Phase B/4: the inaugural CI run's three failures

The first run in this repo's history went red in three places. All three
were mine, and none were caught locally because neither lint nor the
older-Dash matrix leg had ever run here.

LINT (8 findings). Seven unused imports and a blank-line count, almost all
orphaned by edits earlier in this same phase — removing the
requires_dimll_27 marker left its `from conftest import` behind in one
file, collapsing the capability block left run.py one blank line short of
E305, and two `import` lines inside a test body outlived the code that
used them. flake8 has never run in this repo before, so nothing had swept
them.

DASH 4.4.0, BOTH BACKENDS. The matrix pins the older Dash explicitly, and
tests/test_geo_guardrail.py::test_the_nonce_mask_is_sound failed on it.
That test is the CONTROL for every byte-identical assertion in the geo
file, and I had written it to assert that two identical requests DIFFER —
true on 4.4.1, which stamps a per-request `end_id` nonce, and false on
4.4.0, which does not. A control test coupled to a Dash version fact,
failing for a reason that has nothing to do with the guardrail.

Rewritten to assert the two properties that actually matter and hold on
either version:
  1. sound — masking makes two identical requests compare equal;
  2. not over-broad — it must NOT equalise two DIFFERENT pages, which is
     the failure that would make every byte-identical test in the file
     vacuous.

Verified locally on both Dash versions this time, not just the pinned one:
  dash 4.4.0  flask 597 passed / fastapi 594 passed
  dash 4.4.1  flask 597 passed / fastapi 594 passed
  flake8 clean

The CD guard worked as designed on that first run: `deploy to render` and
`verify the live site` both skipped, so nothing was battered against a
host this repo does not own.

Author: pip-install-python

PHASE1-REPORT.md

@@ -296,7 +296,12 @@ subprocess.
   `POLICY_STORE_FILE` disk entry — deliberately, since the service does not
   exist and inventing its shape now would be guessing.
 
-**Genuinely blocked on the package publishing:**
+**Genuinely blocked on the package publishing:** — ***cleared 2026-08-23,
+see the Phase B section of [DEVELOPMENT-LOG.md](DEVELOPMENT-LOG.md).*** The
+floor moved to `>=2.7.1` (2.7.0 published 17:48Z, the 2.7.1 fast-follow
+18:24Z), the capability block is deleted, and the resolution was re-proved
+from PyPI in a fresh Python 3.12 venv.
+
 
 - The `requirements.txt` floor stays `>=2.6.1`. Every 2.7.0 call site is
   behind a `LLMS_HAS_27` **capability** probe (not a version compare, so a

README.md

@@ -151,10 +151,10 @@ The suite boots `run.py` itself rather than a test app, secretless — the
 zero-secret boot is the first invariant, and every fail-closed assertion
 depends on it.
 
-Tests that exercise `dash-improve-my-llms` 2.7.0 features carry
-`pytestmark = requires_dimll_27` and **skip** on the pinned 2.6.1 floor, so a
-clean `pip install -r requirements.txt` gives a green suite rather than a red
-one people learn to ignore.
+Every test runs unconditionally. The `requires_dimll_27` skip marker was
+removed with the floor bump: once `requirements.txt` guarantees the feature,
+a skipif that can never fire is a suite quietly overstating its own
+coverage.
 
 ---
 
@@ -212,9 +212,17 @@ reconstructed component id.
 
 ## Status
 
-`dash-improve-my-llms` **2.7.0** is not on PyPI yet. `requirements.txt` still
-floors at `>=2.6.1`, and every 2.7.0 call site is behind a capability probe
-(`LLMS_HAS_27` in `run.py`) so the app boots on either.
+`dash-improve-my-llms` **2.7.1** is on PyPI and `requirements.txt` floors
+there. The `LLMS_HAS_27` capability block that let this app boot on either
+release is gone — collapsed to a plain import, which was its stated design
+promise.
+
+**Not deployed yet.** There is no Render service, so the live half of
+`cd.yml` — the build-match wait and both live batteries — is dormant, gated
+on an unset `SITE_URL` repository variable. Setting that variable to the
+service's `.onrender.com` URL brings it up at B3; changing it to
+`https://llms.2plot.dev` at cutover is the only other edit. See the header of
+`.github/workflows/cd.yml`.
 
 | Document | What it carries |
 |---|---|

run.py

@@ -239,6 +239,7 @@ def _rate_ceiling():
         return None
     return value if value > 0 else None
 
+
 if DASH_VERSION < (4, 4):
     # Fatal only on FastAPI, where it is not a degradation but an outage:
     # 4.3.0's ASGI middleware returns before setting the request context, so

tests/test_geo_guardrail.py

@@ -23,7 +23,7 @@
 import pytest
 
 
-from conftest import BROWSER_ACCEPT, BROWSER_UA, CRAWLER_UA
+from conftest import BROWSER_UA, CRAWLER_UA
 
 DENIED = "RU"
 ALLOWED = "US"
@@ -114,16 +114,30 @@ def _get(client, path, country=None, **kwargs):
 def test_the_nonce_mask_is_sound(client):
     """The control for every byte-identical assertion in this file.
 
-    If masking `end_id` were hiding something, two identical requests would
-    still differ after the mask — and every "byte-identical" test below would
-    be vacuous.
+    Two properties, and neither depends on the Dash version. An earlier
+    version of this test asserted that two identical requests DIFFER — true
+    on Dash 4.4.1, which stamps a per-request `end_id` nonce, and false on
+    4.4.0, which does not. That made a control test fail on the matrix leg
+    pinning the older Dash, for a reason that had nothing to do with geo.
     """
     a, b = client.get("/"), client.get("/")
-    assert a.text != b.text, (
-        "two identical requests are byte-identical — the nonce mask is now "
-        "unnecessary and should be deleted rather than left hiding changes"
+
+    # 1. Sound: masking makes two identical requests compare equal, whether
+    #    or not this Dash stamps a nonce.
+    assert _stable(a.text) == _stable(b.text), (
+        "two identical requests differ even after masking — the byte-"
+        "identical assertions below cannot mean anything"
+    )
+
+    # 2. Not over-broad: it must NOT equalise genuinely different documents.
+    #    A mask that swallowed real differences would make every
+    #    byte-identical test in this file vacuous, which is the failure worth
+    #    guarding against.
+    other = client.get("/getting-started")
+    assert _stable(a.text) != _stable(other.text), (
+        "the mask equalises two different pages — it is removing more than "
+        "the nonce"
     )
-    assert _stable(a.text) == _stable(b.text)
 
 
 @pytest.mark.parametrize("label,path", SURFACES.items(), ids=list(SURFACES))

tests/test_operator_panel.py

@@ -360,8 +360,8 @@ def test_a_denied_country_gets_451_even_with_the_right_token(app_module, client,
         )
 
 
-def test_geo_denies_the_panel_before_the_token_is_even_checked(app_module, client,
-                                                              no_token):
+def test_geo_denies_the_panel_before_the_token_is_even_checked(
+        app_module, client, no_token):
     """Ordering matters: a 404 here would leak that geo runs after the gate."""
     from lib import policy_store
 

tests/test_prerender_idempotency.py

@@ -25,7 +25,6 @@
 from __future__ import annotations
 
 import json
-import os
 import subprocess
 import sys
 import textwrap

tests/test_prerender_seo.py

@@ -22,8 +22,6 @@
 import html as _html
 import re
 
-import pytest
-
 from conftest import BROWSER_UA, CRAWLER_UA
 
 PRERENDER_OPEN = '<div id="dimll-prerender"'

tests/test_social_card.py

@@ -317,9 +317,6 @@ def test_the_index_template_is_still_wired_in(app_module):
 
 def test_the_home_hero_is_the_social_card_object():
     """The hero renders from the same constant, not a second copy."""
-    import runpy
-    import dash
-
     from lib.constants import OG_IMAGE_URL
 
     source = (REPO_ROOT / "pages" / "home.py").read_text()

tests/test_vendor_policy.py

@@ -17,8 +17,6 @@
 """
 from __future__ import annotations
 
-import re
-
 import pytest