fix: polish & hardening — notify inbox data-id (#121), catalog empty-feed (#95), loop-lock test (#96)

[mvalancy]

Three small, independent polish/hardening follow-ups from prior Gate-1 reviews. Each was independently re-verified against the code before fixing; each ships fail-without/pass-with offline tests. No loop.sh production change; server stays zero-dep; web UI stays vanilla.

#121 — web-ui XSS defense-in-depth (notification inbox inline onclick)

What was broken: The notification inbox rendered onclick="dismissNotif('${esc(n.id)}')" (and a restore variant). esc() (textContent→innerHTML) escapes <>& but not quotes, so it gives zero protection for a value in a JS-string-in-attribute context — safety rested entirely on the server id-constraint. A latent trap: the moment an id is derived from less-constrained data it becomes stored XSS with no safety net.
Fix:

• Notification dismiss/restore buttons → data-notif-act + data-id + a delegated click handler (_onNotifAction) attached to the persistent panel element (survives the innerHTML swap in setNotifFilter, GC'd on close). No id is interpolated into inline JS.
• dl-card mini cancel/retry (web-ui/index.html ~3901) → the file's existing onclick="fn(this)" + data-* idiom (dlMiniAction(this), mirrors triggerRequestFromEl(this)). No id/type in inline JS.
• Fixed the misleading // … esc() — XSS-safe comment to state esc() does not cover the onclick case.
  Test: notifications.spec.ts +2 cases — (a) dismiss works via the new mechanism (data-notif-act/data-id present, onclick null); (b) a '+<img onerror> id neither executes (window.__xss undefined) nor breaks dismiss. Both fail without the fix (2 failed), pass with it. Full spec 9/9; Activity dl-card render test 14/14.

#95 — catalog: HTTP-200 empty feed treated as INCOMPLETE

What was broken: kiwix_catalog.py's completeness signal was exception-based. A well-formed HTTP-200 but entry-less feed for a requested language parsed to 0 rows and counted as complete → catalog_refresh_zim could atomically replace a fuller multi-language cache with the entry-less subset and silently drop that language (unlike the exception path, it did not self-preserve).
Fix: Treat 0 rows for a requested language as INCOMPLETE (return 2), counting rows per language via before = len(rows) around parse() (fires on a truly empty feed, not on cross-language duplicate URLs). Preserves #57's invariant (a partial fetch never replaces a fuller cache) and the bootstrap-empty-cache exception (stdout still carries fetched rows). Docstring updated.
Test: test-catalog-cache.sh +§8b/§8c with a fixture 200/empty feed (EMPTY_LANGS) — asserts the empty-feed refresh exits non-zero and the prior fuller cache stays byte-identical (English never dropped). 4 assertions fail without the fix (34/4), all pass with it (38/0). No real network.

#96 — test: strengthen #81 loop-lock coverage

What was broken: test-loop-lock.sh §7 grep'd 8>&- over the function body and matched the explanatory # 8>&- : … comment line too — vacuous: deleting the operative redirect still passed. And services/*.sh daemon spawns had zero functional coverage.
Fix:

• §7 now strips comment lines and anchors to the operative spawn line (setsid.*8>&- / timeout .*bash .*8>&-).
• New §6b functionally drives the real ensure_services service spawn (fake long-lived daemon, hold loop.lock on fd 8 like run_locked, assert a fresh flock -n acquires it afterward) — mirrors how §6 drives _va_start_web.
  Test: Against a mutant that drops the operative 8>&- (comment kept), the OLD bare grep passed (vacuous) while both new assertions (structural §7 + functional §6b) fail; against the shipped loop.sh, 22/22 pass. Offline/stubbed; never runs loop.sh install or touches the crontab. loop.sh itself unchanged.

Learnings baked into docs/knowledge/gotchas.md under three distinct anchors (esc-not-onclick-safe-121, catalog-empty-feed-95, grep-operative-not-comment-96).

Fixes #121
Fixes #95
Fixes #96

🤖 Generated with Claude Code