Timeline

The description form got a Save/Saved swap; the other panels still said nothing at all. Worse, three of them redirected to ?saved=1, which had quietly stopped meaning anything when the flash cookie replaced it — a regression I left behind an hour ago. Six exit paths across five handlers were still writing it.

They all set a named flash now. The name matters: a page carries six Save buttons, and a bare boolean would light every one of them for a single save, telling the reader that everything was written when one thing was.

Green comes from --add, the token that already marks a passing run and an open glyph, so 'it worked' is one colour across the forge.

Webhooks is deliberately untouched: it is a LIST with Save, Pause and Delete per row, so lighting 'the' Save would need to know which row. Different shape, not this pattern.

The visibility test pinned ?saved=1; it now asserts the flash, which is the contract rather than the spelling of a mechanism. check-in: 2f0c4fcb50 user: dmestas tags: trunk

The inline word had to appear and then leave, which is two layout shifts around the control just pressed. On the button there are none: both labels share one grid cell, so it is sized by the wider of them and nothing moves when they swap.

The revert is CSS on the same four-second beat, because without script the label must still find its way back to Save. The announcement stays — sr-only, role=status — since a screen reader cannot read a button relabelling itself as an event. Reduced motion keeps the word and drops the movement. check-in: d28f1388fe user: dmestas tags: trunk

Three faults in one paragraph. It never left: a confirmation is an EVENT, and rendering it as page content claims the page CONTAINS the fact of having been saved, which is only true for a moment. A reload replayed it: ?saved=1 stays in the address bar, so a refresh — or a bookmark — congratulated the reader for a save from hours ago. And it shifted the layout under the button just pressed.

A one-shot cookie now carries the word across the redirect and is spent on arrival, so the URL stays clean and the second render is silent. The lifetime is CSS: it holds four seconds, then fades AND collapses, so no empty paragraph is left behind. Not script — this page must behave the same without JavaScript, and an animation costs nothing when the script is absent. role=status announces it on insert, before any of that runs.

Reduced motion keeps the message and drops the animation: someone asking for less movement is not asking to be told less. check-in: 563eb933dd user: dmestas tags: trunk

The form keeps its method and action, so without the script it posts and redirects exactly as before — the data-on:submit attribute is inert (0001 Principle 3). With the script it posts to the SAME endpoint, which answers a Datastar-Request with a patch of the panel instead of a page: the same discrimination the board's move already uses.

The panel is one template block, drawn by the page and re-drawn by the save, so the two cannot drift — the fault this page had an hour ago. Its 'Saved.' now sits beside the control that saved, not at the top of a page the reader has scrolled away from, and the refusal travels with the panel as PanelError rather than as the page-wide Error.

The URL is deliberately left alone on the patched path. ?saved=1 exists to carry a word across a navigation; there is no navigation here, and putting it in the address bar would make a later reload announce a save that already happened. check-in: bbd1663825 user: dmestas tags: trunk

The description form rendered the settings page from seven fields of its own while the GET built a dozen panels, so Save returned a page with everything below the form gone — and a stray h1, because the POST also missed HideH1. Two symptoms, one cause: the same page assembled in two places.

There is one builder now, and the successful save REDIRECTS, as every other settings POST already did. That leaves the saved state in one place, so the two cannot disagree again and a reload does not re-submit. The refusal path still comes back holding what the reader typed — now over the whole page rather than a fragment of it.

Verified: after a save the page is byte-equivalent to the GET but for the Saved flash, with all nine panels present. check-in: d2368f6a92 user: dmestas tags: trunk

Squeezed on a phone, the tracker's state filter dropped its last choice onto a line of its own — '99 All' under '30 Open | 69 Closed' — which reads as a stray button rather than as part of the set. The control now keeps its line whole and comes first, because it is how a reader says what they are looking at; the tool groups beside it wrap instead.

The landings list is unchanged: one icon fits beside its filter, so that row still holds one line. check-in: 87f42420b7 user: dmestas tags: trunk

A row whose title is the whole message ran fifteen lines down a phone and pushed every other record off the screen. Clipped at the same 72 the timeline uses for this exact string, so the two listings agree on how long a landing's name is.

The marks come off too: a title is plain text inside the row's link, so *emphasis* and `code` were printing their delimiters. The detail page still renders the message in full, with its markup — a list says what a record is called, not what it says. check-in: f2d73a8545 user: dmestas tags: trunk

The h1 had no rule at all, so it drew at the browser's 2em on every screen. A real subject line then became three lines of shouting on a phone, which made clipping look necessary — it was not. The clip only hid words: 'permissions without a…' with the rest nowhere. Headings now clamp between 1.35rem and 2rem and wrap, so a long one fits and says the whole thing. The pathological case — no subject line at all, the title IS the body — already drops the visible heading, so nothing depends on the clip any more.

The decision row gains a second step at 22rem: measured at 320, five abbreviated buttons want 364px against 302 of room, and Comment is the widest word left. It has an icon and destroys nothing, so it is the one that loses its label. 'Land the strata (N rungs)' is now 'Land strata (N)' at every width — it was too many words wide as well as narrow.

The strata test pinned that sentence, so a wording change read as a missing control. It now asserts the formaction, which is the contract, and the rung count rather than the sentence around it. check-in: 6469f151c4 user: dmestas tags: trunk

The row grew from three verbs to five as landings learned to update and to land a whole strata. Flex items shrink before they overflow, so on a phone every label folded to three lines AND the leftmost button still ran off the side.

flex:none and nowrap keep each button one line at its own width; below 30rem the labels shorten — Update, Accept, Land x2 — so all five fit without the row breaking. The long forms stay on wider screens.

Reject keeps its word at every width: there is no X in the sprite, and an unlabelled destructive control is worse than a cramped one. check-in: 87482c870f user: dmestas tags: trunk

Two faults from one cause. A message written with no blank line has no prose under the header at all — zit put the whole thing in the title card. So clipping the heading dropped 290 of 362 characters with nowhere left to read them, and the record rendered no description. The opener now falls back to the title, rendered like any other body, which is also the only way its Markdown ever reaches a reader.

The heading drops the marks instead: an h1 is plain text, so *emphasis* arrived as literal asterisks and read as a rendering bug. Asterisks and backticks only — _x_ in prose and my_file_name in a path are the same three characters, and mangling every identifier to italicise a rare one is the worse trade. check-in: db743a90a0 user: dmestas tags: trunk

zit puts the entire -m message in the record's title card, so a message written without a subject line arrives as one 400-character 'line' that firstLine returns whole — an h1 that fills a phone screen before the record says anything about itself.

Clipped at the same 72 the timeline already uses for this exact string, so the two agree on what a landing is called. Nothing is lost: the opener's full text renders immediately below as the description. check-in: ff1cfd1aa9 user: dmestas tags: trunk

Current with the segment below, now landed. closed check-in: a50a6dee00 user: dmestas tags: url-sync-doctabs

Keeps the segment current with the landing.update work before it lands. closed check-in: 645b11cd8a user: dmestas tags: url-sync-helper

Files, Timeline, Tickets, Docs, Landings, Forum, CI, Chat — and Repositories/People on the home tabs. CI is spelled, not capitalised: a text-transform would have rendered it Ci.

navlink matches the active tab on its section argument, so the label was only ever display text. check-in: 5a07f20dd6 user: dmestas tags: trunk

Switching README to LICENSE swapped the panel and left the address bar behind, so the tab on screen was unlinkable and a reload dropped you back on README — even though /r/REPO?doc=LICENSE has always been a real route, and the anchor was already carrying it as its href.

Moves the tabs onto syncurl, which corrects the address bar to that same href before fetching the fragment. check-in: c2775268a4 user: dmestas tags: url-sync-doctabs

The diff toggle carried the replaceState handler as literal text in two attributes, with the reasoning in a comment above them. Both move onto a syncurl helper, so the next surface that needs it gets the try/catch and the replaceState-not-pushState choice for free instead of by copy-paste. Emitted markup is unchanged.

The helper neutralizes quotes in the fragment URL: it lands inside a JS string inside an attribute built as HTMLAttr, where escaping is off. check-in: 058a2216c9 user: dmestas tags: url-sync-helper

The open queue folds a stack under its base: a strata mark, the segment count, the landable end named, and the rungs in a details element with 1/N badges — no script. Settled views stay flat; a settled segment has left its chain.

The record page draws the map: every rung bottom-up, this one marked, the landable one named, a rejected base as a broken rung. Above the bottom the accept control is disabled and says the segment below lands first.

Proved with a real zit: two stacked landings count one decision; the top rung's accept is refused; accepting the base retargets the next onto trunk and it becomes the landable end, still one decision. closed check-in: 02f6aadcad user: dmestas tags: strata-ui

AttachStrata reads the chain from target -> branch across landings: base, position, depth, and why a chain cannot be walked — a cycle, or a rejected base. Derived at read time, never stored, so a segment retargeted by zit#144 after its base lands simply stops being one.

landing.list carries the reading and counts DECISIONS: a stack of five is one, the base's, because nothing above it can be acted on. landing.get carries the chain for the record's map and reports a rung above the bottom as stacked, which the merge probe must not overwrite: its answer is true and useless there. check-in: 3e3ad17751 user: dmestas tags: strata-ui

An artifact with no N card IS fossil wiki — fossil's default, and what anything writing through the zit CLI produces. fossilInline resolved this dialect's own [target] links, but @mentions, [[wiki]] refs and bare hash refs are dialect-independent and were reaching only markdown bodies, so 62 of quarry's own 90 forum posts lost every mention in them.

The two passes run after sanitizing, as they do in Render: resolveRefs mints the identity mark and the policy would strip it. It parses HTML and skips a/code/pre, so the anchors fossilInline just built and every

 block are left alone — both asserted.

check-in: b00045e163 user: dmestas tags: trunk

The tab already says landings and the page's first line is the state chips; the heading said the same word a third time.

RFC 0006 gains the rendering proposal it deferred, written after this forge's first real strata listed as five independent open landings. Grounded in what GitHub (native stacks, July 2026), Gerrit (relation chain, submit whole topic) and Graphite do: a position on every member, a map on the record, one action at the landable end. quarry groups in the list because its list is a queue and a queue that shows five rows for one decision counts wrong. closed check-in: 3693d77992 user: dmestas tags: protect-6

Every row of the RFC's table, the way a person or a client would do it: the forge's accept through the API as owner and non-owner; a clone's accept pushed through the sync gate, refused whole with the branch named, then admitted for the owner with no reply posted; a stock fossil client's merge refused; branching off trunk and pushing to an unprotected branch admitted; a forged accepted reply recorded as a claim. A branch continued past its merge stays accepted.

Compatibility and disposability as the RFC states them: a clone's artifacts are identical with the row present or absent, and the record renders identically before and after the row, and across the section-11 wipe.

The disabled control with its reason is proved in the web package, where a viewer has an identity — and proving it found the landing page asking MayLand about nobody: the viewer now travels with the read. Three rows are proved elsewhere and named in the file so the matrix reads complete. closed check-in: 2a68c15ebf user: dmestas tags: protect-5

Protected branches beside capabilities on the repository settings page: a branch or glob per row, owners as logins, every matching rule applies, blank the owners to remove one. The form rebuilds the stored set, so a renamed row is a delete and a write.

The cost is stated where the rule is set, because both things it changes surprise someone who knows fossil: on this forge i means less than it means in fossil, and a stock client can be refused a push its capability string says it may make. Policy of this forge, outside the repository; a clone is byte-identical to an unprotected one.

The section is not drawn on a forge with no policy store. closed check-in: 0d3bcdd784 user: dmestas tags: protect-4

The fold reads accepted from the DAG, for every landing: the earliest target check-in after opening whose non-primary parent is on the proposed branch. A reply asserting acceptance with nothing merged leaves the record open and is recorded as a claim; the page says so, the timeline files it as conversation. Rejection has no DAG fact and stays the reply's to say. Re-derived after every branch recompute — which now also invalidates the count memo, since it can settle a landing — so a merge pushed from a clone with no reply settles.

landing.accept refuses a non-owner on a protected target before writing, naming the owners. landing.get reports MayLand beside CanAccept so the page shows a disabled control with the reason.

Fourteen existing tests settled records by reply alone, or asserted a by-hand merge does not count; each now carries the merge it announces or asserts the RFC's reading. Giving the web fixture real check-ins exposed checkin.diff dereferencing a nil store; it now refuses, after the lookups so not-found still wins. closed check-in: 4832508615 user: dmestas tags: protect-3

The verified login — never the U card — becomes the per-request X-Zit-Protect the --fronted child enforces: the globs this pusher does not own, comma-separated as zit's glob lists are.

Sent on EVERY request, empty when nothing is refused. zit#151 reads an absent header as no rule, so absence is exactly what a forgotten code path would produce; here it cannot happen, and a test proves it against a fake child. The proxy builds a fresh request, so a client's header with that name never reaches the child. A rule source that cannot answer fails the push closed.

End to end with a real zit: a non-owner's push to trunk is refused with the branch named; the owner's identical push lands. closed check-in: daa9fc84b5 user: dmestas tags: protect-2

The first test called DeleteRepo, which drops the repo row and leaves per-repository state to PurgeRepo — the cascade the rule was added to. Committed red because the run gating it used a regex that matched no test; caught by the suite. closed check-in: f30535d269 user: dmestas tags: protect-1