wrong type). Used a `paste()` helper (one `input` event with the whole URL) instead
585. of the existing char-by-char `type()` for the avatar field — typing a URL character by character
586. makes the live preview fetch every half-typed prefix (`h`, `ht`, `htt`, …), each a real 404;
587. a paste (or most real user input) sends the whole value in one event.
588. - Verified: `node tests/browser.mjs` → **92 passed, 0 failed**. Full regression, unchanged:
589. `tests/apps.mjs` 97/97, `tests/selector.mjs` 99/99, `tests/notify.mjs` 130/130,
590. `tests/migration.mjs` 23/23, `tests/hardening.mjs` 15/15.
591. - Not done: apps still don't receive the avatar (blocked on ticket #11, on hold, unchanged from
592. the prior worker's decision — correct, left alone). `.scratch/probe15/` (this session's repro
593. scripts) removed after use — nothing left running, no orphan `bin/hybriel` processes.