cursedbelt-server 4.20.0 → 4.22.0

package/README.md

@@ -36,6 +36,7 @@ actually keeps.
 | `./guard/revocations` | — | `bun:sqlite` |
 | `./sqlite` | — | `bun:sqlite` |
 | `./engagement` | — | `bun:sqlite` |
+| `./request-log` | — | `bun:sqlite` |
 
 `sharp` and `@node-rs/argon2` are loaded lazily (`await import()`), so a missing one breaks only
 the feature that asks for it, not the build.

package/dist/server/d1/localBackup.d.ts

@@ -82,4 +82,4 @@ export declare function createLocalBackup(opts: LocalBackupOpts): DatabaseBackup
  * a host that genuinely has both.
  */
 export declare function backupFor(flavor: 'local' | 'd1', local: () => LocalBackupOpts, remote: () => TimeTravelOpts): DatabaseBackup;
-export { type BackupSourceChoice, type BackupSourceInput, backupTables, chooseBackupSource, type PullD1Options, pullD1ToSqlite, servedRuntime, type Wrangler, } from './pullD1.js';
+export { type BackupSourceChoice, type BackupSourceInput, backupTables, chooseBackupSource, type PullD1Options, insertLines, pullD1ToSqlite, servedRuntime, spawnWrangler, stripTrailingNuls, type Wrangler, wranglerArgv, } from './pullD1.js';

package/dist/server/d1/localBackup.js

@@ -111,4 +111,4 @@ export function backupFor(flavor, local, remote) {
 // After a Worker cutover the live rows are D1's, and a Mac-hosted backup must pull them down
 // rather than snapshot the frozen file — see `./pullD1.ts`. Here, not in the `./d1` barrel,
 // for the reason this file's header gives: it reaches `bun:sqlite`.
-export { backupTables, chooseBackupSource, pullD1ToSqlite, servedRuntime, } from './pullD1.js';
+export { backupTables, chooseBackupSource, insertLines, pullD1ToSqlite, servedRuntime, spawnWrangler, stripTrailingNuls, wranglerArgv, } from './pullD1.js';

package/dist/server/d1/pullD1.d.ts

@@ -56,6 +56,30 @@ export type Wrangler = (args: string[]) => {
     stdout: string;
     stderr: string;
 };
+/**
+ * The argv that runs `wrangler`: THIS bun binary's `x`, never a bare `bunx` — a launchd job's
+ * PATH has no `bunx` (task 2112), and vault's and patterns' nightly backups each carried this
+ * line until 4.22.0.
+ */
+export declare const wranglerArgv: (bun?: string) => string[];
+/** The real {@link Wrangler}: `bun x wrangler …` in `cwd`, with `env` added to this process's. */
+export declare function spawnWrangler(options: {
+    cwd: string;
+    env?: Record<string, string | undefined>;
+}): Wrangler;
+/**
+ * 🔴 Trailing NUL bytes off a `wrangler d1 export` file, in place. Returns how many were removed.
+ *
+ * Measured 2026-09-23 on vault's D1 (wrangler 4.136.3): `wrangler d1 export --table … --output`
+ * INTERMITTENTLY ends the file in hundreds of NUL bytes (`entries` +988, `oplog` +1,369, `sync_ops`
+ * +5,476 across three runs — a different table each time, always trailing). `bun:sqlite`'s `exec`
+ * reads SQL as a C string, so the first NUL silently ended the load: every table after it came back
+ * EMPTY with no error, and vault's real backup held `vault_keys` = 0 rows (task 2128). Only
+ * TRAILING bytes: a NUL inside the SQL is a different fault, and the row-count check refuses it.
+ */
+export declare function stripTrailingNuls(file: string): number;
+/** `^INSERT INTO ` lines — one per row in a `wrangler d1 export --no-schema` dump. */
+export declare const insertLines: (dump: string) => number;
 /**
  * The tables a snapshot carries, from D1's own `sqlite_master` rows — every real table, and
  * none of what cannot or must not be re-inserted: a virtual table and its shadows (`_config`,

package/dist/server/d1/pullD1.js

@@ -27,7 +27,7 @@
  * (`./http.ts` has the measurement), and a restore must put back what was there.
  */
 import { Database } from 'bun:sqlite';
-import { existsSync, readFileSync } from 'node:fs';
+import { existsSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
 /** Which side a backup must read. Pure, so every branch is testable without a network. */
 export function chooseBackupSource(input) {
     if (input.fromFileFlag) {
@@ -84,6 +84,48 @@ export async function servedRuntime(url, { attempts = 3, sleep = (ms) => new Pro
 }
 /** How many times one table's export is asked for when wrangler says success and writes nothing. */
 const EXPORT_ATTEMPTS = 3;
+/**
+ * The argv that runs `wrangler`: THIS bun binary's `x`, never a bare `bunx` — a launchd job's
+ * PATH has no `bunx` (task 2112), and vault's and patterns' nightly backups each carried this
+ * line until 4.22.0.
+ */
+export const wranglerArgv = (bun = process.execPath) => [bun, 'x', 'wrangler'];
+/** The real {@link Wrangler}: `bun x wrangler …` in `cwd`, with `env` added to this process's. */
+export function spawnWrangler(options) {
+    return (args) => {
+        const r = Bun.spawnSync([...wranglerArgv(), ...args], {
+            cwd: options.cwd,
+            env: { ...process.env, ...options.env },
+            stdout: 'pipe',
+            stderr: 'pipe',
+        });
+        return { code: r.exitCode ?? 1, stdout: r.stdout.toString(), stderr: r.stderr.toString() };
+    };
+}
+/**
+ * 🔴 Trailing NUL bytes off a `wrangler d1 export` file, in place. Returns how many were removed.
+ *
+ * Measured 2026-09-23 on vault's D1 (wrangler 4.136.3): `wrangler d1 export --table … --output`
+ * INTERMITTENTLY ends the file in hundreds of NUL bytes (`entries` +988, `oplog` +1,369, `sync_ops`
+ * +5,476 across three runs — a different table each time, always trailing). `bun:sqlite`'s `exec`
+ * reads SQL as a C string, so the first NUL silently ended the load: every table after it came back
+ * EMPTY with no error, and vault's real backup held `vault_keys` = 0 rows (task 2128). Only
+ * TRAILING bytes: a NUL inside the SQL is a different fault, and the row-count check refuses it.
+ */
+export function stripTrailingNuls(file) {
+    if (!existsSync(file))
+        return 0;
+    const bytes = readFileSync(file);
+    let end = bytes.length;
+    while (end > 0 && bytes[end - 1] === 0)
+        end--;
+    if (end === bytes.length)
+        return 0;
+    writeFileSync(file, bytes.subarray(0, end));
+    return bytes.length - end;
+}
+/** `^INSERT INTO ` lines — one per row in a `wrangler d1 export --no-schema` dump. */
+export const insertLines = (dump) => (dump.match(/^INSERT INTO /gm) ?? []).length;
 /**
  * The tables a snapshot carries, from D1's own `sqlite_master` rows — every real table, and
  * none of what cannot or must not be re-inserted: a virtual table and its shadows (`_config`,
@@ -123,50 +165,82 @@ export async function pullD1ToSqlite(options) {
         throw new Error(`D1 lists no \`${options.requiredTable}\` table (saw: ${rows.map((r) => r.name).join(', ') || 'nothing'})`);
     }
     let sql = '';
-    for (const table of tables) {
-        const dump = `${destination}.${table}.sql`;
-        // 🔴 `wrangler d1 export` has been measured answering SUCCESS and writing no file —
-        // collections' nightly of 2026-09-23T15:35Z refused on `derivative_retries`, and the same
-        // command wrote the file (32 bytes, an empty table) an hour later. So a missing file is
-        // asked for again, twice, before it is a refusal; a failure that persists still refuses,
-        // because a snapshot missing a table is not a backup.
-        let exported = { code: 1, stdout: '', stderr: 'not attempted' };
-        for (let attempt = 1; attempt <= EXPORT_ATTEMPTS; attempt++) {
-            exported = wrangler(['d1', 'export', database, '--remote', '--env=', '--table', table, '--no-schema', '--output', dump, '-y']);
-            if (exported.code !== 0 || existsSync(dump))
-                break;
+    const dumps = [];
+    try {
+        for (const table of tables) {
+            const dump = `${destination}.${table}.sql`;
+            // 🔴 `wrangler d1 export` has been measured answering SUCCESS and writing no file —
+            // collections' nightly of 2026-09-23T15:35Z refused on `derivative_retries`, and the same
+            // command wrote the file (32 bytes, an empty table) an hour later. So a missing file is
+            // asked for again, twice, before it is a refusal; a failure that persists still refuses,
+            // because a snapshot missing a table is not a backup.
+            let exported = { code: 1, stdout: '', stderr: 'not attempted' };
+            for (let attempt = 1; attempt <= EXPORT_ATTEMPTS; attempt++) {
+                exported = wrangler(['d1', 'export', database, '--remote', '--env=', '--table', table, '--no-schema', '--output', dump, '-y']);
+                if (exported.code !== 0 || existsSync(dump))
+                    break;
+            }
+            if (exported.code !== 0) {
+                throw new Error(`wrangler d1 export --table ${table} failed: ${exported.stderr.trim() || exported.stdout.trim()}`);
+            }
+            if (!existsSync(dump)) {
+                throw new Error(`wrangler d1 export --table ${table} reported success ${EXPORT_ATTEMPTS} times and wrote no file at ${dump}`);
+            }
+            stripTrailingNuls(dump);
+            const text = readFileSync(dump, 'utf8');
+            dumps.push({ table, text });
+            sql += `${text}\n`;
         }
-        if (exported.code !== 0) {
-            throw new Error(`wrangler d1 export --table ${table} failed: ${exported.stderr.trim() || exported.stdout.trim()}`);
+        if (!/INSERT INTO/i.test(sql)) {
+            throw new Error('the D1 export contains no rows — refusing to snapshot an empty database as if it were the library');
         }
-        if (!existsSync(dump)) {
-            throw new Error(`wrangler d1 export --table ${table} reported success ${EXPORT_ATTEMPTS} times and wrote no file at ${dump}`);
+        const db = new Database(destination, { create: true });
+        try {
+            // `exec`, not `run`: each is many statements and `run` would execute only the first,
+            // leaving a file with a schema and no rows that looks perfectly valid.
+            db.exec(options.schemaSql);
+            // 🔴 A table D1 holds that the schema does not declare is created from D1's OWN DDL, never
+            // dropped: measured on music's first post-cutover pull (2026-09-23), `art_lookups` — a
+            // cache its art job creates where it first needs it — made the whole pull refuse with
+            // `no such table`, because its rows were exported and its table was not in the schema.
+            const have = new Set(db.query("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((r) => r.name));
+            for (const row of rows) {
+                if (!tables.includes(row.name) || have.has(row.name) || !row.sql)
+                    continue;
+                db.exec(row.sql.replace(/^\s*CREATE\s+TABLE\s+(?!IF\s+NOT\s+EXISTS)/i, 'CREATE TABLE IF NOT EXISTS '));
+            }
+            // One table at a time, so a fault is located rather than smeared over the whole load.
+            for (const { text } of dumps)
+                if (text.trim())
+                    db.exec(text);
+            if (options.afterLoadSql)
+                db.exec(options.afterLoadSql);
+            // 🔴 Every table holds as many rows as its dump has INSERTs, or this is not a backup: the
+            // check that makes a silently truncated load — the NUL padding, or whatever does it next —
+            // a REFUSAL. A row count only; nothing here reads what the rows hold.
+            const short = [];
+            for (const { table, text } of dumps) {
+                if (table === 'sqlite_sequence')
+                    continue;
+                const expected = insertLines(text);
+                const loaded = db.query(`SELECT COUNT(*) AS n FROM "${table.replaceAll('"', '""')}"`).get().n;
+                if (loaded < expected)
+                    short.push(`${table}: ${loaded} of ${expected}`);
+            }
+            if (short.length > 0) {
+                db.close();
+                rmSync(destination, { force: true });
+                throw new Error(`the D1 pull did not load every exported row — ${short.join('; ')}. Refusing the snapshot.`);
+            }
         }
-        sql += `${readFileSync(dump, 'utf8')}\n`;
-    }
-    if (!/INSERT INTO/i.test(sql)) {
-        throw new Error('the D1 export contains no rows — refusing to snapshot an empty database as if it were the library');
-    }
-    const db = new Database(destination, { create: true });
-    try {
-        // `exec`, not `run`: each is many statements and `run` would execute only the first,
-        // leaving a file with a schema and no rows that looks perfectly valid.
-        db.exec(options.schemaSql);
-        // 🔴 A table D1 holds that the schema does not declare is created from D1's OWN DDL, never
-        // dropped: measured on music's first post-cutover pull (2026-09-23), `art_lookups` — a
-        // cache its art job creates where it first needs it — made the whole pull refuse with
-        // `no such table`, because its rows were exported and its table was not in the schema.
-        const have = new Set(db.query("SELECT name FROM sqlite_master WHERE type = 'table'").all().map((r) => r.name));
-        for (const row of rows) {
-            if (!tables.includes(row.name) || have.has(row.name) || !row.sql)
-                continue;
-            db.exec(row.sql.replace(/^\s*CREATE\s+TABLE\s+(?!IF\s+NOT\s+EXISTS)/i, 'CREATE TABLE IF NOT EXISTS '));
+        finally {
+            db.close();
         }
-        db.exec(sql);
-        if (options.afterLoadSql)
-            db.exec(options.afterLoadSql);
     }
     finally {
-        db.close();
+        // The per-table dumps are a second, unmanaged copy of the data that no retention rule
+        // would ever delete — eighteen were found beside vault's snapshot (task 2128).
+        for (const table of tables)
+            rmSync(`${destination}.${table}.sql`, { force: true });
     }
 }

package/dist/server/master-lock/accountsPage.js

@@ -33,7 +33,7 @@
  * only be watching one of them.
  */
 import { MASTER_LOCK_PATHS, MASTER_LOCK_PREFIX } from "cursedbelt-core/master-lock";
-import { MASTER_LOCK_DERIVE_SOURCE } from "./lockPage.js";
+import { MASTER_LOCK_DERIVE_SOURCE, MASTER_LOCK_REVEAL_SOURCE, withRevealToggles } from "./lockPage.js";
 /**
  * The page's own two assets.
  *
@@ -59,7 +59,7 @@ export const MASTER_LOCK_MIN_PASSWORD_LENGTH = 10;
 export function accountsPageHtml(options) {
     const label = escapeHtml(options.appLabel);
     const min = MASTER_LOCK_MIN_PASSWORD_LENGTH;
-    return `<!doctype html>
+    return withRevealToggles(`<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
@@ -156,7 +156,7 @@ export function accountsPageHtml(options) {
 <script type="module" src="${MASTER_LOCK_ACCOUNTS_PAGE_PATHS.script}"></script>
 </body>
 </html>
-`;
+`);
 }
 /**
  * The page-specific stylesheet. Loaded AFTER `lock.css` and inheriting every `--ml-*` token
@@ -212,6 +212,10 @@ const MIN_LENGTH = ${MASTER_LOCK_MIN_PASSWORD_LENGTH};
 // ── derivation ───────────────────────────────────────────────────────────────
 ${MASTER_LOCK_DERIVE_SOURCE}
 
+// ── show / hide ──────────────────────────────────────────────────────────────
+${MASTER_LOCK_REVEAL_SOURCE}
+wireMasterLockReveal(document);
+
 const rotateForm = document.getElementById("ml-rotate");
 const addForm = document.getElementById("ml-add");
 const list = document.getElementById("ml-accounts");

package/dist/server/master-lock/lockPage.d.ts

@@ -21,7 +21,26 @@ export interface LockPageOptions {
  */
 export declare function lockPageHtml(options: LockPageOptions): string;
 /** The stylesheet. Follows the viewer's theme and commits to nothing else. */
-export declare const LOCK_STYLE = ":root{color-scheme:light dark;\n  --ml-bg:#f4f5f7;--ml-card:#ffffff;--ml-text:#14171c;--ml-muted:#69707c;--ml-border:#d9dde3;\n  --ml-accent:#1f6feb;--ml-accent-text:#ffffff;--ml-danger:#b42318;\n  --ml-shadow:0 18px 48px rgba(16,18,22,.14)}\n@media (prefers-color-scheme:dark){:root{\n  --ml-bg:#0d0f13;--ml-card:#171a20;--ml-text:#e7eaef;--ml-muted:#8b93a1;--ml-border:#2b3039;\n  --ml-accent:#4f8cf7;--ml-accent-text:#0b0d11;--ml-danger:#f97066;\n  --ml-shadow:0 18px 48px rgba(0,0,0,.55)}}\n*{box-sizing:border-box}\nbody{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:24px;\n  background:var(--ml-bg);color:var(--ml-text);\n  font:15px/1.55 ui-sans-serif,system-ui,-apple-system,\"Segoe UI\",sans-serif}\n.card{width:100%;max-width:23rem;background:var(--ml-card);border:1px solid var(--ml-border);\n  border-radius:16px;padding:28px 26px 24px;box-shadow:var(--ml-shadow);text-align:center}\n.glyph{font-size:30px;line-height:1;margin-bottom:10px}\nh1{margin:0 0 6px;font-size:18px;font-weight:650;letter-spacing:-.01em}\n.note{margin:0 0 20px;font-size:13px;color:var(--ml-muted)}\n.field{display:block;text-align:left;margin-bottom:14px}\n.field span{display:block;font-size:12px;font-weight:600;color:var(--ml-muted);margin-bottom:6px}\ninput{width:100%;height:40px;padding:0 12px;border:1px solid var(--ml-border);border-radius:9px;\n  background:var(--ml-bg);color:inherit;font:inherit}\ninput:focus{outline:2px solid var(--ml-accent);outline-offset:1px;border-color:transparent}\nbutton{width:100%;height:40px;border:0;border-radius:9px;background:var(--ml-accent);\n  color:var(--ml-accent-text);font:inherit;font-weight:600;cursor:pointer}\nbutton[disabled]{opacity:.6;cursor:progress}\n.status{margin:14px 0 0;min-height:1.2em;font-size:12.5px;color:var(--ml-muted)}\n.status[data-tone=\"error\"]{color:var(--ml-danger)}\n.field span em{font-style:normal;font-weight:500;text-transform:none;opacity:.7}\nbutton.quiet{margin-top:10px;height:32px;background:none;color:var(--ml-muted);font-weight:500;\n  font-size:12.5px;text-decoration:underline;text-underline-offset:3px}\nbutton.quiet:hover{color:var(--ml-text)}\nbutton.quiet[disabled]{opacity:.5}\n.hints{margin:10px 0 0;padding:12px 14px;text-align:left;border:1px solid var(--ml-border);\n  border-radius:10px;background:var(--ml-bg);font-size:12.5px}\n.hints dt{font-weight:650;color:var(--ml-text)}\n.hints dd{margin:2px 0 10px;color:var(--ml-muted);overflow-wrap:anywhere}\n.hints dd:last-child{margin-bottom:0}\n";
+export declare const LOCK_STYLE = ":root{color-scheme:light dark;\n  --ml-bg:#f4f5f7;--ml-card:#ffffff;--ml-text:#14171c;--ml-muted:#69707c;--ml-border:#d9dde3;\n  --ml-accent:#1f6feb;--ml-accent-text:#ffffff;--ml-danger:#b42318;\n  --ml-shadow:0 18px 48px rgba(16,18,22,.14)}\n@media (prefers-color-scheme:dark){:root{\n  --ml-bg:#0d0f13;--ml-card:#171a20;--ml-text:#e7eaef;--ml-muted:#8b93a1;--ml-border:#2b3039;\n  --ml-accent:#4f8cf7;--ml-accent-text:#0b0d11;--ml-danger:#f97066;\n  --ml-shadow:0 18px 48px rgba(0,0,0,.55)}}\n*{box-sizing:border-box}\nbody{margin:0;min-height:100vh;display:flex;align-items:center;justify-content:center;padding:24px;\n  background:var(--ml-bg);color:var(--ml-text);\n  font:15px/1.55 ui-sans-serif,system-ui,-apple-system,\"Segoe UI\",sans-serif}\n.card{width:100%;max-width:23rem;background:var(--ml-card);border:1px solid var(--ml-border);\n  border-radius:16px;padding:28px 26px 24px;box-shadow:var(--ml-shadow);text-align:center}\n.glyph{font-size:30px;line-height:1;margin-bottom:10px}\nh1{margin:0 0 6px;font-size:18px;font-weight:650;letter-spacing:-.01em}\n.note{margin:0 0 20px;font-size:13px;color:var(--ml-muted)}\n.field{display:block;text-align:left;margin-bottom:14px}\n.field span{display:block;font-size:12px;font-weight:600;color:var(--ml-muted);margin-bottom:6px}\ninput{width:100%;height:40px;padding:0 12px;border:1px solid var(--ml-border);border-radius:9px;\n  background:var(--ml-bg);color:inherit;font:inherit}\ninput:focus{outline:2px solid var(--ml-accent);outline-offset:1px;border-color:transparent}\nbutton{width:100%;height:40px;border:0;border-radius:9px;background:var(--ml-accent);\n  color:var(--ml-accent-text);font:inherit;font-weight:600;cursor:pointer}\nbutton[disabled]{opacity:.6;cursor:progress}\n.status{margin:14px 0 0;min-height:1.2em;font-size:12.5px;color:var(--ml-muted)}\n.status[data-tone=\"error\"]{color:var(--ml-danger)}\n.field span em{font-style:normal;font-weight:500;text-transform:none;opacity:.7}\nbutton.quiet{margin-top:10px;height:32px;background:none;color:var(--ml-muted);font-weight:500;\n  font-size:12.5px;text-decoration:underline;text-underline-offset:3px}\nbutton.quiet:hover{color:var(--ml-text)}\nbutton.quiet[disabled]{opacity:.5}\n.hints{margin:10px 0 0;padding:12px 14px;text-align:left;border:1px solid var(--ml-border);\n  border-radius:10px;background:var(--ml-bg);font-size:12.5px}\n.hints dt{font-weight:650;color:var(--ml-text)}\n.hints dd{margin:2px 0 10px;color:var(--ml-muted);overflow-wrap:anywhere}\n.hints dd:last-child{margin-bottom:0}\n.secret{position:relative;display:block}\n.secret input{padding-right:68px}\n.secret .reveal{position:absolute;right:5px;top:50%;transform:translateY(-50%);width:auto;height:30px;\n  min-width:56px;padding:0 10px;border-radius:7px;background:none;color:var(--ml-muted);\n  font-size:12.5px;font-weight:600}\n.secret .reveal:hover{color:var(--ml-text);background:var(--ml-card)}\n.secret .reveal:focus-visible{outline:2px solid var(--ml-accent);outline-offset:1px}\n";
+/**
+ * 🔴 Every password field on the wall gets a Show/Hide control (task 077-438's library share) — a
+ * master password is long, typed once and never recoverable, and a typo in "choose" is a lock-out.
+ *
+ * Markup: {@link withRevealToggles} wraps each `type="password"` input in `.secret` with a
+ * `<button type="button" data-reveal>` after it — the inputs keep every attribute, `autocomplete`
+ * included, so a password manager still sees a password field. Behaviour:
+ * {@link MASTER_LOCK_REVEAL_SOURCE}, interpolated into BOTH same-origin scripts, because the wall's
+ * CSP is `script-src 'self'` and allows no inline script (`MASTER_LOCK_CSP`, pinned by
+ * `beaconNeverReachesTheWall.spec.ts`). Nothing about the CSP changes for this.
+ */
+export declare function withRevealToggles(html: string): string;
+/**
+ * The toggle's behaviour, as browser source. It flips the input BEFORE it to `text` and back,
+ * keeps `aria-pressed`/`aria-label` true to what is on screen, and returns every field to
+ * `password` when its form submits — so a manager saving the credential sees a password field.
+ * Publishes itself on `globalThis`, the seam `lockPage.spec.ts` drives it through.
+ */
+export declare const MASTER_LOCK_REVEAL_SOURCE = "function wireMasterLockReveal(doc) {\n  const buttons = doc.querySelectorAll(\"[data-reveal]\");\n  for (const button of buttons) {\n    const input = button.previousElementSibling;\n    if (!input || input.tagName !== \"INPUT\") continue;\n    const show = (on) => {\n      input.type = on ? \"text\" : \"password\";\n      button.setAttribute(\"aria-pressed\", on ? \"true\" : \"false\");\n      button.setAttribute(\"aria-label\", on ? \"Hide password\" : \"Show password\");\n      button.textContent = on ? \"Hide\" : \"Show\";\n    };\n    button.addEventListener(\"click\", () => {\n      show(input.type === \"password\");\n      input.focus();\n    });\n    input.form?.addEventListener(\"submit\", () => show(false), true);\n  }\n  return buttons.length;\n}\nglobalThis.wireMasterLockReveal = wireMasterLockReveal;";
 /**
  * 🔴 The ONE browser copy of `deriveMasterLockVerifier`, shared by every page this feature
  * serves. Pinned by `lockPage.spec.ts`, which evaluates it and compares against the

package/dist/server/master-lock/lockPage.js

@@ -41,7 +41,7 @@ export function lockPageHtml(options) {
                 "Choose one now. Nobody else can see it and nobody else can reset it — " +
                 "if you forget it, it cannot be recovered, so leave yourself a hint."
             : "This site is locked. Signing in is not enough — enter the master password to continue."));
-    return `<!doctype html>
+    return withRevealToggles(`<!doctype html>
 <html lang="en">
 <head>
 <meta charset="utf-8">
@@ -88,7 +88,7 @@ export function lockPageHtml(options) {
 <script type="module" src="${MASTER_LOCK_PATHS.script}"></script>
 </body>
 </html>
-`;
+`);
 }
 /** The stylesheet. Follows the viewer's theme and commits to nothing else. */
 export const LOCK_STYLE = `:root{color-scheme:light dark;
@@ -128,7 +128,54 @@ button.quiet[disabled]{opacity:.5}
 .hints dt{font-weight:650;color:var(--ml-text)}
 .hints dd{margin:2px 0 10px;color:var(--ml-muted);overflow-wrap:anywhere}
 .hints dd:last-child{margin-bottom:0}
+.secret{position:relative;display:block}
+.secret input{padding-right:68px}
+.secret .reveal{position:absolute;right:5px;top:50%;transform:translateY(-50%);width:auto;height:30px;
+  min-width:56px;padding:0 10px;border-radius:7px;background:none;color:var(--ml-muted);
+  font-size:12.5px;font-weight:600}
+.secret .reveal:hover{color:var(--ml-text);background:var(--ml-card)}
+.secret .reveal:focus-visible{outline:2px solid var(--ml-accent);outline-offset:1px}
 `;
+/**
+ * 🔴 Every password field on the wall gets a Show/Hide control (task 077-438's library share) — a
+ * master password is long, typed once and never recoverable, and a typo in "choose" is a lock-out.
+ *
+ * Markup: {@link withRevealToggles} wraps each `type="password"` input in `.secret` with a
+ * `<button type="button" data-reveal>` after it — the inputs keep every attribute, `autocomplete`
+ * included, so a password manager still sees a password field. Behaviour:
+ * {@link MASTER_LOCK_REVEAL_SOURCE}, interpolated into BOTH same-origin scripts, because the wall's
+ * CSP is `script-src 'self'` and allows no inline script (`MASTER_LOCK_CSP`, pinned by
+ * `beaconNeverReachesTheWall.spec.ts`). Nothing about the CSP changes for this.
+ */
+export function withRevealToggles(html) {
+    return html.replace(/(<input\b[^>]*\btype="password"[^>]*>)/g, '<span class="secret">$1<button type="button" class="reveal" data-reveal aria-label="Show password" aria-pressed="false">Show</button></span>');
+}
+/**
+ * The toggle's behaviour, as browser source. It flips the input BEFORE it to `text` and back,
+ * keeps `aria-pressed`/`aria-label` true to what is on screen, and returns every field to
+ * `password` when its form submits — so a manager saving the credential sees a password field.
+ * Publishes itself on `globalThis`, the seam `lockPage.spec.ts` drives it through.
+ */
+export const MASTER_LOCK_REVEAL_SOURCE = `function wireMasterLockReveal(doc) {
+  const buttons = doc.querySelectorAll("[data-reveal]");
+  for (const button of buttons) {
+    const input = button.previousElementSibling;
+    if (!input || input.tagName !== "INPUT") continue;
+    const show = (on) => {
+      input.type = on ? "text" : "password";
+      button.setAttribute("aria-pressed", on ? "true" : "false");
+      button.setAttribute("aria-label", on ? "Hide password" : "Show password");
+      button.textContent = on ? "Hide" : "Show";
+    };
+    button.addEventListener("click", () => {
+      show(input.type === "password");
+      input.focus();
+    });
+    input.form?.addEventListener("submit", () => show(false), true);
+  }
+  return buttons.length;
+}
+globalThis.wireMasterLockReveal = wireMasterLockReveal;`;
 /**
  * 🔴 The ONE browser copy of `deriveMasterLockVerifier`, shared by every page this feature
  * serves. Pinned by `lockPage.spec.ts`, which evaluates it and compares against the
@@ -179,6 +226,10 @@ export const LOCK_SCRIPT = `const paths = ${JSON.stringify(MASTER_LOCK_PATHS)};
 // ── derivation ───────────────────────────────────────────────────────────────
 ${MASTER_LOCK_DERIVE_SOURCE}
 
+// ── show / hide ──────────────────────────────────────────────────────────────
+${MASTER_LOCK_REVEAL_SOURCE}
+wireMasterLockReveal(document);
+
 const form = document.getElementById("ml-form");
 const input = document.getElementById("ml-input");
 const confirmInput = document.getElementById("ml-confirm");

package/dist/server/requestLog/requestMetrics.d.ts

@@ -0,0 +1,91 @@
+/**
+ * `cursedbelt-server/request-log` — the request log, "is this app healthy": one row per request
+ * served, in `<APP_DATA_DIR>/metrics.sqlite`, the file station's Metrics page reads for every app on
+ * this Mac (`apps/station/src/server/fleetMetrics.ts`, `METRICS_DB`).
+ *
+ * ── Why it is here (4.21.0) ─────────────────────────────────────────────────
+ * `apps/family` and `apps/roms` held this module byte-identically (task 265's rollout), and
+ * `check-copies` counted it as five copy groups. The API, the header marker and the migration name
+ * are exactly the apps' — a live corpus is recognised by `METRICS_APPLICATION_ID` and by the
+ * `0001_request_metrics` row in its migrations table, so changing either would make every
+ * existing `metrics.sqlite` look inherited and archive it. Bun-only (`bun:sqlite`, `node:fs`): under
+ * Node the export map routes this subpath to `_bunOnly.js`, the way `./engagement` does; it is NOT
+ * part of `./telemetry`, which is Worker-safe (`telemetryIsWorkerSafe.spec.ts`).
+ *
+ * ── Why it came back, 2026-09-23 (task 265) ─────────────────────────────────
+ * `serve.ts` once recorded that request metrics were GONE, on the grounds that the
+ * console that read them was in the retired generation. Station reads them now, and
+ * a measurement found that all eight apps recorded nothing while their
+ * `metrics.sqlite` files — the RETIRED instances' history, inherited at graduation —
+ * rendered as a corpus that had simply gone quiet. This mounts `cursedbelt-server`'s
+ * own seam (`requestLogger` through `createTelemetrySink`, the modules the Worker-safe
+ * `cursedbelt-server/telemetry` leaf re-exports).
+ *
+ * ── 🔴 The inherited file is ARCHIVED, never written ────────────────────────
+ * The file already at `metrics.sqlite` on the live machine is a previous
+ * generation's history under a different schema (`id INTEGER AUTOINCREMENT` plus
+ * `ip`/`country`/`city`/`device`/`form`; this writer inserts `id TEXT` plus
+ * `user_id`). Appending to it would make every future measurement unreadable, so
+ * {@link retireInheritedCorpus} runs at every boot, BEFORE the database is opened:
+ *
+ *   - a file that carries {@link METRICS_APPLICATION_ID} in its header is this
+ *     writer's own, and is left alone — so a second boot is a no-op;
+ *   - anything else is RENAMED, with its `-wal`/`-shm` sidecars, to
+ *     `metrics.retired.sqlite` — or `metrics.retired-2.sqlite`, `-3`, … when that
+ *     name is taken, so two inherited corpora are both kept and nothing is ever
+ *     overwritten. A rename touches no byte of the file, which is the point.
+ *
+ * The marker lives in the SQLite header (`PRAGMA application_id`, offset 68) so it
+ * can be read without opening the database — opening an inherited WAL database
+ * read-write would checkpoint into it on close, which IS writing into it. The
+ * migration checkpoints after stamping it, so the marker is on disk before the
+ * first request is recorded and a crash cannot leave a fresh corpus that the next
+ * boot mistakes for an inherited one.
+ *
+ * ── 🔴 No user id, ever ─────────────────────────────────────────────────────
+ * `cursedbelt-server/engagement`'s header states the split: `metrics/` promises it
+ * holds NO user id, in every app; `engagement.sqlite` is the user-keyed store. The
+ * writer's schema has a `user_id` column and `requestLogger` fills it from
+ * `c.get("userId")`, so the sink here nulls it on every event — whatever any future
+ * middleware puts on the context — and the logger is given no database of its own,
+ * which means it writes no `event_logs` rows either (those carry a `user_id` too,
+ * and nothing in this generation reads them).
+ *
+ * ── Never takes the app down ────────────────────────────────────────────────
+ * {@link openRequestMetricsFromEnv} catches everything and says so on stderr: an
+ * app that cannot record its traffic must still SERVE it. What catches an app that
+ * silently STOPS recording is `requestMetrics.test.ts`, which drives `/healthz`
+ * through a real server and fails when no row lands — `requestMetrics.spec.ts` here, and each
+ * app's own test through its own `createServer`.
+ */
+import { Database } from "bun:sqlite";
+import type { MiddlewareHandler } from "hono";
+import { type TelemetrySink } from "../metrics/telemetrySink.js";
+/** The file station reads, inside the app's data directory. */
+export declare const METRICS_DB = "metrics.sqlite";
+/** Where an inherited corpus is moved to — the first free of this and `metrics.retired-<n>.sqlite`. */
+export declare const RETIRED_METRICS_DB = "metrics.retired.sqlite";
+/**
+ * Move an inherited `metrics.sqlite` out of the way, or do nothing. Returns the
+ * path it was archived to, or null when there was nothing to archive. See the
+ * header: never writes a byte of the file, never overwrites anything, idempotent.
+ */
+export declare function retireInheritedCorpus(dir: string): string | null;
+export interface RequestMetrics {
+    db: Database;
+    /** Pending rows are flushed on a 1.5 s timer; `flush()` forces it (tests, shutdown). */
+    sink: TelemetrySink;
+    /** Register FIRST — ahead of every route it must see. */
+    middleware: MiddlewareHandler;
+    /** Where an inherited corpus went at this boot, if one was found. */
+    archived: string | null;
+}
+/** Open the corpus in `dir` and build the logger that writes into it. */
+export declare function openRequestMetrics(dir: string): RequestMetrics;
+/**
+ * The request log for a DEPLOYED instance, or null. Deployed means `APP_DATA_DIR`
+ * is set (the launchd plist sets it) and no test runner is in charge. A dev shell
+ * records nothing rather than appending a developer's clicks to the live corpus.
+ * Never throws: a failure is one stderr line and an app that serves unmeasured.
+ */
+export declare function openRequestMetricsFromEnv(name: string, env: NodeJS.ProcessEnv): RequestMetrics | null;