tickets

54.7 KB

1. ## 2026-10-04 — mission 012: ticket #25 API part — a project by its id (`/api/projects/<id>/…`) — NOT deployed by me
2. Every `/api/projects/<x>/…` route takes the slug (also an old one) or the project's id (its 12-char record id, e.g.
3. `0mufbw18nsuj` = tickets.worldapi.org; `GET /api/projects` → `details[].id`). Tickets stay under their project; no new global
4. `/api/tickets/<x>`. All existing paths answer as before. Pages unchanged. README "Short URLs (ticket #25)".
5. - Files: lib/projects.hl `slugOfRef` (id → current slug, slug first), lib/api.hl `slugOf(route)` in `byNumber` + the 7 route functions
6. under /api/projects/:slug (all 16 routes), tests/browser.mjs (+22 "ids (#25)" checks; PWA list count +1), new tests/projectids-realdata.py.
7. - Tests (ports 8760–8764, 8767–8769): gate **315 passed, 0 failed** (`.scratch/w091/gate.sh <out>`); control = the same gate
8. on the old code: 286 passed, 13 failed (exactly the id checks) then stops; connect.mjs (`.scratch/w091/connect.sh <out>`)
9. **60 passed, 0 failed** ×2 (a first run timed out once at the connect page's new-project field — UI, untouched; flake).
10. Real-data copy (Byrodin 2026-10-04 ~05:00, deleted after): `tests/projectids-realdata.py` old :8763 vs new :8764 →
11. 1,484 answers identical, 772 slug-vs-id answers identical, unknown id 404, **0 FAILED** (README "Project ids on real data").
12. letcount: never-reassigned `let` 0.
13. - Open: deploy (`./deploy.sh`, architect); no data change. t.py / watch.py may switch to ids when wanted.
15. ## 2026-10-03 — mission 011: ticket #25 short URLs (web part) — NOT deployed by me, API part waits for the creator
16. Pages: project `/<slug>`, ticket `/<slug>/<number>`; `/projects/<slug>`, `/projects/<slug>/<n>`, `/projects/<slug>/tickets/<n>` and
17. `/tickets/<old n|uuid>` answer 301 to them (current slug; nothing named → 404). API paths unchanged; the page links in its rows
18. (`href`, `projectHref`, Markdown URL lines) are the short ones. Reserved slugs (`lib/projects.hl reservedSlugs`) refused at
19. creation and slug change. Details + why the slug routes are moved behind hl:web's own urls: README "Short URLs (ticket #25)".
20. - Files: project.hl (routes, the reorder after `new WebFramework`), lib/util.hl (hrefs), lib/api.hl + api-helpers.hl (301s),
21. lib/projects.hl (reserved), components settings / ticket / ticket_list (links, comments), tests/browser.mjs (+44 checks),
22. tests/connect.mjs (2 page URLs), new tests/shorturls-realdata.mjs.
23. - Tests (ports 8760–8764, 8767–8769): gate **293 passed, 0 failed** (249 before; `.scratch/w083/gate.sh <out>`); connect.mjs
24. (temp copy, app URL :8762, Chrome 8767–8769, `.scratch/w083/connect.sh <out>`) **60 passed, 0 failed**; control without the
25. reorder: 35 passed, 15 failed. Live-data copy (Byrodin 2026-10-03 ~20:20, deleted after): `tests/shorturls-realdata.mjs`
26. **187 passed, 0 failed** (11 projects, 20 tickets, every old form + followed); the ticket's own test (`/tracker.worldapi.org`,
27. `/tracker.worldapi.org/31`, both old forms 301) by curl; API old vs new: 1,348 answers, 0 different beyond the page links.
28. Collisions with reserved names on live data: none (no old slugs either). letcount: never-reassigned `let` 0.
29. - Open: the API part (`/api/tickets/<x>`, `/api/projects/<id>`) — the creator must say whether `<x>` is a global id.
30. After the deploy: links in old messages keep working by 301; t.py / watch.py use the API, unaffected.
32. ## 2026-10-03 — mission 010: code order (antcolony docs/code-order.md), no behaviour change — NOT deployed by me
33. Commits on main 97e269b (moves), e9d5c61 (one lib/ file per topic, project.hl = map, thin routes/faces), a75e027 (`let`), + docs.
34. - Root: 14 `.hl` → only `project.hl` (621 → 144 lines: index comment, config, routes, audience). Layout + import order: README "Files".
35. - `store.hl` split: `lib/projects.hl` (projects, members, roles), `lib/tickets.hl` (tickets + relations, all their writes,
36. `removeMember` incl. the unassign, `ticketRights`), `lib/events.hl` (history; `putEvent`), `lib/tickets-helpers.hl` (state names,
37. ref / relation view / filter links). `lib/util.hl` = old localtime.hl + the copies of env / storage dir / countOf / first /
38. merged / sorts / text checks that were in store.hl and users.hl. The API routes moved from project.hl to `lib/api.hl`
39. (auth, filters, Accept, HTML page in `lib/api-helpers.hl`); invite checks (`mayInvite`) and the invite join (`joinByInvite`)
40. moved out of project.hl / the settings face into `lib/invites.hl`. `import.hl` → `tools/import.hl`, `styles.hl` → `components/`.
41. - `let`: 680 → 219 (136 reassigned + 83 re-bound in a loop body); 456 → plain declarations (`tests/letcount.py .` → never-reassigned 0).
42. - Tests (ports 8750–8759): gate **249 passed, 0 failed**; connect.mjs (temp copy, app URL :8752, Chrome 8753–8759) **60 passed,
43. 0 failed**; live-data copy (README "Test" → "Same output", copy of Byrodin storage 2026-10-03 19:3x): 2,172 reads (every page
44. signed in as az5b2 + signed out, every API read JSON + Markdown, refusals) **0 different** (1,460 byte-identical, 712 differ
45. only by source positions / hashes / seed time), 72 write answers (API + faces) **0 different**; tools/fix-import-summaries on
46. a copy = same output as the old tree (10 fixed, 40 fine); tools/import.hl reads `import/tickets` by default (gate).
47. Default storage path checked: a server started WITHOUT TICKETS_STORAGE reads `storage/mpackdb` of the app (11 projects).
48. - Found on the way (Hybriel, not app bugs): see Lessons (loop-body declarations, instance inside a copied hybrid, import cycles).
50. ## 2026-10-03 — antcolony mission 074: re-vendored to hybriel master 06617221 (plugin allocators 3a781359 + 413f60e4) — NOT deployed by me
51. bin sha256 21059cc7…d77bdb, same plugin set (old copy `.scratch/pre-074/` = 190aa11d). No app code change. Gate (ports in README
52. "Vendored Hybriel") → **249 passed, 0 failed**; connect.mjs (temp copy, 8760–8769) → **60 passed, 0 failed**. Real-data memory
53. (`.scratch/w074/mem.mjs`, LONG=1, 69 URLs): new 315 → 335 → 312 → 315 MiB after 5700 pairs, swap 0, ~31–38 ms per pair —
54. **flat now** (072's slow growth is gone); old 190aa11d 319 → 743 MiB, 40–47 ms per pair.
56. ## 2026-10-02 — antcolony mission 072: re-vendored to hybriel master 190aa11d (GC correctness fc838894, #126 closure scopes, #127) — NOT deployed by me
57. bin sha256 860f5e61…0a23626, same plugin set (old copy `.scratch/pre-072/` = 7eea0d32). No app code change. Gate (same ports as below)
58. → **249 passed, 0 failed**; `tests/connect.mjs` (temp copy, app URL :8722, Chrome 8723–8729, ports 8720/8721) → **60 passed, 0 failed**.
59. Real-data memory (`.scratch/w072/mem.mjs`, SSR page + API read pairs over 69 URLs): new 315 MiB boot → 355 (200) → 418 (1200) →
60. 706 MiB (5700), ~29 ms per pair, flat timing; old 697 → 1365 → 1719 MiB, ~79 ms per pair. Still slow growth (~0.065 MiB/pair,
61. was 0.26 on 7eea0d32) — watch live RSS after the deploy.
62. ## 2026-10-02 — antcolony mission 069: re-vendored to hybriel master 7eea0d32 (#126 memory, #48 lambda copy) — NOT deployed
63. bin sha256 f0d3019f…fcc4bc734a0, plugins core crypto data fetch fs http http1 mpackdb proc time web (old copy `.scratch/pre-069/`).
64. #48 fix: `migrate.hl` migrate* lambdas take `&log` (first gate run without it: 248/1 "migration: … log says what was migrated").
65. Gate (ports 8720–8729): `TICKETS_GATE_PORT=8720 TICKETS_GATE_IDENT_PORT=8721 TICKETS_GATE_EXCHANGE_PORT=8722 TICKETS_GATE_CHROME_A=8723-8724
66. TICKETS_GATE_CHROME_B=8725-8726 TICKETS_GATE_CHROME_C=8727-8729 node tests/browser.mjs` → **249 passed, 0 failed** (ident's current folder works again).
67. `tests/connect.mjs` (temp copy, app URL :8722, Chrome 8723–8729, `TICKETS_CONNECT_PORT=8720 TICKETS_CONNECT_IDENT_PORT=8721`) → 60/60.
68. Memory (copy of live storage, `.scratch/w069/mem.mjs <tag> <tree> <port>`, LONG=1 for more rounds; one round = N SSR pages + N API reads):
69. RSS old 73267707 / new 7eea0d32 — boot 1541 / 701 MiB, after 200: 2654 / 1114, after 1200: 2874 / 1679, after 2700: 3173 / 2445,
70. after 4200: 2403 / 2840 MiB. Boot and the first 2700 clearly lower, but new still grows ~0.26 MiB per load pair at 4200 (no plateau seen) →
71. watch live RSS after a deploy (`docker stats --no-stream | grep tickets` on Byrodin; live was 8.76 GiB on 2026-10-02 before).
73. ## 2026-10-01 — antcolony mission 048 (2nd try): re-vendored to hybriel master 73267707 (≥ 4850d798, #122 fixed) — NOT deployed
74. bin sha256 9707e0cc…a81be534f, plugins core crypto data fetch fs http http1 mpackdb proc time web (old copy `.scratch/pre-048/`).
75. #122 repro `.scratch/w048/repro/` (`node repro.mjs bin/hybriel`, port 8732, Chrome 8735–8739) → stays "you may edit" after the face.
76. Gate (ports 8732–8739, ident snapshot — README "Test" → "Ident for the gate"):
77. `TICKETS_GATE_IDENT_DIR=$PWD/.scratch/w048/ident-snap TICKETS_GATE_PORT=8732 TICKETS_GATE_IDENT_PORT=8733 TICKETS_GATE_EXCHANGE_PORT=8734
78. TICKETS_GATE_CHROME_A=8735-8735 TICKETS_GATE_CHROME_B=8736-8736 TICKETS_GATE_CHROME_C=8737-8739 node tests/browser.mjs` → **249 passed, 0 failed**
79. (3 runs; all 4 "once:" checks green incl. bob once in settings). `tests/connect.mjs` (temp copy, Chrome 8735–8739, app URL :8734) → 60/60.
80. With ident's CURRENT folder (ident itself on master) the gate stops at "ident /code page" — an ident issue, not tickets.
81. Removed: `migrate.hl` `compactNow()` block (#110) — master 249/0 without it; 837fe120 without it fails (control). Nothing else to remove
82. (no #115/#116 statics, no #118 detours); no client-built SVG. Duplicate @id: counter `.scratch/w048/dupcount.py <storage dir>` (validated on
83. an injected dup); this try's live tar was spent on a framing bug in the first version — numbers from the first try this morning: 0 everywhere.
85. ## 2026-10-01 — antcolony mission 048: re-vendor to hybriel master ff51cf46 STOPPED (Hybriel bug) — restored to 837fe120
86. Tried master ff51cf46 (ReleaseFast, read-only archive): gate 212 passed, 1 failed — settings "Save" turns the admin page into
87. "Only an admin of the project can open its settings". CAUSE (hl:web, 0b17f65b + 64527baa): after ANY face that takes `session`,
88. WebFramework.hl answers with `ack.sync` built from `mount(key, {}, s, …)` — the component re-mounted WITHOUT its route params, so
89. every server reference site reading session (`isAdmin = … isAdminOf(project.id, me)`) is computed with `projectSlug = null` →
90. false, and the browser takes it. Minimal repro: `.scratch/w048/repro/` (`node repro.mjs <bin>` in a tree with master's plugins:
91. "you may edit" → "you may not edit" after a face; 837fe120 keeps it). Restored `bin/` + `plugins/` from `.scratch/pre-048/`;
92. gate on the restored copy (ports 8732–8739, A/B one port each) → 245 passed, 0 failed. Logs: `.scratch/w048/`.
93. Live data (copy, deleted): no duplicate @id in any table (#113). migrate.hl compactNow() workaround (hybriel #110, master has it)
94. KEPT — not provable without the new binary. Not deployed.
95. Follow-up (lead: since 64527baa a session face also syncs session-derived members → a handler that appends the face's row shows
96. it twice, as in gitoria): tickets never appends a face's answer to a synced list (comments/state events arrive by push into `events`,
97. which reads no session; list/inbox upsert by id; tokens/members/choices are replaced from the answer). Gate +4 "once:" checks
98. (comment once in A and B, state change once, bob once in the settings members). 837fe120: 249 passed, 0 failed. Master copy
99. (throwaway): the 3 comment/state ones green, members unreachable (stops at the settings bug) — `.scratch/w048/gate-once-*.txt`.
101. ## 2026-10-01 — antcolony mission 046: installable app (PWA) + own icons — NOT deployed, awaiting architect / creator
102. Done: `project.hl` (appIcons, appTouchIcon, appFavicon, theme = header darker rgb(15, 20, 25), `offline = [ TicketList ]`, icon routes,
103. real `/favicon.ico`), `components/main.hl` + `styles.hl` (the "You are offline" note via the net-probe animation tick),
104. `icons/` (ticket stub, svg source + PNGs + ico), gate part "PWA" in `tests/browser.mjs` (README "PWA", "Test").
105. Gate (ports 8750–8759, command in README "Test") → **245 passed, 0 failed** (was 233); `tests/connect.mjs` 60/60 (run on a
106. temp copy with Chrome 8757–8759). Looked at: icon 48/192/512 + maskable crop, 390 px online/offline shots — /tmp/w046-tickets/ on Loreana.
107. Gate race fixed: "inbox follows the state change live" failed ~1/5 (API write overtook the tab's hello; the worker's extra
108. requests widened the window) → `connected()` now waits for a pong after the hello. 12 runs green (6 on 8740–8749, 6 on 8750–8759).
109. Open: offline `/` shows the list as last loaded (stale by design); verify install on a real phone after deploy.
111. ## 2026-09-26 — ticket #23: connect protocol documented for app workers
112. New `docs/connect-apps.md` (steps, exchange, key headers, create-ticket / comment / state calls); linked from the README. No code change.
114. # STATUS
116. ## 2026-09-26 — ticket #21: connect an app to a project (gitoria's tickets) — NOT deployed
117. Done: `connections.hl` + `components/connect.hl` + routes (`/connect`, `/connect/:nonce`, `/api/connect/exchange`, `…/connections`, `…/connections/remove`), the
118. connections line + Disconnect on the project page, per-project key `tktc_…` (create / comment / state only, roles of the NAMED person via
119. `X-Tickets-Identity`). README section "Connecting an app to a project". `node tests/connect.mjs` → 60 passed, 0 failed. NOT run: the old gate
120. `tests/browser.mjs` / `short-id-switch.mjs` (they need a copy of ident's code, `ident.worldapi.org` is not on this machine); the only shared-code
121. change is `apiAuth` in `project.hl` (token users behave as before — checked in the new gate). Gitoria's side (button "Connect tickets", storing the key,
122. sending the events) is gitoria's ticket. On Byrodin set `TICKETS_CONNECT_ORIGINS` only if a non-worldapi.org app must connect.
124. ## 2026-09-26 — ticket #22: every event in the API carries `userId` — NOT deployed
125. `store.hl eventRowOf` adds `userId` (the users @id of the author; `''` for events from before the login). `author` (display name) unchanged. Checked with a real write on a fresh store (`.scratch/m22/t.hl`: user, project, ticket, comment): both events show `userId` = the author's users @id. Not covered by the gate.
127. ## 2026-09-26 — ticket #20: projects as own data, members, roles, new states — NOT deployed (architect: together with the scheduler update)
128. Took over the unfinished worker session s-20260926T1044-278e20 (store/projects/members/settings/invites/inbox code was written, the gate not run).
129. Fixed: the migration's replaced records left tombstones and the page realm's second open compacted the files under the first handle (every slug
130. lookup 404'd after the first page render) → `migrate.hl` compacts the changed tables. Gate: `tests/browser.mjs` → 233 passed, 0 failed (roles,
131. states + aliases, inbox, project create / settings / slug change / members / invite accepted through ident, layouts of the new pages);
132. `tests/short-id-switch.mjs` (ports 8706/8707) → 19 passed, ported to the roles. The migration was also run on a copy of the dev store (5 projects,
133. 47 tickets: 38 open, 9 done). Parked: the old browser checks (`tests/browser-pre20-parked.txt`). Not done: live push of a role change to an open page
134. (a page needs a reload after an admin changes its role), the "answered" state of #19 is gone (replaced by these states).
136. ## 2026-09-26 — antcolony mission 036: on hybriel master 837fe120 (hl:web, no local patch) — NOT deployed, awaiting architect
137. Still carries the UNDEPLOYED #19 state (see Byrodin STATUS: never deploy tickets before #19 is decided).
138. Switched: plugins/webex + both LOCAL PATCHes gone → master's plugins/web; `'hl:web'` / `'hl:web/css'` imports;
139. NativeWebSocketServer/bindHost gone (hl:web reads HL_HOST); /login/callback uses `req.session` (still mints +
140. Set-Cookie when the browser has none); `realSession()` gone (`session == null`); `encode` = `encodeURIComponent`;
141. import.hl `after` = `a > b`; jsoncheck accepts a VALID \u surrogate pair (lone ones still 400 — JSON.parse still
142. aborts on them, checked with the new binary); shared/tokens.hl = ident's/gitoria's hl:web copy. Gate: the 12 forged
143. checks accept hl:web's own refusal (ack `ok:false`, "the `session` parameter is filled by the server"); surrogate cases
144. updated (+2 checks: pair passes, high+non-low refused). `node tests/browser.mjs` → **423 passed, 0 failed** (incl.
145. the #104 text-order check "the form says which ticket it opened"), no Chrome left. Served page:
146. `/__hl/{hl-runtime.js,web/client.js,app.css}?v=ead0a6f2dfc83077`, 0 unhashed refs, hashed = immutable, bare = no-cache.
147. Backup of the old state: `.scratch/pre-036/` (bin, plugins, src, tests). Kept: jsoncheck, localtime, hand sorts,
148. login.js guard (JS untouched).
150. ## 2026-09-25 — antcolony mission 035: re-vendor to hybriel master 13ef4f9b STOPPED (Hybriel bug) — code NOT touched (only this note)
151. Probe in a copy (loreana `~/scratch-035/tickets-probe` deleted; recipe: rsync without .env/storage, bin+plugins from master,
152. `'hl:webex'`→`'hl:web'`, `'hl:webex/css'`→`'hl:web/css'`, gitoria's `shared/tokens.hl`): gate 408 passed, 13 failed. (1) HYBRIEL
153. BUG: an element built in the browser when its `if` turns true puts a child element BEFORE the bound text: `p { notice " " a {…} }`
154. in ticket_list.hl renders `<a>open it</a>Opened hybriel #1. ` (server render is right). Repro: loreana
155. `~/scratch-035/repro/home-textorder.hl`. (2) 12 forged-session checks expect an app `{error}`; hl:web now refuses the extra
156. argument itself (ack `ok:false`) → the checks must accept that. Workarounds to drop at the real re-vendor: webex LOCAL PATCHes,
157. NativeWebSocketServer listener (HL_HOST), realSession(), charCodeAt ordering, jsoncheck surrogate refusal (#15), hand URL encoders.
159. ## 2026-09-25 — ticket #19 "answered" state — awaiting architect (deploy) / creator
161. New state `answered`. When the creator comments on a ticket in `awaiting creator`, the store (`addComment`)
162. also writes a state event → `answered` (goes back to whoever asked, leaves the inbox). Other users' comments
163. change nothing; "confirmed" stays "tested, works". The asker sets `awaiting creator` again as before.
164. API POST comments and the page face push both events; state badge colour + filter added. Gate: new #19 checks.
165. DECISIONS.md not touched (architect/librarian).
167. ## 2026-09-24 — ticket #12 Markdown source view (antcolony mission 025) — awaiting architect (deploy) / creator
169. Follow-up to mission 009 (old 024): the creator asked (ticket #12, after "awaiting creator") for "a switch
170. source / markdown at the bottom" to copy/paste or hand-edit the raw Markdown.
172. Done (worker; edited `/media/STORAGE/projects/worldapi-components/md-editor.js` directly — a plain
173. JS asset, no `.hl` dev-server-reload risk — then `cp` into `shared/md-editor.js` here; no tickets
174. `.hl`/faces/API/data changed, so nothing else needed a dev-copy round-trip):
175. - `<md-editor>` gets a footer row at the bottom with a "Markdown source" button: swaps the visual
176. editor for a plain textarea with the raw Markdown (copy/paste or hand-editing), "Visual editor"
177. swaps back (re-parses the text). Same `input`/`change` events, Ctrl+Enter still sends the form.
178. Hidden together with the toolbar when `toolbar="none"`. Details: worldapi-components README
179. "Source view" / STATUS antcolony mission 025.
180. - Component test (worldapi-components) → **81 passed, 0 failed** (72 before + 9 new checks), 83
181. with `ORACLE_APP`. Screenshot `worldapi-components/.scratch/test/md-editor-source-view.png`.
182. - This app's gate `node tests/browser.mjs` (ports 8700-8729, this session's range) → **418 passed,
183. 0 failed**, unchanged from mission 009 (old 024) (no new tickets-side checks added — the feature lives
184. entirely in the vendored component; the existing `#12` checks already cover the enhanced/standalone
185. editors and keep passing with the new footer present).
187. How to verify (ports 8700-8749 only):
188. ```bash
189. cmp /media/STORAGE/projects/worldapi-components/md-editor.js shared/md-editor.js && echo same
190. cd /media/STORAGE/projects/worldapi-components && HL_CHROME=/opt/google/chrome/chrome node test/run.mjs # 81 passed
191. cd /media/STORAGE/projects/tickets.worldapi.org
192. TICKETS_GATE_PORT=8700 TICKETS_GATE_IDENT_PORT=8701 TICKETS_GATE_EXCHANGE_PORT=8702 \
193. TICKETS_GATE_CHROME_A=8710-8719 TICKETS_GATE_CHROME_B=8720-8729 node tests/browser.mjs # 418 passed
194. ```
195. Manual (creator): open a ticket → Comment field → click "Markdown source" at the bottom → the box
196. becomes a plain textarea with the Markdown → edit it → click "Visual editor" → it renders again.
198. Not deployed (Byrodin container untouched, live app on tickets.worldapi.org still the pre-mission-025
199. version); the architect deploys with `./deploy.sh` after the creator confirms.
201. ## 2026-09-24 — ticket #12 Markdown editor (mission 009 (old 024)) — awaiting architect (deploy) / creator
203. Done (worker; developed in `.scratch/dev-m024`, copied back, NOT deployed):
204. - New project `/media/STORAGE/projects/worldapi-components/` with `<md-editor>` (its README/STATUS/test).
205. - Vendored as `shared/md-editor.js`, route `/md-editor.js`, script in the shell; new-ticket summary, edit
206. summary, comment and state note (input → textarea rows 1) wrapped in `mdEditor { textarea {…} }`;
207. `styles.hl` sets the `--md-*` tokens. Faces/API/data unchanged. README "Markdown editor".
208. - Gate `node tests/browser.mjs` → **418 passed, 0 failed** (402 old + 16 new `#12` checks; dev copy and main folder).
209. - Component test (in worldapi-components, with this app's markdown.hl as oracle) → 72 passed, 0 failed.
210. - Old files before the copy-back: `.scratch/m024/pre-copy-backup/`.
212. How to verify (ports 8800-8849 only):
213. ```bash
214. cd /media/STORAGE/projects/tickets.worldapi.org
215. cmp shared/md-editor.js ../worldapi-components/md-editor.js && echo same
216. bash .scratch/m024/gate-tickets.sh .scratch/m024/g.txt; tail -2 .scratch/m024/g.txt # 418 passed (ports 8810-8812, Chromes 8835-8844)
217. cd ../worldapi-components && ORACLE_APP=../tickets.worldapi.org HL_CHROME=/opt/google/chrome/chrome node test/run.mjs # 72 passed
218. ps -eo pid,args | grep [h]l-browser-tier | grep remote-debugging-port=88 # empty
219. ```
220. Screenshots: `.scratch/gate-{phone,desktop}-mdeditor.png`, `.scratch/gate-phone-newticket-mdeditor.png`,
221. `../worldapi-components/.scratch/test/md-editor-{phone,desktop}.png`.
222. Manual (creator): open a ticket → Comment: type `**bold**` → it turns bold; tap B / list on the phone;
223. Ctrl+Enter sends; Edit → the summary shows formatted, Save.
224. Lessons: `<md-editor>` is form-associated, so a wrapping `<label>` activates IT (not the textarea);
225. Hybriel's JSON.stringify sorts object keys (compare key-sorted); a `<textarea>` turns CR LF into LF
226. when its value is set by script.
228. ## 2026-09-24 — design tokens AS DESCRIBED (ticket antcolony#3, antcolony mission 021) — awaiting architect (deploy) / creator
230. antcolony Mission 018 (generated `':root'` copy + sync.sh) was REJECTED by the creator; antcolony mission 021 replaces it.
231. Done (worker; developed in `.scratch/dev-m021`, copied back, NOT deployed):
232. - `shared/tokens.hl` = hand-written webex `var()` tokens (`static dark = var('rgb(25, 30, 35)')`, semantic
233. `colorText = var(light)` …, incl. `colorAccentText` moved here from the app), verbatim copy of
234. `/media/STORAGE/projects/worldapi-tokens/tokens.hl`. `styles.hl` member-imports them and uses them as
235. members; sets only `colorAccent = var(purple)`. README "Design tokens".
236. - webex LOCAL PATCH (antcolony mission 021, hybriel#39) in `plugins/webex/WebFramework.hl`; XSS patch kept.
237. - Old files: `.scratch/m021/pre-copy-backup/` (styles.hl, shared/tokens.hl, WebFramework.hl); antcolony mission 018's
238. worldapi-tokens folder (sync.sh, tokens.css, generated tokens.hl): `tickets.worldapi.org/.scratch/m021/worldapi-tokens-m018-backup/`.
239. - Rendered colours unchanged: `/__hl/app.css` after `:root` byte-identical old vs new (in `:root` only
240. the order of `--color-accent-text` / the app's `--color-accent` changed); Chrome computed colours
241. of every element + every token, tickets list/inbox/state/ticket/you + ident home/code/account/apps/inbox,
242. 390 + 1280: 23 passed, 0 failed.
243. - Gate `node tests/browser.mjs` (ports remapped: `.scratch/m021/gate-tickets.sh`) → **402 passed, 0 failed** (dev copy and main folder).
244. - Deploy simulation (deploy.sh excludes + debian:12-slim container): same app.css, byte-identical.
246. How to verify (ports 8850-8879 only; scripts in tickets.worldapi.org/.scratch/m021 unless noted):
247. ```bash
248. cd /media/STORAGE/projects/tickets.worldapi.org
249. for a in tickets ident; do cmp /media/STORAGE/projects/worldapi-tokens/tokens.hl ../$a.worldapi.org/shared/tokens.hl && echo same $a; done
250. bash .scratch/m021/cmpup.sh up; node .scratch/m021/cmpstyles.mjs; bash .scratch/m021/cmpup.sh down # 23 passed (old code: <app>/.scratch/m021/old-<app>)
251. IDENT_GATE_DIR=/media/STORAGE/projects/ident.worldapi.org bash .scratch/m021/gate-tickets.sh .scratch/m021/g.txt; tail -2 .scratch/m021/g.txt # 402 passed
252. cd /media/STORAGE/projects/ident.worldapi.org; bash .scratch/m021/gate-ident.sh . .scratch/m021/gates-main # 6 suites green
253. bash /media/STORAGE/projects/tickets.worldapi.org/.scratch/m021/deploysim.sh <tickets dir> <ident dir> # needs cmpup's run/main-*.css
254. ps -eo pid,args | grep [h]l-browser-tier # empty
255. ```
256. Screenshots: `tickets.worldapi.org/.scratch/m021/shots/<app>-<old|new>-<page>-<390|1280>.png`.
257. Lesson: an imported `static` var() token works only with the antcolony mission 021 webex patch; tokens.hl changes need a restart.
259. ## 2026-09-24 — shared design tokens (ticket antcolony#3, antcolony mission 018) — REJECTED by the creator, superseded by antcolony mission 021
261. Done (worker; developed in `.scratch/dev-m018`, copied back, NOT deployed):
262. - Tokens now come from `shared/tokens.hl` (generated from layouts `tokens.css` by
263. `/media/STORAGE/projects/worldapi-tokens/sync.sh`, vendored like plugins/); `styles.hl` inherits it and
264. sets only the accent (README "Design tokens"). Old copy of `styles.hl`: `.scratch/m018/pre-copy-backup/`.
265. - Every rendered colour unchanged: `/__hl/app.css` after `:root` byte-identical old vs new; computed
266. colours of every element (tickets list/inbox/state/ticket/you, ident home/code/account/apps/inbox, 390 +
267. 1280) old == new in Chrome.
268. - Gate `node tests/browser.mjs` → **402 passed, 0 failed** (dev copy and main folder).
270. How to verify (ports 8850-8879 only):
271. ```bash
272. cd /media/STORAGE/projects/tickets.worldapi.org
273. /media/STORAGE/projects/worldapi-tokens/sync.sh --check # ok ×3
274. bash .scratch/m018/cmpup.sh up; node .scratch/m018/cmpstyles.mjs; bash .scratch/m018/cmpup.sh down # 23 passed (old code in .scratch/m018/old-*)
275. IDENT_GATE_DIR=/media/STORAGE/projects/ident.worldapi.org bash .scratch/m018/gate-tickets.sh /tmp/g.txt; tail -2 /tmp/g.txt # 402 passed
276. cd /media/STORAGE/projects/ident.worldapi.org; bash .scratch/m018/gate-ident.sh . .scratch/m018/gates-main # 6 suites green (ports remapped copies)
277. bash /media/STORAGE/projects/tickets.worldapi.org/.scratch/m018/deploysim.sh <tickets dir> <ident dir> # deploy rsync + container: same app.css
278. ps -eo pid,args | grep [h]l-browser-tier # empty
279. ```
280. Screenshots: `tickets.worldapi.org/.scratch/m018/shots/<app>-<old|new>-<page>-<390|1280>.png`.
281. Lesson: a `var()` token of hl:webex/css can't cross an `inherit` (second instance) — use literal `':root'` strings.
283. ## 2026-09-24 — ticket #4 (mission 008 (old 017)): parent / child + blocked-by — awaiting architect (deploy) / creator
285. Done (worker; developed in `.scratch/dev-m017`, copied back, NOT deployed to Byrodin):
286. - **Relations** (README "Relations"): a ticket has ≤ 1 parent and any number of blockers, across
287. projects; parent page lists children + states, child shows "Part of …"; "Blocked by" / "Blocks" on
288. both sides. New table `storage/mpackdb/links.*` (created empty — no migration); every change is a
289. history event `kind:"link"` on the child / blocked ticket.
290. - **Who may**: the author of either ticket or the creator (legacy tickets without author: only the
291. creator or the other ticket's author). No self-links, no loops (also transitive), no duplicates.
292. - **Parent state**: `allChildrenConfirmed` (children exist and all `confirmed`) → page "all children
293. confirmed (n)" (green) / "k of n children confirmed"; the parent's state is never changed.
294. - **API**: `POST …/parent {parent}` (`""` removes), `POST …/blocked-by {add}|{remove}`, both URL
295. forms; rows (list + single) carry `parent`, `children`, `blockedBy`, `blocks` (refs with states),
296. `allChildrenConfirmed`. Markdown view: Parent / Children / Blocked by / Blocks blocks + list-line tails.
297. - **Web**: forms "Parent ticket" (Set / Remove) and "Blocked by" (Add, Remove per row) for logged-in
298. users; live push `ticketsRelated` after relation writes, state changes and edits.
299. - Gate ports configurable (`TICKETS_GATE_CHROME_A/B` new); a `connected()` wait added before the
300. pre-existing token "Revoke" click (it flaked once on the bare SSR button).
301. - Gate `node tests/browser.mjs` → **402 passed, 0 failed** (dev copy 3× in a row, main folder 3×).
303. How to verify:
304. ```bash
305. cd /media/STORAGE/projects/tickets.worldapi.org
306. bash .scratch/m017/gate.sh .scratch/m017/g.txt; tail -2 .scratch/m017/g.txt # gate on ports 8800-8819 (or plain node tests/browser.mjs)
307. ps -eo pid,args | grep [h]l-browser-tier # empty
308. bash .scratch/m017/compat.sh # old vs new code on store copies: JSON equal minus the 5 new keys, Markdown identical, .mpack unchanged
309. node .scratch/m017/identmigrate.mjs # rehearsal on a store COPY: ident #3–#8 under ident #1 (creator token 201 ×6, non-creator 403)
310. ```
311. Look at `.scratch/gate-{phone,desktop}-{parent,blocked}.png`.
313. For the architect (after the deploy): link the ident pieces —
314. `for n in 3 4 5 6 7 8; do curl -s -XPOST -H "Authorization: Bearer $TOKEN" -d '{"parent":"ident.worldapi.org#1"}' https://tickets.worldapi.org/api/projects/ident.worldapi.org/tickets/$n/parent; done`
315. — ident #1 and #3–#8 were opened BEFORE the login (authors "import" / "architect" as text), so only
316. the CREATOR's token may (a non-creator gets 403, rehearsed). Check: `curl -s -H 'Accept: text/markdown' https://tickets.worldapi.org/api/projects/ident.worldapi.org/tickets/1 | head -20`.
317. Manual (creator): open a ticket you opened → "Parent ticket" field → `ident.worldapi.org#1` → Set parent;
318. the parent page lists it under "Children".
320. Lessons (mission 008 (old 017)):
321. - `from` is reserved in Hybriel (parse error "Expected parameter name") — known (hybriel#22), bit again.
322. - A gate click right after `goto` + `waitForSelector` can hit the SSR button before hydration → wait for
323. the socket (`connected()`) before any click.
324. - Loreana ports 8821 and 8830 are taken by other software (llama-server) — inside the 8800-8849 range.
326. ## 2026-09-24 — tickets #8 (edit) + #6 (Markdown) + #11 (gate under load), mission 007 (old 014) — awaiting architect (deploy) / creator
328. Done (worker; developed in `.scratch/dev-m014`, copied back, NOT deployed to Byrodin):
329. - **SECURITY, found on the way (pre-existing, live too)**: hl:webex writes the page state (user
330. text) into an inline `<script>` unescaped → a summary / comment containing
331. `</script><img src=x onerror=…>` executes in every viewer's browser. Reproduced on the pre-m014
332. code (`.scratch/m014/old-app`, probe ticket via `.scratch/m014/xssprobe.hl` on a store COPY →
333. `xsscheck.mjs` `__pwned = 1`); fixed by a one-line LOCAL PATCH in `plugins/webex/WebFramework.hl`
334. (`<` → `\u003c` in the seed) → `__pwned = undefined`, page hydrates. Deploy soon; ident and
335. every other hl:webex app vendor the same code (hybriel issue to file).
336. - **#8 editing** (README "Markdown, editing"): the author edits subject + summary (web "Edit",
337. API `POST …/edit`); legacy tickets (no user on the created event): only the creator; else 403.
338. Edit = history event `kind:"edit"` with old + new values, pushed live.
339. - **#6 Markdown**: `markdown.hl` + `components/markdown.hl` render summary / comments / state
340. notes safely (text nodes only, `safeHref`); `mdview.hl` = `Accept: text/markdown` on the ticket
341. GETs. JSON unchanged (old vs new code on copies of the store: every GET byte-identical).
342. - **#11 gate**: page waits × `TICKETS_GATE_SLOW` (default 3); console check before ident stops,
343. browsers parked on `about:blank` during "ident down".
344. - Gate `node tests/browser.mjs` → **335 passed, 0 failed** (dev copy and main folder).
346. How to verify:
347. ```bash
348. cd /media/STORAGE/projects/tickets.worldapi.org
349. node tests/browser.mjs # 335 passed; look at .scratch/gate-{phone,desktop}-{edit,markdown}.png
350. ps -eo pid,args | grep [h]l-browser-tier # empty
351. bash .scratch/m014/compat.sh # JSON DUMPS IDENTICAL, 47 tickets md+page 200, .mpack unchanged
352. # #11 under load: a dev server on a store COPY (:8374), then
353. node .scratch/m014/load.mjs http://127.0.0.1:8374 4 6 & # 4 Chromes x 6 tabs; kill %1 afterwards
354. node tests/browser.mjs # 3x green (logs .scratch/m014/gate-load-*.txt, gate-heavy-*.txt)
355. # old code under the same load: .scratch/m014/old-app → 274/1 (ERR_CONNECTION_REFUSED selector.js), 3 of 3 runs
356. ```
357. Manual (creator): open a ticket you opened after the login → "Edit" (top, under the dates) →
358. change subject / summary (Markdown) → Save: the history shows "edited the ticket" with the
359. previous version folded. `curl -H 'Accept: text/markdown' https://tickets.worldapi.org/api/projects/tickets.worldapi.org/tickets/6`.
360. Old files before the copy-back: `.scratch/m014/pre-copy-backup/` (+ `.scratch/m014/old-app/plugins`).
362. Lessons (mission 007 (old 014)):
363. - A `#events li` selector (CSS or test) also hits the `<li>` of a Markdown list inside an event:
364. use `#events > li`.
365. - Hybriel string literals DO decode `\uXXXX` but not `\\`: a literal backslash is `'\u005c'`.
366. - Never embed user text in an inline `<script>` without escaping `<` (webex did — see above).
368. ## 2026-09-24 — tickets #9 + #10 (mission 006 (old 012)): login banner after logout, button returns to the page — awaiting architect (deploy) / creator
370. Done (worker; developed in `.scratch/dev-m012`, copied back, NOT deployed to Byrodin):
371. - **#9 cause (reproduced in headless Chrome, own ident + tickets, `.scratch/m012/repro.mjs`)**:
372. hl:webex re-creates the shell header — `<ident-selector>` AND the `<script>` elements — every
373. time the login state flips (login, logout); the browser runs the re-inserted `/login.js` again,
374. and every run added one more `ident-login` listener to the (new) selector. After a logout the
375. selector carried 2 listeners → one choice = 2 `change`s on `#identcode` = 2 `identLogin` faces =
376. 2 exchanges of the SAME code at ident (200, then 400 "unknown or already used code" → banner).
377. The first exchange had logged the session in as the chosen identity (B). Not identity-specific:
378. A → Log out → A again showed the banner too; the first selector login after a page load never
379. does (one listener) — that is why "with A alone" it never appeared. Navigation is NOT the cause
380. (after an in-app click list → ticket, login.js had not run again); list, ticket page reached by
381. click and ticket page loaded directly all showed it (old code: exchanges `[200, 400]`).
382. - **Fix** `login.js`: installs once per document, `ident-login` listener on `document`, current
383. `#selector` looked up each time (MutationObserver on the whole document), each code handed on
384. once. After: exactly one exchange, no banner, logged in as B (all 3 scenarios).
385. - **#10** the button returns to the page: `login.js` adds `?next=<path+query>` to the button's
386. return URL at the click; `project.hl` `safeNext` + `/login/callback` → 302 there (same-origin
387. path only, else `/`). ident keeps the return URL's query and appends `&ident_code=`.
388. - Gate `node tests/browser.mjs` → **275 passed, 0 failed** (+25: #9 path with an exchange-counting
389. proxy, #10 table + browser). With the OLD `login.js` the new #9/#10 checks FAIL (negative control).
391. How to verify:
392. ```bash
393. cd /media/STORAGE/projects/tickets.worldapi.org
394. node tests/browser.mjs # 275 passed; grep '#9\|#10' in the output
395. ps -eo pid,args | grep [h]l-browser-tier # empty
396. SCEN=ticket-nav node .scratch/m012/repro.mjs # "B login: exchanges=1 ..." ; banner null
397. SCEN=list node .scratch/m012/repro.mjs .scratch/m012/old-app # the OLD login.js: "B login: exchanges=2", banner
398. ```
399. Old files before the copy-back: `.scratch/m012/pre-copy-backup/`. Gate logs `.scratch/m012/gate-*.txt`.
400. Manual (creator): log in with the selector, Log out, choose another identity → no red banner,
401. top right the other identity; log out on a ticket page, "Log in with ident" → back on that page.
403. ## 2026-09-24 — ticket #7 (mission 005 (old 011)): login via ident — awaiting architect (deploy) / creator
405. Done (worker; developed in `.scratch/dev-m011`, NOT deployed to Byrodin):
406. - **Login** (README "Login (ident)"): ident's selector top right + "Log in with ident" button;
407. the server exchanges the one-time code (`users.hl` exchangeCode, IDENT_API_KEY/SECRET) for the
408. per-app identity id; `login.js` bridges the selector's `ident-login` event into the shell's
409. face `identLogin` (no reload); `/login/callback` for the button. Logout resets the selector.
410. - **Users** `storage/mpackdb/users.*` (identity id → display name, asked once at the first login,
411. cannot be changed afterwards), **tokens** `storage/mpackdb/tokens.*` (sha256 only; `/you`:
412. create / list / revoke; `Authorization: Bearer` on every API write, else 401).
413. - **Reading public, writing needs a login** (web faces check the REAL session, #31; API 401).
414. No author field (API `author` → 400 naming it); events store `user`, old events keep their
415. author. **Confirm/reject only by `TICKETS_CREATOR_IDENTITY`** (unset = nobody; API 403).
416. - `/you` shows the user's own per-app id (for TICKETS_CREATOR_IDENTITY) + tokens.
417. - `import.hl` needs `TICKETS_TOKEN`. `docker-compose.yml`: `IDENT_EXCHANGE_URL=http://127.0.0.1:45002`
418. (key/secret/creator come from `.env`, loaded by the runtime).
419. - Gate `node tests/browser.mjs` → **250 passed, 0 failed** (own ident on :8353 from a copy of
420. ident's code without `.env`, mail sink; see README "Test").
421. - Live-store compatibility: old code (`.scratch/dev-m010`) and new code each on a COPY of
422. `storage/mpackdb`, every GET dumped → byte-identical (`.scratch/m011/compat.sh`); old
423. `.mpack` files unchanged; `users.*`/`tokens.*` appear empty. No migration step.
425. For the architect (deploy): `.env` on Byrodin must have `IDENT_API_KEY` / `IDENT_API_SECRET`
426. (creator set them). After the deploy: the creator logs in, opens `/you`, the architect sets
427. `TICKETS_CREATOR_IDENTITY=<id>` in `.env`, restarts; the creator (identity "Architect") creates
428. the architect's token on `/you`. Until then NOBODY can confirm/reject, and every API client
429. (the architect's scripts, import) needs a token — writes without one are 401 from the deploy on.
431. How to verify:
432. ```bash
433. cd /media/STORAGE/projects/tickets.worldapi.org
434. node tests/browser.mjs # 250 passed; screenshots .scratch/gate-*-{signedout,name,loggedin,tokens}.png
435. ps -eo pid,args | grep [h]l-browser-tier # empty
436. bash .scratch/m011/compat.sh # DUMPS IDENTICAL (old vs new code on copies of storage/mpackdb)
437. ```
438. Manual (dev): own ident + tickets: `bash .scratch/m011/devup.sh` (ident :8358 from
439. `.scratch/m011/ident` = copy WITHOUT .env, mail sink `.scratch/m011/run/mail.txt`; tickets :8359
440. with `.scratch/m011/run/app.env`; `node .scratch/m011/devsetup.mjs` registers the app first).
441. Query users/tokens: only on a COPY (#40): `cp -a storage/mpackdb /tmp/c` + a small hl script
442. (`MPackDB(file = '/tmp/c/users.db', primaryKey = '@id', indexes = ['!identity'])`).
444. ## 2026-09-24 — deploy readiness (ident mission 006 (old 010)) — awaiting architect (first deploy)
446. Done (worker; NOT deployed to Byrodin):
447. - `project.hl`: builds the listener itself so `HL_HOST=127.0.0.1` binds loopback (hl:webex
448. ignores HL_HOST); `TICKETS_WATCH=0` = no dev watcher. Defaults unchanged (0.0.0.0, watcher on).
449. - `docker-compose.yml` (container `tickets.worldapi.org`, 127.0.0.1:45003) + `deploy.sh`
450. (README "Deploy").
451. - Gate `node tests/browser.mjs` → 164 passed, 0 failed (dev copy `.scratch/dev-m010` and live folder).
452. - Tested on Loreana only: local deploy into a directory + the container there (only
453. 127.0.0.1:45003 listens, URL 200, fake storage marker untouched), and behind a local TLS
454. nginx in real Chrome: page + wss socket, no http:// URLs (ident `.scratch/m010/`).
456. How to verify:
457. ```bash
458. cd /media/STORAGE/projects/tickets.worldapi.org
459. node tests/browser.mjs # 164 passed
460. bash -n deploy.sh && ./deploy.sh --dry-run --target /tmp/ticketsdeploy-test # LOCAL dir only
461. ```
462. For the architect: the vhost needs WebSocket Upgrade headers and `proxy_pass http://127.0.0.1:45003`.
464. ## 2026-09-24 — ticket #38 (mission 004 (old 008)): per-project numbers, UUID keys, storage/mpackdb/ — awaiting creator
466. Done (worker, not yet confirmed by the creator):
467. - **UUID keys** (`@id`) in all three tables, files in `storage/mpackdb/{projects,tickets,events}.*`.
468. Ordering from stored times: lists by `updated`, history by (`created`, `seq`), projects by `created`.
469. - **Per-project numbers** from 1; URL `/projects/<project>/<number>`; slug = project name as is
470. (new names: letters, digits, `. _ -` only). List, inbox, ticket page, pushes, notice link use it.
471. - **Old global numbers** kept as `oldNumber`: page shows "formerly #n", `/tickets/<n>` → 301,
472. `/api/tickets/<n>[/comments|/state]` still work (also with the UUID). New tickets: no old number.
473. - **API** per-project form `/api/projects/<slug>/tickets[/<number>[/comments|/state]]` (GET/POST),
474. rows carry `project`, `number`, `href`, `apiHref`, `oldNumber`. `ticket.id` is now the UUID.
475. - **Migration** `tools/migrate-008.hl` (idempotent) of the live data, deployed 2026-09-24:
476. old tables stay in `storage/tickets-*` (untouched, md5-checked), full backup
477. `.scratch/storage-backup-<ts>`, logs + before/after dumps in `.scratch/deploy-008-<ts>/`
478. (`deploy-008.sh`, compare `cmp008.py`). Rehearsed on a copy first (`.scratch/rehearse.sh`).
479. - Gate: `node tests/browser.mjs` → **164 passed, 0 failed** (in `.scratch/dev` before deploy).
481. Test: gate (see README "Test"), then
482. `python3 .scratch/cmp008.py .scratch/deploy-008-*/before.jsonl .scratch/deploy-008-*/after.jsonl`
483. and open http://192.168.178.75:8350/tickets/38 (→ /projects/tickets.worldapi.org/5).
485. Known gaps: new tickets have no global number, so `/api/tickets/<n>` works only for the
486. migrated #1–#40 (use the UUID or the per-project form). Numbers are max+1 (a deleted ticket's
487. number would be reused — there is no delete). Project names stay case-sensitive.
489. ## 2026-09-24 — ticket #15 (mission 003 (old 004)): required author, 400 on invalid JSON, list lines — awaiting creator
491. Done (worker, not yet confirmed by the creator):
492. - **`author` required** on `POST /api/tickets`, `/comments`, `/state` → 400 `{error, field:"author"}`
493. when missing/empty (`api.hl` required lists + `store.hl` `authorMissing`, so web faces too).
494. Web forms: name fields removed, they write as `creator` until ident exists. Stored data unchanged.
495. - **Invalid JSON → 400 `{error:"invalid JSON at character N"}`** (no source path) via
496. `jsoncheck.hl` before `JSON.parse` — WORKAROUND for hybriel #12, remove when fixed. It also
497. refuses `\uD800`–`\uDFFF` escapes (hl JSON.parse refuses even valid pairs → would be 500).
498. - **Import list lines**: `ticketfile.hl` keeps `- ` / `* ` / `1. ` lines as own lines (`\n`),
499. wrapped lines still joined; page shows them as separate lines (pre-wrap). #1–#5 have no lists
500. → nothing to migrate.
501. - Gate: `node tests/browser.mjs` → **119 passed, 0 failed** (in `.scratch/dev` before deploy).
502. - Deploy 2026-09-24: backup + before/after API dumps in `.scratch/` (see `deploy-004.sh`).
504. Known gaps: a body that passes jsoncheck but that hl JSON.parse still refuses would 500
505. (none known besides surrogates). Nested list indentation is dropped. A wrapped line that
506. happens to start with `12. ` is taken as a list item (same as Markdown).
508. ## 2026-09-24 — ticket #10 (mission 002): strict API, Vienna time, paragraph import — awaiting creator
510. Done (worker, not yet confirmed by the creator):
511. - **Strict API** (`bodyError` in `api.hl`): every POST body must be a JSON object; unknown
512. field / missing or empty required field / non-string value → 400 `{ error, field }`,
513. nothing written. Semantic refusals (state, project name) carry `field` too. `POST /api/projects` → 405.
514. - **Local time**: all shown times (pages + API `created`/`updated`/`when`) are Europe/Vienna
515. (`localtime.hl`, userland EU DST rule — hl:time has no time zones). Storage stays epoch ms.
516. - **Import**: `ticketfile.hl` joins hard-wrapped lines, blank line = new paragraph (`\n\n`).
517. - **One-off data fix** 2026-09-24 00:11: `tools/fix-import-summaries.hl` rewrote only `summary`
518. of #1–#5 (server stopped, backup `.scratch/storage-backup-20260924-001142`). Ids, states,
519. `updatedMs`, events unchanged — compared API dumps `.scratch/{before,after}-full-20260924-001142.json`.
520. - Gate: `node tests/browser.mjs` → **93 passed, 0 failed** (2026-09-24, run in a copy before deploy).
522. Known gaps: invalid JSON → 500 (no way to catch `JSON.parse` in Hybriel; nothing written).
523. `author` stays optional (defaults to `anonymous`). Vienna rule is correct from 1996 on only.
525. Running: dev server on :8350, PID in `server.pid`, log `server.log`, data `storage/mpackdb/`.
527. ## 2026-09-23 — MVP (AntColony ticket 0001, mission 001)
529. Done (worker, not yet confirmed by the creator):
530. - Data: projects, tickets (id, project, subject, summary, state, source, created, updated),
531. append-only events (created / comment / state, free-text `author`). Six states.
532. - Pages `/`, filters `/project/:p`, `/state/:s`, both; `/tickets/:id`; `/inbox`; new-ticket form.
533. - Live push of comments / state changes / new tickets to every open browser (web AND API writes).
534. - JSON API (list/get/create/comment/state/projects), import command (idempotent by file name).
535. - Dark WorldAPI tokens, accent #c586c0, danger #f44747; works at 390px and 1280px.
536. - Gate then: 57 passed.
538. ## How to verify
540. ```bash
541. cd /media/STORAGE/projects/tickets.worldapi.org
542. node tests/browser.mjs # the gate (see README "Test")
543. node tests/connect.mjs # the connect gate (ports: README "Vendored Hybriel" / a temp copy)
544. # a refactor: tests/realdata-baseline.mjs old vs new + tests/realdata-compare*.py (README "Test" → "Same output")
545. python3 tests/letcount.py . # code order: root .hl files, project.hl lines, misused let
546. ps -eo pid,args | grep [h]l-browser-tier # must print nothing afterwards
547. curl -s http://127.0.0.1:8350/api/tickets | jq '.tickets[] | {project, ref, oldNumber, state, subject}'
548. curl -s -XPOST -d '{"text":"x","bogus":"1"}' http://127.0.0.1:8350/api/tickets/1/comments # → 400 naming bogus (nothing written)
549. curl -s -XPOST -d '{bad' http://127.0.0.1:8350/api/tickets/1/comments # → 400 invalid JSON at character 1
550. curl -si http://127.0.0.1:8350/tickets/38 | grep Location # → /projects/tickets.worldapi.org/5
551. node .scratch/checklive.mjs # read-only real-Chrome look at :8350: list/history times == Intl Vienna, #1/#2 summaries one paragraph
552. ```
553. Then open http://192.168.178.75:8350 in two browsers, comment in one, watch the other.
555. ## Open / next
557. - ~~No users~~ — done by ticket #7 (mission 005 (old 011)): creator-only confirm/reject via TICKETS_CREATOR_IDENTITY.
558. - Not deployed (Byrodin container, nginx vhost, DNS) — out of MVP scope.
559. - Project filter chips / datalist of a list page do not grow live when a NEW project appears
560. (a reload shows it); ticket rows do.
561. - No delete of tickets or comments; comments cannot be edited (only subject + summary, ticket #8).
562. - Keywords in comments (`/confirm`, `/reject`, …) are the scheduler's job, not implemented here.
563. - Hybriel limits met (worked around): no time zones in hl:time (localtime.hl), no catch for
564. JSON.parse (jsoncheck.hl → 400), JSON.parse refuses \u surrogate escapes, no list `concat()` (NotCallable), no string escapes ("\r" is 2 chars).
565. - Older Hybriel limits met (worked around): no string ordering / no list `sort()` (import sorts by
566. char codes). (mpackdb `*id` from 0 no longer matters: UUID keys since #38.)
568. ## Lessons
570. - (mission 010) A plain declaration (`x = 1`, no `let`) is a CONSTANT: inside a for/while body Hybriel refuses it on the
571. 2nd pass ("Cannot reassign immutable variable") — a variable declared in a loop body keeps `let`. A constant can still be
572. mutated (`out.push`, `o.k = v`). Inside a component, `x = …` in a handler assigns the MEMBER `x` if there is one.
573. - (mission 010) A hybrid that holds an instance (the request with `req.session`) keeps the handle through ONE call, but
574. copied into a SECOND call the instance is copied too: writes to the session were lost (the gate's logins failed).
575. `/login/callback` therefore gets `&req` and `&server.sessions` from project.hl. Instances as call arguments are copied
576. anyway — pass `&` when the callee must change the original.
577. - (mission 010) Imports must not form a cycle ("Cyclic member import"): lib/ imports only downwards (README "Files").
578. - (mission 011) hl:web APPENDS its own routes (`/__hl/…`, `/components/<file>.hl` modules) to the app's table during
579. `new WebFramework(…)`, and the first match answers: a catch-all like `/:slug/:number` anywhere in the app's table eats
580. them (the page answered /__hl/app.css with HTML). Fix in project.hl: move such routes to the end of `server.router.routes`
581. after the construction; keep them IN the table, or hl:web serves no module for their component (a component only
582. mounted by a route added later had none: `/components/ticket.hl` → HTML). Upstream: hl:web should match its own urls first.
583. - (mission 011) `setsid cmd &` started from a `( … )` subshell forks: `$!` is not the server's PID (a stale server kept
584. the port and the next run silently talked to it). Start test servers as `(… exec ./bin/hybriel …) &` and check the
585. port is free afterwards (`ss -ltn`).
586. - (mission 010) An HTML page's seed carries source positions (`site`, `Markdown@135:54` mount keys): moving lines changes
587. the bytes without changing the output — tests/realdata-compare.py masks them.
589. - (mission 006 (old 012)) hl:webex re-creates elements of a View when an `if` block before/around them
590. flips — including `script { src }`: the browser EXECUTES a re-inserted script again, and custom
591. elements lose their internal state (the selector forgets the chosen name). A plain script in a
592. View must be idempotent (guard per document) and must not hold element references.
594. - (mission 005 (old 011)) A called function's PARAMETER NAMED LIKE AN ENTRY of the object literal it is
595. called from reads that entry: `{ id = e.id author = nameOfUser(e.user) }` with
596. `nameOfUser = (id) => …` got the EVENT's id. Compute such calls before the literal, avoid
597. parameter names like `id` (Hybriel issue reported in mission 005 (old 011)).
598. - (mission 005 (old 011)) hl:mpackdb `update(key, rec)` on an `@id` table with a record WITHOUT `id`
599. stores it without the key: `fetch(key)` is null afterwards (the unique index still finds it)
600. and the next update fails `CorruptRecord`. Always pass the whole record with `id`.
601. - (mission 005 (old 011)) hl:webex cannot listen to a custom DOM event (`ident-login`): a plain script
602. (`login.js`) writes the value into a hidden input and fires `change`.
603. - (mission 005 (old 011)) A failed hl:fetch (connection refused) is an `Error` event; only a root
604. `on Error(e)` in the ENTRY file (project.hl) absorbs it — one in the imported users.hl did not.
605. - (mission 005 (old 011)) hl:webex ships every component member AND `session.user` to the browser:
606. keep the identity id out of members and out of the session (only on /you, on purpose).
607. - (mission 005 (old 011)) `rsync --exclude 'server.*'` also drops `plugins/*/server.hl` — anchor it (`/server.*`).
609. - Hybriel resolves RELATIVE file paths (mpackdb too) against the ENTRY SCRIPT's directory,
610. not the cwd: a tool in `tools/` must get an absolute `TICKETS_STORAGE`.
611. - Saving a `.hl` file reloads the running dev server (watcher): develop in a copy
612. (`.scratch/dev`, gate there), stop the server, then copy files in.
613. - `JSON.parse` of a JSON array gives a Hybrid with `.length`; of an object `.length` is null.
614. - A function route's request has `req.query` (parsed object); `req.path` carries NO query string.
615. - `emit client …` inside a function route (API) works: with an `audience` entry it fans out to
616. every admitted connection that has a listener mounted.
617. - A selector group in `styles.hl` must be ONE quoted key (`'input,\ntextarea' { … }`); a bare
618. `input, textarea` is a parse error.
619. - Function PARAMETERS are immutable in Hybriel (`i = i + 1` on a param is a runtime error):
620. copy into a `let` first (jsoncheck.hl).
621. - `google-chrome` is not on PATH on Loreana; the gate uses `/opt/google/chrome/chrome`.
622. - Opening an hl:mpackdb table REWRITES its index/meta files (`*.txt`, `*.meta.json`,
623. `*.idxstate.json`) even with `compact = false`; only `.mpack` stays. Migrate from a COPY
624. when the originals must stay byte-identical (deploy-008.sh does).
625. - mpackdb `@id` keys are 12-char strings (`0mufbphip3w7`); a missing indexed field is fine
626. (`*oldNumber` on new tickets); `!path` unique index refuses duplicate numbers.
627. - A non-literal `static` in project.hl reads null in function routes (hybriel #16): API helpers
628. in project.hl are plain members, not statics.
630. ## 2026-09-24 — DEPLOYED (architect)
631. - LIVE is now https://tickets.worldapi.org on Byrodin (/CONTAINERS/projects/tickets.worldapi.org). The live data was moved there.
632. - This Loreana folder is DEVELOPMENT only; its storage/ is a stale copy. Dev servers were stopped. Update live with ./deploy.sh.
634. ## 2026-09-24 — ticket #16: tidy relations block out of the edit handlers — awaiting creator
636. Done (worker, not yet confirmed by the creator):
637. - `components/ticket.hl`: the relations init block (`rel`, `hasRelations`, `hasParent`, …,
638. `parentDraft`, `blockerDraft`, `linkMessage` — 16 lines) had been pasted verbatim into
639. `startEdit`, `cancelEdit` and `saveEdit` too (ticket #4 code landing inside the ticket #8 edit
640. handlers). Removed the three copies; the component's own init block (still there) is the only
641. place that sets them. No behaviour change intended — clicking Edit/Cancel/Save no longer resets
642. `parentDraft`/`blockerDraft`/`linkMessage` mid-edit, which was a side effect of the paste, not a
643. feature. 489 → 441 lines.
644. - Gate: `node tests/browser.mjs` → **418 passed, 0 failed**, run on this folder with
645. `TICKETS_GATE_PORT=8700 TICKETS_GATE_IDENT_PORT=8701 TICKETS_GATE_EXCHANGE_PORT=8702
646. TICKETS_GATE_CHROME_A=8703-8704 TICKETS_GATE_CHROME_B=8705-8706` (own storage in
647. `.scratch/gate-store`, own ident, no live data touched). Includes the full #4 relations suite
648. and #8 edit suite, both still green.
649. - Not deployed (deploy.sh is the architect's job).
651. Test: gate above, then open a ticket with relations on the live site and click Edit — the
652. relations panel keeps showing normally, editing subject/summary still works.