@bongos/core 1.19.349 → 1.19.350

package/docs/copy-registry.json

@@ -134,8 +134,8 @@
       "text": "Copy prompt",
       "occurrences": 3,
       "at": [
-        "modules/hall-ui/public/task.js:258",
-        "modules/hall-ui/public/task.js:275",
+        "modules/hall-ui/public/task.js:288",
+        "modules/hall-ui/public/task.js:305",
         "modules/hall-ui/public/work.js:446"
       ]
     },
@@ -804,7 +804,7 @@
       "text": "No cross-project activity reported yet.",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/profile.js:233",
+        "modules/hall-ui/public/profile.js:239",
         "modules/hall-ui/public/scouting.js:29"
       ]
     },
@@ -1581,7 +1581,7 @@
       "surface": "builders-hall",
       "text": "+ {…} more project{…} not publicly listed.",
       "file": "modules/hall-ui/public/profile.js",
-      "line": 230,
+      "line": 236,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -1626,7 +1626,7 @@
       "surface": "builders-hall",
       "text": ", or",
       "file": "modules/hall-ui/public/profile.js",
-      "line": 265,
+      "line": 271,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -1860,7 +1860,7 @@
       "surface": "builders-hall",
       "text": "All builders",
       "file": "modules/hall-ui/public/hall-render.js",
-      "line": 997,
+      "line": 998,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -1941,7 +1941,7 @@
       "surface": "builders-hall",
       "text": "Analytics scope",
       "file": "modules/hall-ui/public/hall-render.js",
-      "line": 995,
+      "line": 996,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -2166,7 +2166,7 @@
       "surface": "builders-hall",
       "text": "Awaiting the grader / a confirmation before it can ship.",
       "file": "modules/hall-ui/public/task.js",
-      "line": 253,
+      "line": 283,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -2769,7 +2769,7 @@
       "surface": "builders-hall",
       "text": "Confirm that verification for #{…} actually passed?",
       "file": "modules/hall-ui/public/task.js",
-      "line": 290,
+      "line": 320,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -2904,7 +2904,7 @@
       "surface": "builders-hall",
       "text": "Copy prompt",
       "file": "modules/hall-ui/public/task.js",
-      "line": 258,
+      "line": 288,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -2913,7 +2913,7 @@
       "surface": "builders-hall",
       "text": "Copy prompt",
       "file": "modules/hall-ui/public/task.js",
-      "line": 275,
+      "line": 305,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -3111,7 +3111,7 @@
       "surface": "builders-hall",
       "text": "Could not load #{…}",
       "file": "modules/hall-ui/public/task.js",
-      "line": 309,
+      "line": 339,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -3246,7 +3246,7 @@
       "surface": "builders-hall",
       "text": "Could not load the profile.",
       "file": "modules/hall-ui/public/profile.js",
-      "line": 330,
+      "line": 336,
       "origin": "js-notice",
       "confidence": "certain"
     },
@@ -4425,7 +4425,7 @@
       "surface": "builders-hall",
       "text": "Goal #{…}",
       "file": "modules/hall-ui/public/task.js",
-      "line": 202,
+      "line": 225,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5010,7 +5010,7 @@
       "surface": "builders-hall",
       "text": "Kinds of work shipped",
       "file": "modules/hall-ui/public/hall-render.js",
-      "line": 1047,
+      "line": 1048,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5064,7 +5064,7 @@
       "surface": "builders-hall",
       "text": "Last claimed by",
       "file": "modules/hall-ui/public/task.js",
-      "line": 213,
+      "line": 236,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5676,7 +5676,7 @@
       "surface": "builders-hall",
       "text": "No builder selected. Open a builder from the",
       "file": "modules/hall-ui/public/profile.js",
-      "line": 265,
+      "line": 271,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5685,7 +5685,7 @@
       "surface": "builders-hall",
       "text": "No cross-project activity reported yet.",
       "file": "modules/hall-ui/public/profile.js",
-      "line": 233,
+      "line": 239,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5937,7 +5937,7 @@
       "surface": "builders-hall",
       "text": "Not found",
       "file": "modules/hall-ui/public/task.js",
-      "line": 304,
+      "line": 334,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -6261,7 +6261,7 @@
       "surface": "builders-hall",
       "text": "Open the Work Board",
       "file": "modules/hall-ui/public/task.js",
-      "line": 258,
+      "line": 288,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7512,7 +7512,7 @@
       "surface": "builders-hall",
       "text": "Ship it",
       "file": "modules/hall-ui/public/task.js",
-      "line": 249,
+      "line": 279,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7521,7 +7521,7 @@
       "surface": "builders-hall",
       "text": "Shipped {…}{…}.",
       "file": "modules/hall-ui/public/task.js",
-      "line": 234,
+      "line": 264,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7746,7 +7746,7 @@
       "surface": "builders-hall",
       "text": "Standing there",
       "file": "modules/hall-ui/public/profile.js",
-      "line": 224,
+      "line": 230,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7818,7 +7818,7 @@
       "surface": "builders-hall",
       "text": "Task #{…}",
       "file": "modules/hall-ui/public/task.js",
-      "line": 176,
+      "line": 199,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -7881,7 +7881,7 @@
       "surface": "builders-hall",
       "text": "Tasks are numbered separately from GitHub pull requests, so this may be a PR rather than a GDS task.",
       "file": "modules/hall-ui/public/task.js",
-      "line": 299,
+      "line": 329,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7944,7 +7944,7 @@
       "surface": "builders-hall",
       "text": "That project's own standing, as reported by that project.",
       "file": "modules/hall-ui/public/profile.js",
-      "line": 224,
+      "line": 230,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8304,7 +8304,7 @@
       "surface": "builders-hall",
       "text": "This builder keeps their track record private.",
       "file": "modules/hall-ui/public/profile.js",
-      "line": 204,
+      "line": 210,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8403,7 +8403,7 @@
       "surface": "builders-hall",
       "text": "This is you —",
       "file": "modules/hall-ui/public/profile.js",
-      "line": 200,
+      "line": 206,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8529,7 +8529,7 @@
       "surface": "builders-hall",
       "text": "Try reloading in a moment.",
       "file": "modules/hall-ui/public/task.js",
-      "line": 309,
+      "line": 339,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9969,7 +9969,7 @@
       "surface": "builders-hall",
       "text": "manage its visibility in Settings → Cross-project record",
       "file": "modules/hall-ui/public/profile.js",
-      "line": 200,
+      "line": 206,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10059,7 +10059,7 @@
       "surface": "builders-hall",
       "text": "no data",
       "file": "modules/hall-ui/public/hall-render.js",
-      "line": 948,
+      "line": 949,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10338,7 +10338,7 @@
       "surface": "builders-hall",
       "text": "sign in",
       "file": "modules/hall-ui/public/profile.js",
-      "line": 265,
+      "line": 271,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10455,7 +10455,7 @@
       "surface": "builders-hall",
       "text": "to see your own profile.",
       "file": "modules/hall-ui/public/profile.js",
-      "line": 265,
+      "line": 271,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -10473,7 +10473,7 @@
       "surface": "builders-hall",
       "text": "trend, latest {…}",
       "file": "modules/hall-ui/public/hall-render.js",
-      "line": 960,
+      "line": 961,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13164,7 +13164,7 @@
       "surface": "status-dashboard",
       "text": "Avg time per work (min)",
       "file": "modules/status-ui/public/status.js",
-      "line": 1190,
+      "line": 1223,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13407,7 +13407,7 @@
       "surface": "status-dashboard",
       "text": "No builders yet — be the first.",
       "file": "modules/status-ui/public/status.js",
-      "line": 1084,
+      "line": 1117,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -13434,7 +13434,7 @@
       "surface": "status-dashboard",
       "text": "No works yet inscribed in this window.",
       "file": "modules/status-ui/public/status.js",
-      "line": 921,
+      "line": 947,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -13677,7 +13677,7 @@
       "surface": "status-dashboard",
       "text": "Works shipped / day",
       "file": "modules/status-ui/public/status.js",
-      "line": 1189,
+      "line": 1222,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -13776,7 +13776,7 @@
       "surface": "status-dashboard",
       "text": "page {…} of {…}",
       "file": "modules/status-ui/public/status.js",
-      "line": 977,
+      "line": 1010,
       "origin": "js-text-assign",
       "confidence": "certain"
     },
@@ -13794,7 +13794,7 @@
       "surface": "status-dashboard",
       "text": "tablet last consulted at {…}",
       "file": "modules/status-ui/public/status.js",
-      "line": 1134,
+      "line": 1167,
       "origin": "js-text-assign",
       "confidence": "certain"
     },

package/docs/file-map.md

@@ -123,7 +123,7 @@
 │   ├── autonomy/                ← CORE-DOMAIN carve (BV1.R83, default-on): the MAS autonomy surfaces — the $0 deterministic autonomy gate (System 3, inert until armed), the conductor/architect CLIs, and the in-process routine timers (incl. the weekly peer-vote-tally poller). Registers no port; resolves the lifecycle `tallyPeerVotes` doorway. CLAUDE.md, module.json, routes/autonomy.js, autonomy.js.
 │   ├── status-ui/              ← CORE-DOMAIN WEB-SURFACE carve (BV1.R84, default-on): the public status dashboard at status.<apex>, moved from public-status/. NO routes/db/port — declares contributes.webSurfaces:[{host:"status.",dir:"public"}], served by the loader web-surface seam (moduleWebSurfaces → serve-internal). CLAUDE.md, module.json, public/{index.html,status.js,style.css,cursors/,snapshots/}.
 │   ├── hall-ui/                ← CORE-DOMAIN WEB-SURFACE carve (BV1.R85, default-on): the authenticated builders' hall at builders.<apex>, moved from public-builders/ (~13k LOC, the largest). NO routes/db/port — declares contributes.webSurfaces:[{host:"builders.",dir:"public"}] for discovery, but UNLIKE status-ui keeps its DEDICATED serving block in serve-internal (the /builders shim + canonical redirects + citizen/Archon page gates + asset-stamping + hall-widget injection), partitioned out of the generic web-surface loop and served from BUILDERS_DIR. CLAUDE.md, module.json, public/{index.html,builders.js,style.css,work,watch,harbor,gate,pair,settings,ranks,sessions,primer,diagrams,atlas,...}.{html,js},cursors/,chime.wav.
-│   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js.
+│   ├── lifecycle/               ← CORE-DOMAIN carve (BV1.R86, default-on): the build state machine — tasks · claims · versions · done-when · goals · dependencies · claim→ship→grade→credit · github-push + merge-lock + conflict-resolve + publish-reconciler. The LAST, most-coupled carve; registers the `lifecycle` kernel port (createTask, classifyTaskKind, tallyPeerVotes, work-tracking reads). CLAUDE.md, module.json, routes/{tasks,claims,versions,done-when,goals,dependencies,gate-approvals,analytics}.js, lifecycle.js, github-push.js, merge-lock.js, conflict-resolve.js, publish-reconciler.js, task-visuals.js + task-visual-db.js + routes/visuals.js (the optional ship-time visual, task 1003109 — the route file is NOT named task-*.js on purpose; see the module CLAUDE.md).
 │   ├── copy-desk/               ← CORE-DOMAIN module (task 1003113 / R02 of goal 1000074, default-on): the COPY half of the design contract — ADR 0081 gave design TOKENS a repo-owned source of truth, text had none. Owns the FLAG (anyone in any role marks a string or a whole surface as needing an artist's attention, with a reason required in BOTH the route and a CHECK constraint) and the QUEUE an artist reads it from. READS R01's committed registry (docs/copy-registry.json, generated by scripts/gds/copy-inventory.js) and never writes it. NO LIVE CMS is the hard non-goal: no column here could hold replacement text, and copy_no_cms.mjs pins that. Key is `copy-desk`, not `copy` — the branding contract already owns a `copy` block, so the bare word reds the "core carries no module code" fitness check. CLAUDE.md, module.json, registry.js, flags.js, routes/copy-desk.js, migrations/copy_desk_001_flags.sql, tests/{copy_flags,copy_queue,copy_no_cms}.mjs. Its hall surface lives with hall-ui (public/copy-desk.{html,js,css}), per the one-key-per-web-surface precedent.
 │   ├── character-anim/          ← consistent-character generative animation (ADR 0088) — graded painterly frame sets + manifest, the otb-character-review skill. CLAUDE.md, module.json.
 │   ├── provisioning/            ← stands up + operates a Cloud Bongos instance's own infra (server/DB/domain/DNS/TLS) via the API (ADR 0111); web-tier request+state only, no cloud tokens — a separate control-plane runner drains the intents. Distinct from the `hosting` module (ADR 0092), which brokers compute workloads. CLAUDE.md, module.json.
@@ -155,6 +155,7 @@
 │       ├── gen-file-map.js      ← ADR 0066 ([#1276](https://example.com/builders#/task/1276)): generates the `.claude/skills/` + `.claude/scheduled-tasks/` sections of docs/file-map.md from disk; per-entry notes come from docs/file-map.notes.json; `--check` fails on drift OR a skill/routine with no note (CI gate via fitness.js); regenerated on deploy by ship.js regenerateFileMap()
 │       ├── fitness.js           ← Path C (ADR 0062 §9, [#1225](https://example.com/builders#/task/1225)): architecture fitness functions — core↔host import boundary (zero grandfathered exceptions as of R52/#1191), CLAUDE.md budget + nested-doc presence (ADR 0061), no route bypasses rank checks (reuses route-rank-check), repo-map freshness. Enforced in CI via tests/fitness.mjs (the `unit` gate). `node scripts/gds/fitness.js`
 │       ├── ship.js              ← resolve claim as shipped, award credits (`/builder-ship`); also uploads a secret-scrubbed session digest to the corpus (6D.1, ADR 0027); on a dev box runs the sandbox-first review gate before resolving (#927, ADR 0046)
+│       ├── ship-visual.js       ← the OPTIONAL `--visual <image> [--visual-alt "…"]` leg of a ship (task 1003109): screens the file BEFORE the claim resolves (bad input costs no claim), uploads it AFTER (a failed picture never fails a ship)
 │       ├── package-core.js      ← package the core as a versioned, installable artifact + pin manifest (`bongos package-core`; R84, ADR 0100 §1, [#1688](https://example.com/builders#/task/1688)): isPublishable() selection + mirror redaction + fail-closed no-leak gate → dist/bongos-core-<version>.{tgz,manifest.json}; version = src/module-api CORE_VERSION. Recipe: docs/recipes/packaging-the-core.md
 │       ├── sandbox-stage.js     ← stage the working tree on the live game preview (box OR local) for browser review before ship; resolvePreviewContext picks the context (`/builder-stage`; #927, ADR 0046; local: task 1056)
 │       ├── local-preview.js     ← builder CLI for the LOCAL sandbox: start/stop/status/restart/logs/url of the game-only preview at http://localhost:3100 (`npm run preview`; task 1056)

package/migrations/core_223_task_visual.sql

@@ -0,0 +1,33 @@
+-- core_223_task_visual.sql — task 1003109 (goal 1000072, "Human legibility").
+--
+-- A CORE migration, not a lifecycle-module one, even though the lifecycle module
+-- owns the feature: `tasks` is a CORE table, and ADR 0083 §Decision #5 lets a
+-- module's migrations touch only its own <key>_-namespaced tables. A module
+-- reaches core state through the doorway, never through DDL.
+--
+-- A shipped task can carry a VISUAL, not just a value summary. `value_summary`
+-- already holds the plain-language "what this means for a reader" line collected
+-- at ship time; these two columns hold the SAME claim in another medium — the
+-- served URL of one optional image, plus its caption/alt text.
+--
+-- OPTIONAL BY CONSTRUCTION: both columns are nullable with no default and nothing
+-- reads them as a completeness signal. A task with no visual is a complete task
+-- ("where relevant" is the owner's own wording, idea 1000400), and no ship path
+-- blocks on their absence.
+--
+-- ADVISORY, NOT A NEW PRIVACY AXIS: visual_url carries no audience of its own. The
+-- serve route derives who may view an image from the TASK it belongs to (the
+-- filename embeds the task id) — the same gate that already decides whether
+-- value_summary is public. One claim, one audience, in both media.
+--
+-- PORTABLE + replay-safe: IF NOT EXISTS on a fresh or already-migrated DB alike;
+-- no instance data, no backfill (there is nothing to backfill — no visual has
+-- ever been uploaded).
+
+ALTER TABLE tasks ADD COLUMN IF NOT EXISTS visual_url TEXT;
+ALTER TABLE tasks ADD COLUMN IF NOT EXISTS visual_alt TEXT;
+
+COMMENT ON COLUMN tasks.visual_url IS
+  'Optional served URL (/api/bongos/task-visuals/<file>) of the ship-time visual for this task. Same audience as value_summary; never required.';
+COMMENT ON COLUMN tasks.visual_alt IS
+  'Optional caption / alt text rendered with tasks.visual_url.';

package/modules/dev-box/app/src/vendor/bongos-client.cjs

@@ -715,6 +715,10 @@ function createClient(opts = {}) {
       // POST /sso/token — rank: public — POST /sso/token
       postSsoToken: (args) => request("POST", "/sso/token", { hasBody: true }, args),
     },
+    "taskVisuals": {
+      // GET /task-visuals/{name} — rank: public — GET /task-visuals/:name
+      getTaskVisualsName: (args) => request("GET", "/task-visuals/{name}", { hasBody: false }, args),
+    },
     "tasks": {
       // GET /tasks — rank: any-builder — GET /tasks
       getTasks: (args) => request("GET", "/tasks", { hasBody: false }, args),
@@ -758,6 +762,10 @@ function createClient(opts = {}) {
       getTasksIdPublishStatus: (args) => request("GET", "/tasks/{id}/publish-status", { hasBody: false }, args),
       // POST /tasks/{id}/ship — rank: any-builder — POST /tasks/:id/ship
       postTasksIdShip: (args) => request("POST", "/tasks/{id}/ship", { hasBody: true }, args),
+      // DELETE /tasks/{id}/visual — rank: any-builder — DELETE /tasks/:id/visual
+      deleteTasksIdVisual: (args) => request("DELETE", "/tasks/{id}/visual", { hasBody: false }, args),
+      // POST /tasks/{id}/visual — rank: any-builder — POST /tasks/:id/visual
+      postTasksIdVisual: (args) => request("POST", "/tasks/{id}/visual", { hasBody: true }, args),
       // POST /tasks/{id}/vote — rank: metic+archon — POST /tasks/:id/vote
       postTasksIdVote: (args) => request("POST", "/tasks/{id}/vote", { hasBody: true }, args),
       // GET /tasks/claimable — rank: any-builder — GET /tasks/claimable

package/modules/hall-ui/public/hall-kit.js

@@ -517,6 +517,37 @@
     };
   }
 
+  // ---- ship-time task visual (task 1003109, goal 1000072) -------------------
+  //
+  // A shipped task may carry an optional IMAGE alongside its value summary — the
+  // same claim in another medium, so a non-engineer can SEE what changed rather
+  // than read about it. In a FEED the summary is one line in a list, so the image
+  // appears as a small thumbnail linking to the full-size file; the task page
+  // renders it properly (task.js taskVisualHtml).
+  //
+  // Lives here because three separate feeds render it (Standing's ship ledger,
+  // a profile's recent ships, the status dashboard) and a fourth copy of an
+  // HTML-building helper is how the pre-kit drift started.
+
+  // Same-origin, SERVER-MINTED paths only. The URL arrives from our own API, but
+  // it lands in an href and a src, so it is matched literally against the shape
+  // modules/lifecycle/task-visuals.js mints rather than trusted. Anything else
+  // renders nothing at all.
+  const VISUAL_URL_RE = /^\/api\/(gds|bongos)\/task-visuals\/task-\d+-[0-9a-f]{16}\.(png|jpg|gif|webp)$/;
+  function isTaskVisualUrl(url) {
+    return VISUAL_URL_RE.test(String(url ?? ''));
+  }
+
+  // The compact thumbnail. Returns '' when the row carries no visual — a task
+  // without one must never look incomplete, so nothing is drawn (no placeholder).
+  function shipVisualThumbHtml(row) {
+    const url = String((row && row.visual_url) ?? '');
+    if (!isTaskVisualUrl(url)) return '';
+    const alt = String((row && row.visual_alt) || `Visual for task ${(row && row.id) ?? ''}`).trim();
+    return `<a href="${esc(url)}" target="_blank" rel="noopener" title="${esc(alt)}">` +
+      `<img class="ship-visual-thumb" src="${esc(url)}" alt="${esc(alt)}" loading="lazy"></a>`;
+  }
+
   const api = {
     esc,
     // pager (low-level exports so pages can adopt incrementally)
@@ -525,6 +556,8 @@
     makeLedger, makeFilterBar, makeTabs, makeSectionRail,
     // states
     emptyStateHtml, skeletonRows, collapsibleCard,
+    // ship-time task visual (task 1003109)
+    isTaskVisualUrl, shipVisualThumbHtml,
     // age (task 1002955)
     fmtAge, fmtAbsDate, ageChipHtml, AGE_STALE_DAYS,
   };

package/modules/hall-ui/public/hall-render.js

@@ -931,6 +931,7 @@
         <td>
           <div>${escapeHtml(s.title)}</div>
           ${s.value_summary ? `<div style="color:var(--ink-soft);font-size:0.88rem;font-style:italic;margin-top:2px">${escapeHtml(s.value_summary)}</div>` : ''}
+          ${s.visual_url ? `<div style="margin-top:6px">${window.OTBKit.shipVisualThumbHtml(s)}</div>` : ''}
         </td>
         <td class="ledger__drachmae">${fmtNum(window.OTBBranding?.taskCreditValue?.(s) ?? s.credits_reward)}</td>
         <td class="ledger__date">${fmtDate(s.shipped_at)}</td>

package/modules/hall-ui/public/profile.html

@@ -95,6 +95,9 @@
 <!-- shared frontend toolkit (window.OTB) — loaded before profile.js, which pulls from it. -->
 <script src="/builders/dom-utils.js?v=2026-06-14-domutils"></script>
 <script src="/builders/brand-apply.js?v=2026-06-27-r75"></script>
-<script src="/builders/profile.js?v=2026-08-16-r04"></script>
+<!-- hall-kit (window.OTBKit) — profile.js renders ship-time task visuals through
+     its shared thumbnail helper (task 1003109), so it must load first. -->
+<script src="/builders/hall-kit.js?v=2026-08-25-visual"></script>
+<script src="/builders/profile.js?v=2026-08-25-visual"></script>
 </body>
 </html>

package/modules/hall-ui/public/profile.js

@@ -150,10 +150,16 @@
       const summary = s.value_summary
         ? `<span style="display:block;margin-top:2px;font-size:12px;color:var(--ink-faint)">${escapeHtml(s.value_summary)}</span>`
         : '';
+      // task 1003109: the optional ship-time visual, as a thumbnail beside the
+      // summary it restates. '' when the task has none — which is most of them,
+      // and never reads as an omission.
+      const visual = window.OTBKit && window.OTBKit.shipVisualThumbHtml
+        ? window.OTBKit.shipVisualThumbHtml(s)
+        : '';
       return `
         <tr>
           <td class="ledger__num">#${escapeHtml(String(s.id))}</td>
-          <td><a href="/task/${encodeURIComponent(s.id)}">${escapeHtml(s.title || `Task ${s.id}`)}</a>${summary}</td>
+          <td><a href="/task/${encodeURIComponent(s.id)}">${escapeHtml(s.title || `Task ${s.id}`)}</a>${summary}${visual ? `<span style="display:block;margin-top:6px">${visual}</span>` : ''}</td>
           <td class="ledger__drachmae">${fmtNum(reward)}</td>
           <td class="ledger__date">${fmtDate(s.shipped_at)}</td>
         </tr>`;

package/modules/hall-ui/public/style.css

@@ -1804,6 +1804,35 @@ main [id] { scroll-margin-top: calc(var(--topbar-h) + 16px); }
   overflow-y: auto;
 }
 .td-touches { font-size: 12.5px; color: var(--ink-faint); word-break: break-word; margin: 0 0 12px; }
+/* task 1003109: the ship-time VISUAL, rendered directly under the value summary
+   it restates. Sized to be READ (this exists so a non-engineer can see a change),
+   capped so a tall screenshot can't push the rest of the record off the page, and
+   never drawn at all when a task has no visual. */
+.td-visual { margin: 0 0 12px; }
+.td-visual__img {
+  display: block;
+  max-width: 100%;
+  max-height: 52vh;
+  width: auto;
+  height: auto;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: var(--surface-2);
+}
+.td-visual__caption { font-size: 12.5px; color: var(--ink-faint); margin: 6px 0 0; }
+/* The compact form: a thumbnail beside a value summary in a ship FEED, where the
+   summary is one line in a list and a full-width image would drown it. */
+.ship-visual-thumb {
+  display: inline-block;
+  width: 44px;
+  height: 44px;
+  flex: 0 0 auto;
+  object-fit: cover;
+  border: 1px solid var(--border);
+  border-radius: var(--radius-sm);
+  background: var(--surface-2);
+  vertical-align: middle;
+}
 /* Shared small-caps label: overlay section heads and triage form-field labels. */
 .td-section-h, .td-field > span { font-size: 11px; font-weight: 600; text-transform: uppercase; letter-spacing: 0.05em; color: var(--ink-faint); }
 .td-section-h { margin: 0 0 4px; }

package/modules/hall-ui/public/task.js

@@ -149,6 +149,29 @@
     return `<div class="td-deps"><p class="td-section-h">${escapeHtml(kindWord)}</p><ul class="td-dep-list">${rows}</ul></div>`;
   }
 
+  // task 1003109 (goal 1000072, "Human legibility") — the ship-time visual.
+  //
+  // The point of the feature is that a NON-ENGINEER can see what changed, so the
+  // image renders at a readable size, not as a thumbnail, and links to itself so
+  // a detail can be opened full-size. The caption (visual_alt) doubles as the alt
+  // text, which is why it is stored: an image with no alt tells a screen reader
+  // nothing, and "a picture of the change" is exactly the audience that needs it.
+  function taskVisualHtml(t) {
+    const url = String(t.visual_url || '');
+    // Same-origin, server-generated paths only. The URL comes from our own API,
+    // but rendering it into an href/src is a place to be literal rather than
+    // trusting: anything that is not the shape our serve route mints is dropped.
+    if (!/^\/api\/(gds|bongos)\/task-visuals\/task-\d+-[0-9a-f]{16}\.(png|jpg|gif|webp)$/.test(url)) return '';
+    const alt = String(t.visual_alt || `Visual for task ${t.id}`);
+    const caption = t.visual_alt
+      ? `<figcaption class="td-visual__caption">${escapeHtml(t.visual_alt)}</figcaption>`
+      : '';
+    return `<figure class="td-visual">` +
+      `<a href="${escapeHtml(url)}" target="_blank" rel="noopener">` +
+      `<img class="td-visual__img" src="${escapeHtml(url)}" alt="${escapeHtml(alt)}" loading="lazy">` +
+      `</a>${caption}</figure>`;
+  }
+
   async function copyText(text) {
     try { await navigator.clipboard.writeText(text); return true; }
     catch (_) {
@@ -217,6 +240,13 @@
       parts.push(`<p class="td-goal"><strong>Value:</strong> ${escapeHtml(t.value_summary)}</p>`);
     }
 
+    // task 1003109: the ship-time VISUAL — the same claim as the value summary in
+    // another medium, so it renders directly beneath it and nowhere the summary
+    // isn't. Absent on almost every task, and that is not an omission: a task with
+    // no visual must never look incomplete, so nothing is drawn at all when there
+    // is none — no placeholder, no empty frame, no "no visual" line.
+    if (t.visual_url) parts.push(taskVisualHtml(t));
+
     if (t.description) {
       parts.push(`<div class="td-desc">${escapeHtml(t.description)}</div>`);
     }

package/modules/lifecycle/db-analytics.js

@@ -43,6 +43,8 @@ async function recentShippedTasks(limit = 30, { days = null } = {}) {
   }
   const { rows } = await pool.query(
     `SELECT t.id, t.title, t.value_summary, t.version_id, t.status, t.shipped_at, t.credits_reward,
+            -- task 1003109: the SQL mirror of task-visuals.isPubliclyViewable — this feed is UNAUTHENTICATED, so a security_sensitive task's image is nulled out rather than published (nulling the URL keeps the flag itself off the public wire). Change this, change that predicate.
+            CASE WHEN t.security_sensitive THEN NULL ELSE t.visual_url END AS visual_url, CASE WHEN t.security_sensitive THEN NULL ELSE t.visual_alt END AS visual_alt,
             ${CREDITS_AWARDED_SUBQUERY} AS credits_awarded,
             t.est_minutes, t.actual_minutes,
             b.github_login, b.display_name
@@ -123,7 +125,7 @@ async function estimationDriftSummary() {
 
 async function recentShippedTasksByBuilder(builderId, limit = 10) {
   const { rows } = await pool.query(
-    `SELECT t.id, t.title, t.value_summary, t.version_id, t.status, t.shipped_at, t.credits_reward,
+    `SELECT t.id, t.title, t.value_summary, t.visual_url, t.visual_alt, t.version_id, t.status, t.shipped_at, t.credits_reward,
             ${CREDITS_AWARDED_SUBQUERY} AS credits_awarded
        FROM tasks t
       WHERE t.shipped_by = $1

package/modules/lifecycle/module.json

@@ -18,7 +18,8 @@
       "gate-approvals",
       "analytics",
       "lifecycle",
-      "help-requests"
+      "help-requests",
+      "visuals"
     ],
     "pollers": [
       "publish-reconciler"