#552: the middle dot in the account meta line was an escaped escape #565

Merged

Cordy merged 2 commits from fix-middot into main

2026-09-16 03:27:41 +00:00

Cordy commented

2026-09-16 03:24:25 +00:00

Owner

Nikola spotted test5 · via the cairn-admins group under a directory account — the separator printing as its own escape sequence instead of a ·.

One character, one occurrence, but the cause is worth naming because it is the third time this exact mechanism has bitten this feature.

What it was

index.html line 10466 carried \\u00b7 — an escaped backslash followed by u00b7. JavaScript reads that as a literal backslash plus the five characters u00b7, so the DOM text was literally ·. Every other middle dot in the page is either a real · (62 of them) or a correct single-escape · (98); this was the only doubled one.

Confirmed from the live DOM before touching anything:

.uameta → "test5 · via the cairn-admins group"

Where the extra backslash came from

The house one-shots write index.html through a Python heredoc. A separator typed as "\\u00b7" inside a non-raw Python string emits · correctly — but inside a raw string, or when the escaping level is off by one, it emits \\u00b7 and JavaScript then renders the escape rather than the character.

This is the same failure as two earlier rounds:

v0.6.206: '\\\\s' emitted [._\\s-], so avInitials split names on the letter "s" instead of whitespace (Fall 1 → "FA").
v0.6.208: tf("nc" + …) defeated the i18n key scanner.
this one: \\u00b7 rendered as text.

The pattern: anything that passes through a Python heredoc on its way into JavaScript has two escaping layers, and only the runtime shows which one won. The first was caught by a CI sanity check I had written, the second by TestI18nKeysDefined, this one only by a human reading the screen — which is the gap.

Worth considering as a cheap guard (not in this PR, it belongs in #552's follow-ups): a webcheck assertion that index.html contains no \\u sequence outside a regex literal. It is a one-line static check that would have caught all three.

Verification

Full Go suite green, all web tests pass, node --check clean. The one-shot asserted exactly one occurrence before replacing and zero after, and printed the line before and after so the change is visible in the run log.

Nikola spotted `test5 · via the cairn-admins group` under a directory account — the separator printing as its own escape sequence instead of a `·`. One character, one occurrence, but the cause is worth naming because it is the third time this exact mechanism has bitten this feature. ## What it was `index.html` line 10466 carried `\\u00b7` — an **escaped backslash** followed by `u00b7`. JavaScript reads that as a literal backslash plus the five characters `u00b7`, so the DOM text was literally `·`. Every other middle dot in the page is either a real `·` (62 of them) or a correct single-escape `·` (98); this was the only doubled one. Confirmed from the live DOM before touching anything: ``` .uameta → "test5 · via the cairn-admins group" ``` ## Where the extra backslash came from The house one-shots write index.html through a Python heredoc. A separator typed as `"\\u00b7"` inside a non-raw Python string emits `·` correctly — but inside a **raw** string, or when the escaping level is off by one, it emits `\\u00b7` and JavaScript then renders the escape rather than the character. This is the same failure as two earlier rounds: - **v0.6.206**: `'\\\\s'` emitted `[._\\s-]`, so `avInitials` split names on the letter "s" instead of whitespace (`Fall 1` → "FA"). - **v0.6.208**: `tf("nc" + …)` defeated the i18n key scanner. - **this one**: `\\u00b7` rendered as text. The pattern: **anything that passes through a Python heredoc on its way into JavaScript has two escaping layers, and only the runtime shows which one won.** The first was caught by a CI sanity check I had written, the second by `TestI18nKeysDefined`, this one only by a human reading the screen — which is the gap. Worth considering as a cheap guard (not in this PR, it belongs in #552's follow-ups): a webcheck assertion that `index.html` contains **no** `\\u` sequence outside a regex literal. It is a one-line static check that would have caught all three. ## Verification Full Go suite green, all web tests pass, `node --check` clean. The one-shot asserted exactly one occurrence before replacing and zero after, and printed the line before and after so the change is visible in the run log.

Cordy added 2 commits

2026-09-16 03:24:27 +00:00