Changes touching this path
- the metrics dashboard ships as SIX STATIC PANELS behind an operator allowlist, and the two reviews moved it from a client-fetched page with a 401 to a server-rendered one that cannot be probed: 1623 settled Variant A, the Briefing - one column, one section per question, each caveat as PROSE beside the number it qualifies, which is the structural reason it won, since a caveat there cannot be skipped without skipping its number.
the access decision is that being signed in is not the same as being the operator. anyone can sign up to this host and the data is site-WIDE - every visitor path, referrer host and install-funnel count - so the door is a custody list in the 1045 shape: a Clerk id is on it or it is not. it fails CLOSED in every branch, and the proof is that the fail-OPEN spelling was written and run: allowed.length greater than zero AND not includes, then return true, reads as careful and admits the entire internet the moment the list is empty, which is the state a box is in before its first deploy writes one. exactly two tests went red on it.
the security review then found the route around that allowlist was the wrong shape twice over. the check sat INSIDE withPrivateSession, which maps an unauthenticated caller to 401 - so a stranger probing the endpoint got a 401 where an unserved path gets 404, and the refusal meant to hide the route confirmed it, while a load-bearing comment three lines up asserted the opposite. and the page itself answered 200 to anyone, rendering a document and only saying not found after a client fetch failed. both collapse into one server function returning null for BOTH refusals, which the loader turns into a real notFound: signed-out, signed-in-not-an-operator and a path we do not serve are now one answer.
that rework is also what the ticket asked for and I had not done - the panels render into the HTML from a route loader rather than from a browser round trip, so the acceptance criterion about server-side rendering stops being approximated. the second finding is sharper than it looks: the route declared no headers, and every private route sets private no-store BECAUSE an nginx proxy_cache sits in front. an operator document without it is cacheable at the edge, which is the edge handing one caller a page meant for another. it now carries PRIVATE_HEADERS, and that constant own comment is widened to say it covers two tiers rather than left reading as private-only.
one real data bug came out of the same review and no test I had written could see it: ordering a to_char MM-DD label sorts the series as TEXT, so any window crossing new year draws january before december - the sparkline scrambled about thirty days a year on the one chart whose job is a shape over time. grouped and ordered on the timestamp now, formatted on the way out, and pinned by asserting the grouped expression is not a to_char, verified by restoring the bug and watching it go red.
built against the PRODUCERS rather than the schema, which is what the prototype was really for: visitor_key is null on every log-sourced row and permanently will be since 1632 took the address out of the log, so there are no uniques and no sessions here at all, and device, browser, os and country have no producer either. the panels that wait on one are rendered, named and marked rather than omitted - uniques on 1757, forge usage on 1758, downloads on 1647 and telemetry on 1658 - because a dashboard that silently drops what it cannot see is how you talk yourself into a wrong conclusion.
not prerendered, and that is a security property rather than a build detail: a prerendered page is served as a static FILE with the static route headers, so an operator surface would exist as bytes anyone can fetch with the door never consulted - the same reason private joined that filter in 1043. asserted, and the mutation confirms the assertion bites. it is correspondingly absent from the byte budget, which discovers prerendered surfaces, and its styles stay in the route rather than styles.css because that sheet is eager on all sixty budgeted surfaces and an operator page has no business charging them (#1794)
2c969a0e · dbf3dbe6… - the drill-down takes the dashboard door and pays for react-table on its own route alone, and ADR 0087 records the metrics pipeline as one document
loot#1804 and loot#1636 in one land, because a docs-only land pays the full
gate and the drill-down is the last code the ADR describes.
The drill-down is /metrics/paths and /metrics/referrers - a react-table over
the same rows each bar panel summarises, sortable, bounded at 200 with the
distinct count beside it. It is the only interactive escalation and it lives
here, not on the dashboard: react-table is imported by this route alone,
pinned by a test and MEASURED - the dashboard chunk moved by 80 bytes gzip for
its two footer links, the drill-down chunk is 13.1 KB gzip and paid only there,
and every other surface grew by ~220 bytes for the route-tree entry, which is
the manifest cost loot#1640 predicted. Excluded from prerender by the /metrics
prefix rule, METRICS_HEADERS for the dashboard reasons.
The door is the hard part and it is the SAME door. operatorReader now lives in
operator-door.ts and both the dashboard and the drill-down reach it through a
dynamic import inside a handler, returning null for every refusal so the loader
raises one notFound - a stranger, a non-operator and an unknown kind are
indistinguishable from each other and from a path we do not serve. The kind is
refused by the LOADER before the server function runs, and the validator
narrows rather than throws, because a thrown validator would surface as a 500,
a third distinguishable answer.
Two defects were found by the BUILD and the BUDGET with the typecheck green
both times, which is why both are pinned as tests rather than remembered. A
plain exported function that a route module imports statically is not
stripped from the client bundle the way a handler body is, so the first
refactor dragged @tanstack/react-start/server into the client and the build
refused it. And a VALUE import of two constants from the pg-backed reader put
pg into every client bundle - 62 surfaces up by 24.8 KB each - so the
constants a route may need now live in lib/metrics-drill.ts with no server
dependency in the graph, and read.ts imports them back.
ADR 0087 records the pipeline: three collection points and why no one of them
can see the surface, the loot_metrics database and its three roles, the
visitor key with the two rejected salt constructions, the route-shape rule and
its two enforcement points, the account-reference amendment to the map, the
retention and rollup boundary, the edge-log posture as the reason uniques
need a beacon at all, and the departures and residue - the kept User-Agent,
the eager beacon as the answer to the gate hazard, the error log, the
out-of-scope vhosts, the shared disk. It is 0087 and not the 0074 the ticket
named: telemetry took 0074 the night after this claimed it, and twelve more
landed while this waited on its build tickets. Four glossary entries ride the
same land - Visitor key, Session, Route-shape path, Marginal rollup - each
with the framing it rejects.
624 site tests, published_surfaces gate green, budget green.
984260b2 · dbf3dbe6…diff
Renames are not followed. loot's tree maps a path to an address, so a rename is a delete and an add. This list is the history of the name, not of the bytes.