A browser gives crypto.subtle only to a secure page (https, or http://localhost). Opened any other way, for example a dev server reached over plain http by its LAN address from a phone, every pinned file was refused with a bare "reading 'digest'": the packet printed in English and page 1 fell back to its stored sheet. sha384() now refuses with a sentence that names the cause. check:pinned-fetch-fresh arm D2 removes crypto.subtle and requires that sentence; its self-test plants the unguarded call.
The Embed tab now offers the plugin's own page (URL), that page in an iframe
(with the sizes), and its own bundle + element (JavaScript), each with one plain
sentence and one Copy button. They embed the plugin whose Share was pressed, even
nested in Plugin Studio, Deep Research or Posterverse.
Where the codes point: a new build-config key shareBaseUrl, baked as
__DOXA_SHARE_BASE__ and overridable per embed (profile-config.shareBaseUrl) or
per page (window.MAP_SHARE_BASE_URL), https only (or a local test server). It is
committed EMPTY: the codes then point at the tree the bundle is served from, so
the stable site gives its own public URLs by construction. embedBaseUrl stays
empty, so the manifest's snippets and a dropped tree are unchanged.
The JavaScript code is the plugin's embed.script from that tree's manifest
(library/utils/publicEmbed.js, fetched once when Embed opens, default
credentials), made absolute, with integrity dropped from our unversioned bundle
URL (a pinned hash would break every partner's embed at the next release). A
plugin that tree does not carry gets a plain note instead of codes that would
404. Share this page stays first; the explanation and the 5 steps stay. English
only (parity debt 19 per locale). The library index lists publicEmbed.js.
check:dev-leaf-escape and its self-test join gates:pre. The comment on the
dev pages' owner rule named the wrong reason for leaving a framed page
unowned: the frame is a partner page that iframes a leaf (the iframe
embed). Plugin Studio mounts its rows directly.
Measured in a browser on a fresh load: ?owner=x&pane=map came back as ?pane=map&owner=x through one replaceState.
viewSearch puts the view keys first, and writeViewKeys compared strings. The link meant the same thing and no Back
step was added, but it was a needless write, and on a host it would be a needless router.replace. writeViewKeys now
compares the parsed tab/pane/place. check:view-address B covers it, with a poison (44); the real-file revert fails.
From the 5B: an observer fires only when the COLUMN resizes. A pane whose height arrives later (styles adopted late
in a shadow root) would have left the link pending, and a pending link blocks the settle's write. check:view-address
covers it: a fresh load whose observer never fires again still opens the link (43 poisons).
Measured in a browser on Country Posters and on Regions: a fresh load with ?pane=<second pane> stayed on the first
pane, with the column's scrollTop 0 at 6 s. The column is built in the composite's onMounted, before it has a
layout, so the pane's offsetTop was 0 when the link was shown. And a ResizeObserver's first callback, which comes
after layout, only recorded the height.
Now the link waits until the column has a height and the pane a top, then shows it once. The wait is the observer's
callback, or a bounded rAF without one. A scroll that settles while the link waits does not overwrite it. The
composite's view readout follows from the scroll event it already listens to.
check:view-address F models a column with no layout at build, whose observer first fires after layout. There are 2
new poisons (42 in all), and restoring the old immediate show in the real file fails the gate.
- ownAddress records only pane and place. tab is the owner's own key, so a nested announcement cannot switch it.
- A shell keeps Regions (and UPG100) alive when another tab is open. Switching back dropped ?pane= and ?place=
(the tab change), while the screen still showed them. pane-wrapper and region-dashboards now watch for being
shown again (a ResizeObserver: no height, then height) and claim their pane / place back with a replace. An
address that names one wins, because Back to an entry of this tab is applied while the column has no layout.
- scrollTo(id, null) behaves as scrollTo(id).
check:view-address covers each of these (34 poisons, each caught). The slow pane-wrapper arm runs only for
pane-wrapper poisons, so the self-test takes 16 s.
pageLink() drops ?tk= from the page's address: a leaf page reads a token from
there and leaves it in place, so pressing Share would have sent it. The URL is
rewritten only when tk is present; every other link is the address as it stands.
The comments name the page, not who measured it, and no longer cite a request.
check:map-menu-anchor strips a same-line comment before testing each return, so
a fallback named only in a comment no longer passes.
The address gets its second and third keys:
- ?pane= is the open view of a composite;
- ?place= is Regions' subject.
Both keep the ONE-writer rule:
- On its own leaf the composite owns the address and writes.
- Nested in a shell it announces, and the shell writes.
- On a partner's page nothing is written; a link is still read.
useViewAddress:
- claimView() is the one call for a reader's choice: the owner writes it, any other element announces it.
- ownAddress() lets an owner record its nested elements' announcements, and stops them there.
- An announcement carries only the view keys, one event per action.
- pane and place are siblings: a tab change drops both, but a pane change keeps the place, because Regions keeps
its region while the reader is on the list.
pane-wrapper (buildPaneColumn) takes an opt-in `address`:
- a link opens its pane without writing;
- a click is a push, and a selection made by the same click rides in the same push (one Back step);
- where the reader's scroll settles is a replace;
- Back/Forward scroll and never write;
- the first pane is the default and is never written.
Regions:
- regions-mfe opts its column in and records its panes' announcements on its own leaf. A list click opens the
dashboard with its place in one write.
- region-dashboards claims ?place= instead of writing its #slug with its own pushState (replace at first paint,
push on a choice, re-applied on Back). An old #slug link still opens, and on its own leaf it is rewritten to
?place=.
- urlSync:false now guards only the tab title.
check:view-address adds:
- E: nested claims and the owner;
- F: pane-wrapper on a simulated column;
- G: the Regions wiring.
The census drops region-dashboards (5 writers now). Self-test: 29 poisons, each caught. Real-source mutations are
caught too.
The dev leaf route wrote the URL's parts into the page's <title> and the
element's profile-config attribute, refusing only .. and /. A quote or a
tag in a crafted link broke out of the attribute on a publicly reachable
dev server. Each part must now have the shape every bundle, profile and
instance id has, before it reaches either; the title is escaped too.
check:dev-leaf-escape drives the plugin's own middleware: every leaf the
dev manifest advertises is still served in both URL forms, hostile parts
are refused in every position, and the title escapes on its own.
ShareButton: the first tab is "Share this page", the link to exactly what the
reader is looking at. Where the page owns its address (urlOwner 'app' or 'host',
on the map's own profile-config or any element above it across shadow roots)
that is the page's own URL, read at open and at copy; on a partner's page it is
the map's own page, as before. The second tab, "Embed", says in plain words what
embedding is and why it helps, keeps the buttons.shareSteps list, then the paste
hint, the sizes and the code. Copy/sizes labels come from the catalogue.
MapControlMenu: a standalone anchor (a Share button outside any map toolbar)
resolves where its menu lives when it opens, and places it below the button,
toward the side with room, inside the viewport, at the readable width (340 or the
viewport minus its edges), converting into the menu's real containing block. The
render-time area tag that sent header menus far left and narrow is gone. Map
toolbars keep their placement unchanged.
English only for now (the new share.json keys are recorded as translation debt in
check:i18n-parity). check:map-menu-anchor reads a resolution that lives in a named
function, every named-area return must keep its structural fallback.
The dev pages passed no urlOwner, so on the dev server a shell read ?tab=
but never wrote it: a clicked tab was lost on reload and a copied link
opened the first tab. The root page, every /__leaf/ page and the Studio
staging page now own the address, as the built leaves do. A framed leaf
(Studio iframes its map rows) stays unowned, so it never adds entries
to the top page's Back stack.
Plugin Studio read its tab from #<bundle/profile> or from localStorage, and
never wrote it, so a reload worked for one reader but a sent link did not. It
now writes the view address through useViewAddress: ?tab=<bundle>__<profile>
(a row key's "/" is not a plain id; the double underscore keeps a sent link
meaning one row even if another bundle later adopts the profile's name). A
reader's tab click is a push, the first paint a replace, and Back/Forward
re-open the named tab without writing. route() reads ?tab= first (or a bare
profile name while it names exactly one row), then the old #bundle/profile
(rewritten to ?tab= on first paint, its hash dropped), then the remembered
tab, then the first row. The listener is removed before the hot-update return.
generate-tree bakes urlOwner 'app' into our own leaf pages only (never into an
embed snippet), and a framed leaf drops it at runtime, so a page embedded in a
partner's iframe reads its address but never adds entries to the partner's
Back button.
library/composables/useViewAddress.js is the page's address for the view a reader is on: ?tab= &pane= &place=, with
a level rule, an id whitelist, and ONE history write (commitUrl). It keeps history.state and sets its `current` to
the new URL, so a link survives the next in-app navigation on a Vue Router host. The OUTERMOST owner writes,
named by profile-config urlOwner:
- 'app' writes history itself;
- 'host' hands its router one dxm-address;
- absent, nothing is written and links are still read.
Nested elements announce dxm-view. Back/Forward is read and never written.
useShareableView's filter write used to call replaceState(null, ...) itself, which wiped the router's state. It
now goes through commitUrl (writeFilterView). A filter write keeps tab/pane/place, and a tab/pane/place write keeps
the filters.
Level 2 is `pane`, not `view`: ?view= is already published by four of our pages.
check:view-address (gates:pre) runs on a simulated browser history. It covers:
- the whitelist and the level rule;
- one push per tab change, with state + current kept;
- no write when unchanged, on a partner page, or by a host owner;
- the filters and the view keys keeping each other through writes, Back and Forward;
- a census of every history writer in library/ and plugin-designs/ (6 today). A new writer fails until it is listed.
The self-test has 14 poisons, each caught. Real-source mutations are caught too: drop current, drop the unchanged
guard, drop the level rule, an uncomposed event, no length cap, an aliased pushState in a plugin.
Conflicts resolved by taking the pilot's side: upg100's
my-upg-100-list/poster-wall.meta.json (its new label) and the generated
files (regenerated). upg100's posterDesign block is re-added in the next
commit.
A group with no record in a set figure's data (no near-neighbour data,
for example) was in none of that figure's numbers, so the captions
added up to less than the list: Laos printed 94 of its 95 groups. Each
caption now names the groups without data ("1 without data", in all 11
languages), so its parts add up to the list. check:packet-variants
asserts the sum both ways.
- The life calendar and the reached chart share one grid at the page's
full printable width: each week a 22x11 box, bold year numbers every
5 years (larger every 10), week numbers 1/13/26/39/52, a clear rule
every 10 years and light rules at the quarters. The reached chart has
no week or year numbers; each 10-row block is labelled with its share
of the list's people, 10% to 100%.
- Page 1: the UPG100 series sets its own one-paragraph Jesus column
(series.json strategyBody) and prints the explainer's first paragraph
only (sideBoxMore), so the three columns balance and the map grows.
The long text is one constant shared by both header layouts; the
Country and India-state posters print it unchanged.
- The points page takes, per language, the largest size tier that fits
one sheet, up to the earlier two-sheet sizes. The tier comes from a
character-count estimate; the render gate fails if the real page is
ever taller than that estimate.
- The twelve prayer points and the themes fit one sheet again, as large
as the page allows (points 18.5px, themes 19px); measured in all 11
languages, the tightest keeps 75px under the last point.
- Page 1 header columns read: Jesus' Strategy to Feed the 5000 | the
facts | What is a UPG100 List? The facts' labels are bold.
- The header columns are measured for a fallback font too, so the right
column no longer runs to the border when Lato is absent.
- check:packet-render expects one points sheet.
Points: text 22.5px (~9.2pt on letter), headings 25px, the Mark 5 passage 20px, the themes 21px; the themes and
points 1–6 on the first sheet, 7–12 and the credit on the second, each titled with its range. Measured in all 11
languages: the fullest first sheet keeps ~330px. Full detail: tally columns 160px (the worksheet's), heads 15px
in two lines in every language, the first-page block 720px (the tallest, ru, uses 692), 11 rows on the first page.
Gates: the render gate measures BOTH points sheets (pointsOver), counts the points by .pt-h across the document,
expects 2 points sheets; the structure gate reads consecutive points sheets as one entry; profile-table probes the
15px tier between the two budgets wherever they fall.
The points page fits ONE sheet only because its sizes are tuned to the longest language (studio's ask): pointsOver
fails a page whose content outgrows its box (two-sided: 26px text fails; all 11 languages PASS at 18.5px).
Each point's heading carries class pt-h, and the gate counts those: counting every line that starts 'N. ' read
German's '1. Petrus 5:6–11' (its name for 1 Peter, point 11's reference) as a thirteenth point.
Centered set: the ring numbers ride the axis BELOW the cross, 9 at the bottom, so the eye climbs 9 → 1 to it;
the dots turn half a circle to keep the number lane clear. The ring legend opens with what a ring means in
plain words (sets_rings_lede x11) before listing the rings that hold someone.
Life in weeks + the reached grid: each grid is ONE inline SVG, two paths of square subpaths (empty, shaded),
hairlines between decades, small week and year numbers; measured on the two pages together: 10,553 page nodes
→ 86, load 474 → 214 ms, print 641 → 320 ms. The reached grid now has the life grid's exact shape (same
geometry, no week or year numbers, centred), shaded from the top by this list's share.
Gates: variants and render decode each grid's subpaths back to box indexes in reading order (5,200 distinct,
Jesus' 33 years = the first 1,716, the share from the top, the same viewBox for both); two-sided: shading
the LAST 33 years fails both. Gospel's three optional nits folded in (it un’altra, example_note x5, ru чёрточка).
It asserted ceil(n/20) pages and a typed DESC_W 1036; the first list page now gives its top to the explanation
band and the tally cells widened, so both went stale. Pagination is 1 + ceil((n - FD_FIRST) / PER_PAGE); DESC_W
is the row less the photo, the three tally cells and two gutters, read from packet-render's constants.
Themes (bless the nations, perfect unity, protection from evil, hearing God's voice, true identity in Christ,
deep relational health, the priesthood of believers) to weave into the wheel's five-minute blocks, then the
scenes treasure, mountain and sea, each with its two references from the Wall of People Groups' poster
(Haggai 2:7 · Matthew 13:44, Isaiah 2:2 · Matthew 21:21, Habakkuk 2:14 · Matthew 8:26). Point 12: the blessing,
the great, the greater and one of the greatest blessings of John 17, unity and protection, beyond all we ask
or think (John 17:3 · John 17:11–23 · Ephesians 3:20). Words drafted by the gospel lane x11; books Haggai,
Isaiah, Habakkuk, Ephesians x11. The page still fits one sheet in every language (19px text, 6px between points).
Gates: parity fails a point whose references are not English's (ten languages kept point 12's old ones) and
needs 7 themes + 3 scenes per language; variants checks the themes block and point 12 in both packets.
Full detail: the question no longer repeats under every tally cell; the heads stand once per page over the
cells' own columns, and each cell is all tally room (96px columns, taller boxes). The worksheet's boxes
get a little more room too.
Both lists' first page: the intro and the blessing (Numbers 6:24-26, its credit, one line of references, the
wheel pointer) at full width, then ONE band like the poster's (ruled above and below, three columns between
short rules): the pace table (strongest to slower, weekly marked, each load computed from the list), what the
three columns ask, and an EXAMPLE row of tally cells under the table's own heads, exactly as wide as the
tally block and directly over it. One code path (explainTop, explainBand) for both packets.
Measured with a 100-group list in all 11 languages: the worksheet's first page holds 10 rows (the tallest,
ru, keeps 67px), Full detail's 12 under a 640px block (the tallest uses 612); the example sits over the real
cells to the pixel. Gates: packet-variants checks the band in BOTH packets (once, before the first row,
computed paces, one example row, heads once per page); packet-render reads the page sizes from the
renderer, fails a clipped first-page block, and measures text direction against the content box (a padded
cell is still pinned left). New strings x11: howto_bless_col, example_title, example_note.
