Add unique content, figure, and doc fixes on top of audit follow-ups

Layers the non-overlapping parts of a parallel audit-remediation pass
onto the editorial-registry/security/CSP work already in HEAD. Only the
items the follow-up commit did not cover are included here; redundant
work (confusable code-scoping, broad-tour focused_neighbors, security
headers, the score-registry move) is intentionally omitted in favour of
the existing implementation.

Content correctness:
- special-methods: __lt__ now orders by contents (consistent with __eq__,
  which the old length-based __lt__ contradicted) and the __hash__ cell
  demonstrates the mutable-hash hazard it warns about — a Bag found in a
  set becomes unfindable after its items change.
- subprocesses / threads-and-processes / networking: drop the duplicated
  :::unsupported block that restated the executable cell's code; each page
  keeps one verified cell whose prose carries the mechanism plus one
  honest sentence about the sandbox boundary.

Figures:
- Remove dead grammar vocabulary (open_arrow, dispatch, register(between=),
  the orphaned ARROW_OPEN constant) — no callers.
- FigureSizeContract gains a banner-height check (<=440px displayed at
  banner width); new FigureLineTextCollisionContract (Contract 12) rejects
  a solid line striking a label. The latter caught a real collision in
  control-stop-boundary (the first-true arrow clipped the 'd' label),
  fixed by starting the arrow below the cell row.

Docs:
- rubric-saturation: 124 figures / 7 reused (was 109 / 12).
- observability-spec: cleanup snippet gains the not-used guard.
- rubric-audit-2026-05-12: marked superseded; journey count 24 -> 21.
- figure-rubric documents Contract 12 and the height check.

https://claude.ai/code/session_018EpcfENTg7herPR712vZeE

Author: claude

docs/example-figure-rubric.md

@@ -161,7 +161,13 @@ the figure can merge.
 - **Banner-fit, enforced.** Every figure's RENDERED width —
   INTRINSIC_SCALE · (Canvas.w + 2 · PAD_X) — must fit the 640px
   ceiling of `.cell-banner--1` / `.journey-section-figure`
-  (`clamp(280px, 65-70vw, 640px)` in site.css). *Contract 8.*
+  (`clamp(280px, 65-70vw, 640px)` in site.css). The figure must also not
+  display taller than 440px at that banner width, or it reads as a
+  portrait column rather than a margin banner. *Contract 8.*
+- **No solid line strikes a label.** A solid `<line>` may not cross a
+  text label's interior (reads as an accidental strike-through);
+  deliberate *dashed* strikes through a label are allowed. *Contract 12
+  — FigureLineTextCollisionContract.*
 - **Twin consistency.** When two figures depict parallel concepts
   (`kw-only-separator` ↔ `positional-only-separator`,
   `class-triangle` ↔ `metaclass-triangle`), their metrics must

docs/observability-spec.md

@@ -503,7 +503,10 @@ Do not emit a second per-request log. Attach the cleanup failure to the same wid
 
 ```python
 finally:
-    if code_callback is not None and hasattr(code_callback, "destroy"):
+    # create_once_callable destroys itself after the Dynamic Loader invokes it,
+    # so destroy ONLY callbacks that went unused (e.g. cache-hit paths) to avoid
+    # false "OnceProxy has already been destroyed" cleanup errors.
+    if code_callback is not None and not code_callback_used and hasattr(code_callback, "destroy"):
         try:
             code_callback.destroy()
         except Exception as exc:

docs/rubric-audit-2026-05-12.md

@@ -1,12 +1,14 @@
 # Rubric audit snapshot — 2026-05-12
 
+> **Superseded.** This is a point-in-time snapshot. The catalog has since dropped the Workers journey (journey sections went from 24 to 21) and the figure registry grew past a one-per-slug count. The journey-section counts below have been corrected to the current 21; regenerate a fresh snapshot with `make rubric-audit` rather than trusting the rest of these frozen numbers.
+
 This snapshot audits the shipped catalog against the example, example-figure, and journey-visualisation rubrics. It records the green baseline and the accepted exception so future passes can hunt for semantic drift instead of rediscovering the same ledgers.
 
 ## Scoreboard
 
 - Examples: count=109, min=7.1, avg=8.98, median=9, below9=1, distribution=7.1 × 1, 9 × 108
 - Example diagrams: count=109, min=9, avg=9.01, median=9, below9=0, distribution=9 × 106, 9.5 × 3
-- Journey diagrams: count=24, min=9, avg=9.02, median=9, below9=0, distribution=9 × 23, 9.5 × 1
+- Journey diagrams: count=21, min=9, avg=9.02, median=9, below9=0, distribution=9 × 20, 9.5 × 1
 - Accepted waiver: `hello-world` remains intentionally tiny at 7.1.
 - Graph health: 109 linked sources, 361 edges, 0 orphaned examples.
 
@@ -54,7 +56,7 @@ This snapshot audits the shipped catalog against the example, example-figure, an
 | Grammar conformance | Shared geometry contracts | PASS |
 | Independence from lesson figures | Section figures compared with example attachments | PASS |
 | Layout fit | Journey figure dimensions within production column | PASS |
-| Outcome support | `check_journey_outcomes.py` over all 24 sections | PASS |
+| Outcome support | `check_journey_outcomes.py` over all 21 sections | PASS |
 | Prerequisite order | Journey order reviewed against lesson dependencies | PASS |
 
 ## Example and diagram inventory

docs/rubric-saturation.md

@@ -1,9 +1,9 @@
 # Rubric saturation analysis
 
-After six iteration passes, the figure system has 109 examples
-attached (one per slug on `main`) and 109 figures in
-`src/marginalia.py FIGURES`. Coverage is 100%. Distribution against
-`docs/example-figure-rubric.md`:
+After six iteration passes, the figure system attaches a figure to
+every example (one banner per slug on `main`) from the 124 paint
+functions in `src/marginalia.py FIGURES`. Coverage is 100%.
+Distribution against `docs/example-figure-rubric.md`:
 
 | band | count | composition |
 |---|---:|---|
@@ -27,10 +27,10 @@ at 8.5 by design:
 A figure loses up to 1.0 when its placeholders (`a`, `b`, `xs`) do
 not match the cell's specific names (`first`, `second`, `factor`,
 `numbers`). For a library of 109 figures across 109 cells, matching
-running variables one-for-one would require 109 bespoke paint
-functions; reuse becomes impossible. Today 12 figures are reused
-across multiple slugs precisely because they capture a *general*
-mechanism (`iter-protocol` covers `iterators`,
+running variables one-for-one would require a bespoke paint
+function per cell; reuse becomes impossible. Today 7 figures are
+reused across multiple slugs precisely because they capture a
+*general* mechanism (`iter-protocol` covers `iterators`,
 `iterator-vs-iterable`, `iterating-over-iterables`,
 `container-protocols`). Every reuse pays a tax against this
 criterion.

public/prototyping/journey-figures-gestalt.html

@@ -1,3 +1,3 @@
 # Generated by scripts/fingerprint_assets.py. Do not edit by hand.
 ASSET_PATHS = {'SITE_CSS': '/site.0c2adaa2c94a.css', 'SYNTAX_JS': '/syntax-highlight.3b6c7f730d46.js', 'EDITOR_JS': '/editor.a4a7766e1b9b.js'}
-HTML_CACHE_VERSION = '9aace8e7f09e'
+HTML_CACHE_VERSION = 'ae825b1de0bc'

public/prototyping/production-figures-gestalt.html

@@ -35,18 +35,8 @@ finally:
 ```
 :::
 
-:::unsupported
-`socketpair()` returns two connected endpoints. `sendall` writes encoded bytes into one end, and `recv` reads up to 16 bytes off the other. The byte boundary is the whole point: `"ping".encode("utf-8")` produces `b'ping'`, which is what the socket actually moves. (The in-browser Run button cannot open sockets — the sandbox disables outbound access — so pressing Run on this page fails; the verified output below comes from a real socket pair under standard CPython at build time.)
-
-```python
-left, right = socket.socketpair()
-left.sendall("ping".encode("utf-8"))
-data = right.recv(16)
-```
-:::
-
 :::cell
-The complete version adds two things: a `try`/`finally` so both endpoints close even if `recv` or the surrounding work raises, and a second `print` that `decode`s the received bytes back into a Python `str` for display. The first `print` shows the raw bytes `b'ping'`; the second shows the decoded text `ping`.
+`socketpair()` returns two connected endpoints. `sendall` writes encoded bytes into one end and `recv` reads up to 16 bytes off the other — the byte boundary is the whole point: `"ping".encode("utf-8")` produces `b'ping'`, which is what the socket actually moves. The `try`/`finally` closes both endpoints even if `recv` raises, and the second `print` `decode`s the bytes back into a Python `str`. The in-browser sandbox cannot open sockets, so pressing Run here fails; this output came from a real socket pair under standard CPython at build time.
 
 ```python
 import socket
@@ -73,5 +63,5 @@ ping
 - Network protocols move bytes, not Python `str` objects.
 - Close real sockets when finished, usually with a context manager or `finally` block.
 - Use high-level HTTP libraries for application HTTP unless socket-level control is the lesson.
-- Cloudflare Workers support HTTP-style networking through platform APIs; this example avoids outbound calls so the editable lesson stays deterministic and safe.
+- The verified output came from a real `socketpair()` under standard CPython at build time; the in-browser sandbox cannot open sockets, so live runs of this page fail there.
 :::

src/asset_manifest.py

@@ -43,7 +43,7 @@ class Bag:
         return hash(tuple(self.items))
 
     def __lt__(self, other):
-        return len(self.items) < len(other.items)
+        return self.items < other.items
 
     def __contains__(self, item):
         return item in self.items
@@ -209,7 +209,7 @@ Bag(['a', 'b'])
 :::
 
 :::cell
-`__eq__` decides what equality means for the type. Defining `__eq__` removes the default `__hash__`, so add `__hash__` back when instances should work in sets or as dict keys — but only for types treated as immutable: this `Bag` hashes its current items, so mutating one after adding it to a set makes it unfindable. `__lt__` alone is enough for `<` and for `sorted()`.
+`__eq__` decides what equality means for the type, comparing contents. `__lt__` orders by those same contents, so ordering stays consistent with equality (define one comparison and `functools.total_ordering` can fill in the rest; `__lt__` alone is enough for `<` and `sorted()`). Defining `__eq__` removes the default `__hash__`, so add it back only for types you treat as immutable: this `Bag` hashes its current items, so the last two lines show the hazard — a `Bag` found in a set becomes unfindable once its items change, because its hash no longer points at the bucket it was stored in.
 
 ```python
 class Bag:
@@ -223,17 +223,23 @@ class Bag:
         return hash(tuple(self.items))
 
     def __lt__(self, other):
-        return len(self.items) < len(other.items)
+        return self.items < other.items
 
 print(Bag(["a", "b"]) == Bag(["a", "b"]))
 print(Bag(["a"]) < Bag(["a", "b"]))
-print(hash(Bag(["a"])) == hash(Bag(["a"])))
+
+bag = Bag(["a"])
+seen = {bag}
+print(bag in seen)
+bag.items.append("b")
+print(bag in seen)
 ```
 
 ```output
 True
 True
 True
+False
 ```
 :::
 

src/example_sources/networking.md

@@ -35,21 +35,8 @@ print(result.returncode)
 ```
 :::
 
-:::unsupported
-`subprocess.run` spawns a child Python interpreter, captures its stdout and stderr (`capture_output=True`), decodes them as text (`text=True`), and raises `CalledProcessError` if the child exits non-zero (`check=True`). The returned `result` holds the captured streams and exit code as portable evidence the child ran. (The in-browser Run button cannot spawn child processes, so pressing Run on this page fails in the sandbox; the verified output below comes from standard CPython at build time.)
-
-```python
-result = subprocess.run(
-    [sys.executable, "-c", "print('child process')"],
-    text=True,
-    capture_output=True,
-    check=True,
-)
-```
-:::
-
 :::cell
-`subprocess.run()` starts a child process and waits for it. `capture_output=True` stores the child's standard output and error streams on the result object.
+`subprocess.run()` spawns a child Python interpreter and waits for it: `capture_output=True` stores the child's stdout and stderr on the result, `text=True` decodes them as strings, and `check=True` raises `CalledProcessError` on a non-zero exit. The result object carries the captured streams and exit code as portable evidence the child ran. The in-browser Run button cannot spawn processes, so pressing Run here fails in the sandbox; the output below was produced by really spawning the child under standard CPython when the example was verified.
 
 ```python
 import subprocess
@@ -76,5 +63,5 @@ child process
 - Use a list of arguments instead of shell strings when possible.
 - Capture output when the parent program needs to inspect it.
 - `check=True` turns non-zero exits into exceptions.
-- The output shown here was produced by really spawning the child under standard CPython when the example was verified; the site's in-browser sandbox cannot create processes, so live runs of this page fail there.
+- The verified output came from a real child process under standard CPython at build time; the in-browser sandbox has no process table, so live runs of this page fail there.
 :::