Closes the review of 11ba7bff4 (deployment/cloud/atomic-pull.mjs, vite.cloud.config.mjs; Vite 5.4.21).
- The gate now opens the moment git takes <git dir>/index.lock (fs.watch on the git dir, a 50 ms poll if that
watch cannot be set up), before git's first write, and stays open while the lock exists: `git reset --hard`
writes every file, public/ included (which Vite does not watch), inside that window. File events (and raw
kernel notifications) still extend it, and still open it for any other writer. A lock that comes and goes with
no file event (`git status`, as the dev plugin's /__dev-sha runs) closes it at once.
- What the container writes for itself under /app/repo leaves the watcher (server.watch.ignored in the overlay,
appended to the repo's public/ by mergeConfig): .pb/ (backend logs and data), backend/bin/ (the engine
binary), backend/pocketbase/pb_migrations/ (what PocketBase dev writes from its dashboard). They held pages
before; a landing that changes them is still gated by the lock.
- At closing only the touched files' modules are invalidated (from the file events, plus `git diff` between
HEAD before the lock and HEAD after when git moved it), so unchanged modules keep their transform and answer
304. The gate's log line names the git range and file count.
- With a restart waiting, the held requests (and any that arrive until this server closes) are answered
503 + Retry-After: 1, not passed into the closing server (504). A page gets a small page that reloads itself
once the server answers again.
- One startup line: "[atomic-pull] armed: quiet 1200 ms, cap 10000 ms, git-lock watch on".
- The cap (ATOMIC_CEILING_MS) defaults to 10000: no browser is held longer, and it still gets its one reload.
Measured on the scratch Vite 5.4.21 project under the worktree's own overlay (paths changed), with a page of 50
modules and 80 public files in a browser: 52/52 checks pass. The earlier cases (bursts, a request mid-burst, a
single edit, a broken-then-fixed module with and without a page, a config restart and a failed one, the ceiling)
plus: a git landing of 392 files (80 under public/) where requests sent at the lock are held until git lets go
and answered new, one reload, every module and public file new after it; a .pb/ + backend/bin/ + pb_migrations/
writer every 250 ms holds nothing (slowest request 17 ms); `git status` every 300 ms holds nothing; the 10 s cap
with a never-ending writer and with a stale index.lock; the startup line once per server start; a restart
mid-burst answering 503 + Retry-After: 1 and one reload on the new server. Against 11ba7bff4 the same landing
served a public bundle and a module OLD while git wrote, and the same server writer held a request 19.8 s.
The pull loop (entry.sh) runs `git reset --hard` straight into the tree Vite watches. A landing rewrites
hundreds of files one by one, and Vite answered the first of them while git was still writing the rest:
an open page was reloaded onto a mix of old and new modules, and its tab clicks then fetched nothing until
it was reloaded by hand.
deployment/cloud/atomic-pull.mjs, added to the cloud overlay only (local dev, builds and entry.sh are
unchanged; Vite restarts itself once when this config lands). The first file event opens a gate that
closes once the tree has been quiet for ATOMIC_QUIET_MS (1200), never past ATOMIC_CEILING_MS (20000,
under oauth2-proxy's 30 s upstream timeout). While it is open it holds the messages to the browsers
(update, full-reload, prune, error: at ws.send, which Vite 5's server.hot broadcasts through and which IS
environments.client.hot in Vite 6/7), every request except the backend routes (a middleware registered
ahead of all others), and a config restart. When it closes: invalidate the module graph, release the
requests, then exactly ONE full-reload (or the held restart). A held error is dropped, so none is buffered
for the next browser. Past the ceiling it passes everything through until the tree is quiet.
ATOMIC_QUIET_MS=0 or PULL_INTERVAL=0 turns it off.
Measured on a scratch Vite 5.4.21 project (the version bun.lock pins) under a copy of this overlay, with a
page of 50 modules in a browser: one `git reset --hard` of 312 files sent the page 27 full-reloads and
25 updates without the plugin, and exactly 1 full-reload with every module new with it. Bursts, a
request mid-burst, a single edit, a broken-then-fixed module (page open and no page open), a config
restart (and a failed one) and the ceiling: 27/27 checks pass.
check:dev-leaf-escape and its self-test join gates:pre. The comment on the
dev pages' owner rule named the wrong reason for leaving a framed page
unowned: the frame is a partner page that iframes a leaf (the iframe
embed). Plugin Studio mounts its rows directly.
The precondition's scope against the pilot (its own step-4 rule): every bundle
that imports ShareButton/MapControlMenu or reads the share catalogue area, plus
the P1 shells. Built one bundle at a time, then bun run tree + fix:sri.
gates:pre 141/0/1, gates:post 99/0/16.
pageLink() drops ?tk= from the page's address: a leaf page reads a token from
there and leaves it in place, so pressing Share would have sent it. The URL is
rewritten only when tk is present; every other link is the address as it stands.
The comments name the page, not who measured it, and no longer cite a request.
check:map-menu-anchor strips a same-line comment before testing each return, so
a fallback named only in a comment no longer passes.
The dev leaf route wrote the URL's parts into the page's <title> and the
element's profile-config attribute, refusing only .. and /. A quote or a
tag in a crafted link broke out of the attribute on a publicly reachable
dev server. Each part must now have the shape every bundle, profile and
instance id has, before it reaches either; the title is escaped too.
check:dev-leaf-escape drives the plugin's own middleware: every leaf the
dev manifest advertises is still served in both URL forms, hostile parts
are refused in every position, and the title escapes on its own.
ShareButton: the first tab is "Share this page", the link to exactly what the
reader is looking at. Where the page owns its address (urlOwner 'app' or 'host',
on the map's own profile-config or any element above it across shadow roots)
that is the page's own URL, read at open and at copy; on a partner's page it is
the map's own page, as before. The second tab, "Embed", says in plain words what
embedding is and why it helps, keeps the buttons.shareSteps list, then the paste
hint, the sizes and the code. Copy/sizes labels come from the catalogue.
MapControlMenu: a standalone anchor (a Share button outside any map toolbar)
resolves where its menu lives when it opens, and places it below the button,
toward the side with room, inside the viewport, at the readable width (340 or the
viewport minus its edges), converting into the menu's real containing block. The
render-time area tag that sent header menus far left and narrow is gone. Map
toolbars keep their placement unchanged.
English only for now (the new share.json keys are recorded as translation debt in
check:i18n-parity). check:map-menu-anchor reads a resolution that lives in a named
function, every named-area return must keep its structural fallback.
The dev pages passed no urlOwner, so on the dev server a shell read ?tab=
but never wrote it: a clicked tab was lost on reload and a copied link
opened the first tab. The root page, every /__leaf/ page and the Studio
staging page now own the address, as the built leaves do. A framed leaf
(Studio iframes its map rows) stays unowned, so it never adds entries
to the top page's Back stack.
The dev server serves plugin-designs/doxa-maps-spa/index.html as-is, with no
profile-config, so the shell read ?tab= there but never wrote it. The page is
ours: it now passes urlOwner 'app'. A partner's page still leaves it out.
The staging page the dev server serves sets profile-config urlOwner 'app', so on
the dev server the shell writes the open tab to ?tab=: a reload keeps it and a
copied link opens it. Inside the Plugin Studio, Posterverse is nested and still
writes nothing (the Studio owns the address there).
The merged posterDesign blocks brought biblePosters.posterDesign.label and
upgMap.posterDesignTerritory, catalogue areas these two bundles ship, so
their committed bytes were stale against the merged source. Rebuilt only;
no source edit.
The first-paint write is skipped when the address names a tab the shell
doesn't know yet (a row that only resolves once the manifest is in). Writing
tab 0 there would replace the link before applyManifest could honour it;
applyManifest's own first-paint replace writes the honoured tab.
Plugin Studio read its tab from #<bundle/profile> or from localStorage, and
never wrote it, so a reload worked for one reader but a sent link did not. It
now writes the view address through useViewAddress: ?tab=<bundle>__<profile>
(a row key's "/" is not a plain id; the double underscore keeps a sent link
meaning one row even if another bundle later adopts the profile's name). A
reader's tab click is a push, the first paint a replace, and Back/Forward
re-open the named tab without writing. route() reads ?tab= first (or a bare
profile name while it names exactly one row), then the old #bundle/profile
(rewritten to ?tab= on first paint, its hash dropped), then the remembered
tab, then the first row. The listener is removed before the hot-update return.
generate-tree bakes urlOwner 'app' into our own leaf pages only (never into an
embed snippet), and a framed leaf drops it at runtime, so a page embedded in a
partner's iframe reads its address but never adds entries to the partner's
Back button.
When the shell owns the address, a reload or a shared ?tab= now wins over a
profile-config tab, so the first-paint replace can never overwrite a sent link
with the default. Elsewhere the order is unchanged (attribute, config, URL).
A reader's pick in the rail writes ?tab= through useViewAddress as a push,
so a reload keeps the tab, a sent link opens it, and Back returns to the
previous tab. Only the address owner writes: urlOwner 'app' writes history,
'host' gets a dxm-address event for its router, and a partner's page is
never written. Programmatic switches (the manifest's re-select, the device
fallback, a host's tab attribute, Back/Forward) write nothing, and there is
no first-paint write. Back/Forward re-open the tab the address names on a
page that owns its address. ?tab= is read through readViewKeys.
The shell reads ?tab= through the shared view-address helper and writes the
open tab back through it: a reader's choice is a push, first paint a replace,
and Back / Forward re-apply the tab without writing. Only the address owner
writes (urlOwner 'app' on our own pages, 'host' hands the change to a host's
router, absent on a partner's page = read only), so a reload keeps the tab
and a sent link opens it.
The header claimed that every write to the address bar goes through commitUrl. Only the view keys and the filters
do. The tree's other history writers are pinned by check:view-address's census. The header also says why a push
copies the previous state: a Vue Router page is a 'host' owner, so its router does its own pushes.
Comment only.
library/composables/useViewAddress.js is the page's address for the view a reader is on: ?tab= &pane= &place=, with
a level rule, an id whitelist, and ONE history write (commitUrl). It keeps history.state and sets its `current` to
the new URL, so a link survives the next in-app navigation on a Vue Router host. The OUTERMOST owner writes,
named by profile-config urlOwner:
- 'app' writes history itself;
- 'host' hands its router one dxm-address;
- absent, nothing is written and links are still read.
Nested elements announce dxm-view. Back/Forward is read and never written.
useShareableView's filter write used to call replaceState(null, ...) itself, which wiped the router's state. It
now goes through commitUrl (writeFilterView). A filter write keeps tab/pane/place, and a tab/pane/place write keeps
the filters.
Level 2 is `pane`, not `view`: ?view= is already published by four of our pages.
check:view-address (gates:pre) runs on a simulated browser history. It covers:
- the whitelist and the level rule;
- one push per tab change, with state + current kept;
- no write when unchanged, on a partner page, or by a host owner;
- the filters and the view keys keeping each other through writes, Back and Forward;
- a census of every history writer in library/ and plugin-designs/ (6 today). A new writer fails until it is listed.
The self-test has 14 poisons, each caught. Real-source mutations are caught too: drop current, drop the unchanged
guard, drop the level rule, an uncomposed event, no length cap, an aliased pushState in a plugin.
Every verse now comes from one translation, the WEB British Edition (public domain), which reads "the LORD"
(the WEB reads "Yahweh"). Every text was re-checked verbatim against it (bible.helloao.org eng_webpb), 31 of
31 matching; the check found three mid-sentence names written with the sentence-start placeholder ("says the
LORD of Armies", "Now the LORD said", "as the LORD had told him") and the British spellings (towards, honour,
offence, amongst, marvellous). The credit line names the one translation.
UPG100's zone-poster code lived only inside its plugin, so Poster Design
(which draws from the library) could list UPG100's posters but never show
them. It is now COPIED, unchanged, into library/packet/upg100Zones/
(zone-sheet-print, zone-sheet, legend-tree, selector-evaluator,
zone-geometry, zones-for-list, clusters.json; only the library import paths
are shorter). UPG100's own files are untouched.
Poster Design adds a UPG100 zone posters family drawn from that copy with a
real zone (middle-east-core) and all the records, as UPG100's own wall
does: the letter, 3 x 3 and 3 x 4 zone posters under UPG100's own design
names (so the drawn card replaces the no-preview plugin card), and the
prayer packet's page 1 (the full letter zone poster). Keys in 11 locales.
check:upg100-zone-copy (in gates:pre) keeps the copy equal to UPG100's
originals beyond the import paths; once UPG100 switches to the library copy
and deletes its originals it becomes a one-path gate. Its self-test proves
a one-character edit, a changed clusters.json, a missing file, a half
switch and a re-definition each fail. check:poster-design-catalogue allows
a template to carry a plugin's design name only when it declares that
plugin (poisoned). Source only: poster-design is rebuilt when the heavy
slot reopens.
The four Wall sources both sides changed (blessPoster.js, wall.css, wallCanvas.js, check-wall-no-bg-photos.mjs)
merged without conflict: the pilot's side is the comment-only privacy rewording of those files (c1a2f3698); both
sides are kept (no agent names; every branch change present). The generated files (the wall bundle, its leaf page
and the two manifests) were taken from the pilot and rebuilt from the merged source, then fix:sri and the tree.
Styles now lists the production designs by family, and puts every
experimental design last, in one Experimental (in progress) group that
starts collapsed (a click opens it). Experimental: the side-lane country
sheets (66x66, 36x60, and 60x96, still being designed), the map print (no
preview: it prints the live map), and every other plugin's design (made by
its own plugin, so not drawn here). templates.js marks them experimental;
posterDesign.family.experimental is new in all 11 locales.
The Bless poster follows the UPG 100 List posters' structure:
- the header and the prayer-themes chart close on dividers that run the page's width (to a quarter of the
border from the sheet's edge), while the text stays in the content column;
- at the foot: the call to action in a band ruled across the page ("Jesus Christ is the cornerstone, and we
are living stones. ... bless them in his name, and join the global family in prayer.", moved down from the
header), then the journey's table, a page-wide rule, and the footer: the whole priestly blessing,
Numbers 6:24-26 (World English Bible British Edition, public domain, verbatim), in two lines that fill
the width, with its reference and the credit line.
Measured on the print at 3 x 4, 2 x 3 and 5 x 8 ft, en and ar: the blessing fills 99.2% of the text width
(49 pt at 3 x 4, 74 pt at 5 x 8); the call to action is one line, 97.6% of its band in English; no text
overflows (the only overflow is the dividers' intended reach past the column). Both em constants come from
those measurements. Cards: 3 x 4 0.49 in, 2 x 3 0.35 in, 5 x 8 0.92 in (one verse per row).
Conflicts resolved by taking the pilot's side: upg100's
my-upg-100-list/poster-wall.meta.json (its new label) and the generated
files (regenerated). upg100's posterDesign block is re-added in the next
commit.
- The life calendar and the reached chart share one grid at the page's
full printable width: each week a 22x11 box, bold year numbers every
5 years (larger every 10), week numbers 1/13/26/39/52, a clear rule
every 10 years and light rules at the quarters. The reached chart has
no week or year numbers; each 10-row block is labelled with its share
of the list's people, 10% to 100%.
- Page 1: the UPG100 series sets its own one-paragraph Jesus column
(series.json strategyBody) and prints the explainer's first paragraph
only (sideBoxMore), so the three columns balance and the map grows.
The long text is one constant shared by both header layouts; the
Country and India-state posters print it unchanged.
- The points page takes, per language, the largest size tier that fits
one sheet, up to the earlier two-sheet sizes. The tier comes from a
character-count estimate; the render gate fails if the real page is
ever taller than that estimate.
- The twelve prayer points and the themes fit one sheet again, as large
as the page allows (points 18.5px, themes 19px); measured in all 11
languages, the tightest keeps 75px under the last point.
- Page 1 header columns read: Jesus' Strategy to Feed the 5000 | the
facts | What is a UPG100 List? The facts' labels are bold.
- The header columns are measured for a fallback font too, so the right
column no longer runs to the border when Lato is absent.
- check:packet-render expects one points sheet.
