max / makenotwork

Read every described screen's region from the screen, and clear two advisories The SCREENS table transcribed four regions and three had drifted: ssh-keys and forums answer their own panes since the settings strip was described, and analytics has never answered tab-content. Read them from the constants the screens publish, which is what the table's own comment asks for. Only buyer_contacts still transcribes one, because it publishes none. h2 to 0.4.17 for RUSTSEC-2026-0258, and allow-git the quasi-type remote, which no Sando build had seen since the dep was added.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

Author: Max Johnson <me@maxj.phd> · 2026-08-19 21:48 UTC

Signed with PGP, not checked

Commit: adf56cd942ef44f068f7f375e316e1277bcfc286

Parent: 8668f54

3 files changed, +58 insertions, -35 deletions

M server/Cargo.lock +30 -30

			@@ -2865,7 +2865,7 @@
2865	2865		checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
2866	2866		dependencies = [
2867	2867		"libc",
2868		-	"windows-sys 0.52.0",
	2868	+	"windows-sys 0.59.0",
2869	2869		]
2870	2870
2871	2871		[[package]]
			@@ -4168,9 +4168,9 @@
4168	4168
4169	4169		[[package]]
4170	4170		name = "h2"
4171		-	version = "0.4.15"
	4171	+	version = "0.4.17"
4172	4172		source = "registry+https://github.com/rust-lang/crates.io-index"
4173		-	checksum = "6cb093c84e8bd9b188d4c4a8cb6579fc016968d14c99882163cd3ff402a4f155"
	4173	+	checksum = "9f877e75f39e9827ec50a572dd592684ac28c029578726c85f1b2aa6ab807449"
4174	4174		dependencies = [
4175	4175		"atomic-waker",
4176	4176		"bytes",
			@@ -4801,7 +4801,7 @@
4801	4801		source = "registry+https://github.com/rust-lang/crates.io-index"
4802	4802		checksum = "82cb6a9f675da968c63b6208c641b9dca58fc0133ae53375736b1767b0cab8bd"
4803	4803		dependencies = [
4804		-	"windows-sys 0.61.2",
	4804	+	"windows-sys 0.59.0",
4805	4805		]
4806	4806
4807	4807		[[package]]
			@@ -5694,7 +5694,7 @@
5694	5694		source = "registry+https://github.com/rust-lang/crates.io-index"
5695	5695		checksum = "7957b9740744892f114936ab4a57b3f487491bbeafaf8083688b16841a4240e5"
5696	5696		dependencies = [
5697		-	"windows-sys 0.61.2",
	5697	+	"windows-sys 0.59.0",
5698	5698		]
5699	5699
5700	5700		[[package]]
			@@ -6735,7 +6735,7 @@
6735	6735		"once_cell",
6736	6736		"socket2",
6737	6737		"tracing",
6738		-	"windows-sys 0.52.0",
	6738	+	"windows-sys 0.59.0",
6739	6739		]
6740	6740
6741	6741		[[package]]
			@@ -7298,7 +7298,7 @@
7298	7298		"errno",
7299	7299		"libc",
7300	7300		"linux-raw-sys 0.4.15",
7301		-	"windows-sys 0.52.0",
	7301	+	"windows-sys 0.59.0",
7302	7302		]
7303	7303
7304	7304		[[package]]
			@@ -7311,7 +7311,7 @@
7311	7311		"errno",
7312	7312		"libc",
7313	7313		"linux-raw-sys 0.12.1",
7314		-	"windows-sys 0.52.0",
	7314	+	"windows-sys 0.59.0",
7315	7315		]
7316	7316
7317	7317		[[package]]
			@@ -7391,7 +7391,7 @@
7391	7391		"security-framework 3.7.0",
7392	7392		"security-framework-sys",
7393	7393		"webpki-root-certs",
7394		-	"windows-sys 0.52.0",
	7394	+	"windows-sys 0.59.0",
7395	7395		]
7396	7396
7397	7397		[[package]]
			@@ -8517,7 +8517,7 @@
8517	8517		"getrandom 0.4.3",
8518	8518		"once_cell",
8519	8519		"rustix 1.1.4",
8520		-	"windows-sys 0.52.0",
	8520	+	"windows-sys 0.59.0",
8521	8521		]
8522	8522
8523	8523		[[package]]
			@@ -10731,6 +10731,26 @@
10731	10731		"pkg-config",
10732	10732		]
10733	10733
	10734	+	[[patch.unused]]
	10735	+	name = "synckit-client"
	10736	+	version = "0.8.0"
	10737	+
	10738	+	[[patch.unused]]
	10739	+	name = "synckit-config"
	10740	+	version = "0.2.0"
	10741	+
	10742	+	[[patch.unused]]
	10743	+	name = "kberg"
	10744	+	version = "0.1.0"
	10745	+
	10746	+	[[patch.unused]]
	10747	+	name = "ops-status"
	10748	+	version = "0.1.0"
	10749	+
	10750	+	[[patch.unused]]
	10751	+	name = "painhours"
	10752	+	version = "0.1.0"
	10753	+
10734	10754		[[patch.unused]]
10735	10755		name = "quasi-immediate"
10736	10756		version = "0.36.0"
			@@ -10747,14 +10767,6 @@
10747	10767		name = "quasi-tauri"
10748	10768		version = "0.36.0"
10749	10769
10750		-	[[patch.unused]]
10751		-	name = "synckit-client"
10752		-	version = "0.8.0"
10753		-
10754		-	[[patch.unused]]
10755		-	name = "synckit-config"
10756		-	version = "0.2.0"
10757		-
10758	10770		[[patch.unused]]
10759	10771		name = "makeover-immediate"
10760	10772		version = "0.30.0"
			@@ -10762,15 +10774,3 @@
10762	10774		[[patch.unused]]
10763	10775		name = "makeover-tui"
10764	10776		version = "0.30.0"
10765		-
10766		-	[[patch.unused]]
10767		-	name = "kberg"
10768		-	version = "0.1.0"
10769		-
10770		-	[[patch.unused]]
10771		-	name = "ops-status"
10772		-	version = "0.1.0"
10773		-
10774		-	[[patch.unused]]
10775		-	name = "painhours"
10776		-	version = "0.1.0"

M server/deny.toml +5

			@@ -83,6 +83,11 @@
83	83		# gate caught it on the first build that carried them, which is the gate
84	84		# working.
85	85		"https://makenot.work/git/max/quasi.git",
	86	+	# The house font pipeline, rev-pinned (Cargo.toml:261). Caught on
	87	+	# 2026-08-19 by the same mechanism and for the same reason as the quasi
	88	+	# entry above: the dep was added, no Sando build ran while it was there,
	89	+	# and every dev box read it as a path dep through the ~/Code patch.
	90	+	"https://makenot.work/git/max/quasi-type.git",
86	91		]
87	92
88	93		[licenses]

M server/tests/workflows/described_screens.rs +23 -5

			@@ -50,24 +50,38 @@
50	50		/// `tab-content` with everything else, and this list still said they did. A
51	51		/// constant this table can name is a constant this table cannot disagree with.
52	52		const SCREENS: &[(&str, &str, &str)] = &[
53		-	("user_ssh_keys", "/dashboard/tabs/ssh-keys", "settings-body"),
	53	+	(
	54	+	"user_ssh_keys",
	55	+	quasi::ssh_keys::PATH,
	56	+	quasi::ssh_keys::REGION,
	57	+	),
54	58		(
55	59		"library_contacts",
56	60		quasi::library_contacts::PATH,
57	61		quasi::library_contacts::REGION,
58	62		),
	63	+	// The one screen that publishes no REGION, so this is the only row left
	64	+	// transcribing one. Read it from the screen the day it publishes one.
59	65		(
60	66		"buyer_contacts",
61		-	"/dashboard/tabs/contacts",
	67	+	quasi::buyer_contacts::PATH,
62	68		"contacts-section",
63	69		),
64		-	("user_analytics", "/dashboard/tabs/analytics", "tab-content"),
	70	+	(
	71	+	"user_analytics",
	72	+	quasi::user_analytics::PATH,
	73	+	quasi::user_analytics::REGION,
	74	+	),
65	75		(
66	76		"library_communities",
67	77		quasi::forum_memberships::LIBRARY_PATH,
68	78		quasi::forum_memberships::LIBRARY_REGION,
69	79		),
70		-	("user_forums", "/dashboard/tabs/forums", "settings-body"),
	80	+	(
	81	+	"user_forums",
	82	+	quasi::forum_memberships::SETTINGS_PATH,
	83	+	quasi::forum_memberships::SETTINGS_REGION,
	84	+	),
71	85		];
72	86
73	87		/// One control the description emitted.
			@@ -283,12 +297,16 @@
283	297		// The answer is this screen's own pane, named as such. Before 2026-08-11
284	298		// the control addressed the API route, whose answer is the Askama list
285	299		// fragment with no retarget: htmx put that table inside the button.
	300	+	//
	301	+	// Read from the screen rather than transcribed, for the reason SCREENS
	302	+	// gives: this assertion said `#settings-body` until 2026-08-19, when the
	303	+	// settings strip was described and the pane stopped being shared.
286	304		assert_eq!(
287	305		resp.headers
288	306		.get("HX-Retarget")
289	307		.and_then(\|v\| v.to_str().ok())
290	308		.unwrap_or_default(),
291		-	"#settings-body",
	309	+	format!("#{}", quasi::ssh_keys::REGION),
292	310		"the answer did not name the pane it changed"
293	311		);
294	312		assert!(