bible270 1.11.1 → 1.12.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 278f587d3e7ee3670bbed00a42ebb91477cc29adfcf72280ff023e1702a5acdf
-  data.tar.gz: 642a9fa5623de02a5cdee5f8d50184dfb371a3ac15e88ee6b91fb29bef76a2e9
+  metadata.gz: a699484a74364bfd2ca703e50a1ab634d9449691f9242acee726d2fbc5a27afc
+  data.tar.gz: 17711f1bf0c60d00bb7b1cb0545e218a808e93226da8627c10c16f20c3f4473a
 SHA512:
-  metadata.gz: 230466a6011d77944bd7994e07ea20e67b4b20e34cc364a1347d780f9bfddaa07bc83b0e534f76282c4b9ac07e8f610d57e120ffab8edf954bafae324e2701c2
-  data.tar.gz: 23ae33b11fc8fc92b795b240d3e38dd4a3492b66dc7ac8b6d4765cfd15a8aa01af964e12d31dfe2f74c315a33b4fe743394cd7d62f2e7860a1443329b8dbc852
+  metadata.gz: 66ed48de38122303a4fe50cfbdbf6251334ee9c67bb82be501a95c3c5d14fdcaa63f5356d4db1d7cf518307870fdc0e08b9045ea23e956a55f20ce7d46e771e9
+  data.tar.gz: 6230d31ac89feb6a6d830c9ca2009edcb266ca9886be87a57bc6b1fed378f0580d0e76ae5ec4c51353b3751b1a52c214eca5dbf016eddbeecaa740abed162626

data/CHANGELOG.md

@@ -4,7 +4,41 @@ All notable changes to bible270. Format follows [Keep a Changelog](https://keepa
 
 ## [Unreleased]
 
-**[Full Changelog](https://github.com/avonderluft/bible270/compare/v1.11.0...main)**
+### Fixed
+
+- load avatars eagerly without forced asynchronous decoding, while retaining attachment preloading and bounded database queries
+- recover failed avatar requests with up to two automatic retries, refreshing same-origin uploaded-image redirects without modifying signed provider URLs
+- show accessible initials instead of broken images when avatars fail, including cached failures and images inserted during navigation or conversations
+
+### Added
+
+- automatically create 256×256, center-cropped static WebP avatars on Profile and Admin uploads, with orientation correction, color conversion, transparency preservation, and metadata stripping; animated images use their first frame
+- preserve the current original upload separately and display the optimized thumbnail only after successful processing and storage, without request-time image processing
+- validate actual image data and enforce a 40-megapixel limit in addition to the existing configurable upload byte limit (2 MiB by default)
+- add `bible270:avatars:optimize` to backfill existing uploaded avatars, with `DRY_RUN=1`, `FORCE=1`, bounded batches, rerun-safe version tracking, and protection against concurrent picture changes
+
+Avatar processing requires libvips with PNG, JPEG, GIF and WebP support on upload/backfill hosts; the gem now depends on `image_processing` and `ruby-vips`. No additional database migration is required for hosts already using Active Storage. Existing avatars continue displaying their originals until optimized; remote provider images are unchanged.
+
+**[Full Changelog](https://github.com/avonderluft/bible270/compare/v1.11.1...main)**
+
+## [1.11.1] - 2026-10-22
+
+### Changed
+
+- simplify artwork on phone-sized screens: hide decorative scripture and word reflections, lower landscape scenes, and reduce fine detail while preserving desktop artwork
+- further mute Ocean's mobile colors and wave lines while keeping the shoreline and gulls
+- use a soft moonlight reflection on phones and retain opaque foreground trees in the simplified Forest scene
+- draw Forest trees as direct SVG paths with explicit green fills instead of reused SVG instances
+- increase the space between the app title and compact theme selector
+
+### Fixed
+
+- declare the selected color scheme early in the page and synchronize root settings and metadata on theme changes and Turbo navigation
+- request `color-scheme: only light` for Papyrus, Meadow, and Ocean while preserving System's device-following behavior
+
+Browser website-darkening features can still override theme colors. In iOS Brave, disabling Night Mode resolved the reported darkened light themes and white Forest trees.
+
+**[Full Changelog](https://github.com/avonderluft/bible270/compare/v1.11.0...v1.11.1)**
 
 ## [1.11.0] - 2026-10-22
 
@@ -897,7 +931,8 @@ This is the initial public release.
 
 * Email sign-in requires working Action Mailer delivery in the host application. Set `config.mailer_from`; delivery is inline by default, or set `email_sign_in_deliver_later` when a queue backend is available.
 
-[Unreleased]: https://github.com/avonderluft/bible270/compare/v1.11.0...HEAD
+[Unreleased]: https://github.com/avonderluft/bible270/compare/v1.11.1...HEAD
+[1.11.1]: https://github.com/avonderluft/bible270/releases/tag/v1.11.1
 [1.11.0]: https://github.com/avonderluft/bible270/releases/tag/v1.11.0
 [1.10.2]: https://github.com/avonderluft/bible270/releases/tag/v1.10.2
 [1.10.1]: https://github.com/avonderluft/bible270/releases/tag/v1.10.1

data/README.md

@@ -21,14 +21,40 @@ The schedule is pure deterministic Ruby (`Bible270::Plan`) — none of it is sto
 
 ## Requirements
 
-- **Ruby** >= 3.2. Plain Ruby, no C extensions. Runs on 4.0.6 — it avoids everything 4.0 dropped or unbundled (notably `cgi`; URL escaping uses `URI.encode_www_form_component`).
+- **Ruby** >= 3.2. Engine code is plain Ruby; avatar processing uses native libvips through `ruby-vips`. Runs on 4.0.6 — it avoids everything 4.0 dropped or unbundled (notably `cgi`; URL escaping uses `URI.encode_www_form_component`).
 - **Rails** >= 7.2. On Ruby 4.0 your host app is the real constraint, not this engine — check your lockfile with RailsBump first.
 - A host app, and Turbo if you want check-offs without a page reload.
+- For picture uploads and avatar backfills: **libvips** with PNG, JPEG, GIF and WebP support. The gem supplies the `image_processing` and `ruby-vips` Ruby dependencies. Install libvips on every upload/backfill host (for example, `sudo apt-get install libvips-tools` on Ubuntu or `sudo pacman -S libvips` on Arch). Native processing is loaded only when optimizing an image; existing pages and provider avatars do not require it.
 
 Mutation controls expose pending, success, and retry feedback when JavaScript runs, while ordinary HTML
 forms remain the fallback. Repeated checkoff and like requests converge on the intended state rather
 than accidentally reversing it.
 
+## Avatar optimization
+
+Profile and Admin picture uploads produce a **256×256 static WebP thumbnail at quality 85** before switching the displayed avatar. Images are auto-oriented, center-cropped, converted to sRGB, and stripped of metadata; transparency is preserved. Animated GIF/WebP uploads use the first frame. Small images are upscaled to the same dimensions. Invalid or corrupt image data is rejected, even if its filename or declared type looks valid.
+
+Uploads are limited to **2 MiB by default** (`config.avatar_max_bytes`) and **40 million pixels** in the selected frame/container canvas. The pixel limit bounds dimensions, not total processor memory. A processing or storage failure leaves the previous picture and profile details unchanged.
+
+The current original remains in the `avatar` attachment, including its original metadata; the display image is stored separately as `avatar_thumbnail`. This preserves the source for future reprocessing, not a history of past pictures. Removing/replacing a picture detaches the old pair; Active Storage's purge jobs clean up their files. Keep the host's Active Job worker running for that cleanup. Original retention increases storage use even though avatar downloads become smaller. No new database migration is needed if Active Storage is already installed.
+
+Existing uploaded avatars continue displaying their originals until optimized. Run the following **from the host Rails application**, with its normal database/storage credentials and production environment when appropriate:
+
+```sh
+# Metadata-only preview: no image downloads or attachment changes
+RAILS_ENV=production bundle exec rake bible270:avatars:optimize DRY_RUN=1
+
+# Process existing uploaded reader avatars, sequentially in bounded batches
+RAILS_ENV=production bundle exec rake bible270:avatars:optimize BATCH_SIZE=100
+
+# Rebuild even current thumbnails from the retained originals
+RAILS_ENV=production bundle exec rake bible270:avatars:optimize FORCE=1
+```
+
+The task skips current thumbnails, protects concurrent avatar changes, continues after per-image failures, and exits nonzero if any fail. It prints reader IDs, counts, and original/optimized display-byte totals (not total storage savings). Correct failed files, limits, storage access, or processor dependencies and rerun. `BATCH_SIZE` defaults to 100 and must be between 1 and 1000. Dry-run checks eligibility only; it does not verify file availability or decodability. Take a normal database/storage backup before a production backfill. The task reads originals and writes thumbnails to the configured storage service; remote storage can incur request and transfer costs. It does **not** download remote sign-in-provider avatars or modify unrelated host attachments.
+
+For host code that uploads reader pictures, use `reader.attach_avatar(upload)` or `Bible270::AvatarImages.update!(reader, attributes, upload: upload)` rather than attaching directly with Active Storage, which bypasses this processing pipeline. Uploads and backfills must run **outside a caller-owned database transaction**: the service owns the commit boundary so a later outer rollback cannot orphan already-uploaded files. Failed cleanup retains unattached blob records with their storage keys for retry; check logged blob IDs and include these in the host's unattached-blob maintenance.
+
 ## Install
 
 ```ruby

data/app/controllers/bible270/admin_controller.rb

@@ -229,23 +229,20 @@ module Bible270
     # Name and picture together, mirroring what a reader can change about
     # themselves on their own profile.
     def update_profile
-      problems = []
-      @reader.transaction do
-        if (params[:first_name].present? || params[:last_name].present?) && !@reader.update_names(params[:first_name],
-                                                                                                  params[:last_name])
-          problems << 'both a first and last name'
+      attributes = {}
+      if params[:first_name].present? || params[:last_name].present?
+        attributes = Names.normalize(params[:first_name], params[:last_name])
+        unless attributes
+          return redirect_to admin_reader_path(@reader), alert: 'Needs both a first and last name.'
         end
-        if problems.empty? && params[:avatar].present? && !@reader.attach_avatar(params[:avatar])
-          problems << (@reader.errors[:avatar].first || 'a valid image')
-        end
-        raise ActiveRecord::Rollback if problems.any?
       end
 
-      if problems.empty?
-        redirect_to admin_reader_path(@reader), notice: 'Updated.'
-      else
-        redirect_to admin_reader_path(@reader), alert: "Needs #{problems.to_sentence}."
-      end
+      AvatarImages.update!(@reader, attributes, upload: params[:avatar].presence)
+      redirect_to admin_reader_path(@reader), notice: 'Updated.'
+    rescue AvatarOptimizer::Error, AvatarImages::Error => e
+      redirect_to admin_reader_path(@reader), alert: e.message
+    rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotSaved
+      redirect_to admin_reader_path(@reader), alert: 'The profile could not be saved. Please try again.'
     end
 
     def update_theme

data/app/controllers/bible270/profiles_controller.rb

@@ -35,6 +35,10 @@ module Bible270
 
       save_profile(names.merge(passage_source: source))
       redirect_to profile_path, notice: 'Your profile has been updated.'
+    rescue AvatarOptimizer::Error, AvatarImages::Error => e
+      current_reader.attachment_changes.clear if Reader.avatar_uploads?
+      current_reader.reload
+      render_profile_error(e.message)
     rescue ActiveRecord::RecordInvalid, ActiveRecord::RecordNotSaved => e
       message = e.record ? e.record.errors.full_messages.to_sentence : nil
       # Reload does not discard Active Storage's deferred attachment changes.
@@ -103,13 +107,7 @@ module Bible270
         attributes[:daily_reminder_time] = @daily_reminder_time
       end
 
-      Reader.transaction do
-        current_reader.assign_attributes(attributes)
-        # Unlike attach, assignment never saves early. Active Storage persists the
-        # attachment with the reader and uploads only after a successful commit.
-        current_reader.avatar = params[:avatar] if params[:avatar].present?
-        current_reader.save!
-      end
+      AvatarImages.update!(current_reader, attributes, upload: params[:avatar].presence)
     end
 
     def render_profile_error(message)

data/app/helpers/bible270/plan_helper.rb

@@ -154,19 +154,25 @@ module Bible270
     end
 
     def b270_avatar_src(reader)
-      return main_app.rails_blob_path(reader.avatar, only_path: true) if reader.avatar_uploaded?
+      return main_app.rails_blob_path(reader.display_avatar, only_path: true) if reader.avatar_uploaded?
 
       reader.avatar_url.presence
     end
 
-    def b270_avatar(reader, size: 72, loading: 'lazy')
+    def b270_avatar(reader, size: 72, loading: 'eager')
       src = b270_avatar_src(reader)
-      if src
-        image_tag src, class: 'b270-avatar', width: size, height: size, alt: reader.display_name,
-                       loading: loading, decoding: 'async'
-      else
-        content_tag :span, reader.initials, class: 'b270-avatar b270-avatar-fallback',
-                                            style: "width:#{size}px;height:#{size}px;line-height:#{size}px"
+      dimensions = "width:#{size}px;height:#{size}px;line-height:#{size}px"
+      unless src
+        return content_tag :span, reader.initials, class: 'b270-avatar b270-avatar-fallback',
+                                                   style: dimensions, role: 'img', 'aria-label': reader.display_name
+      end
+
+      content_tag :span, class: 'b270-avatar-frame', style: dimensions,
+                         role: 'img', 'aria-label': reader.display_name do
+        image = image_tag src, class: 'b270-avatar', width: size, height: size, alt: reader.display_name,
+                               loading: loading, data: { b270_avatar: true, b270_avatar_uploaded: reader.avatar_uploaded? }
+        fallback = content_tag :span, reader.initials, class: 'b270-avatar b270-avatar-fallback', 'aria-hidden': true
+        safe_join([image, fallback])
       end
     end
 

data/app/models/bible270/comment.rb

@@ -53,10 +53,10 @@ module Bible270
     # listing them again at the top level would show each twice.
     scope :for_day,  ->(d) { approved.where(day: d, parent_id: nil).order(created_at: :asc) }
     scope :with_reader_avatars, -> {
-      Reader.avatar_uploads? ? includes(reader: { avatar_attachment: :blob }) : includes(:reader)
+      Reader.avatar_uploads? ? includes(reader: Reader::AVATAR_ASSOCIATIONS) : includes(:reader)
     }
     scope :with_thread_details, -> {
-      reply_reader = Reader.avatar_uploads? ? { reader: { avatar_attachment: :blob } } : :reader
+      reply_reader = Reader.avatar_uploads? ? { reader: Reader::AVATAR_ASSOCIATIONS } : :reader
       with_reader_avatars.includes({ likes: :reader }, { replies: [reply_reader, { likes: :reader }] })
     }
     scope :threads_for_day, ->(d) { for_day(d).with_thread_details }

data/app/models/bible270/reader.rb

@@ -15,11 +15,16 @@ module Bible270
     # to keep working there — readers simply can't upload, and any avatar from
     # their sign-in provider is used instead.
     AVATAR_UPLOADS = respond_to?(:has_one_attached)
-    has_one_attached :avatar if AVATAR_UPLOADS
+    if AVATAR_UPLOADS
+      has_one_attached :avatar
+      has_one_attached :avatar_thumbnail
+    end
+
+    AVATAR_ASSOCIATIONS = { avatar_attachment: :blob, avatar_thumbnail_attachment: :blob }.freeze
 
     def self.avatar_uploads? = AVATAR_UPLOADS
 
-    scope :with_avatar, -> { avatar_uploads? ? includes(avatar_attachment: :blob) : all }
+    scope :with_avatar, -> { avatar_uploads? ? includes(AVATAR_ASSOCIATIONS) : all }
 
     # Fires for every way a reader comes into existence — email sign-in, OmniAuth,
     # or a bridged host user — rather than in each controller, so no path can
@@ -426,22 +431,29 @@ module Bible270
       self.class.avatar_uploads? && avatar.attached?
     end
 
+    def avatar_optimized?
+      avatar_uploaded? && avatar_thumbnail.attached? &&
+        avatar_thumbnail.blob.metadata['bible270_avatar_source_id'] == avatar.blob.id &&
+        avatar_thumbnail.blob.metadata['bible270_avatar_version'] == AvatarOptimizer::VERSION
+    end
+
+    def display_avatar
+      avatar_optimized? ? avatar_thumbnail : avatar
+    end
+
     # Returns false and sets an error when the upload isn't acceptable.
     def attach_avatar(upload)
       return false unless self.class.avatar_uploads?
 
-      problem = Avatars.problem_with(content_type: upload.content_type, byte_size: upload.size)
-      if problem
-        errors.add(:avatar, problem)
-        return false
-      end
-
-      avatar.attach(upload)
+      AvatarImages.update!(self, {}, upload: upload)
       true
+    rescue AvatarOptimizer::Error, AvatarImages::Error => e
+      errors.add(:avatar, e.message)
+      false
     end
 
     def remove_avatar!
-      avatar.purge if avatar_uploaded?
+      AvatarImages.remove!(self)
       true
     end
 

data/app/views/bible270/admin/show.html.erb

@@ -23,7 +23,8 @@
             <span>Picture</span>
             <%= file_field_tag :avatar, accept: Bible270::Avatars.content_types.join(',') %>
             <span class="b270-hint" style="margin:0">
-              PNG, JPEG, GIF or WebP, up to <%= Bible270::Avatars.human_size(Bible270::Avatars.max_bytes) %>.
+              PNG, JPEG, GIF or WebP, up to <%= Bible270::Avatars.human_size(Bible270::Avatars.max_bytes) %> and <%= Bible270::AvatarOptimizer::MAX_PIXELS / 1_000_000 %> megapixels.
+              Automatically center-cropped to a square. Animated pictures use the first frame.
             </span>
           </label>
           <% if @reader.avatar_uploaded? %>

data/app/views/bible270/profiles/edit.html.erb

@@ -15,7 +15,8 @@
             <span>Picture</span>
             <%= file_field_tag :avatar, accept: Bible270::Avatars.content_types.join(',') %>
             <span class="b270-hint" style="margin:0">
-              PNG, JPEG, GIF or WebP, up to <%= Bible270::Avatars.human_size(Bible270::Avatars.max_bytes) %>.
+              PNG, JPEG, GIF or WebP, up to <%= Bible270::Avatars.human_size(Bible270::Avatars.max_bytes) %> and <%= Bible270::AvatarOptimizer::MAX_PIXELS / 1_000_000 %> megapixels.
+              Automatically center-cropped to a square. Animated pictures use the first frame.
             </span>
           </label>
           <% if current_reader.avatar_uploaded? %>

data/app/views/bible270/shared/_avatar_ui.html.erb

@@ -0,0 +1,85 @@
+<script nonce="<%= content_security_policy_nonce %>">
+  (() => {
+    if (window.Bible270AvatarUI) {
+      window.Bible270AvatarUI.initialize();
+      return;
+    }
+
+    const selector = "img[data-b270-avatar]";
+    const states = new WeakMap();
+    const delays = [500, 1500];
+
+    function stateFor(image) {
+      const source = image.getAttribute("src");
+      let state = states.get(image);
+      if (!state || state.current !== source) {
+        if (state) clearTimeout(state.timer);
+        state = { original: source, current: source, attempts: 0, timer: null };
+        states.set(image, state);
+      }
+      return state;
+    }
+
+    function loaded(image) {
+      const state = stateFor(image);
+      clearTimeout(state.timer);
+      state.timer = null;
+      image.removeAttribute("data-b270-avatar-failed");
+    }
+
+    function failed(image) {
+      image.setAttribute("data-b270-avatar-failed", "");
+      const state = stateFor(image);
+      if (!state.original || state.timer !== null || state.attempts >= delays.length) return;
+
+      state.timer = setTimeout(() => {
+        state.timer = null;
+        if (!image.isConnected || image.getAttribute("src") !== state.current) return;
+        if (image.complete && image.naturalWidth > 0) {
+          loaded(image);
+          return;
+        }
+        state.attempts += 1;
+        let source = state.original;
+        // Refresh our blob redirect, which may have cached an expired storage URL.
+        // Never alter provider URLs: their query parameters may be signed.
+        const url = new URL(source, document.baseURI);
+        if (image.dataset.b270AvatarUploaded === "true" && url.origin === window.location.origin) {
+          url.searchParams.set("_b270_avatar_retry", `${Date.now()}-${state.attempts}`);
+          source = url.href;
+        }
+        state.current = source;
+        image.setAttribute("src", source);
+      }, delays[state.attempts]);
+    }
+
+    function inspect(image) {
+      if (!image.complete) return;
+      if (image.naturalWidth > 0) loaded(image);
+      else failed(image);
+    }
+
+    function initialize(root = document) {
+      if (root.matches?.(selector)) inspect(root);
+      root.querySelectorAll?.(selector).forEach(inspect);
+    }
+
+    // Image events do not bubble. Capture also handles images inserted by replies
+    // and Turbo; the scan catches cached failures before this script was installed.
+    document.addEventListener("load", (event) => {
+      if (event.target.matches?.(selector)) loaded(event.target);
+    }, true);
+    document.addEventListener("error", (event) => {
+      if (event.target.matches?.(selector)) failed(event.target);
+    }, true);
+    document.addEventListener("turbo:load", () => initialize());
+    document.addEventListener("turbo:render", () => initialize());
+    window.addEventListener("pageshow", () => initialize());
+    new MutationObserver((records) => {
+      records.forEach((record) => record.addedNodes.forEach((node) => initialize(node)));
+    }).observe(document.documentElement, { childList: true, subtree: true });
+
+    window.Bible270AvatarUI = { initialize };
+    initialize();
+  })();
+</script>

data/app/views/bible270/shared/_styles.html.erb

@@ -424,6 +424,11 @@
   .b270-completers{display:flex;align-items:center;gap:8px;flex-wrap:wrap;margin-top:16px;font-size:13px;color:var(--muted)}
   .b270-avatar{border-radius:50%;object-fit:cover;display:inline-block;text-align:center;background:var(--teal-fill);color:var(--on-accent);font-size:12px;font-weight:600}
   .b270-avatar-fallback{border-radius:50%}
+  .b270-avatar-frame{position:relative;display:inline-block;vertical-align:middle;flex-shrink:0}
+  .b270-avatar-frame>img{display:block}
+  .b270-avatar-frame>.b270-avatar-fallback{position:absolute;inset:0;visibility:hidden}
+  .b270-avatar-frame>img[data-b270-avatar-failed]{visibility:hidden}
+  .b270-avatar-frame>img[data-b270-avatar-failed]+.b270-avatar-fallback{visibility:visible}
 
   /* comments */
   .b270-section-h{font-family:"Spectral",serif;font-size:20px;font-weight:600;margin:34px 0 14px}

data/app/views/layouts/bible270/application.html.erb

@@ -33,6 +33,7 @@
     <%= render 'bible270/shared/day_index', expanded: content_for?(:expand_day_index) unless content_for?(:hide_day_index) %>
     <%= b270_footer %>
   </div>
+  <%= render "bible270/shared/avatar_ui" %>
   <%= render "bible270/shared/theme_ui" %>
   <%= render "bible270/shared/scripture_popups" %>
   <%= render "bible270/shared/video_embeds" %>

data/lib/bible270/avatar_backfill.rb

@@ -0,0 +1,93 @@
+# frozen_string_literal: true
+
+module Bible270
+  class AvatarBackfill
+    DEFAULT_BATCH_SIZE = 100
+    MAX_BATCH_SIZE = 1000
+
+    class Error < StandardError; end
+
+    def initialize(dry_run: false, force: false, batch_size: DEFAULT_BATCH_SIZE, output: $stdout)
+      @dry_run = dry_run
+      @force = force
+      @batch_size = validate_batch_size(batch_size)
+      @output = output
+    end
+
+    # processed counts successful optimizations, not all visited readers. Byte
+    # totals cover successful/current derivatives only, never failed or raced work.
+    def run
+      check_storage!
+      summary = { processed: 0, skipped: 0, changed: 0, failed: 0, eligible: 0,
+                  original_bytes: 0, optimized_bytes: 0 }
+
+      Reader.with_avatar.joins(:avatar_attachment).find_each(batch_size: @batch_size) do |reader|
+        if @dry_run
+          eligible = @force || !reader.avatar_optimized?
+          summary[eligible ? :eligible : :skipped] += 1
+          @output.puts "reader_id=#{reader.id} #{eligible ? 'eligible' : 'skipped'}"
+        else
+          process(reader, summary)
+        end
+      end
+
+      if @dry_run
+        @output.puts "DRY RUN: eligible=#{summary[:eligible]} skipped=#{summary[:skipped]} " \
+                     'processed=0 changed=0 failed=0'
+      else
+        @output.puts "processed=#{summary[:processed]} skipped=#{summary[:skipped]} " \
+                     "changed=#{summary[:changed]} failed=#{summary[:failed]}"
+        @output.puts "Display bytes (optimized/skipped readers): original=#{summary[:original_bytes]} " \
+                     "optimized=#{summary[:optimized_bytes]}. Originals retained; not total storage savings."
+      end
+      summary
+    end
+
+  private
+
+    def validate_batch_size(value)
+      valid = value.is_a?(Integer) || (value.is_a?(String) && value.match?(%r{\A[0-9]+\z}))
+      size = Integer(value, 10) if valid && value.is_a?(String)
+      size = value if value.is_a?(Integer)
+      return size if valid && size.between?(1, MAX_BATCH_SIZE)
+
+      raise Error, "BATCH_SIZE must be a positive integer between 1 and #{MAX_BATCH_SIZE}."
+    end
+
+    def check_storage!
+      return if Reader.avatar_uploads? && defined?(ActiveStorage::Blob) &&
+                defined?(ActiveStorage::Attachment) && ActiveStorage::Blob.table_exists? &&
+                ActiveStorage::Attachment.table_exists?
+
+      raise Error, 'Avatar backfill requires Active Storage. Enable active_storage/engine, ' \
+                   'configure a storage service, and run bin/rails active_storage:install and bin/rails db:migrate in the host app.'
+    end
+
+    def process(reader, summary)
+      result = AvatarImages.optimize_existing!(reader, force: @force)
+      case result.fetch(:status)
+      when :optimized, :skipped
+        summary[result[:status] == :optimized ? :processed : :skipped] += 1
+        summary[:original_bytes] += result.fetch(:before_bytes)
+        summary[:optimized_bytes] += result.fetch(:after_bytes)
+      when :changed
+        summary[:changed] += 1
+      else
+        raise Error, 'Avatar optimizer returned an unsupported status.'
+      end
+      @output.puts "reader_id=#{reader.id} #{result[:status]}"
+    rescue AvatarOptimizer::Error
+      record_failure(reader, summary, 'image processing failed; check the source image and libvips codec support')
+    rescue AvatarImages::Error
+      record_failure(reader, summary, 'storage failed; check storage service configuration and access')
+    rescue ActiveRecord::ActiveRecordError
+      record_failure(reader, summary, 'database failed; check database availability and record integrity')
+    end
+
+    def record_failure(reader, summary, reason)
+      summary[:failed] += 1
+      # Exception messages, causes and record inspections can expose private data.
+      @output.puts "reader_id=#{reader.id} failed: #{reason}"
+    end
+  end
+end

data/lib/bible270/avatar_images.rb

@@ -0,0 +1,159 @@
+# frozen_string_literal: true
+
+require_relative 'avatar_optimizer'
+
+module Bible270
+  # Originals and their display thumbnails are separate, immutable blobs. All
+  # storage work finishes before attachment changes become visible to readers.
+  class AvatarImages
+    class Error < StandardError; end
+
+    class << self
+      def update!(reader, attributes, upload: nil)
+        raise Error, 'Picture uploads require Active Storage.' if upload && !reader.class.avatar_uploads?
+
+        require_own_transaction!(reader) if upload
+
+        reader.assign_attributes(attributes)
+        raise ActiveRecord::RecordInvalid, reader unless reader.valid?
+        return reader.save! unless upload
+
+        blobs = []
+        AvatarOptimizer.open(upload.tempfile.path, content_type: upload.content_type, byte_size: upload.size) do |output|
+          # Do not let Active Storage decode the unsanitized original again in
+          # an analysis job. Validation/conversion already ran through our safe
+          # pipeline, and originals are retained for reprocessing, not variants.
+          original = store_blob(blobs, io: upload.tempfile, filename: upload.original_filename,
+                                       content_type: upload.content_type.to_s.downcase.split(';').first.to_s.strip,
+                                       metadata: { 'analyzed' => true })
+          thumbnail = store_thumbnail(blobs, output, original)
+          pending_attributes = reader.changes.transform_values(&:last)
+          reader.class.transaction do
+            # Reload under the row lock: cached (even nil) attachments may have
+            # changed during processing. Replacing a stale association can leave
+            # multiple attachments with the same has_one_attached name.
+            reader.class.lock.find(reader.id)
+            reader.attachment_changes.delete('avatar')
+            reader.attachment_changes.delete('avatar_thumbnail')
+            reader.reload
+            reader.assign_attributes(pending_attributes)
+            reader.avatar = original
+            reader.avatar_thumbnail = thumbnail
+            reader.save!
+          end
+        end
+      ensure
+        discard_unattached(blobs)
+      end
+
+      def optimize_existing!(reader, force: false)
+        return result(:skipped) unless reader.avatar_uploaded?
+
+        require_own_transaction!(reader)
+        original = reader.avatar.blob
+        if !force && reader.avatar_optimized?
+          return result(:skipped, original.byte_size, reader.avatar_thumbnail.blob.byte_size)
+        end
+
+        problem = Avatars.problem_with(content_type: original.content_type, byte_size: original.byte_size)
+        raise AvatarOptimizer::Error, "Avatar #{problem}." if problem
+
+        blobs = []
+        thumbnail = download_original(original) do |input|
+          AvatarOptimizer.open(input.path, content_type: original.content_type, byte_size: original.byte_size) do |output|
+            store_thumbnail(blobs, output, original)
+          end
+        end
+        reader.with_lock do
+          unless reader.avatar_uploaded? && reader.avatar.blob.id == original.id
+            return result(:changed, original.byte_size)
+          end
+          if !force && reader.avatar_optimized?
+            return result(:skipped, original.byte_size, reader.avatar_thumbnail.blob.byte_size)
+          end
+
+          reader.avatar_thumbnail = thumbnail
+          reader.save!
+        end
+        result(:optimized, original.byte_size, thumbnail.byte_size)
+      ensure
+        discard_unattached(blobs)
+      end
+
+      def remove!(reader)
+        return unless reader.class.avatar_uploads?
+
+        # Detach atomically; Active Storage purges both old blobs after commit.
+        reader.with_lock do
+          reader.avatar = nil
+          reader.avatar_thumbnail = nil
+          reader.save!
+        end
+      end
+
+    private
+
+      def require_own_transaction!(reader)
+        return unless [reader.class, ActiveStorage::Blob].any? do |model|
+          model.connection_pool.with_connection(&:transaction_open?)
+        end
+
+        # Files cannot roll back with an outer database transaction. Reject that
+        # usage before creating blobs rather than leaking files on a later abort.
+        raise Error, 'Avatar uploads and optimization must run outside an existing database transaction.'
+      end
+
+      def download_original(original, &)
+        original.open(&)
+      rescue AvatarOptimizer::Error, Error
+        raise
+      rescue StandardError => e
+        Rails.logger.error("Bible270 avatar download failed (#{e.class}).")
+        raise Error, 'The original picture could not be read. Check storage availability and file integrity.'
+      end
+
+      def result(status, before_bytes = 0, after_bytes = 0)
+        { status: status, before_bytes: before_bytes, after_bytes: after_bytes }
+      end
+
+      def store_thumbnail(blobs, output, original)
+        store_blob(blobs, io: output, filename: 'avatar.webp', content_type: 'image/webp',
+                          service_name: original.service_name,
+                          metadata: { 'bible270_avatar_version' => AvatarOptimizer::VERSION,
+                                      'bible270_avatar_source_id' => original.id,
+                                      'width' => AvatarOptimizer::SIZE, 'height' => AvatarOptimizer::SIZE,
+                                      'analyzed' => true })
+      end
+
+      def store_blob(blobs, **attributes)
+        attributes.fetch(:io).rewind
+        # Register the blob before uploading so a partial storage failure can be
+        # cleaned up too. create_and_upload! would not return that failed blob.
+        blob = ActiveStorage::Blob.create_after_unfurling!(**attributes, identify: false)
+        blobs << blob
+        blob.upload_without_unfurling(attributes.fetch(:io))
+        blob
+      rescue StandardError => e
+        Rails.logger.error("Bible270 avatar storage failed (#{e.class}).")
+        raise Error, 'Your picture could not be stored. Please try again.'
+      end
+
+      def discard_unattached(blobs)
+        Array(blobs).each do |blob|
+          # An after-commit callback may raise after a successful save. Never
+          # remove blobs that have already become somebody's live attachment.
+          blob.with_lock do
+            next if blob.attachments.exists?
+
+            # Unlike purge, delete storage first. If deletion fails, retain the
+            # unattached row (service/key) so maintenance can retry cleanup.
+            blob.delete
+            blob.destroy!
+          end
+        rescue StandardError => e
+          Rails.logger.error("Bible270 unused avatar blob #{blob.id} cleanup failed (#{e.class}); retry unattached-blob cleanup.")
+        end
+      end
+    end
+  end
+end

data/lib/bible270/avatar_optimizer.rb

@@ -0,0 +1,257 @@
+# frozen_string_literal: true
+
+require 'tempfile'
+require 'zlib'
+require_relative 'configuration'
+
+module Bible270
+  # File-only avatar processing; no Rails, Active Storage, or original-file writes.
+  class AvatarOptimizer
+    VERSION = '1'
+    SIZE = 256
+    # Bounds the first frame's decoded pixels before materializing it. This is not
+    # a process-memory cap: channels, bit depth, and working buffers also use RAM.
+    MAX_PIXELS = 40_000_000
+    # PNG text is discarded without inflation. PNG permits only one iCCP chunk,
+    # so rejecting duplicates makes this an aggregate expanded ICC limit too.
+    # This bounds that metadata attack, not total Ruby/native process memory.
+    MAX_PNG_ICC_BYTES = 4 * 1024 * 1024
+    PNG_SIGNATURE = "\x89PNG\r\n\x1a\n".b.freeze
+    private_constant :PNG_SIGNATURE
+
+    class Error < StandardError; end
+
+    DECODERS = {
+      'VipsForeignLoadPngBuffer' => 'image/png',
+      'VipsForeignLoadJpegBuffer' => 'image/jpeg',
+      'VipsForeignLoadNsgifBuffer' => 'image/gif',
+      'VipsForeignLoadWebpBuffer' => 'image/webp'
+    }.freeze
+    private_constant :DECODERS
+
+    class << self
+      # Yields a readable, rewound WebP Tempfile and returns the block's result.
+      # The output is closed/unlinked even on exceptions or non-local block exits.
+      # Input must remain stable while being read; originals remain caller-owned.
+      def open(path, content_type:, byte_size:)
+        raise ArgumentError, 'AvatarOptimizer.open requires a block' unless block_given?
+
+        type = content_type.to_s.downcase.split(';').first.to_s.strip
+        data = read_source(path, type, byte_size)
+        data = sanitize_png(data) if data.start_with?(PNG_SIGNATURE)
+        load_backend!
+        output = new_output
+        write_output(data, type, output.path)
+        output.rewind
+        yield output
+      ensure
+        output&.close!
+      end
+
+    private
+
+      def read_source(path, content_type, byte_size)
+        unless Avatars.acceptable_type?(content_type)
+          raise Error, 'Avatar must be a PNG, JPEG, GIF or WebP image.'
+        end
+        unless byte_size.is_a?(Integer) && byte_size.positive?
+          raise Error, 'Avatar byte size must be a positive integer; upload the file again.'
+        end
+        raise Error, 'Avatar must be a readable regular file; upload it again.' unless File.file?(path)
+
+        limit = Avatars.max_bytes
+        size = File.size(path)
+        if size > limit || byte_size > limit
+          raise Error, "Avatar must be no larger than #{Avatars.human_size(limit)}."
+        end
+        if size.zero? || size != byte_size
+          raise Error, 'Avatar file size does not match the upload; upload it again.'
+        end
+
+        # A bounded snapshot avoids path-option injection, decoder TOCTOU, and
+        # unbounded reads if a file grows between stat and read.
+        data = File.binread(path, limit + 1)
+        unless data.bytesize == size
+          raise Error, 'Avatar file changed while being read; upload it again.'
+        end
+
+        data
+      rescue SystemCallError, IOError, ArgumentError, TypeError
+        raise Error, 'Avatar file could not be read; upload a readable file again.'
+      end
+
+      def sanitize_png(data)
+        sanitized = PNG_SIGNATURE.dup
+        seen = {}
+        image_data_ended = false
+        each_png_chunk(data) do |type, payload, encoded|
+          invalid_png! unless seen['IHDR'] || type == 'IHDR'
+          image_data_ended = true if seen['IDAT'] && type != 'IDAT'
+          invalid_png! if type == 'IDAT' && image_data_ended
+          check_png_chunk(type, payload, seen)
+          seen[type] = true if %w[IHDR PLTE IDAT iCCP eXIf].include?(type)
+          # Keep eXIf and bounded iCCP for orientation/colour conversion. All
+          # text (including compressed XMP/raw profiles) is unnecessary here.
+          sanitized << encoded unless %w[tEXt zTXt iTXt].include?(type)
+        end
+        sanitized
+      end
+
+      def check_png_chunk(type, payload, seen)
+        invalid_png! if %w[IHDR PLTE iCCP eXIf].include?(type) && seen[type]
+        case type
+        when 'IHDR'
+          invalid_png! unless payload.bytesize == 13
+          check_dimensions(*payload.unpack('N2'))
+        when 'PLTE'
+          invalid_png! if seen['IDAT']
+        when 'iCCP'
+          invalid_png! if seen['PLTE'] || seen['IDAT']
+          check_png_profile(payload)
+        when 'IEND'
+          invalid_png! unless seen['IDAT'] && payload.empty?
+        end
+      end
+
+      def each_png_chunk(data)
+        offset = PNG_SIGNATURE.bytesize
+        while offset < data.bytesize
+          invalid_png! if data.bytesize - offset < 12
+          length = data.byteslice(offset, 4).unpack1('N')
+          invalid_png! if length > 0x7fffffff || length > data.bytesize - offset - 12
+          type = data.byteslice(offset + 4, 4)
+          invalid_png! unless type.match?(%r{\A[A-Za-z]{2}[A-Z][A-Za-z]\z}n)
+          payload = data.byteslice(offset + 8, length)
+          crc = data.byteslice(offset + 8 + length, 4).unpack1('N')
+          invalid_png! unless Zlib.crc32(payload, Zlib.crc32(type)) == crc
+
+          yield type, payload, data.byteslice(offset, length + 12)
+          offset += length + 12
+          if type == 'IEND'
+            invalid_png! unless offset == data.bytesize
+            return
+          end
+        end
+        invalid_png! # Missing IEND, including an incomplete final chunk.
+      end
+
+      def png_profile_data(payload)
+        separator = payload.index("\0")
+        invalid_png! unless separator && separator.between?(1, 79)
+        name = payload.byteslice(0, separator)
+        unless name.match?(%r{\A[\x20-\x7e\xa1-\xff]+\z}n) &&
+               !name.start_with?(' ') && !name.end_with?(' ') && !name.include?('  ')
+          invalid_png!
+        end
+        invalid_png! unless payload.getbyte(separator + 1)&.zero?
+        compressed = payload.byteslice((separator + 2)..)
+        invalid_png! if compressed.nil? || compressed.empty?
+        compressed
+      end
+
+      def check_png_profile(payload)
+        compressed = png_profile_data(payload)
+        inflater = Zlib::Inflate.new
+        expanded = 0
+        offset = 0
+        while offset < compressed.bytesize && !inflater.finished?
+          part = compressed.byteslice(offset, 1024)
+          # Block-form inflate yields small output buffers instead of allocating
+          # the whole expanded profile. Never use inflate/finish without a block.
+          inflater.inflate(part) do |block|
+            expanded += block.bytesize
+            if expanded > MAX_PNG_ICC_BYTES
+              raise Error, 'Avatar PNG colour profile exceeds the 4 MiB expanded limit; re-export it with a smaller profile.'
+            end
+          end
+          offset += part.bytesize
+        end
+        # Reject truncation, concatenated streams, trailing junk and empty profiles;
+        # otherwise the native decoder might interpret different bytes than we did.
+        invalid_png! unless inflater.finished? && inflater.total_in == compressed.bytesize && expanded.positive?
+      rescue Zlib::Error
+        invalid_png!
+      ensure
+        inflater&.close
+      end
+
+      def invalid_png!
+        raise Error, 'Avatar PNG has invalid chunk structure, checksums or colour metadata; re-export it and upload it again.'
+      end
+
+      def load_backend!
+        require 'image_processing/vips'
+      rescue LoadError, StandardError
+        raise Error, 'Avatar processing is unavailable. Ask the administrator to install image_processing, ruby-vips and libvips with PNG, JPEG, GIF and WebP support.'
+      end
+
+      def new_output
+        Tempfile.new(['bible270-avatar-', '.webp'], binmode: true)
+      rescue SystemCallError, IOError
+        raise Error, 'Avatar output could not be created. Ask the administrator to check temporary storage.'
+      end
+
+      def write_output(data, content_type, destination)
+        decoder = Vips.vips_foreign_find_load_buffer(data, data.bytesize)
+        actual_type = DECODERS[decoder]
+        unless actual_type
+          raise Error, 'Avatar data must decode as PNG, JPEG, GIF or WebP; re-export the image and upload it again.'
+        end
+        unless actual_type == content_type
+          raise Error, 'Avatar format does not match its content type; re-export the image and upload it again.'
+        end
+
+        check_canvas_dimensions(data, actual_type)
+        options = { access: :sequential, fail_on: :warning }
+        options.merge!(page: 0, n: 1) if %w[image/gif image/webp].include?(actual_type)
+        image = Vips::Image.new_from_buffer(data, '', **options)
+        check_dimensions(image.width, image.height)
+
+        # libvips is lazy: materialize the entire selected frame so corruption
+        # outside the eventual crop is not silently accepted.
+        # ruby-vips 2.3's copy_memory wraps NULL without checking it on decode
+        # failure. Check the native result before constructing/using an Image.
+        decoded = Vips.vips_image_copy_memory(image)
+        raise Vips::Error if decoded.null?
+
+        image = Vips::Image.new(decoded).autorot
+        image = image.icc_transform('srgb', embedded: true) if image.get_typeof('icc-profile-data').positive?
+        image = image.colourspace(:srgb)
+        # Page-height survives first-frame loading; do not let the saver interpret
+        # the resized image as a new animation. Remaining metadata is stripped on
+        # save, after orientation and embedded-profile conversion have been applied.
+        image.remove('page-height')
+        ImageProcessing::Vips.source(image)
+          .resize_to_fill(SIZE, SIZE, sharpen: false)
+          .convert('webp')
+          .saver(quality: 85, strip: true)
+          .call(destination: destination)
+      rescue Error
+        raise
+      rescue StandardError
+        # Native errors can contain private paths and uploaded metadata. Never
+        # expose them, and keep this rescue outside the caller's block.
+        raise Error, 'Avatar could not be decoded or converted. Re-export a valid PNG, JPEG, GIF or WebP; if this persists, ask the administrator to check libvips codec and colour-profile support.'
+      end
+
+      def check_dimensions(width, height)
+        return if width.positive? && height.positive? && width * height <= MAX_PIXELS
+
+        raise Error, "Avatar exceeds the #{MAX_PIXELS / 1_000_000}-megapixel limit; resize it before uploading."
+      end
+
+      def check_canvas_dimensions(data, type)
+        # Check container canvases as well as the decoder's frame dimensions.
+        # GIF decoders may ignore an oversized logical screen, while WebP may
+        # reject a canvas/frame mismatch before exposing its header dimensions.
+        if type == 'image/gif' && data.bytesize >= 10
+          check_dimensions(*data.byteslice(6, 4).unpack('v2'))
+        elsif type == 'image/webp' && data.bytesize >= 30 && data.byteslice(12, 4) == 'VP8X'
+          width = "#{data.byteslice(24, 3)}\0".unpack1('V') + 1
+          height = "#{data.byteslice(27, 3)}\0".unpack1('V') + 1
+          check_dimensions(width, height)
+        end
+      end
+    end
+  end
+end

data/lib/bible270/avatars.rb

@@ -7,8 +7,8 @@ module Bible270
   module Avatars
     CONTENT_TYPES = %w[image/png image/jpeg image/gif image/webp].freeze
 
-    # Two megabytes. Large enough for a photo off a phone, small enough that
-    # nobody's profile page crawls.
+    # Original-upload byte limit. AvatarOptimizer separately limits decoded
+    # dimensions and produces the smaller display image; originals are retained.
     DEFAULT_MAX_BYTES = 2 * 1024 * 1024
 
   module_function

data/lib/bible270/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Bible270
-  VERSION = '1.11.1'
+  VERSION = '1.12.0'
 end

data/lib/bible270.rb

@@ -9,6 +9,8 @@ require 'bible270/names'
 require 'bible270/mentions'
 require 'bible270/comment_formatter'
 require 'bible270/avatars'
+require 'bible270/avatar_images'
+require 'bible270/avatar_backfill'
 require 'bible270/translations'
 require 'bible270/favicon'
 require 'bible270/configuration'

data/lib/tasks/bible270_avatars.rake

@@ -0,0 +1,21 @@
+# frozen_string_literal: true
+
+require 'bible270/avatar_backfill'
+
+namespace :bible270 do
+  namespace :avatars do
+    desc 'Optimize uploaded reader avatars (DRY_RUN=1, FORCE=1, BATCH_SIZE=100; maximum 1000)'
+    task optimize: :environment do
+      summary = Bible270::AvatarBackfill.new(
+        dry_run: ENV['DRY_RUN'] == '1',
+        force: ENV['FORCE'] == '1',
+        batch_size: ENV.fetch('BATCH_SIZE', Bible270::AvatarBackfill::DEFAULT_BATCH_SIZE)
+      ).run
+      if summary[:failed].positive?
+        raise Bible270::AvatarBackfill::Error,
+              "Avatar backfill failed for #{summary[:failed]} reader(s). Review the reader IDs and failure categories above, correct the problem, and rerun.",
+              cause: nil
+      end
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: bible270
 version: !ruby/object:Gem::Version
-  version: 1.11.1
+  version: 1.12.0
 platform: ruby
 authors:
 - Andrew vonderLuft
@@ -9,6 +9,20 @@ bindir: bin
 cert_chain: []
 date: 1980-01-02 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: image_processing
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.14'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.14'
 - !ruby/object:Gem::Dependency
   name: json
   requirement: !ruby/object:Gem::Requirement
@@ -57,6 +71,20 @@ dependencies:
     - - ">="
       - !ruby/object:Gem::Version
         version: '7.0'
+- !ruby/object:Gem::Dependency
+  name: ruby-vips
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '2.3'
 - !ruby/object:Gem::Dependency
   name: turbo-rails
   requirement: !ruby/object:Gem::Requirement
@@ -172,6 +200,7 @@ files:
 - app/views/bible270/readers/progress.html.erb
 - app/views/bible270/readers/show.html.erb
 - app/views/bible270/sessions/new.html.erb
+- app/views/bible270/shared/_avatar_ui.html.erb
 - app/views/bible270/shared/_comment_drafts.html.erb
 - app/views/bible270/shared/_comment_notification_choices.html.erb
 - app/views/bible270/shared/_day_completion_dove.html.erb
@@ -221,6 +250,9 @@ files:
 - db/migrate/20260101000022_change_all_comment_notices_default_to_true.rb
 - db/migrate/20260101000023_add_display_mode_to_bible270_readers.rb
 - lib/bible270.rb
+- lib/bible270/avatar_backfill.rb
+- lib/bible270/avatar_images.rb
+- lib/bible270/avatar_optimizer.rb
 - lib/bible270/avatars.rb
 - lib/bible270/comment_formatter.rb
 - lib/bible270/configuration.rb
@@ -240,6 +272,7 @@ files:
 - lib/generators/bible270/install/install_generator.rb
 - lib/generators/bible270/install/templates/bible270.rb.tt
 - lib/generators/bible270/install/templates/omniauth.rb.tt
+- lib/tasks/bible270_avatars.rake
 - lib/tasks/bible270_migrations.rake
 - lib/tasks/bible270_notifications.rake
 - lib/tasks/bible270_readers.rake