Repository navigation
fix(routes): size tripwire compares against the readable source - #1392
Merged
Merged
Conversation
The /nav.js row capped the served body at 65,000 B to catch a deploy that skipped build.ts, but the readable src/client/nav.js is 61,284 B, so serving it passed the size check. The cap was set on 2026-08-11 when the source was 102,009 B; a week later the islands split out and it fell to 49,704 B. Every shell row now names its readable source and must serve at most 0.8 of that file's size, read at check time. Measured 2026-10-17, the loosest row is nav-tips.js at 0.60. luna.css moves to the same check. Control: against a server returning each readable source with the deploy banner stamped on (so only size can fail), main's oracle passes /nav.js and this one fails all 7 rows; both pass the real build.
Contributor
Wire-size diff vs merge base
Brotli q11, the quality the edge serves. Every number here is deterministic: Client assetsNo change. 39 files, 206.14 KiB Brotli total. PagesNo change. 74 files, 670.40 KiB Brotli total. Worker bundleNo change. 288.40 KiB gzip. Dictionary transportFamily dictionary acquisition: no change, 14.50 KiB q11.
|
Deploying with
|
| Status | Name | Latest Commit | Preview URL | Updated (UTC) |
|---|---|---|---|---|
| ✅ Deployment successful! View logs |
aadhar-sh | 38208e6 | Commit Preview URL Branch Preview URL |
Oct 17 2026, 07:59 PM |
…ipwire # Conflicts: # tools/verify-routes.ts
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The route oracle's
/nav.jsrow capped the served body at 65,000 B to catch a deploy that skippedbuild.ts. The readablesrc/client/nav.jsis 61,284 B, so a bypass passed the size check and only the "minified at deploy" banner marker stood in its way.The cap went dead in August. It was set on 2026-08-11 (#319), when the readable source was 102,009 B. A week later the islands split out and the source fell to 49,704 B, under the cap.
What changed
A fixed cap has to sit between two sizes that both move, so this swaps the caps for a check that keeps the gap by construction. Each shell row now names its readable source (
readable: "src/client/nav.js"), and the served body must come in at or underMINIFIED_MAX_RATIO(0.8) of that file's size, read at check time. Serving the source itself is ratio 1.0 and fails.Measured 2026-10-17, served bytes against readable bytes:
nav-tray.jsandnav-tips.jshad about 1.1 KB between their caps and their readable size, so a comment trim would have killed those two the same way. The loosest ratio is 0.60, so 0.8 leaves room for the minifier to do worse.I also corrected a nearby comment: it said
maxBytescatches truncation, but an upper bound can't flag a short body.Control
I pointed the oracle (
VERIFY_BUILT=1) at a small local server in three modes:.build/public: all 7 rows pass./nav.js. That pass is the bug, reproduced.Checks
bun run routes:check: 362 routes, 0 hard failures.bun run check:fastunder the pinned Bun (1.4.3-canary.20261013.1): lint clean, typecheck at its 641-error baseline, 1,515 tests passing with 0 failures.