Teardown

A resto-mod gets pulled apart on a lift before anyone trusts it on the road. This site got the same treatment. Fable 5 ran a multi-agent audit over the whole thing, eight finders sweeping in parallel, and handed every finding to a skeptic that tried to refute it before it counted. Here is what came back, and what changed. Before on the left, after on the right.

The harness: eight finders (payload, caching, two consistency passes, compatibility fallbacks, frontier adoption, perceived speed, live behavior), then one adversarial verifier per finding that re-read the code or re-hit the live URL and tried to prove it wrong. Sixty agents in all. Every claim below survived a second pass.

Actually broken2 × correctness

const res = await env.ASSETS.fetch(request);
// only rewrote the cache header on a 4xx/5xx
if (!res.ok) { /* short cache */ }
return res;  // a 200 text/html sails through

const res = await env.ASSETS.fetch(request);
const ct = res.headers.get("content-type") || "";
if (res.ok && ct.startsWith("image/")) return res;
return errorResp("not found", 404);  // no masquerade

.np-note:not(:popover-open) {
  display: none !important;
}

.np-note { display: none !important; }
.np-note:popover-open { display: flex !important; }

Made it feel fasterperceived speed

// page paints in document-scroll mode;
// the deferred nav.js flips it to the
// windowed model AFTER first paint, so
// the window visibly jumps + the taskbar
// pops in a frame or two later

/* inline, in every page's <style> */
html { height: 100dvh; overflow: hidden; }
body { height: calc(100dvh - 30px); overflow: hidden;
  display: flex; flex-direction: column; padding: 8px; }
.window > .content { flex: 1; min-height: 0; overflow: auto; }

const counterP = DO.fetch(...).then(r => r.json());
await Promise.all([assets, tracks, photos,
                   counterP, alt]);
// every visit blocks on a cross-region RTT
// for a footer pill that has a static fallback

const raw = DO.fetch(...).then(r => r.json());
const counterP = Promise.race([raw,
  new Promise(r => setTimeout(() => r(null), 75))]);
ctx.waitUntil(raw);  // increment still lands

const hit = await KV.get(key, "json");
if (hit) return hit;
return await scrapeSpotify(pid);  // 1-3s inline
// one key, expires hourly: when it lapses the
// next visitor pays the 3-tier scrape on the hot path

// value persists; a :fresh sentinel holds the hour
const hit = await getTracksSWR(env, ctx, pid);
if (hit) return hit;  // stale serves now,
                       // rescrape rides waitUntil

if (hit) {
  fetch(req).then(res => cache.put(req, res.clone()));
  return hit;  // background refetch, every view
}

if (hit) return hit;
// thumbnails are ?v=N + immutable: a refetch can
// never see new bytes, so the write was pure waste

Polishlow severity

results = items;
sel = items.length ? 0 : -1;
// the async photo/writing load re-renders and
// resets sel to 0, mid-aim, under your arrow keys

var keep = (q === lastQuery && sel >= 0) ? results[sel] : null;
results = items;
sel = keep ? indexOfIdentity(items, keep)
           : (items.length ? 0 : -1);
// only reset to top on an actual keystroke

The restverified, shipped

Smaller findings that did not need a diagram, each confirmed and fixed:

Two findings were left on the bench on purpose, the same honesty rule the rest of the site follows: no OAuth metadata where there is no authorization server, no A2A agent card where there is no Agent2Agent server. You do not advertise an engine the car does not have.

Every change above is live and committed. The harness is a workflow of finders plus adversarial verifiers, and the interesting part is that nothing reached this page until a second agent tried to tear the finding apart and failed.

← back to the garage