1b6635a1

test: the page's badge vocabulary and the attach it gates

a73x 2026-08-26 12:13

Commit message

test: the page's badge vocabulary and the attach it gates

Every rule in the terminal-status region was found by driving Chrome by
hand and none of it was pinned: deleting sendAttach's `exited` gate,
emptying TERMINAL, or renaming the refusal badge all left verify.js at
781 passed, 0 failed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

web/verify.js

@@ @@ -2552,6 +2552,76 @@ async function verifySelectionShell(shell, html) { @@
+  check('failed destructive reset also clears orphaned scroll request', failedResetPaint.tile.scrollRequest, null);
+// The terminal-status region: which badge stops a tile re-attaching, and
+// the two words the hub and the page agree on. Nothing on the wire can
+// see any of it — wsclient attaches 0x0 and renders no badge — so this
+// shell is the gate, and a real browser is the gate for pixels and keys.
+async function verifyStatusShell(shell) {
+  const h = browserShell(shell);
+  const wall = h.document.createElement('div');
+  // ENV_FRAME/ENV_CONTROL and the exit_status opcode, spelled as the
+  // browser receives them: mux.js reads these bytes off a WebSocket, so a
+  // fixture that called its constants instead would pin nothing.
+  const exitStatus = (code) => Uint8Array.from([0x00, 0x82, 1, 0, 0, 0, code]);
+  const control = (state) =>
+    Uint8Array.from([0x01, ...new TextEncoder().encode(JSON.stringify({ state }))]);
+  const makeTile = () => {
+    const tile = new h.Tile(9, 'status fixture', wall, '');
+    tile.core = {
+      memory: { buffer: new ArrayBuffer(64) },
+      mux_attach_payload: () => 20,
+      mux_output_ptr: () => 0,
+      mux_output_len: () => 20,
+    };
+    const sent = [];
+    tile.sendFrame = (type) => { sent.push(type); return true; };
+    tile.reflow = () => {};
+    return { tile, sent };
+  };
+  // --- the badge vocabulary, which webhub.zig's restore rule reads back ---
+  const refusal = makeTile();
+  refusal.tile.onMessage(exitStatus(0));
+  check('a refusal before any grid badges refused', refusal.tile.status, 'refused');
+  check('the refusal badge names no reason the daemon never gave', refusal.tile.statusText, 'refused');
+  const ending = makeTile();
+  ending.tile.gotState = true;
+  ending.tile.onMessage(exitStatus(3));
+  check('an exit after a grid badges exited', ending.tile.status, 'exited');
+  check('the exit badge carries the code', ending.tile.statusText, 'exited 3');
+  // --- what each badge does to the next attach ---
+  const exited = makeTile();
+  exited.tile.gotState = true;
+  exited.tile.onMessage(exitStatus(0));
+  exited.tile.zoomed = true; // a sized attach CREATES: the dangerous one
+  exited.tile.sendAttach(false);
+  check('a session the user ended is not re-attached', exited.sent.length, 0);
+  // The restore heal IS a refusal followed by a re-attach: the hub births
+  // the session and re-dials, and this attach is what lands on it. Gate
+  // the whole TERMINAL set and the browser wall stays dead after a daemon
+  // restart.
+  const refused = makeTile();
+  refused.tile.onMessage(exitStatus(0));
+  refused.tile.sendAttach(false);
+  check('a refused tile keeps re-attaching', refused.sent.length, 1);
+  // --- the precedence the gate rests on ---
+  const narrated = makeTile();
+  narrated.tile.gotState = true;
+  narrated.tile.onMessage(exitStatus(0));
+  narrated.tile.onMessage(control('up'));
+  check('link news cannot clear exited', narrated.tile.status, 'exited');
+  check('and the up it rode in on sends no attach', narrated.sent.length, 0);
+}
+// --- wire builders (layouts golden-pinned in protocol.zig) ---
+function snapshotPayload({ seq, history, cols, rows, epoch }, state) {
+  const stateBytes = Buffer.from(state, 'utf8');
@@ @@ -3249,6 +3319,7 @@ async function main() { @@
+  await verifyClipboardShell(shell, html);
+  await verifySelectionShell(shell, html);
+  await verifySettingsShell(shell, html);
+  await verifyStatusShell(shell);
+  // Mutation fixture for the source checks below. A correct-looking route
+  // in either kind of comment must be invisible, while live literal