fix(audit-r2): misc findings (F4/F8/F9/F15) (#77)

* fix(audit-r2): close 4 remaining swarm-audit findings (F4/F8/F9/F15)

F4 — remove dead extrapolation controls. richardson_p / levin_order /
levin_weight / levin_beta were collected from both UIs, serialized into the
payload and persisted to workspaces, but mpmath's mp.richardson(seq) and
mp.levin(variant) accept no such parameters, so the compute layer silently
ignored them. Removed the controls end-to-end (desktop views/window/mixin/
workers_core/workspace_controller, datalab_core builder, web logic, the
ExtrapolationOptions dataclass, shared ui_specs, and help_specs.json), keeping
the one Levin knob the backend honors — levin_variant. The richardson page and
the emptied levin section stay as layout-parity stack pages, matching the
existing shanks/wynn (fields=[]) convention.

F8 — update_payload._urlopen now verifies HTTPS with certifi's CA bundle
(ssl.create_default_context(cafile=certifi.where())), mirroring
update_checker._urlopen. On frozen builds whose default OpenSSL context has no
system CA store the check path could advertise an update the download path
could never fetch.

F9 — install_tinytex.sh rejects a non-https TINYTEX_INSTALLER_URL (the script
is downloaded and executed, so http is remote code execution) and honors an
optional TINYTEX_INSTALLER_SHA256 pin verified before execution. Upstream
regenerates the installer, so the pin is opt-in rather than hard-coded.

F15 — render_statistics_plot_from_spec's series_with_mean path filters
non-finite values before handing them to matplotlib, matching its sibling
histogram/box/qq renderers; a single NaN/Inf previously blanked the plot.

TDD throughout (RED tests first). ruff clean; 407 neighborhood tests pass;
GUI builds offscreen with the dead controls gone and the method stack intact.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(audit-r2): drop stale Levin visibility rule, fix Richardson label, sha256 case

Review follow-ups on the F4/F9 changes:

- get_parameter_visibility_rules() still returned a levin_u.beta rule that
  depended on the removed levin_u.weight control — a dangling reference after the
  F4 dead-control removal. Return {} (no dynamic rules remain); the web
  /api/ui_specs payload and desktop imports handle an empty map.

- Richardson was labeled "(3-point)" / "(三点外推)" in the method spec, help
  text, and the desktop i18n map, but it is an accelerator that needs >=4
  columns (the F4 help edit made the contradiction explicit). Rename to plain
  "Richardson" / "Richardson 序列加速" across ui_specs, help_specs, and
  window_i18n_mixin so the label and the documented minimum input agree.

- install_tinytex.sh compared the SHA-256 pin against the raw digest; shasum
  emits lowercase but a pin may be pasted uppercase, causing a false mismatch.
  Normalize both with `tr` (Bash 3.2 safe, avoids the Bash-4 ${x,,} expansion).
  Verified: uppercase pin now matches under bash and system /bin/bash 3.2, a
  genuine mismatch still exits 2.

ruff clean; 86 tests pass; GUI builds with a consistent Richardson label.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: fanghao <fanghaoaa@gmail.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: 3 people

app_desktop/views/extrapolation.py

@@ -5,7 +5,6 @@
 from PySide6.QtCore import Qt
 from PySide6.QtWidgets import (
     QComboBox,
-    QDoubleSpinBox,
     QFormLayout,
     QGroupBox,
     QHBoxLayout,
@@ -14,7 +13,6 @@
     QPlainTextEdit,
     QPushButton,
     QSizePolicy,
-    QSpinBox,
     QVBoxLayout,
     QWidget,
 )
@@ -192,73 +190,15 @@ def build_extrapolation_mode_view(owner: Any) -> QGroupBox:
         ],
     )
     levin_layout.addRow(lbl_variant, owner.levin_variant_combo)
+    # order / weight / beta controls removed (audit F4): mpmath's mp.levin honors
+    # only the variant, so those inputs were silently ignored.
 
-    lbl_order = QLabel("变换阶数：")
-    owner._register_text(lbl_order, "变换阶数：", "Transform order:")
-    owner.levin_order_spin = QSpinBox()
-    owner.levin_order_spin.setRange(1, 10)
-    owner.levin_order_spin.setValue(2)
-    owner.levin_order_spin.setToolTip(
-        owner._tr(
-            "变换阶数（越高越精确但需要更多项，至少需要 2N+1 项数据）",
-            "Transform order (higher = more accurate but needs more terms, requires at least 2N+1 data points)",
-        )
-    )
-    levin_layout.addRow(lbl_order, owner.levin_order_spin)
-
-    lbl_weight = QLabel("权重函数：")
-    owner._register_text(lbl_weight, "权重函数：", "Weight function:")
-    owner.levin_weight_combo = QComboBox()
-    owner.levin_weight_combo.addItem("默认 (1)", "default")
-    owner.levin_weight_combo.addItem("1/(n+1)", "reciprocal")
-    owner.levin_weight_combo.addItem("1/(n+β)", "reciprocal_beta")
-    owner._register_combo(
-        owner.levin_weight_combo,
-        [
-            ("默认 (1)", "Default (1)", "default"),
-            ("1/(n+1)", "1/(n+1)", "reciprocal"),
-            ("1/(n+β)", "1/(n+β)", "reciprocal_beta"),
-        ],
-    )
-    owner.levin_weight_combo.currentIndexChanged.connect(owner._update_levin_weight_state)
-    levin_layout.addRow(lbl_weight, owner.levin_weight_combo)
-
-    lbl_beta = QLabel("β 参数：")
-    owner._register_text(lbl_beta, "β 参数：", "β parameter:")
-    owner.levin_beta_spin = QDoubleSpinBox()
-    owner.levin_beta_spin.setRange(0.01, 100.0)
-    owner.levin_beta_spin.setValue(1.0)
-    owner.levin_beta_spin.setSingleStep(0.1)
-    owner.levin_beta_spin.setDecimals(2)
-    owner.levin_beta_spin.setToolTip(
-        owner._tr(
-            "权重函数 ω(n) = 1/(n+β) 中的 β 参数",
-            "β parameter in weight function ω(n) = 1/(n+β)",
-        )
-    )
-    levin_layout.addRow(lbl_beta, owner.levin_beta_spin)
-    lbl_beta.setVisible(False)
-    owner.levin_beta_spin.setVisible(False)
-    owner.levin_beta_label = lbl_beta
-
+    # Richardson has no tunable knobs (mp.richardson takes only the sequence),
+    # so its page carries no fields — kept as a stack page for layout parity
+    # with the other method pages. The former "p" control was dead (audit F4).
     owner.richardson_box = QGroupBox("Richardson 序列加速参数")
     owner._register_title(owner.richardson_box, "Richardson 序列加速参数", "Richardson acceleration parameters")
-    richardson_layout = QFormLayout(owner.richardson_box)
-
-    lbl_richardson_p = QLabel("收敛幂指数 p：")
-    owner._register_text(lbl_richardson_p, "收敛幂指数 p：", "Convergence power p:")
-    owner.richardson_p_spin = QDoubleSpinBox()
-    owner.richardson_p_spin.setRange(0.1, 10.0)
-    owner.richardson_p_spin.setValue(2.0)
-    owner.richardson_p_spin.setSingleStep(0.1)
-    owner.richardson_p_spin.setDecimals(2)
-    owner.richardson_p_spin.setToolTip(
-        owner._tr(
-            "误差展开的幂指数（f(h) ≈ f∞ + c·h^p），常见值 p=2（二阶方法）",
-            "Power exponent in error expansion (f(h) ≈ f∞ + c·h^p), common value p=2 (second-order method)",
-        )
-    )
-    richardson_layout.addRow(lbl_richardson_p, owner.richardson_p_spin)
+    QFormLayout(owner.richardson_box)
 
     owner.extrap_method_stack.addWidget(owner.power_box)
     owner.extrap_method_stack.addWidget(owner.levin_box)
@@ -294,10 +234,6 @@ def build_extrapolation_mode_view(owner: Any) -> QGroupBox:
         lbl_p=lbl_p,
         lbl_seed=lbl_seed,
         lbl_variant=lbl_variant,
-        lbl_order=lbl_order,
-        lbl_weight=lbl_weight,
-        lbl_beta=lbl_beta,
-        lbl_richardson_p=lbl_richardson_p,
         lbl_uncert=lbl_uncert,
         combo_items=combo_items,
     )
@@ -313,10 +249,6 @@ def _bind_extrapolation_schema_fields(
     lbl_p: QLabel,
     lbl_seed: QLabel,
     lbl_variant: QLabel,
-    lbl_order: QLabel,
-    lbl_weight: QLabel,
-    lbl_beta: QLabel,
-    lbl_richardson_p: QLabel,
     lbl_uncert: QLabel,
     combo_items: list[tuple[str, str, str]],
 ) -> None:
@@ -429,51 +361,6 @@ def _bind_extrapolation_schema_fields(
             ChoiceSpec(value="v", label=LocalizedText("v (积分)", "v (integrals)")),
         ],
     )
-    levin_order_field = FormFieldSpec(
-        key="extrapolation.levin.order",
-        widget_kind="number",
-        label=LocalizedText("变换阶数：", "Transform order:"),
-        tooltip=LocalizedText(
-            EXTRAPOLATION_METHOD_SPECS["levin_u"].parameter_groups[0].parameters[1].tooltip_zh,
-            EXTRAPOLATION_METHOD_SPECS["levin_u"].parameter_groups[0].parameters[1].tooltip_en,
-        ),
-        required=True,
-    )
-    levin_weight_field = FormFieldSpec(
-        key="extrapolation.levin.weight",
-        widget_kind="select",
-        label=LocalizedText("权重函数：", "Weight function:"),
-        tooltip=LocalizedText(
-            EXTRAPOLATION_METHOD_SPECS["levin_u"].parameter_groups[0].parameters[2].tooltip_zh,
-            EXTRAPOLATION_METHOD_SPECS["levin_u"].parameter_groups[0].parameters[2].tooltip_en,
-        ),
-        required=True,
-        choices=[
-            ChoiceSpec(value="default", label=LocalizedText("默认 (1)", "Default (1)")),
-            ChoiceSpec(value="reciprocal", label=LocalizedText("1/(n+1)", "1/(n+1)")),
-            ChoiceSpec(value="reciprocal_beta", label=LocalizedText("1/(n+β)", "1/(n+β)")),
-        ],
-    )
-    levin_beta_field = FormFieldSpec(
-        key="extrapolation.levin.beta",
-        widget_kind="number",
-        label=LocalizedText("β 参数：", "β parameter:"),
-        tooltip=LocalizedText(
-            EXTRAPOLATION_METHOD_SPECS["levin_u"].parameter_groups[0].parameters[3].tooltip_zh,
-            EXTRAPOLATION_METHOD_SPECS["levin_u"].parameter_groups[0].parameters[3].tooltip_en,
-        ),
-        required=False,
-    )
-    richardson_p_field = FormFieldSpec(
-        key="extrapolation.richardson.p",
-        widget_kind="number",
-        label=LocalizedText("收敛幂指数 p：", "Convergence power p:"),
-        tooltip=LocalizedText(
-            EXTRAPOLATION_METHOD_SPECS["richardson"].parameter_groups[0].parameters[0].tooltip_zh,
-            EXTRAPOLATION_METHOD_SPECS["richardson"].parameter_groups[0].parameters[0].tooltip_en,
-        ),
-        required=True,
-    )
     uncertainty_field = FormFieldSpec(
         key="extrapolation.uncertainty.reference_column",
         widget_kind="select",
@@ -531,15 +418,6 @@ def _bind_extrapolation_schema_fields(
     bind_field(field=levin_variant_field, label=lbl_variant, widget=owner.levin_variant_combo, lang=lang)
     bind_choices(owner.levin_variant_combo, levin_variant_field.choices, lang=lang)
     register_schema_text_refresh(owner, levin_variant_field, widget=owner.levin_variant_combo)
-    bind_field(field=levin_order_field, label=lbl_order, widget=owner.levin_order_spin, lang=lang)
-    register_schema_text_refresh(owner, levin_order_field, widget=owner.levin_order_spin)
-    bind_field(field=levin_weight_field, label=lbl_weight, widget=owner.levin_weight_combo, lang=lang)
-    bind_choices(owner.levin_weight_combo, levin_weight_field.choices, lang=lang)
-    register_schema_text_refresh(owner, levin_weight_field, widget=owner.levin_weight_combo)
-    bind_field(field=levin_beta_field, label=lbl_beta, widget=owner.levin_beta_spin, lang=lang)
-    register_schema_text_refresh(owner, levin_beta_field, widget=owner.levin_beta_spin)
-    bind_field(field=richardson_p_field, label=lbl_richardson_p, widget=owner.richardson_p_spin, lang=lang)
-    register_schema_text_refresh(owner, richardson_p_field, widget=owner.richardson_p_spin)
     bind_field(
         field=uncertainty_field,
         label=lbl_uncert,

app_desktop/window.py

@@ -796,7 +796,6 @@ def _initialize_workspace_tracking(self) -> None:
             "mode_combo",
             "method_combo",
             "levin_variant_combo",
-            "levin_weight_combo",
             "error_method_combo",
             "error_units_mode_combo",
             "stats_workflow_combo",
@@ -848,9 +847,6 @@ def _initialize_workspace_tracking(self) -> None:
             "display_digits_spin",
             "latex_input_precision_spin",
             "latex_group_size_spin",
-            "levin_order_spin",
-            "levin_beta_spin",
-            "richardson_p_spin",
             "error_order_spin",
             "error_mc_samples_spin",
             "inverse_min_spin",
@@ -2341,16 +2337,6 @@ def _update_method_state(self):
         if hasattr(self, "refresh_workbench_formula_panel"):
             self.refresh_workbench_formula_panel()
 
-    def _update_levin_weight_state(self):
-        """Show/hide Levin beta parameter based on weight function selection."""
-        if not hasattr(self, "levin_weight_combo") or not hasattr(self, "levin_beta_spin"):
-            return
-        weight_type = self.levin_weight_combo.currentData()
-        show_beta = weight_type == "reciprocal_beta"
-        if hasattr(self, "levin_beta_label"):
-            self.levin_beta_label.setVisible(show_beta)
-        self.levin_beta_spin.setVisible(show_beta)
-
     def _set_corner_example_hint(self, example: str) -> None:
         """Show the per-mode example as a tooltip on the table's
         corner button (row-header × column-header intersection —

app_desktop/window_extrapolation_mixin.py

@@ -33,14 +33,6 @@
 }
 
 
-def _widget_value(owner, attr_name: str, default: object) -> object:
-    widget = getattr(owner, attr_name, None)
-    value_func = getattr(widget, "value", None)
-    if callable(value_func):
-        return value_func()
-    return default
-
-
 def _combo_current_data(owner, attr_name: str, default: str) -> str:
     combo = getattr(owner, attr_name, None)
     data_func = getattr(combo, "currentData", None)
@@ -114,15 +106,6 @@ def _label_with_unit(label: str, unit: str) -> str:
     return f"{label} [{unit_text}]" if unit_text else label
 
 
-def _read_extrapolation_method_options_from_controls(owner) -> dict[str, object]:
-    return {
-        "richardson_p": float(_widget_value(owner, "richardson_p_spin", 2.0)),
-        "levin_order": int(_widget_value(owner, "levin_order_spin", 2)),
-        "levin_weight": _combo_current_data(owner, "levin_weight_combo", "default"),
-        "levin_beta": float(_widget_value(owner, "levin_beta_spin", 1.0)),
-    }
-
-
 class WindowExtrapolationMixin:
     # --------------------------------------------------------- Worker Control Methods --
     def _has_running_worker(self) -> bool:
@@ -325,8 +308,6 @@ def run_calculation(self):
         if hasattr(self, "levin_variant_combo"):
             levin_variant = self.levin_variant_combo.currentData() or "u"
 
-        method_option_values = _read_extrapolation_method_options_from_controls(self)
-
         options = ExtrapolationOptions(
             method=method_choice,
             power_law_config=power_config,
@@ -335,7 +316,6 @@ def run_calculation(self):
             levin_variant=levin_variant,
             custom_formula=custom_formula,
             uncertainty_digits=uncertainty_digits,
-            **method_option_values,
         )
 
         capture_stream = io.StringIO() if verbose else None

app_desktop/window_i18n_mixin.py

@@ -85,7 +85,7 @@ def _localize_label(self, label: str) -> str:
             "x 级数 / 1/x series": "1/x series",
             "1/x^3~1/x^5 / 1/x^3~1/x^5": "1/x^3~1/x^5",
             "幂律外推(三点外推)": "Power-law (3-point)",
-            "Richardson 序列加速(三点外推)": "Richardson (3-point)",
+            "Richardson 序列加速": "Richardson",
             "Shanks 变换": "Shanks transform",
             "Levin u-transform": "Levin u-transform",
             "自定义公式(三点外推) (A,B,C)": "Custom (A,B,C)",

app_desktop/workers_core.py

@@ -34,7 +34,6 @@
     normalize_uncertainty_propagation_config,
     uncertainty_payload_to_results,
 )
-from shared.integer_validation import strict_int
 from shared.extrapolation_engine import parse_extrapolation_string
 from shared.fitting_engine import (
     DirectFitInput,
@@ -604,17 +603,10 @@ def _safe_extrapolation_core_request(
 
 def _extrapolation_method_options(options: ExtrapolationOptions) -> dict[str, object]:
     payload: dict[str, object] = {}
-    for attr in ("uncertainty_column", "levin_variant", "custom_formula", "levin_weight"):
+    for attr in ("uncertainty_column", "levin_variant", "custom_formula"):
         value = getattr(options, attr, None)
         if value is not None and str(value).strip():
             payload[attr] = str(value)
-    for attr in ("richardson_p", "levin_beta"):
-        value = getattr(options, attr, None)
-        if value is not None:
-            payload[attr] = str(value)
-    levin_order = getattr(options, "levin_order", None)
-    if levin_order is not None:
-        payload["levin_order"] = strict_int(levin_order, field_name="levin_order")
     power_config = getattr(options, "power_law_config", None)
     if power_config is not None:
         power_payload: dict[str, object] = {}

app_desktop/workspace_controller.py

@@ -777,12 +777,6 @@ def _restore_extrapolation_config(window: Any, config: Any) -> None:
     levin = config.get("levin") or {}
     if isinstance(levin, dict):
         _set_combo_data(getattr(window, "levin_variant_combo", None), str(levin.get("variant") or "u"))
-        _set_value(getattr(window, "levin_order_spin", None), levin.get("order"))
-        _set_combo_data(getattr(window, "levin_weight_combo", None), str(levin.get("weight") or "default"))
-        _set_value(getattr(window, "levin_beta_spin", None), levin.get("beta"))
-    richardson = config.get("richardson") or {}
-    if isinstance(richardson, dict):
-        _set_value(getattr(window, "richardson_p_spin", None), richardson.get("p"))
     uncertainty_column = str(config.get("uncertainty_column") or "")
     if uncertainty_column:
         _set_combo_data(getattr(window, "uncertainty_combo", None), uncertainty_column)
@@ -1137,11 +1131,7 @@ def _capture_config(window: Any) -> dict[str, Any]:
             },
             "levin": {
                 "variant": _combo_data(getattr(window, "levin_variant_combo", None), "u"),
-                "order": _value(getattr(window, "levin_order_spin", None), 2),
-                "weight": _combo_data(getattr(window, "levin_weight_combo", None), "default"),
-                "beta": str(_value(getattr(window, "levin_beta_spin", None), 1.0)),
             },
-            "richardson": {"p": str(_value(getattr(window, "richardson_p_spin", None), 2.0))},
             "uncertainty_column": _combo_data(getattr(window, "uncertainty_combo", None), "A"),
         },
         "error": _capture_error_config(window),

app_web/logic/extrapolation.py

@@ -31,7 +31,6 @@
     _format_rows,
     _generate_csv_from_rows,
     _is_checked,
-    _parse_float,
     _parse_int,
 )
 from .plots import _render_extrapolation_plot
@@ -144,17 +143,9 @@ def _method_options_payload(
     reference_column: str | None,
     levin_variant: str,
     custom_formula: str | None,
-    richardson_p: float,
-    levin_order: int,
-    levin_weight: str,
-    levin_beta: float,
 ) -> dict[str, object]:
     payload: dict[str, object] = {
         "levin_variant": levin_variant,
-        "richardson_p": str(richardson_p),
-        "levin_order": levin_order,
-        "levin_weight": levin_weight,
-        "levin_beta": str(levin_beta),
     }
     if reference_column:
         payload["uncertainty_column"] = reference_column
@@ -188,16 +179,6 @@ def _run_extrapolation(data_text: str, form, lang: str = "zh") -> ExtrapolationR
     latex_engine = (form.get("latex_engine") or "xelatex").strip() or "xelatex"
     # Dynamic (ui_specs) fields may use shorter names; keep legacy names as fallback.
     levin_variant = (form.get("variant") or form.get("levin_variant") or "u").strip() or "u"
-    richardson_p = _parse_float(form.get("p"))
-    if richardson_p is None:
-        richardson_p = 2.0
-    levin_order = _parse_int(form.get("order"))
-    if levin_order is None:
-        levin_order = 2
-    levin_weight = (form.get("weight") or "default").strip() or "default"
-    levin_beta = _parse_float(form.get("beta"))
-    if levin_beta is None:
-        levin_beta = 1.0
     custom_formula = (form.get("custom_formula") or "").strip() or None
 
     accelerators = {"richardson", "shanks", "levin_u", "wynn_epsilon"}
@@ -214,10 +195,6 @@ def _run_extrapolation(data_text: str, form, lang: str = "zh") -> ExtrapolationR
         levin_variant=levin_variant,
         custom_formula=custom_formula,
         uncertainty_digits=result_digits,
-        richardson_p=richardson_p,
-        levin_order=levin_order,
-        levin_weight=levin_weight,
-        levin_beta=levin_beta,
     )
     with _precision_guard(mp_precision) as applied_precision:
         headers, parsed_rows = parse_extrapolation_string(
@@ -230,10 +207,6 @@ def _run_extrapolation(data_text: str, form, lang: str = "zh") -> ExtrapolationR
             reference_column=reference_column,
             levin_variant=levin_variant,
             custom_formula=custom_formula,
-            richardson_p=richardson_p,
-            levin_order=levin_order,
-            levin_weight=levin_weight,
-            levin_beta=levin_beta,
         )
         request = build_extrapolation_request(
             headers=headers,