sync 1.6.43: the read table drops internal traffic; three traps (items 1-3)

ITEM 1 — ported as contract, and this host had the defect. `track_visit`
has dropped INTERNAL_UA_TOKEN since the internal-traffic contract
existed; `record_read`, the on_document_read hook the 2.8.0 floor added,
never learned it. Measured here before the fix, in-process against a
tempfile: one token-carrying probe wrote one reads row, vendor_key None,
crawler lane. The hub's sweep, this site's link audit and every
post-deploy battery have been landing there since 08-29.

The drop runs BEFORE the row is built and keys on `ua` — `user_agent` is
the VISITS row's name, and keying on it here would be a silent no-op,
which is this item's own failure mode. Verified by reading EVENT_FIELDS
out of the WHEELS rather than inferring, with `ast` rather than a regex
(a first attempt with a regex parsed a COMMENT inside the 2.9.4 tuple and
reported `ua` missing when it is present — the round's own lesson, live):
  2.8.0 local      ua=True  user_agent=False  n=15
  2.9.0 PRODUCTION ua=True  user_agent=False  n=15
  2.9.4 CI         ua=True  user_agent=False  n=16 (+vendor_class)

Correction to the drop, reported to ops: this host has THREE versions,
not a CI-vs-production pair, and production's 2.9.0 is the one neither of
the others covers. Read from the wire, not assumed — pages/home.md
carries {{VERSION:dash-improve-my-llms}}, so /llms.txt publishes what
production resolved.

Acceptance, both directions in one run with counts printed, because a
bare negative is what this round learned not to trust:
  internal-token probe : rows 0 -> 0  delta 0
  real crawler probe   : rows 0 -> 1  delta 1
tests/test_internal_traffic.py gains both as pins, plus one asserting the
package's field name is `ua` and not `user_agent`.

ITEM 2 — already-present, with the evidence the item asks for rather than
an assertion. (a) I rely on the per-call-site pin from item 18
(test_every_test_client_user_names_headers), which resolves the lane
hazard as a CLASS. (b) the `user_agent=` kwarg is portable HERE because
this fork has the conftest Client wrapper that folds it into headers.
(c) tests/test_analytics_classifier.py is present as cargo and its three
fork-owned seams were diffed against this tracker, not assumed: the
row-key set (my human row writes exactly 5 keys, all inside the asserted
bound, zero extras), flush() (no-arg, matches), and the geo switch
(ANALYTICS_GEO_LOOKUP honoured at lib/analytics_tracker.py:294).

ITEM 3 — three traps merged into .claude/CLAUDE.md's traps section, not
installed over it. The branch-timing trap is adapted: it records that
this host holds the CANONICAL red-push proof (run 33337712632) rather
than green-push timing evidence, so its `deploy: release-branch` fence
row is proven. The corpus trap names four families of silent-green
measured in this tree, three of them mine — a pytest|tail whose exit
status was tail's (and that PIPESTATUS is bash while this shell is zsh,
so the bash form expands to nothing here), a `git show && diff` that
printed "same" when the show failed, and the regex-vs-ast parse above.

Verified with exit codes rather than a grep for "passed", per item 3(c):
727 collected; flask exit=0, fastapi exit=0, quart exit=0, flake8 exit=0.
NOT PUSHED — the owner's word.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01EjfiNPKsgLwAxtN3BexPSJ

Author: pip-install-python

.claude/CLAUDE.md

@@ -143,6 +143,42 @@ they win.
   fast-forward push of the run's sha after a green matrix. `main`
   ahead of `release` is an uncertified push pending — never drift,
   never a hand deploy. Compare against `origin/release`.
+- **Which branch Render builds can be measured on a GREEN push, by
+  TIMING — but that is evidence, not proof** (leaflet, 1.6.43).
+  `main == release == wire` at every step of a promote tells you
+  nothing, because both roads end at the same sha. Sample `/healthz`
+  every ~45 s and time the swap against the **promote**, not the
+  push. The canonical discriminator is still the first push that goes
+  RED on main with `release` unmoved and the wire unchanged, and
+  THIS HOST HAS ONE — run 33337712632, 2026-08-31: ee75b5b red on
+  `ci / lint` at 21:57:01Z, promote skipped, `release` went
+  bdd8e77 → 625c91c without ever holding it, and the wire held
+  bdd8e77 across 21:54:34–22:01:29 on a ~90 s promote→wire host. The
+  `deploy: release-branch` fence row here is proven, not inferred.
+  Four forks correctly declined to call theirs proven on a green
+  push; that refusal is the standard.
+- **Verify the artifact the claim is about, and SAY WHICH ONE. When a
+  lane disagrees, THAT IS THE FINDING** (pannellum, excalidraw). Moving
+  an assertion to the lane that passes held a pin for a fortnight over
+  a corpus serving zero props. The inverse wastes more time: `curl … |
+  grep -c skip-link` returns **0** on a host where the skip link ships
+  and works, because it is a Dash component in `app.layout` — the
+  browser lane spans three artifacts (app-shell markup, the dimll
+  prerender block inside the SAME HTML, and the JS-rendered DOM) and
+  curl sees two of them.
+- **ASSERT THE CORPUS IS NON-EMPTY before trusting any negative, and
+  print the count beside the result.** A sweep that found nothing and a
+  sweep that swept nothing produce the same green. This repo's
+  `.flake8` excludes `docs/*/`, so `flake8 docs/` exits 0 on a file
+  containing `def broken(:` — not passing it, not reading it.
+  Same family, all measured in this tree: a `pytest … | tail` whose
+  exit status is `tail`'s, not pytest's (use `pytest … > log; rc=$?`
+  — and note `PIPESTATUS` is bash, `pipestatus` is zsh, so the bash
+  form silently expands to nothing here); a `git show X:f > out &&
+  diff` that printed "same" when the `show` failed and the `diff`
+  never ran; and a regex for `EVENT_FIELDS` that parsed a COMMENT
+  inside the tuple and reported a field missing that was present —
+  use `ast`, not a regex, to read a literal out of source.
 - **There is ONE classifier**, `dash_improve_my_llms.classify()`.
   `lib/analytics_tracker.py` delegates `is_bot` / `detect_bot_type`
   to it and ends with ZERO User-Agent strings; the old in-module

CHANGELOG.md

@@ -5,6 +5,47 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [llms-2plot-dev 1.6.0] - 2026-09-03
+
+**Sync 1.6.43, all three items.**
+
+### Fixed
+
+- **The read table drops internal traffic too.** `track_visit` has
+  dropped requests carrying `INTERNAL_UA_TOKEN` since the network's
+  internal-traffic contract existed; `record_read` — the
+  `on_document_read` hook added with the 2.8.0 floor — never learned it.
+  So the hub's health sweep, this site's own link audit and every
+  post-deploy battery were writing `reads` rows, and were the busiest
+  unidentified "vendor" on this host's board. Measured before the fix:
+  one token-carrying probe wrote one row, `vendor_key` null, crawler
+  lane. "Counted nowhere" now includes the read table.
+  **Reporting consequence:** read counts DROP from this release, and the
+  drop is the network's own probes leaving the numbers. The clean window
+  for this host's ledger starts 2026-09-02 (ops' fleet ruling); earlier
+  rows keep the inflation and are not being re-sent, because re-importing
+  them would re-import exactly what this fix removes.
+
+### Changed
+
+- **Three verification traps added to `.claude/CLAUDE.md`** — which
+  branch Render builds can be timed on a green push but is only PROVEN by
+  a red one (this host has that proof, run 33337712632); a disagreeing
+  lane IS the finding, and the browser lane spans three artifacts of
+  which curl sees two; and assert a corpus is non-empty before trusting
+  any negative, with four families of silent-green measured in this tree.
+
+### Notes
+
+- The drop keys on `ua`, which is what the package's `EVENT_FIELDS` calls
+  it — `user_agent` is the visits row's name and keying on it here would
+  have been a silent no-op. Verified by reading `EVENT_FIELDS` out of the
+  wheels rather than inferring: `ua` present at 2.8.0 (local), 2.9.0
+  (**what production actually resolves**) and 2.9.4 (what CI pulls from
+  the `>=2.8.0` floor); `user_agent` present at none. 2.9.4 adds
+  `vendor_class`, which this fork picks up automatically because the row
+  is built by iterating `EVENT_FIELDS`.
+
 ## [llms-2plot-dev 1.5.0] - 2026-08-31
 
 **Sync item 18 — the 1.6.41 remainder, nineteen files as one contract.**

lib/analytics_tracker.py

@@ -399,6 +399,28 @@ def record_read(self, event):
         """
         if not isinstance(event, dict):
             return
+
+        # Network machinery is never a READER either (1.6.43 item 1, note
+        # 83a). `track_visit` has dropped the internal token since the
+        # internal-traffic contract existed; this hook never learned it, so
+        # the hub's health sweep, every satellite's link audit and every
+        # post-deploy battery were landing in `reads` — measured here
+        # before the fix: one probe carrying the token wrote one row,
+        # vendor_key None, crawler lane, which made the network's own
+        # probes the busiest unidentified "vendor" on this host's board.
+        # "Counted nowhere" has to include the read table, or the contract
+        # is only half held.
+        #
+        # Keyed on `ua`, which is what `_ledger.EVENT_FIELDS` calls it —
+        # `user_agent` is the VISITS row's name and keying on it here
+        # would be a silent no-op, which is this item's own failure mode.
+        # Dropped BEFORE the row is built, so nothing about an internal
+        # request is read, let alone kept.
+        from lib.constants import INTERNAL_UA_TOKEN
+
+        if INTERNAL_UA_TOKEN in (event.get("ua") or "").lower():
+            return
+
         row = {k: event.get(k) for k in EVENT_FIELDS}
         if not KEEP_CLIENT_IP:
             row.pop("client_ip", None)

tests/test_internal_traffic.py

@@ -36,6 +36,17 @@
 # against one of those would pass no matter what the tracker did.
 PAGE = "/reference/configuration"
 
+# The READ table is written only for corpus documents the package serves
+# (`on_document_read`), never for a browser page — so the reads-side pins
+# below must ask for a machine surface, not PAGE.
+LLMS_DOC_PATH = "/llms.txt"
+
+# A real vendor, NOT carrying the internal token: the positive control for
+# the reads pins. In-process only — never send this at a live host, which
+# would write an unverified vendor row into a real ledger.
+VENDOR_UA = ("Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko; compatible; "
+             "GPTBot/1.2; +https://openai.com/gptbot)")
+
 
 def _ledger_visits():
     """Every hit on disk, flushing the write buffer first."""
@@ -47,6 +58,16 @@ def _ledger_visits():
         return []
 
 
+def _ledger_reads():
+    """Every READ row on disk, flushing first — the second table (1.6.34)."""
+    tracker.flush()
+    try:
+        with open(analytics_path()) as f:
+            return json.load(f).get("reads", [])
+    except FileNotFoundError:
+        return []
+
+
 def _rollup():
     """Today's rollup as the hub would receive it, or an all-zero stand-in."""
     from lib.traffic_rollup import daily_rollup
@@ -109,6 +130,55 @@ def test_a_crawler_shaped_probe_carrying_the_token_stays_internal(client):
     assert len(_ledger_visits()) == before
 
 
+def test_internal_ua_is_counted_nowhere_in_the_READ_table(client):
+    """"Counted nowhere" includes the read table (1.6.43 item 1, note 83a).
+
+    `track_visit` has dropped the token since this contract existed;
+    `record_read` — the `on_document_read` hook the 2.8.0 floor added —
+    did not, so the hub's health sweep, every satellite's link audit and
+    every post-deploy battery were landing in `reads`. Measured on this
+    host before the fix: one token-carrying probe wrote one row,
+    vendor_key None, crawler lane, which made the network's own probes
+    the busiest unidentified vendor on this board.
+
+    BOTH DIRECTIONS IN ONE TEST, deliberately: a drop that dropped
+    everything would pass the first assertion alone, and this round has
+    learned not to trust a bare negative. The counts are in the failure
+    messages for the same reason.
+    """
+    before = len(_ledger_reads())
+    client.get(LLMS_DOC_PATH, user_agent=internal_ua("network-smoke"))
+    client.get(LLMS_DOC_PATH, user_agent=f"{CRAWLER_UA} {INTERNAL_UA}")
+    after = len(_ledger_reads())
+    assert after == before, (
+        f"internal traffic reached the read table: {before} -> {after}"
+    )
+
+    # ... and the table is still reachable, so the assertion above is not
+    # passing because nothing can ever be written.
+    client.get(LLMS_DOC_PATH, user_agent=VENDOR_UA)
+    real = len(_ledger_reads())
+    assert real == after + 1, (
+        f"a real crawler wrote {real - after} read rows, expected 1 — the "
+        "drop is dropping everything and the pin above is vacuous"
+    )
+
+
+def test_the_read_drop_keys_on_the_packages_own_field_name(client):
+    """`EVENT_FIELDS` calls it `ua`; the visits row calls it `user_agent`.
+
+    Keying the drop on the wrong name is silently a no-op — item 1's own
+    failure mode. Verified against the wheels this host can run: `ua` is
+    in EVENT_FIELDS at 2.8.0 (local), 2.9.0 (production) and 2.9.4 (what
+    CI resolves from the >=2.8.0 floor), and `user_agent` is in none of
+    them.
+    """
+    from dash_improve_my_llms._ledger import EVENT_FIELDS
+
+    assert "ua" in EVENT_FIELDS
+    assert "user_agent" not in EVENT_FIELDS
+
+
 def test_the_token_is_matched_case_insensitively(client):
     before = len(_ledger_visits())
     client.get(PAGE, user_agent="2PLOT-INTERNAL/1.0 Health-Sweep")