v0.126.4: edge-safe error statuses + native-alert ban — writeDiskJSON maps 502/504→500 (CF swallows those bodies; the M1 refusal reached the operator as a JSON SyntaxError popup), M1 refusal = typed errLastUsableDrive → 409; all 29 native alert() swept to showAlert + native_confirm_gate now bans alert( (F-11 class complete)

2026-07-13 14:13:05 +02:00
parent 6136461de6
commit c739003379
10 changed files with 147 additions and 40 deletions
@@ -1,5 +1,21 @@
 ## Changelog

+### v0.126.4 — edge-safe error statuses + the native-alert ban (2026-07-13)
+
+Two defects surfaced by the agent-0.87.0 wizard leg's decommission attempt (the M1 refusal —
+correct policy — reached the operator as a JSON SyntaxError popup):
+
+- **502/504 never leave the origin:** Cloudflare replaces origin 502/504 bodies with its own
+  HTML error page, so every `writeDiskJSON(StatusBadGateway…)` refusal/error rendered as
+  "<!DOCTYPE … is not valid JSON" in the browser. `writeDiskJSON` now maps 502/504 → 500 at the
+  single choke point (JSON body crosses the edge intact); the M1 last-usable-drive refusal
+  became the typed `errLastUsableDrive` sentinel → **409** (policy verdict, not gateway
+  failure). Unit tests + red-proofs for both.
+- **Native `alert()` banned** (the F-11 OS-modal class, now complete): the decommission error
+  path's `alert()` froze browser automation exactly as F-11 predicted. All 29 native `alert(`
+  calls across 5 templates swept to the existing `showAlert` modal (layout.html);
+  `native_confirm_gate.py` extended to ban `alert(` alongside confirm/prompt.
+
 ### v0.126.3 — storage wizard on a CLAIMED box: the init/attach POST no longer dies on CSRF (2026-07-13)

 First live hit during the agent-0.87.0 drill wizard leg: /api/storage/init → "CSRF token missing