webhook corridor/sparse builders + guidance-cron unnamed way compute
tiny tables through the ONE preprocessing core (@araharah/routing
farthestPointAnchors + landmarkTables) and pass the landmarks block
into the same single encodeGraph call — call-site updates, not a
second encode function. Graphs with no degree>=2 candidate (sparse,
2-node) pin their anchor explicitly; tables still come from the
integer-Dijkstra core.
FULL BATTERY at this commit: routing:test 74/74, bot 126/126, both
typechecks clean; the regenerated fixture is deterministic (byte-
identical re-run); mini-graph-arg1.bin is byte-stable vs its committed
08-01 bytes.
graph.ts versioned IN PLACE (no second codec): GRAPH_MAGIC 0x41524732,
GRAPH_VERSION 2, HEADER_SIZE 72 (72%8==0 keeps f64 views aligned);
header gains landmarkCount u32 @60 (the old pad), landmarkQuantumS f32
@64, reserved u32 @68; the landmark suffix (u16 toTable, u16 fromTable,
u32 landmarkNodes) extends layoutFor's total arithmetic — exact-size
law covers the variable suffix BEFORE any view allocation (T-08-01).
D-01 fail-honest: ARG1 bytes / version!=2 / landmarkCount=0 / hostile
quantum / size mismatch all decode null (committed mini-graph-arg1.bin
is the standing rejection vector). GraphInput.landmarks REQUIRED and
loud-validated (T-08-04). RoadGraph gains the five landmark fields
(Plan 08-03's ALT potentials consume them).
Fixture regenerated as ARG2 through the SAME encode authority: the
builder gains the tiny real landmark stage (L=2, anchors [0,18],
quantum 0.1s, coverage 1.0 — identical bytes every re-run).
Rule-3 call-site updates forced by the required-landmarks law (missed
by the plan's files list): astar.test A3 + snap.test S3 synthetics
carry inert hand landmark blocks. Fixture regen pulled forward from
task 3 so this commit's own battery is green (74 passed, 0 failed).
farthestPointAnchors + landmarkTables + landmarkCoverage over the
ĉ metric: edge weights floor-quantized once (Math.floor(seconds/q)),
exact integer Dijkstras (Int32 labels, binary heap, lazy deletion),
0xFFFF sentinel, 65000-quantum loud overflow. Traversal law mirrors
astar.ts verbatim: bit0 edges never relaxed in EITHER direction.
Test-vector corrections caught at GREEN (expectations were wrong,
implementation was right):
- L4: rows index by anchor POSITION (row-major [l*N+v]), not node id
- L6: the c-metric farthest node from corner 0 is interior node 18
(297q: interior hops cost 2x perimeter), not corner 24 (264q) —
verified against an independent brute-force Dijkstra
A 2-node graph has no degree>=2 candidates, so farthestPointAnchors
returns empty before any Dijkstra runs and never reaches the overflow
throw. Node 1 on a 3-node path is a candidate, so the selection pass
actually exercises the law.
Hand-computed vectors for the pure landmark compute core: deterministic
degree-filtered farthest-point anchors, exact integer quanta
(floor(2.55/0.1)=25, two edges=50), 0xFFFF sentinel + self-cell laws,
oneway asymmetry, the 65000-quantum overflow throw, and the 5x5-grid
corner-to-corner 264-quanta vector with coverage 1.0.
- Part A: the ONE consolidated walk (D-05) — four clients × seven
interactions, ⬜ cells, PASS/FAIL/NOT RUN vocabulary defined in-file
- Part B: the Android battery record (D-04) — 11 required fields, the
no-extrapolation rule in the file's own voice
- Part C: the 12 automated-half commands with ⬜ result cells + the
--live NOT-RUN-is-not-a-pass note
- Part D: the six D-09 checklist items, each naming its evidence
- Executor notes: the /cari defect ROOT-CAUSED+FIXED (script param
name), the c3 posture, the R2 graph state, the KV-list over-ceiling
options (user decision), the kv-expiry credential caveat, never-fake
- FINAL VERDICT: ⬜ NOT YET SIGNED — the human fills the verdicts
- the Bot API parameter is 'scope' (verified against
core.telegram.org/bots/api/methods/setmycommands); the script's
'bot_command_scope' was an unknown field Telegram silently ignores,
so every call hit the default scope and the two clear calls wiped the
default set entirely — the ok:true lines proved nothing about scope
- registration re-run: default (agnostic/en/ms) + all_private_chats
(agnostic/ms) read back help, privacy, cari via getMyCommands with
the correct 'scope' param; group scopes verified cleared
- docs/KNOWN-LIMITATIONS.md: the 'Telegram-side defect' attribution
corrected to the actual script bug; residual client menu-caching
caveat + type-the-command workaround kept
- bot/README.md command row updated to the real scope set
- banner takes one step down the SAME type-token scale in landscape
(headline-md distance / label-lg street) + xs vertical padding so the
measures fit the 72px min-height instead of overflowing it
- guide-list chrome offset corrected to its own margin stack
(sm + 72 + 1 + 24 + sm = 113px, was 104px)
- bottom register: the portrait 64px control-clearance composite already
seats the guidance/confirm card inside the landscape height — the
landscape override is removed (measured card top 159 vs banner bottom
103 at 844x390); attribution chip + recenter control clear
- device-walk feedback on 07-02's committed geometry; tokens binding
- captures re-run: CAPTURE OK — 22/22 non-blank
- /start sendPhoto now points at MASTER_FILE-arah2_logo.png (deployed
from web/public/ — the untracked asset lands here so the reference
resolves on deploy)
- README + AGENTS.md + the 4 mockup screens swapped the Stitch
googleusercontent logo placeholder for the local master logo
- pre-existing on the tree through 07-03..07-05 execution; verified by
this session's baselines (bot 126/126, web 165/165, captures 22/22)
- source-side runtime-hosts gate gains DOC_POINTER_STATIC_TEXT_HOSTS (the
MapLibre-attribution precedent): the published repo origin may appear
ONLY as a bare URL literal in bot copy (D-08/D-09), never fetched
- class is NARROW and pinned by SA6: a fetch( target naming the same
host is still a violation
- Rule 1 (found by SA6's RED): the fetch( handler's declaration
heuristic misclassified any quoted absolute URL as a TS declaration —
quoted strings are targets; they now reach the host check
- docs/PRIVACY-AUDIT.md: adjudication documented + dated re-run addendum
- deferred-items.md #1 closed: npm run privacy-audit exits 0 again
(PRIVACY AUDIT CLEAN — 5 gate(s) passed, 0 violations; suite 13/13)
- asset-header probe reads HTTP status BEFORE interpreting headers — a
non-2xx is deployment drift (the notRun exit-2 class), never a cache
violation; the violations.length count bug fixed
- XHTML namespace URI joins the SVG spec-identifier adjudication
- probeUnavailable carries the reason only (the CLI prints NOT RUN)
- CP2/AU1 suite vectors updated to the corrected contracts
Residue note: these edits were on the tree during 07-03/07-04 execution
but escaped those plans' commits (07-04-SUMMARY residue caution).
- 3 tasks (TDD RED→GREEN), 7 commits, 19/19 budget-audit suite vectors
- BUDGET AUDIT CLEAN (exit 0); --live exits 2 on deployment drift (honest class)
- 2 deviations documented: the c3-aware route-cpu verdict (plan contradiction),
the golden-corpus environment-drift class
- open items for 07-06 flagged: the KV-list cadence finding + the privacy-audit
RED (07-05's gitmirah strings) — both in deferred-items.md
- a missing package.json in the audit root is T-07-22's environment-drift class,
not a corpus failure — the corpora cannot even be spawned there
- AU1's flag-skip assertion matches the printed 'NOT RUN — (pass --live)' shape
- the full ceilings table (Cloudflare Workers limits / KV limits / pricing, sourced)
- current measurements: A* p95 83.989 ms vs 8 ms ladder budget (the accepted c3 class,
negative headroom printed), BA9 79,815/204,800 gz, app bundle 479,178/500,000 gz,
KV write classes (cron = 0, source-proven), golden corpora exit 0
- the per-request-class subrequest inventory (source-derived, not a live Workers Logs metric)
- the DISCOVERED finding: KV list rate 1,440/day (60 s cron x 1 list/tick) OVER the
1,000/day ceiling — documented with options, decision deferred to the 07-06 launch gate
- the c3 cross-metro escalation restated; honest Statement; unsigned signature block
- npm run budget-audit: 5 required gates + the --live cache-header probe; one evidence line per gate
- the FREE-TIER COMPARISON table: every documented Cloudflare free-plan ceiling beside the
current value where measured, `not measured` where not — the console form of docs/BUDGETS.md
- exit 0 CLEAN / 1 FAILED / 2 NOT RUN — a skip is never a pass (T-07-22)
- no secret, no coordinate in the output (D-14's category-only law, applied to budgets)
- route-cpu: RE-RUNS routing/scripts/measure-route-cpu.mjs as a child process; p95 printed
against the 8 ms product budget + 10 ms free ceiling; the child's GATE FAIL line carried
verbatim; the accepted c3 band has a 200 ms drift guard — uncharted regression fails
- bundle-budget: BA9 route-payload gz sum + whole-app bundle ceiling (500000 gz bytes);
Worker bundle honest NOT MEASURED when bot/dist is absent (never zero)
- kv-writes: 4 write sites inventoried by family, every write TTL-named (PG1); the cron
zero-write law is source-proven — runGuidanceCronTick's body must contain no .put(/.delete(
- subrequests: per-request-class external-subrequest inventory derived from the route table;
uninventoried classes FAIL; source-derived honesty sentence verbatim; never a fabricated zero
- cache-headers: reuses cloudflare-probes' runAssetHeaderProbe (imported, never forked)
- golden-corpus: RE-RUNS routing:corpus + search:corpus as child processes (SC4.a/SC4.b)
- every gate must print its measurement and carry its contract id
- every gate must be able to FAIL on a synthetic violation (fixture injection)
- a skip is never a pass (notRun class; T-07-22)
- web/public/_headers: /assets/* → public, max-age=31556952, immutable (Vite content-hashed output)
- / → public, max-age=0, must-revalidate (the HTML entry points at the current hashed assets)
- no CORS/Set-Cookie/other rules — same-origin policy stays the app's design
- verified: web/dist/_headers exists after the theme+web build
- /cari re-arm RAN 2026-10-25: all six scopes ok:true — 'all command scopes
armed'; residual Telegram client-menu caching risk stated, workaround
pointers at docs/KNOWN-LIMITATIONS.md (T-07-24/T-07-26)
- A1: NOT RETIRED as a mechanism hypothesis — mitigated-by-design via the
chain.ts polling degradation; A3: RETIRED as a decision constraint
(remote workers.dev origin, no LAN-IP dev deployment)
- the Phase-3 FINAL VERDICT table untouched (1 occurrence; the dated
section is the closure)
- docs/KNOWN-LIMITATIONS.md — new, for drivers AND forks: OSM data gaps,
the c3 cross-metro CPU degradation (2-8 ms short / p95 38-93 ms cross-metro,
measure-route-cpu.mjs LADDER HISTORY as evidence, ALT as the committed lever,
Workers Paid rejected on the $0 mandate), the /cari menu defect + the
type-the-command workaround, the beta-quality statement, the roadmap
pointers (WASM-router / ALT / engine B — none in this release), the
privacy paragraph, and the fork-facing audit commands
- strings.ts helpMenu (en+ms): ONE pointer line each, not /-prefixed so the
CS5 menu parse ignores it; URL is the repo's actual remote deep link
(http://gitmirah:3000/c-fu/arah2/src/branch/main/docs/KNOWN-LIMITATIONS.md),
identical in both locales — single-copy law (D-05)
- suite 126/126, CS5 green
- IN-01: delete the never-constructed ParsedInitData export (sole repo hit was
its own declaration); the three read-helper catches now carry Intent:
comments stating malformed-vs-tampered precedence and the chat-degrade law
- IN-02: wrangler.jsonc line 2 states the post-fact truth — the chat_sessions
namespace id below is live, no re-creation
- IN-03: new T4 vector 'age 900 s → ok:true (the boundary is INCLUSIVE)' pins
the strictly-greater comparator's inclusive edge (T-07-08); suite 126/126
- Findings table carries the ACTUAL printed evidence from the audited run
(commit 9c55e9a): 5 static gates PASS, 0 violations; live legs recorded
honestly as NOT RUN with the launch-gate re-run protocol
- Storage inventory: the four TTL-only KV families; Log vocabulary: the
category-only surfaces; Runtime network: the printed host inventory
(allowlist + documented static-text class) and D-02's zero-telemetry posture
- human signature block left blank for the launch gate (D-09)
- runs the five static gates in Pattern-4 order; --live adds the KV-expiry
and asset-header probes; the no-flag skip prints '(pass --live)' and is
never silently green
- exit 0 CLEAN / 1 FAILED (violations counted across gates) / 2 NOT RUN
(credentials or build or deployment drift — never mistaken for a pass)
- header states the maintainer-time-tool law, the GPL fork-reuse contract,
and D-02's zero-telemetry prove-the-absence posture
- AU1-3 CLI vectors green: CLEAN exit 0 on this tree, FAILED exit 1 via the
PRIVACY_AUDIT_ROOT fixture, NOT RUN exit 2 for --live without credentials
- runBundleTelemetryGate: PRODUCTION web/dist ONLY (dist-harness forbidden,
BA5); analytics/beacon token set (sendBeacon explicit form); positive
host allowlist with the host inventory printed, never assumed (A4);
deep-link crypto (D-11) and storage tokens JS-assets-only; a missing
build is notRun, never a silent pass
- runKvExpiryProbe: npx wrangler kv key list (current syntax, deprecated
colon form forbidden), namespace id read from bot/wrangler.jsonc at
runtime; parses name/expiration/metadata + list_complete/cursor and
follows the cursor; unexpected families REPORTED (A5); oldest/newest
expiry reported; raw key names never printed (category-only evidence)
- runAssetHeaderProbe: curl -sSI cache-control/cf-cache-status reported
VERBATIM (probabilistic — printed, never interpreted)
- documented adjudications: MapLibre static-text hosts, W3C namespace
identifiers, bare-array = CLI's internally-paginated complete set
araharah-executor