Follow-ups from the #34 and #37 reviews

[TaprootFreakAI]

EN. The four items the reviews of #34 and #37 left open, none of which changes what a visitor sees today: one list where there were two disagreeing ones, one cache rule where two matched the same request, and two tests that could not tell a working build from a broken one.

DE. Die vier Punkte, die aus den Reviews von #34 und #37 offen geblieben sind. Für Besucher ändert sich nichts: eine Liste statt zweier widersprüchlicher, eine Cache-Regel statt zweier für dieselbe Anfrage, und zwei Tests, die vorher nichts bewiesen haben.

Two lists that disagreed

The gate that decides whether the Function owns a path and the parser that reads the code out of it both ask whether a segment names a file, and they asked it with different lists — one carried html and not the image types, the other the reverse. So /invite/AB.HTML passed the gate and then lost its code, while /invite/AB.JSON never reached the gate at all.

The real difference was narrower than it first looked: the gate carried jpg|jpeg|webp|ico|txt|xml that the parser lacked, the parser carried html that the gate lacked.

Both read one constant now, and a case asks the two as a single question across every suffix — the sweep includes html, a suffix that names no file type, and a mixed-case spelling — so a set that grows on one side and not the other fails there rather than in production.

They still ask it of different things, deliberately: the gate of the whole path, because /invite/AB12CD/logo.png is an asset request whoever owns the first segment, and the parser of the code segment alone. A case pins that difference as well as the agreement.

html is not in the list for one reason: a code that happens to end in .HTML stays a code. The shell needs no help from the list — the parser names index.html outright — and the 308 that canonicalises it comes from the platform and is handed on either way.

One cache rule instead of two

public/_headers carried a rule for /invite/ and another for /invite/*, and the first matches the second. Every answer that matched both carried the value twice — measured on the deploy:

curl -sI https://realunit.app/invite/
  ->  cache-control: public, max-age=60, public, max-age=60

The rules the wildcards already cover are gone; the bare /invite and /promo keep theirs, because a wildcard does not match them. scripts/check-site.mjs now requires the wildcard and fails if a covered rule comes back. Measured on a preview deployment of this branch, the landing paths each carry the value once.

Pages concatenates what every matching rule says rather than letting one win, and a parser takes the first. /invite/invite.js therefore keeps its own rule above the wildcard, and the restatement below it is gone: it was added when the match order was thought to be uncertain and only appended a third value nobody reads. On production the zone's Browser Cache TTL replaces the lot with max-age=14400 anyway.

The checker also rejects the same exact path declared twice, which its own header parser had been merging out of sight — proven by adding a duplicate block and watching it fail.

Two tests that proved nothing

The clipboard stub discarded what it was handed. writeText: () => Promise.resolve() — so the case named after copying the canonical invite URL passed on any string, or on none; what it actually checked was the label beside the button, which is written from the DOM. The stub records now, and the case requires exactly one write, carrying the code, equal to the canonical link. Verified by mutation: making copyLinkHref() return the bare code turns it red.

The fifteen-second lookup budget was asserted against its own constant. expect(LOOKUP_TIMEOUT_MS).toBe(15000) and nothing else — no case established that a request which never answers ever leaves the loading state. One does now: the endpoint is routed and never fulfilled, the page still says it is checking ten seconds in, and the unavailable state has to appear before the twenty-second mark. Verified by mutation: raising the budget turns it red.

The fake clock does not work here — the budget's timer is armed while the page loads — so the case runs in real time and carries its own longer timeout.

[TaprootFreakAI]

EN. Ready. Four lanes across two vendors report nothing that changes what a visitor gets; what they did find was a run of my own sentences claiming more than the code beside them held, and those are corrected. Every behavioural claim here is measured: the cache values on a preview deployment, both new tests by mutation, and the new site check by adding the rule it is meant to reject.

DE. Freigegeben. Die Prüfungen melden nichts, was für Besucher einen Unterschied macht. Gefunden wurden vor allem eigene Formulierungen von mir, die mehr behaupteten als der Code daneben hält; die sind korrigiert.

What was measured

On a preview deployment of this branch:

Path	Cache-Control
/invite/, /invite/AB12CD, /invite, /promo/EVT1	public, max-age=60 — once
/invite/invite.js	public, max-age=3600, public, max-age=60 — its own rule first, as intended

Before it, /invite/ answered public, max-age=60, public, max-age=60.

Each new guard was made to fail on purpose:

Guard	Fault put back	Result
the copied link	copyLinkHref() returns the bare code	red
the lookup budget	LOOKUP_TIMEOUT_MS set to 12000	red
the covered-rule check	a rule for /invite/foo added to _headers	red
the duplicate-block check	/promo/* declared a second time	red

npm run check exit 0 with every coverage threshold met; npm run test:e2e 124 passing.

What the review found

No lane found anything behavioural, on any round. What they did find, and what is corrected here:

• The historical account in the new comment was wrong: the two lists did not split along html versus the image types. The gate carried jpg|jpeg|webp|ico|txt|xml that the parser lacked, the parser carried html that the gate lacked.
• The justification for leaving html out claimed that including it would take the canonicalising 308 with it. It would not — that redirect comes from the platform and is handed on either way. The real reason is narrower: a code that happens to end in .HTML stays a code.
• The two functions ask the shared list of different things — the gate of the whole path, the parser of the code segment — which is deliberate and was not said. A case now pins the difference as well as the agreement.
• A comment said the budget is read from the page rather than restated, with the restatement on the next line. Both belong there, and it now says which does which job.
• The covered-rule check listed the four rules that happened to be there; it now rejects any exact path a landing wildcard covers.
• The budget case timed from the navigation, so a slow load counted against the budget. It times from the moment the page says it is checking.