Partial-render residual: chrome mounts but content does not, so gaps.length==0 yields a false fixed
Nobody has claimed this yet.
Assessment
- Difficulty
- 5/5
- Estimated time
- Over a week
- Newbie friendliness
- 38/100
- Issue type
- Feature
- Clarity
- Mostly clear
- Activity status
- Quiet
- Tech stack
- playwright, typescript
- Domain
- accessibility, testing-qa
Research direction
Start by reading markUnseenScreens, runProviders, and the gate that builds cleanlyScannedScreens; the issue describes the reproduced case but names no file or test. Reproduce the partial render where chrome mounts and content does not, then weigh a deterministic content or control signal for flagging it unseen and adding a gap. Done means the affected screen cannot produce a false fixed verdict, without making results depend on timing or DOM order.
Written by the indexing model from the issue text.
Description
What this is
An accepted, documented residual of the #164 fix (no fixed on unscanned screens), filed so it
is visible rather than living only in a code comment. It is invariant-5 surface (a false green),
and it is a pre-existing weakness of gaps.length === 0 as a proxy for "this screen was measured."
#164 narrows the false-fixed population and does not widen it, so this is tracked, not a blocker.
The residual
cleanlyScannedScreens is built from scanned screens with gaps.length === 0. The gate treats
membership in that set as "the screen was genuinely measured this run," and only there does it mark
a disappeared floored identity fixed.
A screen whose chrome mounts but whose content region silently fails to mount defeats the proxy.
The keyboard walk lands on a real control, so isBodyOnly does not fire. No provider is denied or
throws, so runProviders records no gap. The affected content never renders, so its floored
identity is absent from the drafts. The screen therefore has zero gaps, enters
cleanlyScannedScreens, and the floored identity on the missing content is claimed fixed. That
is "absence of evidence read as evidence of absence," surviving at a narrower scope than before
#164.
Reproduced
Driven end to end through the real makeCheckRunner, makeConcreteStepRunner, markUnseenScreens,
and the gate during the #164 security review:
scan gaps: 0 stops: 1 drafts: 0
flagged unseen: [] gaps after unseen pass: 0
cleanlyScannedScreens: [ 'orders' ]
FALSE FIXED on partially-rendered screen: 1 [ 'orders/button-name' ]
Why it is not fixed in #164
The signal that would catch it, a genuine "content mounted" marker, is one the gate does not have.
markUnseenScreens detects only body-only blanks and duplicate renders; runProviders gaps only
on denied or thrown providers. A partial render with surviving chrome trips none of them. Closing
it needs a partial-render detector in markUnseenScreens, which is its own change, not a tweak to
the #164 guard.
Before #164 the gate marked fixed for any absent floored identity with no scan check at all, so a
completely unscanned floored screen got a false fixed. #164 excludes unscanned screens, gapped
screens, and body-only blanks. This partial-render case is the strict subset that remains.
Fix direction, if it is worth the cost
Add a partial-render detector to markUnseenScreens: a screen that reports a control count or a
content-region signal below a floor for its surface is flagged unseen and gets a gap, which removes
it from cleanlyScannedScreens. Whatever the detector, it must be deterministic, because a verdict
that depends on it must not depend on timing or DOM iteration order. This reintroduces some of the
per-application coupling the heuristics exist to avoid, so it is a tradeoff to weigh, not an obvious
win. This issue keeps it visible.
Origin
Found and reproduced in Chromium during the #164 security review. Accepted residual, not a blocker
for #164.
- Dominant language
- TypeScript
- Stars
- 0
- Forks
- 0
- Avg merge
- 2h 48m
- Merged PRs (30d)
- 8
Getting set up
- No Dockerfile or Docker Compose file
- Has a pull request template
- No contributing guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from usabl-dev/usabl
-
area: engine bug
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
-
Stop hook allows a stop on an unknown verdict, and the self-check prints IDLE for a null verdictOpenarea: assistants bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
-
area: engine bug security
Difficulty 2/5 1-3 hours Newbie friendliness 72/100
-
Overlay: browser context failures are counted per plugin, not per browser, and close is not sharedOpenarea: overlay bug
Difficulty 2/5 1-3 hours Newbie friendliness 64/100
-
area: engine enhancement performance
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
Similar issues
-
level/task type/bug
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
wazuh/wazuh-dashboard-plugins#9508 ·
Maintainers usually reply within 1 day
-
Testnet EOL page links Zonescan mainnetPossibly taken @napelvs claimed this today. Open
Difficulty 1/5 Under an hour Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Azure-Samples/azure-search-openai-demo#3249 ·
Maintainers usually reply within 1 day
-
[Docs] docs/architecture.mermaid leaves out 21 of the 51 src/ directoriesPossibly taken @uyg7x claimed this today. Open
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
Maintainers usually reply within 1 day
-
enhancement status:needs-triage
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
dongdongbh/Mindwtr#1438 ·
Maintainers usually reply within 1 day