Timeline

See the wiki page [Selected states] for the states and the reasoning. check-in: baecdf8460 user: quarry tags: trunk

quarry served no page policy at all. The blocker was never the data-on:* attributes — script-src does not govern data attributes — it was unsafe-eval, because datastar compiled expressions with Function(). 1.0.3 takes a nonce instead.

Removed all 14 inline handlers: 11 identical onchange=this.form.submit() became data-on:change with requestSubmit (which validates, unlike submit), two selection handlers became expressions, and the copy-hash button moved to a delegated assets/copy.js. Scripts now carry content-hashed immutable URLs instead of revalidating daily.

The audit found the expressions already safe, for a reason worth pinning: html/template strips a data- prefix before classifying, so data-on:drop gets the JAVASCRIPT escaper. That matters because an HTML-escaped quote decodes back to a quote before any script reads the attribute, and a board column status comes from .quarry/tickets.json — upstream content on a mirror. check-in: ef352402f6 user: quarry tags: trunk

A release candidate was shipping in production. No breaking changes across the three patch releases; two fix things quarry leans on — select signal typing and dynamic multiple (the ticket sidebar and board are native selects) — and 1.0.3 adds the CSP mode that would let the forge drop unsafe-eval. check-in: e13cb74667 user: quarry tags: trunk

Nothing was compressed: a request carrying Accept-Encoding got byte-identical bytes back. Measured here, the timeline page is 309,584 to 36,599 (88%), a ticket list 84%, a highlighted source page 92%.

gzip rather than brotli deliberately — brotli q5 beat gzip 6 on both size and time, but that is a dependency for ~7% on a page already 88% smaller. SSE is excluded by content type: 22 stream writers, and a buffered stream is a live update that never arrives. check-in: d598ecafa3 user: quarry tags: trunk

112,118 bytes of <style> rode on every response — 40% of a 309,584-byte timeline page, byte-identical each time and uncacheable because it had no URL, while the JS assets already carried Cache-Control. Now one hashed asset served immutable: a rule change mints a new URL, so a stale cache is impossible without anyone revalidating. check-in: eb4793ee8e user: quarry tags: trunk

The multiplication sign in 'zit 34.1ms×2' never matched a byte compare, so the duration parsed as zero and the store note appeared beside an identical zit figure — claiming a wait already accounted for. check-in: 433a022052 user: quarry tags: trunk

A call on context.Background() carries no timer, so a page blocking six seconds on a warm pass reported 'ops 11.09s, zit 32.9ms' — and the ops panel's claim that ops minus zit is index work was false while it did. Overlap catches what attribution misses: subprocess busy time inside the render window, unioned, reported only when it exceeds what was already attributed. check-in: 17454ef71f user: quarry tags: trunk