routine 2026-10-09: the folded README in both engines — Back, reload and heading links that land, Firefox checks, sized README images, no dead buttons without script, vue-router 5.4

[physics515]

Nightly run, 2026-10-09 21:10 → 2026-10-10 00:10 CDT. Seventeen commits. Theme: the about page's folded README, in both engines — tonight's vue-router check turned up real bugs in how a visitor's own navigation treats it, and Firefox (Tor Browser's engine) turned up more. Every browser check here was Chromium-only until tonight.

Unless noted, each increment was verified on its own build with: nuxt typecheck clean, Vitest, npm run build, the real server on a spare port, and all 42 routes the verify script hits (/healthz, /, /projects, every /projects/<slug> 301 and its /about and /blog 200, deliberate 404s, admin 404s) identical to main's status codes. The server ran with the fixture posts (CONTENT_DIR=test/fixtures/content) for check, a11y and a11y:browser, and headless-Chromium screenshots of home, Skidbladnir and Nisaba were taken at 1280 and 390 and looked at.

1. vue-router 5.4.0 — chore(deps) (8f271bd)

Roadmap: the vue-router 5.4 item. Files: package.json, package-lock.json, ROADMAP.md.

It had been out two days with no issue filed against it. 5.4 changes client navigation defaults: it restores hashes and the top of the page, and invalidates obsolete scroll positions. I wrote a CDP probe that drives README anchors, back/forward between anchors, about → blog → back → forward, a cross-project hop, and a cold fragment load. It ran side by side on 5.3.1's build and 5.4's, on onyums and Skidbladnir.

Result:

• Back/forward and cold loads landed identically on both builds.
• README anchor clicks differed by up to ~100 px; I put that down to smooth-scroll timing in the probe and didn't confirm it.
• No console output.

Nuxt's own scrollBehavior governs all of these navigations. Checks: typecheck clean, 246 tests, build, check, a11y, a11y:browser and audit:runtime clean.

2. Back returns a reader to the README they were reading — fix(about) (a843361)

Files:

• app/composables/useReadmeFold.ts (new)
• shared/markdown/anchor.ts (new)
• test/anchor.test.ts (new)
• app/pages/projects/[slug]/about.vue
• README.md, ROADMAP.md

Found by increment 1's probe, and present on main too. A page reached by Back is rendered afresh, folded, so the saved scroll position no longer exists. A reader 6,000 px down onyums' README came back at 2,700, the bottom of the folded page.

The fold state now lives in history.state beside vue-router's own keys:

• Back and Forward reopen it before Nuxt scrolls.
• A visit by link starts folded.
• A fold the visitor closed stays closed.
• A client navigation to a README #heading opens it (hasAnchor).
• A reload reopens it at the reader's place. That position goes to sessionStorage on pagehide, because Chromium drops a replaceState made while the page unloads.

Checks (onyums and Nanna, main build vs this one):

• Back: 2,700 → 6,000.
• Reload: 2,700 → 6,000.
• The fold markup the server sends (<details>) is identical.

3. A link to a README heading lands on it in Firefox — fix(about) (800df87)

Files: app/composables/useReadmeFold.ts, ROADMAP.md.

Chromium opens a closed <details> for a fragment by itself; Firefox 155 here did not. A cold link to /projects/onyums/about#how-onyums-compares left Firefox at y 2,701 with the heading hidden.

Once mounted, the composable now looks the fragment up in the document, opens the fold and scrolls the heading in. Checked with a WebDriver BiDi probe in headless Firefox 155: the heading lands 80 px from the top (its scroll margin), and Back and reload behave as in Chromium. Chromium is unchanged, including a percent-encoded emoji slug.

4. The browser accessibility pass runs in Firefox too — feat(checks) (4033b44)

Files:

• scripts/lib/bidi.mjs (new): headless Firefox over BiDi, using Node's own WebSocket.
• scripts/lib/browser.mjs (new): one page interface over CDP and BiDi.
• scripts/check-a11y-browser.mjs: rewritten against it.
• package.json: npm run a11y:firefox.
• .github/workflows/ci.yml, README.md, ROADMAP.md.

First run: no violations and no console errors on 23 pages at both widths in Firefox. The refactored Chromium pass is also clean.

Proved it bites, on a stub server in both engines:

• A console error, an uncaught exception, a CSP-refused inline script and two 8 px buttons each fail it.
• A clean page passes.

The CI runner's Firefox is a deb from the Mozilla PPA, not a snap (I read the runner image script), so a profile under /tmp works. This CI step runs for the first time on this PR.

5. Stale reading position on a fresh load — fix(about) (b81df31)

Files: app/composables/useReadmeFold.ts.

Found by writing increment 6. vue-router numbers entries from the history length when a document loads, so a fresh load could reuse an older entry's number. My sessionStorage key then sent a cold about#heading link to an old reading position, on Nisaba and Nanna, in both engines. The saved position is now read only when the navigation timing says reload or back/forward.

6. npm run check:navigation — feat(checks) (dc48fd3, 93330fe, 0196dcd)

Files: scripts/check-navigation.mjs (new), scripts/lib/browser.mjs, package.json, .github/workflows/ci.yml, README.md, ROADMAP.md.

What a visitor's own navigation does to the fold runs only in the browser, so nothing else could see it break. For every about page whose README has a heading, at 1280 and 390 px, in Chromium or Firefox (--firefox), it checks:

• Back, Forward-then-Back, and reload return to the reader's place (±4 px).
• A visit by link starts folded, at the top.
• A cold load of #heading lands on it.
• A client navigation to #heading lands on it.
• A visitor-closed fold stays closed on Back.
• A fold opened before hydration stays open (added in 08d8391).
• No console errors.

It waits for scrolling to stop rather than a fixed time, because the site scrolls smoothly.

Results:

• 144 checks per engine, green in both.
• Against main's build (desktop only): 32 failures in Chromium, 41 in Firefox.

Firefox logs every cookie it refuses to a third-party response at error level; a README image from github.com sets three. The driver ignores those as the browser's notice, not a page fault.

7. No dead copy buttons without script — fix(a11y) (44eea71)

Files: app/components/CodeLine.vue, app/components/CodeBlock.vue, app/assets/css/main.css, scripts/check-site.mjs, ROADMAP.md.

Tor Browser's "Safest" level turns script off. Every page renders fine that way (checked in Firefox with javascript.enabled off), except that [copy] was shown and did nothing. It now carries needs-script, and @media (scripting: none) hides it: the browser's own answer, so nothing arrives late for visitors with script.

Checks:

• Firefox: gone with script off, present with it on.
• Chromium over CDP with script disabled: display: none; with script, flex.
• npm run check now fails any public <button> without the class. It failed 12 on main's build and passes this one.

8. My own regression, caught and fixed: a README opened before hydration snapped shut — fix(about) (08d8391)

Files: app/composables/useReadmeFold.ts, scripts/check-navigation.mjs, scripts/lib/browser.mjs, ROADMAP.md.

Increment 2's :open binding made hydration write false over a fold the reader had already opened. On a slow line (Tor) there is time to do that. Open at load, closed 4 s later, on every about page.

• Not on main; introduced by a843361 in this branch.
• Found while screenshotting READMEs. I traced it with a MutationObserver plus a throwaway debug build: hydration removes the attribute between setup and mount.
• Fix: while hydrating, open starts from the document as it stands, and an already-open fold is recorded once mounted.
• Check: check:navigation now opens the fold at DOMContentLoaded via a preload script. The build with the bug fails exactly those 16 cases (8 pages × 2 widths) and nothing else; this build passes.

9. README images reserve their space — feat(readme) (12bb426, then 0196dcd, 776937d)

Files:

• shared/markdown/image-size.ts (new)
• shared/markdown/image-probe.ts (new)
• server/utils/readmeImages.ts (new)
• test/image-size.test.ts (new, 17 cases)
• server/utils/github.ts, scripts/fetch-projects.mjs
• README.md, ROADMAP.md

Markdown can't state image sizes, so every README <img> was zero-height until it loaded. With Skidbladnir's README open, its last heading moved 691 px as the screenshots landed (splimes 194, WeftDB 22).

How it works:

• Sizes are read from each file's first 64 KB (PNG, GIF, JPEG, WebP, SVG root) and written in. An author's own width is kept, and its shape is preserved.
• Only https URLs on the hosts GitHub README images come from are asked, with Range and a hard read cap. None of them is GitHub's API, so the REST quota is untouched.
• The server caches each URL's size for a day with defineCachedFunction; a failure is not stored. npm run sync does the same, so the snapshot matches.

Results:

• All 26 live images measured in 0.47 s.
• Shift: 691 → 0 px in Chromium; Firefox the same within 2 px.
• This also fixed a client navigation to a README #heading stopping short (Skidbladnir #editions at 771 px). check:navigation now holds it to the cold-load band, and both engines pass.

Cost: a cold start's first render went from 0.88–1.04 s on main to 1.02–1.47 s (three runs each); warm renders are unchanged at ~9 ms. The server's probe now gives up after 2 s (776937d).

10. Headless browsers no longer leave profiles in /tmp — fix(checks) (314c7b3)

Files: scripts/lib/cdp.mjs, scripts/lib/bidi.mjs.

72 Chromium profiles were left in /tmp today. Chromium's network service kept writing after the kill, so the removal lost the race. stop() now asks Chromium to close over CDP, waits for the exit, then removes the profile. A stop takes ~60 ms, and none are left after a full a11y:browser run. I removed the 121 stale ones.

11. /status endpoint links: big enough to tap in Firefox — fix(a11y) (616a9ac)

Files: app/pages/status.vue, ROADMAP.md.

The first CI run of a11y:firefox (Firefox 157 on the runner) failed, on something my local Firefox 155 and Chromium had both passed. /status at 390 px has six endpoint links, each 15 px tall and stacked 8 px apart: axe target-size, serious.

Each link is now its own 24 px row (inline-block py-1, as the footer's), at the same pitch. Locally check, a11y, a11y:browser and a11y:firefox are clean, and I took and looked at a 390 px screenshot of /status.

Roadmap-only commit

eeddc84 (research, below):

• Nuxt 4.6.1 to soak.
• security.txt, waiting on a contact.
• The devtools and esbuild advisories that moved this week.
• Two questions only a real browser can settle.

Snapshot

npm run sync at 05:05 UTC: all 8 projects, and all 28 README images in the snapshot are sized. With the snapshot forced by a bad token, /healthz reports snapshot/degraded, Skidbladnir's screenshots render at 1280×960 and 1280×2562, and npm run check is clean (19 pages, 74 URLs).

Final tree

• Typecheck clean, 269 tests.
• font:check, og:check, sizes:check and contrast pass; build green.
• All 42 routes identical to main's.
• check (22 pages, 79 URLs), a11y (23 pages), a11y:browser and a11y:firefox (23 pages × 2 widths) and audit:runtime are clean.
• check:navigation: 144/144 in each engine.

Research

• Nuxt 4.6.1, published 2026-10-09 22:59 UTC, was ~1 h old at the end of the run, so it is held to the same soak as 4.6.0. It's mostly dev-server and typing fixes. Its first issue, #36529, reproduces on 3.x, so it isn't a regression. https://github.com/nuxt/nuxt/releases/tag/v4.6.1 · Aborted navigation to an unmatched route renders a 404 nuxt/nuxt#36529
• Auto-expanding <details>: Mozilla bug 1724299 is described as shipping it in Firefox 139, fragment navigation included. Yet headless Firefox 155 left the fold closed on a cold #heading load here, on main's build. Both are recorded; increment 3 is harmless either way. https://bugzilla.mozilla.org/show_bug.cgi?id=1724299 · Expand <details> for find-in-page and element fragments whatwg/html#6466
• scripting media feature: Baseline, widely available since December 2023. A script-blocking extension may not change what it reports. https://developer.mozilla.org/en-US/docs/Web/CSS/Reference/At-rules/@media/scripting
• security.txt (RFC 9116): requires Contact and Expires (less than a year out), served over HTTPS as text/plain. https://www.rfc-editor.org/rfc/rfc9116.html
• The CI runner's Firefox is a PPA deb, not a snap. https://github.com/actions/runner-images/blob/main/images/ubuntu/scripts/build/install-firefox.sh
• New dev-time advisories, none reaching the image (audit:runtime clean):
  • simple-git ≤3.36 (GHSA-g4wm-2vf7-vfgr, GHSA-x6jw-m9v5-85vh)
  • @simple-git/argv-parser <2.0.1 (GHSA-v5rq-49vh-5v5c)
  • Both come in through devtools 3.4.2; devtools' only newer release is 4.0.0-beta.4.
  • esbuild 0.27.7 (GHSA-g7r4-m6w7-qqqr, Windows dev server only), pinned by @nuxt/fonts 0.14 → fontless ^0.2.

Done vs open

• Landed: 11 increments in 17 commits, 3 checks (a11y:firefox, check:navigation, the needs-script assertion), 1 roadmap research commit, the snapshot.
• Found and fixed in-run: 3 bugs (one pre-existing on main in two forms, one I introduced in this branch).
• New [ ]:
  • Nuxt 4.6.1 (soak).
  • security.txt (owner: contact).
  • No-script #heading links in Firefox (no CSS can open a <details>).
  • Look at the masthead blur in a real Firefox or Tor Browser.
• On that masthead item: headless Firefox drew no backdrop-filter blur at all, not even the plain fallback, so its screenshots show text crisp behind the nav. Most likely the headless compositor; I did not change the CSS.
• Still owner-gated: site token, distroless and healthcheck, Onion-Location, HSTS, basic-automation.github.io, contrast, onion outage cause.
• Upstream: x265 link, onyums anchor, WeftDB links, Arti 0.47 (needs an onyums release), devtools/simple-git, TypeScript 7.1.

STOP REASON: no workable next item, at 00:10 CDT, 3 h 00 min after the 21:10 start, short of the 4 h bar. Everything left is owner-gated, upstream in repos this routine doesn't push to, blocked, or deliberately soaking: Nuxt 4.6.1 was 70 minutes old.

Recommended next step

1. Watch this PR's CI. a11y:firefox and check:navigation run on a GitHub runner for the first time (~8 min more CI).
2. Owner:
   • A contact for security.txt.
   • A look at the masthead and a README #heading link in a real Tor Browser.
3. Next run: Nuxt 4.6.1 once it has soaked, with check:navigation in both engines as part of the gate.

🤖 Generated with Claude Code