@bongos/core 1.19.663 → 1.19.665

package/docs/copy-registry.json

@@ -3,9 +3,9 @@
   "generator": "scripts/gds/copy-inventory.js",
   "goal": 1000074,
   "counts": {
-    "strings": 1744,
-    "unique_ids": 1508,
-    "certain": 1744,
+    "strings": 1755,
+    "unique_ids": 1519,
+    "certain": 1755,
     "heuristic": 0,
     "duplicate_ids": 165
   },
@@ -13,7 +13,7 @@
     "builders-hall": {
       "at": "modules/hall-ui/public",
       "files": 81,
-      "strings": 1271
+      "strings": 1282
     },
     "status-dashboard": {
       "at": "modules/status-ui/public",
@@ -925,8 +925,8 @@
       "text": "Let it be for now",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/studio.js:87",
-        "modules/hall-ui/public/studio.js:104"
+        "modules/hall-ui/public/studio.js:203",
+        "modules/hall-ui/public/studio.js:218"
       ]
     },
     {
@@ -1645,8 +1645,8 @@
       "text": "to tend now · {…}",
       "occurrences": 2,
       "at": [
-        "modules/hall-ui/public/studio.js:87",
-        "modules/hall-ui/public/studio.js:104"
+        "modules/hall-ui/public/studio.js:203",
+        "modules/hall-ui/public/studio.js:218"
       ]
     },
     {
@@ -3314,7 +3314,7 @@
       "surface": "builders-hall",
       "text": "Coach the grader",
       "file": "modules/hall-ui/public/studio.js",
-      "line": 87,
+      "line": 181,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -4425,6 +4425,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "b384ec1a6fe4",
+      "surface": "builders-hall",
+      "text": "Dismissed — the copy and visuals are good as shipped.",
+      "file": "modules/hall-ui/public/studio.js",
+      "line": 356,
+      "origin": "js-notice",
+      "confidence": "certain"
+    },
     {
       "id": "3e561393f4e9",
       "surface": "builders-hall",
@@ -4848,6 +4857,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "a7bdd4706975",
+      "surface": "builders-hall",
+      "text": "Filed as task {…} — this review is closed against it.",
+      "file": "modules/hall-ui/public/studio.js",
+      "line": 445,
+      "origin": "js-notice",
+      "confidence": "certain"
+    },
     {
       "id": "6430ee350486",
       "surface": "builders-hall",
@@ -5703,12 +5721,21 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "a28aa368453f",
+      "surface": "builders-hall",
+      "text": "It shipped and it is live. Say what you see — your review coaches the grader and never blocks what shipped.",
+      "file": "modules/hall-ui/public/studio.js",
+      "line": 201,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "d751fe51e178",
       "surface": "builders-hall",
       "text": "It shipped and it is live. Your review coaches the grader on how it judged the work, then remakes or tweaks the words or art only if they need it — it never blocks what shipped.",
       "file": "modules/hall-ui/public/studio.js",
-      "line": 87,
+      "line": 202,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5933,7 +5960,7 @@
       "surface": "builders-hall",
       "text": "Let it be for now",
       "file": "modules/hall-ui/public/studio.js",
-      "line": 87,
+      "line": 203,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -5942,7 +5969,7 @@
       "surface": "builders-hall",
       "text": "Let it be for now",
       "file": "modules/hall-ui/public/studio.js",
-      "line": 104,
+      "line": 218,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -6207,6 +6234,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "73677b6839d7",
+      "surface": "builders-hall",
+      "text": "Looks good",
+      "file": "modules/hall-ui/public/studio.js",
+      "line": 161,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "a93ca2841b96",
       "surface": "builders-hall",
@@ -6405,6 +6441,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "3970d299c95a",
+      "surface": "builders-hall",
+      "text": "Needs work",
+      "file": "modules/hall-ui/public/studio.js",
+      "line": 161,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "7def635421ea",
       "surface": "builders-hall",
@@ -6864,6 +6909,24 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "73c72974f4f9",
+      "surface": "builders-hall",
+      "text": "Note it",
+      "file": "modules/hall-ui/public/studio.js",
+      "line": 161,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
+    {
+      "id": "c404f22d7892",
+      "surface": "builders-hall",
+      "text": "Noted on the review — it stays open.",
+      "file": "modules/hall-ui/public/studio.js",
+      "line": 388,
+      "origin": "js-notice",
+      "confidence": "certain"
+    },
     {
       "id": "cd652d04d616",
       "surface": "builders-hall",
@@ -7022,7 +7085,7 @@
       "surface": "builders-hall",
       "text": "Only if it needs it — with the AI at your side, or on your own.",
       "file": "modules/hall-ui/public/studio.js",
-      "line": 87,
+      "line": 181,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7085,7 +7148,7 @@
       "surface": "builders-hall",
       "text": "Open in the copy desk",
       "file": "modules/hall-ui/public/studio.js",
-      "line": 104,
+      "line": 218,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7166,7 +7229,7 @@
       "surface": "builders-hall",
       "text": "Open this review",
       "file": "modules/hall-ui/public/studio.js",
-      "line": 87,
+      "line": 203,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -7931,7 +7994,7 @@
       "surface": "builders-hall",
       "text": "Remake or tweak",
       "file": "modules/hall-ui/public/studio.js",
-      "line": 87,
+      "line": 181,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8228,7 +8291,7 @@
       "surface": "builders-hall",
       "text": "Review how it judged this work, and teach it what good looked like.",
       "file": "modules/hall-ui/public/studio.js",
-      "line": 87,
+      "line": 181,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -8903,7 +8966,7 @@
       "surface": "builders-hall",
       "text": "Start over",
       "file": "modules/hall-ui/public/studio.js",
-      "line": 120,
+      "line": 234,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -9321,6 +9384,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "027e9420daa2",
+      "surface": "builders-hall",
+      "text": "The headline lands, but the sub-line reads like a brochure.",
+      "file": "modules/hall-ui/public/studio.js",
+      "line": 161,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "797f02fa8295",
       "surface": "builders-hall",
@@ -10293,6 +10365,15 @@
       "origin": "html-attr:placeholder",
       "confidence": "certain"
     },
+    {
+      "id": "1d5bfd09068c",
+      "surface": "builders-hall",
+      "text": "What you saw",
+      "file": "modules/hall-ui/public/studio.js",
+      "line": 161,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "3dade88f0584",
       "surface": "builders-hall",
@@ -10878,6 +10959,15 @@
       "origin": "html-text",
       "confidence": "certain"
     },
+    {
+      "id": "a824e3e2057a",
+      "surface": "builders-hall",
+      "text": "Your verdict on a review is recorded from the review itself — open it to dismiss it, note what you saw, or file the follow-up.",
+      "file": "modules/hall-ui/public/studio.js",
+      "line": 158,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "f6b12676169b",
       "surface": "builders-hall",
@@ -11036,7 +11126,7 @@
       "surface": "builders-hall",
       "text": "and {…} more waiting{…}",
       "file": "modules/hall-ui/public/studio.js",
-      "line": 156,
+      "line": 276,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -11684,7 +11774,7 @@
       "surface": "builders-hall",
       "text": "no data",
       "file": "modules/hall-ui/public/hall-kit.js",
-      "line": 727,
+      "line": 761,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12215,7 +12305,7 @@
       "surface": "builders-hall",
       "text": "to tend now · {…}",
       "file": "modules/hall-ui/public/studio.js",
-      "line": 87,
+      "line": 203,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12224,7 +12314,7 @@
       "surface": "builders-hall",
       "text": "to tend now · {…}",
       "file": "modules/hall-ui/public/studio.js",
-      "line": 104,
+      "line": 218,
       "origin": "js-markup",
       "confidence": "certain"
     },
@@ -12993,6 +13083,15 @@
       "origin": "js-markup",
       "confidence": "certain"
     },
+    {
+      "id": "d3afa6d6dd9e",
+      "surface": "builders-hall",
+      "text": "— your words, in your voice. Needed for a note or a follow-up.",
+      "file": "modules/hall-ui/public/studio.js",
+      "line": 161,
+      "origin": "js-markup",
+      "confidence": "certain"
+    },
     {
       "id": "68b547166d48",
       "surface": "builders-hall",

package/docs/module-api-changelog.md

@@ -1775,5 +1775,19 @@ is load-bearing: the script throws rather than guess if it is missing, and
         landed since 1.19.661 with no explicit bump. run 34553965204. (task 1002620)
   1.19.663 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
         landed since 1.19.662 with no explicit bump. run 34557840364. (task 1002620)
+  (next carrier) — grantedScopeCoversRepos re-exported (task 1002909, goal 1000106).
+        The provisioning module's create-route credential preflight must tell "that
+        repo does not exist" apart from "it is private and your pre-ADR-0155 token
+        cannot see it" — GitHub answers 404 to both — so it needs the canonical scope
+        read. Shared rather than re-implemented because `public_repo` CONTAINS the
+        substring "repo", so a naive match accepts exactly the stale token it guards
+        against. auth-config.js is KERNEL (ADR 0091 §1), so this stays inside the
+        kernel-imports-only rule; db.getGithubToken and github-repos are DOMAIN and
+        deliberately did NOT come through the doorway — the module reaches those via
+        the already-exposed `pool` + `secretBox` and its own one-field repo client.
+  1.19.664 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.663 with no explicit bump. run 34558906002. (task 1002620)
+  1.19.665 — CI auto-patch (publish-on-merge, ADR 0161): carrier for merges
+        landed since 1.19.664 with no explicit bump. run 34560552542. (task 1002620)
 ---------------------------------------------------------------------------
 ```

package/modules/hall-ui/public/hall-kit.js

@@ -610,6 +610,40 @@
       `<img class="ship-visual-thumb" src="${esc(url)}" alt="${esc(alt)}" loading="lazy"></a>`;
   }
 
+  // The FULL-SIZE form: the picture as the thing being looked at, with
+  // visual_alt as its caption. The thumbnail above is for a FEED, where the
+  // summary is one line in a list; this is for a surface whose subject IS the
+  // image — the task record, and the Studio's review card (task 1003829).
+  //
+  // It lives here so the Studio did not become the THIRD hand-rolled <figure>
+  // for this one image. Be precise about what that did and did not fix: the two
+  // that already existed — task.js's taskVisualHtml (.tk-visual) and
+  // task-detail.js's overlay (.td-visual) — are NOT converged onto this yet and
+  // are untouched by the task that added it (1003829). Neither page loads the
+  // kit, so migrating them means adding it to task.html, which is a call of its
+  // own. So: one canonical renderer exists and new callers take it; the two
+  // legacy copies are a known, named cleanup rather than a claim already met.
+  //
+  // `className` is the caller's BEM base, because the size is the surface's
+  // decision and not the kit's: the task record caps at 52vh inside a record
+  // column (.tk-visual), the Studio gives the plate the card's whole width.
+  // The markup, the URL guard and the escaping are the kit's and identical
+  // everywhere. Returns '' with no visual, like the thumbnail.
+  function taskVisualFigureHtml(row, { className = 'task-visual' } = {}) {
+    const url = String((row && row.visual_url) ?? '');
+    if (!isTaskVisualUrl(url)) return '';
+    const written = String((row && row.visual_alt) || '').trim();
+    const alt = written || `Visual for task ${(row && row.id) ?? ''}`;
+    const base = String(className).replace(/[^A-Za-z0-9_-]/g, '');
+    // The caption is only drawn when the shipper WROTE one — the fallback alt is
+    // a machine sentence for a screen reader, not a caption to show a reader.
+    const caption = written ? `<figcaption class="${base}__caption">${esc(written)}</figcaption>` : '';
+    return `<figure class="${base}">` +
+      `<a href="${esc(url)}" target="_blank" rel="noopener">` +
+      `<img class="${base}__img" src="${esc(url)}" alt="${esc(alt)}" loading="lazy">` +
+      `</a>${caption}</figure>`;
+  }
+
   // ---- charts (task 1003445) ------------------------------------------------
   //
   // Charts were the one primitive the kit never got, which is exactly why the
@@ -1184,8 +1218,8 @@
     plotBox, plotWindow,
     // states
     emptyStateHtml, skeletonRows, collapsibleCard,
-    // ship-time task visual (task 1003109)
-    isTaskVisualUrl, shipVisualThumbHtml,
+    // ship-time task visual (task 1003109; the full-size figure, task 1003829)
+    isTaskVisualUrl, shipVisualThumbHtml, taskVisualFigureHtml,
     // age (task 1002955)
     fmtAge, fmtAbsDate, ageChipHtml, AGE_STALE_DAYS,
   };

package/modules/hall-ui/public/studio.css

@@ -151,6 +151,42 @@
   max-width: var(--measure);
 }
 
+/* THE PLATE — the reviewed work's ship-time visual (task 1003829). The picture
+   IS the card: an artist is being asked to LOOK at something, so it is given the
+   card's full width and as much height as a screen can spare, not the 44px
+   thumbnail a ship feed uses. Markup comes from the kit's one renderer
+   (OTBKit.taskVisualFigureHtml); only the size is this room's decision.
+
+   max-height in vh, and MEASURED at 1440x900 rather than chosen. The size an
+   artist can judge it at wins over a zero-scroll card — that is the task's own
+   priority — so this is not tuned to fit the verdict on the first screen; the
+   room's head alone is ~300px and no judgeable plate fits under it. What 40vh
+   buys is that the picture AND its caption are wholly in view together (plate
+   459-819, caption 827-865), with the weights one short scroll below (946). At
+   58vh the caption fell off too, which is worse: a plate you cannot read the
+   subject of. The tonal well behind it is --glass, so a transparent PNG has
+   something to sit on in both modes. */
+.studio-plate { margin: 0 0 18px; }
+.studio-plate__img {
+  display: block;
+  max-width: 100%;
+  max-height: 40vh;
+  width: auto;
+  height: auto;
+  border-radius: var(--radius-sm);
+  background: var(--glass);
+}
+/* The shipper's own words about the picture, in the caption voice — drawn only
+   when they wrote some (the kit omits the element otherwise, never a caption
+   that reads "Visual for task 1899"). */
+.studio-plate__caption {
+  margin: 8px 0 0;
+  font-size: 12.5px;
+  line-height: 1.5;
+  color: var(--ink-faint);
+  max-width: var(--measure);
+}
+
 /* The two steps of a review (R04): coach the grader, then remake or tweak. Not
    a checklist widget — a gentle reminder of the shape of the work, so the room
    describes the craft without becoming the form the criterion warns against. */
@@ -184,6 +220,73 @@
   color: var(--ink-faint);
 }
 
+/* THE VERDICT — the artist's answer, said here rather than somewhere else
+   (task 1003829). A tonal well separates it from the card's prose without a
+   drawn edge (the v3 hall rule), and it sits ABOVE the actions so the reader
+   meets "what did you think" before "open this" / "let it be". */
+.studio-verdict {
+  margin: 0 0 20px;
+  padding: 16px;
+  border-radius: var(--radius-sm);
+  background: var(--glass);
+}
+.studio-verdict__label {
+  display: block;
+  margin: 0 0 8px;
+  font-family: var(--label-face);
+  font-size: var(--label-size);
+  letter-spacing: var(--label-space);
+  text-transform: var(--label-case);
+  color: var(--ink-soft);
+}
+/* The clarifier rides inside the label (so clicking it still focuses the field)
+   but drops out of the label voice — caps are for the label, not a sentence. */
+.studio-verdict__label small {
+  font-family: var(--font-body);
+  font-size: 12.5px;
+  letter-spacing: normal;
+  text-transform: none;
+  color: var(--ink-faint);
+}
+.studio-verdict__words {
+  display: block;
+  width: 100%;
+  resize: vertical;
+  font-size: 14.5px;
+  line-height: 1.5;
+}
+/* The inline error, beside the control that caused it and gone the moment the
+   field is edited. --danger is the platform's measured status red; the room
+   spends no other colour. */
+.studio-verdict__err {
+  margin: 8px 0 0;
+  font-size: 13px;
+  line-height: 1.45;
+  color: var(--danger);
+}
+/* Three equal answers on one line, wrapping to a column on a phone rather than
+   squeezing. The 24px control floor is the shell's (.btn-ghost); the gap keeps
+   them from reading as a segmented control, which would imply one is selected. */
+.studio-verdict__weights {
+  margin-top: 12px;
+  display: flex;
+  flex-wrap: wrap;
+  gap: 10px;
+}
+/* What a viewer below the routes' floor sees instead of three buttons it would
+   refuse: a sentence naming where the verdict is recorded. Quiet, not a warning
+   — this is not an error, it is a different door. */
+.studio-verdict__sealed {
+  margin: 0 0 20px;
+  padding: 14px 16px;
+  border-radius: var(--radius-sm);
+  background: var(--glass);
+  font-size: 13.5px;
+  line-height: 1.5;
+  color: var(--ink-soft);
+  max-width: var(--measure);
+}
+
 /* The one place the accent is spent on a control. Ghost is the calm pass —
    "let it be for now" advances to the next piece without changing anything. */
 .studio-card__actions {
@@ -237,7 +340,18 @@
   font-size: 13.5px;
   color: var(--ink-faint);
 }
-.studio-links a { color: var(--accent-ink); }
+/* The 24px control floor, which these two links were failing at every width and
+   in both modes (the kit's controls-24px audit: 229x21 and 154x21). A link IS a
+   control, and the floor is "clears 24px on both sides" — so they get the height
+   here rather than staying the one failing pair on an otherwise clean surface.
+   inline-flex + align-items keeps the text where it sits today; only the hit
+   area grows. */
+.studio-links a {
+  color: var(--accent-ink);
+  display: inline-flex;
+  align-items: center;
+  min-height: 24px;
+}
 
 /* The empty room — a good sign, said plainly, not a dead panel. */
 .studio-empty {
@@ -265,4 +379,10 @@
 @media (max-width: 640px) {
   .studio { padding-top: 20px; }
   .studio-card__actions { gap: 8px; }
+  /* The plate takes less of a phone's height so the verdict is still reachable
+     without a scroll past the picture. */
+  .studio-plate__img { max-height: 34vh; }
+  /* Full-width weights, stacked: three buttons side by side at 320px would each
+     fall under the 24px-clearance floor. */
+  .studio-verdict__weights { flex-direction: column; align-items: stretch; }
 }

package/modules/hall-ui/public/studio.html

@@ -69,6 +69,10 @@
 <script src="/builders/shell.js?v=2026-07-02-shell1"></script>
 <script src="/builders/palette.js" defer></script>
 <script src="/builders/dom-utils.js?v=2026-06-23-contrib"></script>
-<script src="/builders/studio.js?v=2026-09-04-studio1"></script>
+<!-- The kit, for its ONE renderer: the full-size ship-time visual figure
+     (task 1003829). The copy desk — the artist's other room — already loads it,
+     and a fourth hand-rolled <figure> is what the kit exists to stop. -->
+<script src="/builders/hall-kit.js"></script>
+<script src="/builders/studio.js?v=2026-09-10-studio2"></script>
 </body>
 </html>