@bongos/core 1.21.109 → 1.21.111

package/modules/hall-ui/public/craft-review.css

@@ -0,0 +1,227 @@
+/* craft-review.css — artist review mode (task 1004686; craft-mode.js draws the
+   menu, craft-review.js the wall). Imported by style.css, beside page-notes.css.
+
+   The Review button becomes a split pill: Review still opens the feedback doc,
+   and the chevron (or, where a pointer can hover, the whole pill) opens a menu
+   of the four experiences. While an artist reviews one, small black-and-white
+   doodles in the sky's hand are scribbled into the top bar's empty space.
+
+   Every colour is a token (tests/hall_audit.mjs holds that). Every motion is
+   CSS on transform and opacity, and the hall's reduced-motion kill switch
+   (style.css) leaves three doodles standing, finished, with no pen.
+
+   An @import lands BEFORE style.css's own rules, so a rule here that restyles
+   .craft-tool must out-rank it (two classes), or style.css silently wins. */
+
+/* ---------- the split pill ---------- */
+.craft-review {
+  position: relative;
+  display: inline-flex;
+  align-items: center;
+  flex-shrink: 0;
+  border-radius: var(--radius-pill);
+  box-shadow: inset 0 0 0 1px color-mix(in srgb, var(--craft, var(--ink)) 40%, transparent);
+}
+.craft-review > .craft-tool {
+  box-shadow: none;
+  border-radius: var(--radius-pill) 0 0 var(--radius-pill);
+}
+.craft-review__more {
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  width: 24px;
+  height: 32px;
+  padding: 0 4px 0 0;
+  border: 0;
+  border-radius: 0 var(--radius-pill) var(--radius-pill) 0;
+  background: none;
+  color: var(--craft, var(--ink-soft));
+  cursor: pointer;
+}
+.craft-review__more svg { width: 12px; height: 12px; transition: transform 200ms cubic-bezier(.2, .7, .3, 1); }
+.craft-review__more[aria-expanded="true"] svg { transform: rotate(180deg); }
+.craft-review__more:hover { background: color-mix(in srgb, var(--craft, var(--ink)) 12%, transparent); }
+.craft-review__more:focus-visible { outline: 2px solid var(--focus); outline-offset: 2px; }
+@media (min-width: 1181px) {
+  .craft-review > .craft-tool { padding-right: 6px; }
+}
+@media (max-width: 1180px) {
+  .craft-review > .craft-tool { width: 30px; }
+}
+
+/* Reviewing: the pill takes a wash of the experience's colour, says
+   "Reviewing", and a drop of wet paint hangs from it. */
+.craft-tool.craft-tool--reviewing { position: relative; background: color-mix(in srgb, var(--craft, var(--sea)) 14%, transparent); }
+.craft-tool.craft-tool--reviewing::after {
+  content: '';
+  position: absolute;
+  left: 13px;
+  bottom: -4px;
+  width: 4px;
+  height: 7px;
+  border-radius: 0 0 3px 3px;
+  background: var(--craft, var(--sea));
+}
+
+/* ---------- the menu ---------- */
+.craft-review__menu {
+  position: absolute;
+  top: calc(100% + 8px);
+  right: 0;
+  z-index: var(--z-drawer);
+  display: flex;
+  flex-direction: column;
+  gap: 2px;
+  min-width: 248px;
+  padding: 6px;
+  box-sizing: border-box;
+  background: var(--bg-card);
+  border-radius: var(--radius);
+  box-shadow: 0 0 0 1px var(--glass-edge), var(--shadow-pop);
+}
+.craft-review__menu[hidden] { display: none; }
+/* A bridge over the gap, so a pointer travelling down to the menu never
+   leaves the pill and the hover menu does not close under it. */
+.craft-review__menu::before { content: ''; position: absolute; left: 0; right: 0; top: -8px; height: 8px; }
+.craft-review__head {
+  margin: 8px 12px 2px;
+  font-family: var(--label-face);
+  font-size: 11px;
+  letter-spacing: .12em;
+  text-transform: uppercase;
+  color: var(--ink-faint);
+}
+.craft-review__item {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  min-height: 36px;
+  padding: 0 12px;
+  border: 0;
+  border-radius: var(--radius-sm);
+  background: none;
+  color: var(--ink);
+  font: inherit;
+  font-size: 14px;
+  text-align: left;
+  white-space: nowrap;
+  cursor: pointer;
+}
+.craft-review__item:hover { background: color-mix(in srgb, var(--craft, var(--ink)) 10%, transparent); }
+.craft-review__item:focus-visible { outline: 2px solid var(--focus); outline-offset: -2px; }
+.craft-review__icon { width: 16px; height: 16px; flex-shrink: 0; color: var(--ink-soft); }
+.craft-review__item[aria-checked="true"] { color: var(--craft, var(--ink)); font-weight: 500; }
+.craft-review__item[aria-checked="true"] .craft-review__icon { color: var(--craft, var(--ink)); }
+.craft-review__check { width: 14px; height: 14px; margin-left: auto; flex-shrink: 0; }
+.craft-review__item--stop { margin-top: 4px; border-top: 1px solid var(--rule-soft); border-radius: 0 0 var(--radius-sm) var(--radius-sm); }
+
+/* A phone: no hover and no room for the chevron, so Review itself opens the
+   menu (craft-mode.js), and the menu spans the bar instead of hanging off a
+   pill that may sit near the left edge. */
+@media (max-width: 640px) {
+  .craft-review { position: static; }
+  .craft-review__more { display: none; }
+  .craft-review > .craft-tool { width: 28px; border-radius: var(--radius-pill); }
+  .craft-review__menu { top: calc(100% + 6px); left: 12px; right: 12px; min-width: 0; }
+  .craft-review__item { min-height: 44px; }
+}
+/* Under 360px the bar holds two tools, not three: reviewing Ideating, its
+   own Ideas button folds away (craft-mode.js marks it a guest). */
+@media (max-width: 359px) { .craft-tool.craft-tool--guest { display: none; } }
+
+/* ---------- the scribble wall ---------- */
+/* The top bar's empty space, between the title and the controls. Where none
+   is left (a phone), the Review pill still says "Reviewing". */
+.craft-graffiti {
+  position: relative;
+  flex: 1 1 0;
+  min-width: 0;
+  align-self: stretch;
+  overflow: hidden;
+  pointer-events: none;
+  container: gx / inline-size;
+}
+@media (max-width: 640px) { .craft-graffiti { display: none; } }
+/* Small walls keep the small doodles; a wall too tight for even one shows none. */
+@container gx (max-width: 58px) { .gx-tag--wide { display: none; } }
+@container gx (max-width: 34px) { .gx-tag { display: none; } }
+
+/* Six doodles in the sky's hand (craft-review.js), each scribbled at its own
+   spot and height across the wall: a new one every five seconds of a
+   thirty-second round, each staying about ten, so two or three are up at once. */
+.gx-tag {
+  position: absolute;
+  top: calc(50% - 12px + var(--gx-dy, 0px));
+  width: var(--gx-w);
+  height: 24px;
+  --gx-delay: 0s;
+}
+.gx-tag--1 { left: calc((100% - var(--gx-w)) * .06); --gx-dy: -7px; }
+.gx-tag--2 { left: calc((100% - var(--gx-w)) * .55); --gx-dy: 6px; --gx-delay: 5s; }
+.gx-tag--3 { left: calc((100% - var(--gx-w)) * .3); --gx-dy: 4px; --gx-delay: 10s; }
+.gx-tag--4 { left: calc((100% - var(--gx-w)) * .84); --gx-dy: -6px; --gx-delay: 15s; }
+.gx-tag--5 { left: calc((100% - var(--gx-w)) * .42); --gx-dy: -5px; --gx-delay: 20s; }
+.gx-tag--6 { left: calc((100% - var(--gx-w)) * .72); --gx-dy: 7px; --gx-delay: 25s; }
+
+/* The wet line: the window slides in from the left while the drawing inside
+   it slides the other way by the same amount, so the doodle stays put and is
+   uncovered left to right. The pen tip rides that edge, jittering up and
+   down as it scribbles. */
+.gx-win, .gx-track { position: absolute; inset: -2px -3px; }
+.gx-win { overflow: hidden; }
+.gx-ink { position: absolute; inset: 0; padding: 2px 3px; }
+.gx-svg { display: block; overflow: visible; }
+.gx-win, .gx-ink, .gx-track {
+  animation-duration: 30s;
+  animation-timing-function: linear;
+  animation-iteration-count: infinite;
+  animation-fill-mode: both;
+  animation-delay: var(--gx-delay);
+}
+.gx-win { animation-name: gx-win; }
+.gx-ink { animation-name: gx-ink; }
+.gx-track { animation-name: gx-track; opacity: 0; }
+/* The rest frame (and the reduced-motion one): three doodles, finished. */
+.gx-tag:not(.gx-tag--1):not(.gx-tag--2):not(.gx-tag--4) .gx-win { opacity: 0; }
+
+@keyframes gx-win {
+  0% { transform: translateX(-100%); opacity: 1; }
+  4% { transform: translateX(0); }
+  28% { opacity: 1; }
+  32%, 100% { transform: translateX(0); opacity: 0; }
+}
+@keyframes gx-ink {
+  0% { transform: translateX(100%); }
+  4%, 100% { transform: translateX(0); }
+}
+/* The pen waits unseen: a doodle not yet begun shows no tip. */
+@keyframes gx-track {
+  0% { transform: translateX(-100%); opacity: 0; }
+  .3% { opacity: 1; }
+  4% { transform: translateX(0); opacity: 1; }
+  5%, 100% { transform: translateX(0); opacity: 0; }
+}
+
+.gx-nib {
+  position: absolute;
+  right: -1.5px;
+  top: calc(50% - 1.5px);
+  width: 3px;
+  height: 3px;
+  border-radius: 999px;
+  background: var(--ink);
+  animation: gx-scribble .16s ease-in-out infinite alternate;
+}
+@keyframes gx-scribble {
+  from { transform: translateY(-7px); }
+  to { transform: translateY(7px); }
+}
+
+/* The ink: hairlines and dots, black on the light bar and white on the dark
+   one, with the sky's own ladder for the fainter marks. */
+.gx-ln { fill: none; stroke: var(--ink); stroke-width: 1.3px; stroke-linecap: round; stroke-linejoin: round; }
+.gx-ln--soft { stroke: color-mix(in srgb, var(--ink) 55%, transparent); }
+.gx-ln--dash { stroke: color-mix(in srgb, var(--ink) 55%, transparent); stroke-width: 1px; stroke-dasharray: 2 2.5; }
+.gx-pt { fill: var(--ink); }
+.gx-halo { fill: none; stroke: color-mix(in srgb, var(--ink) 28%, transparent); stroke-width: 1px; }

package/modules/hall-ui/public/craft-review.js

@@ -0,0 +1,64 @@
+// craft-review.js — the scribble wall of artist review mode (task 1004686,
+// goal 1000095). Loaded on demand by craft-mode.js, only while an artist is
+// reviewing an experience: wallHtml() returns small doodles a pen scribbles,
+// one after another, into the top bar's empty space, so the reviewer can see
+// at a glance that the hall they are looking at is under review.
+//
+// The doodles are drawn in the sky's hand (thinking.css, ADR 0331): hairlines,
+// small stars, dashed orbits and constellations, in ink alone — black on the
+// light bar, white on the dark one (owner, 2026-10-09: "small black white
+// graffiti scribbling", not the first cut's big painted tags).
+//
+// Markup only, and decorative (the wall is aria-hidden; the Review button and
+// its menu say the state in words). Every motion is CSS in craft-review.css:
+// no motion in JavaScript (DESIGN.md, the Kill Switch Rule), so a reader who
+// asks for reduced motion sees three finished doodles standing still.
+(function () {
+  'use strict';
+
+  var H = 24;
+
+  // The six doodles, in the order they are scribbled. Each is { w, wide, svg }:
+  // `wide` ones fold away when the wall is too tight for them.
+  var DOODLES = [
+    // A constellation: five stars joined by a hairline, one with a halo.
+    { w: 56, wide: true, svg:
+      '<path class="gx-ln gx-ln--soft" d="M3 17 16 8l12 5 13-9 12 7"/>' +
+      '<circle class="gx-pt" cx="3" cy="17" r="1.5"/><circle class="gx-pt" cx="16" cy="8" r="1.5"/>' +
+      '<circle class="gx-pt" cx="28" cy="13" r="1.5"/><circle class="gx-pt" cx="53" cy="11" r="1.5"/>' +
+      '<circle class="gx-pt" cx="41" cy="4" r="2"/><circle class="gx-halo" cx="41" cy="4" r="4.5"/>' },
+    // A ringed protostar on a dashed orbit, a moon riding it.
+    { w: 40, svg:
+      '<circle class="gx-ln" cx="20" cy="12" r="5"/>' +
+      '<ellipse class="gx-ln gx-ln--dash" cx="20" cy="12" rx="16" ry="4.5" transform="rotate(-16 20 12)"/>' +
+      '<circle class="gx-pt" cx="35" cy="6" r="1.3"/>' },
+    // A shooting star: a scribbled trail and a four-point head.
+    { w: 52, wide: true, svg:
+      '<path class="gx-ln gx-ln--soft" d="M2 21c9-2 18-6 31-12"/><path class="gx-ln gx-ln--soft" d="M10 22c6-1.5 12-4 19-7.5"/>' +
+      '<path class="gx-ln" d="M42 1.5v9M37.5 6h9"/><circle class="gx-pt" cx="42" cy="6" r="1.4"/>' },
+    // A crescent and a spark beside it.
+    { w: 32, svg:
+      '<path class="gx-ln" d="M16 3.5a8.5 8.5 0 1 0 9.5 12.6A7 7 0 0 1 16 3.5z"/>' +
+      '<path class="gx-ln" d="M27 2.5v5M24.5 5h5"/>' },
+    // A scribbled orbit loop, the pen going round and round.
+    { w: 40, svg:
+      '<path class="gx-ln" d="M3 15c3-8 11-9 13-4s-5 8-7 4 4-9 11-8 10 6 7 9-8 1-5-4 9-6 13 0"/>' },
+    // A cluster of sparks, big to small.
+    { w: 30, svg:
+      '<path class="gx-ln" d="M8 2.5v11M2.5 8h11"/><path class="gx-ln gx-ln--soft" d="M21 13v7M17.5 16.5h7"/>' +
+      '<circle class="gx-pt" cx="27" cy="5" r="1.2"/><circle class="gx-pt" cx="14" cy="20" r="1"/>' },
+  ];
+
+  function wallHtml() {
+    return DOODLES.map(function (d, i) {
+      return '<span class="gx-tag gx-tag--' + (i + 1) + (d.wide ? ' gx-tag--wide' : '') + '" style="--gx-w:' + d.w + 'px">' +
+        '<span class="gx-win"><span class="gx-ink">' +
+          '<svg class="gx-svg" viewBox="0 0 ' + d.w + ' ' + H + '" width="' + d.w + '" height="' + H + '" aria-hidden="true">' + d.svg + '</svg>' +
+        '</span></span>' +
+        '<span class="gx-track"><span class="gx-nib"></span></span>' +
+      '</span>';
+    }).join('');
+  }
+
+  window.OTBCraftReview = { wallHtml: wallHtml, COUNT: DOODLES.length };
+})();

package/modules/hall-ui/public/style.css

@@ -57,6 +57,7 @@
    body declaration beats an inherited :root value at every width and a token
    tier that carries a breakpoint silently defeats its own media query. */
 @import url("page-notes.css");
+@import url("craft-review.css");
 
 :root {
   color-scheme: light;

package/modules/hall-ui/records/craft-mode.md

@@ -57,3 +57,11 @@ Covers: every shelled hall page (`craft-mode.js`, `shell.js`, `style.css`), and
 - **The panel lists the ideas already filed from this page** (`GET /page-notes/ideas?page_path=`): open and promoted ideas whose body carries the page's link, from the lightbulb (`](/page)`) or the palette (`](/page?note=`). That link is the only record of where an idea came from, so `notes.pageLinks` and the two idea bodies are pinned together in `tests/lightbulb.mjs`.
 - **Unsent text waits in this browser only**, per page (`localStorage 'hall-lightbulb:<path>'`), and is forgotten once it files.
 - `tests/lightbulb.mjs` runs the real routes and the real script over a small DOM.
+
+## Artist review mode (task 1004686)
+
+- **Review is a split pill** (owner, 2026-10-09): pressing Review still opens the feedback doc; hovering it with a mouse, or pressing its chevron, opens a menu: "Write feedback on this page", then the four experiences in the owner's order and words (Ideator, Governing, Building, Artistry experience), then "Stop reviewing" while a review is on. Hover is asked of the pointer (`pointerType === 'mouse'`), never `(hover: hover)`: a touch laptop can report no hover at all. On a phone (<=640px) the chevron folds away and a tap on Review opens the menu.
+- **Picking one makes the hall wear that mode** (`html[data-craft]`, so its tabs, look, eyebrow and tallies follow) and stamps `html[data-craft-review]`. The artist's own mode stays Artistry: `sessionStorage['hall-craft-review']` holds the experience for the session only, and is ignored unless the mode is Artistry. Choosing any mode from the switch or the picker ends it. The artist keeps Review and Edit words; the experience's own tools follow them, marked `craft-tool--guest` so a phone under 360px can fold them away (three tools pushed 320px 36px sideways; Artistry alone overflows 4px there today, before and after).
+- **The scribble wall** (`craft-review.js`, loaded on demand; `craft-review.css`, imported by `style.css`): a flexible box in the top bar's empty space where a pen tip scribbles six small doodles in the sky's hand (thinking.css: hairlines, stars, a dashed orbit, a constellation, a crescent, a shooting star, a looped scribble, sparks), each at its own spot and height, a new one every 5s of a 30s round and each up about 10s, so two or three show at once. **Ink alone** (owner, 2026-10-09, after a first cut of big painted colour tags: "small black white graffiti scribbling"): every mark is `--ink`, black on the light bar and white on the dark, with the sky's fainter ladder for trails and orbits; the test holds the wall section to that one token. No doodle is wider than 56px or taller than 24px; the two widest fold away on a wall under 58px (Governing at 1440px keeps about 60), all of them under 34px and on a phone. The wipe is two opposite `translateX` moves, so every motion is transform or opacity in CSS, and the kill switch leaves three doodles standing, finished, with no pen. A doodle not yet begun keeps its pen unseen (`gx-track` starts at opacity 0), or each waiting tip shows as a stray dot.
+- **An @import lands before style.css's own rules**, so a rule in `craft-review.css` that restyles `.craft-tool` needs two classes, or `.craft-tool` silently wins (it did, for the reviewing wash and the guest fold, until measured).
+- `tests/craft_review_mode.mjs` runs the real `craft-mode.js` and `craft-review.js` over a small DOM, and reads the sheet's motion rules.

package/modules/lifecycle/autopickup-files.js

@@ -0,0 +1,140 @@
+'use strict';
+
+// modules/lifecycle/autopickup-files.js — an automatic page tweak may change only
+// its own page (task 1004678 / BV2.TW19b, ADR 0371 D7, D8).
+//
+// The Autobongos tweak lane claims a round with the auto_pickup mark (task
+// 1004677) and runs `/tweak --page <id> --unattended` with nobody watching. The
+// skill tells the worker to stay inside the page; this file is why the server
+// does not have to TRUST that. At publish, the route asks `autoPickupFileRefusal`
+// for the task; when the round's latest claim carries the mark, the server reads
+// the pull request's files itself (GitHub, never the client's list) and refuses
+// the publish if any path is
+//
+//   - outside the page's own files (docs/page-inventory.json `files` +
+//     `states_files`) and not one of the files a ship regenerates anyway, or
+//   - a protected path (ADR 0043's matcher, the same one decideTask runs).
+//
+// FAIL CLOSED. A page id that does not parse, a page the inventory does not know,
+// a file read that throws, or a list at GitHub's cap (it stops at 300 and says
+// nothing) all refuse: an unattended round that cannot be checked is a round a
+// person applies. An UNMARKED claim is never read here, so every other publish is
+// unchanged.
+
+const fs = require('node:fs');
+const path = require('node:path');
+const api = require('../../src/module-api');
+const githubPush = require('./github-push');
+const { PR_FILES_CAP } = require('./ship-files');
+const { isPageTweak } = require('./page-tweak-hold');
+
+const REPO_ROOT = path.resolve(__dirname, '..', '..');
+const INVENTORY_REL = 'docs/page-inventory.json';
+
+// What a /tweak ship writes besides the page's own files: copy-apply regenerates
+// the copy registry and re-reads the page, and ship.js refreshes the generated
+// maps. Not CLAUDE.md: it is protected, and its §13 snippet moves only when the
+// branch adds a session-log file, which the unattended mode never writes. A path
+// here still runs through the protected-path matcher.
+const SHIP_WRITES = Object.freeze([
+  'docs/copy-registry.json',
+  'docs/copy-inventory.md',
+  'docs/page-readings.json',
+  'docs/repo-map.md',
+  'docs/file-map.md',
+]);
+
+// 'page-tweak/landing:index/r2' -> 'landing:index' (copy-desk's parseRoundRef,
+// restated: a module never requires another module).
+function pageIdFromRef(sourceRef) {
+  const m = /^page-tweak\/([a-z0-9-]+:[a-z0-9-]+)\/r[1-9][0-9]*$/.exec(String(sourceRef || ''));
+  return m ? m[1] : null;
+}
+
+function readInventory(root = REPO_ROOT) {
+  return JSON.parse(fs.readFileSync(path.join(root, INVENTORY_REL), 'utf8'));
+}
+
+function pageFiles(inventory, pageId) {
+  const page = ((inventory && inventory.pages) || []).find((p) => p && p.id === pageId);
+  if (!page) return null;
+  return [...(page.files || []), ...(page.states_files || [])];
+}
+
+// PURE. The verdict over one round's changed paths: null when every path may
+// change, else { code, page_id, outside[], protected[] }.
+function decideFiles({ pageId, allowed, changed, truncated = false, matchProtected }) {
+  if (!pageId || !Array.isArray(allowed)) {
+    return { code: 'auto_pickup_page_unknown', page_id: pageId || null, outside: [], protected: [] };
+  }
+  if (truncated) return { code: 'auto_pickup_files_unreadable', page_id: pageId, outside: [], protected: [] };
+  const ok = new Set([...allowed, ...SHIP_WRITES]);
+  const outside = changed.filter((p) => !ok.has(p));
+  const prot = (matchProtected(changed) || []).map((m) => (m && m.file) || m);
+  if (!outside.length && !prot.length) return null;
+  return { code: 'auto_pickup_outside_page', page_id: pageId, outside, protected: prot };
+}
+
+// The round as the check needs it, in ONE read: its source, its ref, and whether
+// its latest claim (released or not: a publish runs after the ship resolved it)
+// carried the mark. A read that FAILS answers null and the publish goes on as
+// usual: an ordinary publish must not depend on this read, and a worker cannot
+// make the database fail to see its own claim.
+const ROUND_SQL = `
+  SELECT t.id, t.source, t.source_ref,
+         (SELECT c.auto_pickup FROM claims c WHERE c.task_id = t.id
+           ORDER BY c.claimed_at DESC, c.id DESC LIMIT 1) AS auto_pickup
+    FROM tasks t WHERE t.id = $1`;
+async function readRound(taskId, exec = api.pool) {
+  try {
+    const { rows } = await exec.query(ROUND_SQL, [taskId]);
+    return rows[0] || null;
+  } catch (_) {
+    return null;
+  }
+}
+
+// The route's one call. Returns null (publish as usual) or the refusal.
+// `deps` is the test seam.
+async function autoPickupFileRefusal({ taskId, prNumber }, deps = {}) {
+  const round = await (deps.readRound || readRound)(taskId);
+  if (!isPageTweak(round) || round.auto_pickup !== true) return null;
+  const pageId = pageIdFromRef(round.source_ref);
+  let allowed = null;
+  try { allowed = pageId ? pageFiles((deps.readInventory || readInventory)(), pageId) : null; } catch (_) { allowed = null; }
+  let rows;
+  try {
+    rows = await (deps.getPullRequestFiles || ((a) => githubPush.getPullRequestFiles(a)))({ number: Number(prNumber) });
+  } catch (_) {
+    return { code: 'auto_pickup_files_unreadable', page_id: pageId, outside: [], protected: [] };
+  }
+  const list = Array.isArray(rows) ? rows : [];
+  return decideFiles({
+    pageId, allowed,
+    changed: list.map((x) => x && x.path).filter((p) => typeof p === 'string' && p),
+    truncated: list.length >= PR_FILES_CAP,
+    matchProtected: deps.matchProtected || ((files) => api.permissionPathCheck.matchProtected(files)),
+  });
+}
+
+function refusalMessage(r) {
+  const parts = [];
+  if (r.outside && r.outside.length) parts.push(`outside the page: ${r.outside.slice(0, 10).join(', ')}`);
+  if (r.protected && r.protected.length) parts.push(`protected: ${r.protected.slice(0, 10).join(', ')}`);
+  const why = {
+    auto_pickup_outside_page: `An automatic page tweak may change only its own page's files (${parts.join('; ')}).`,
+    auto_pickup_page_unknown: 'An automatic page tweak names a page the inventory does not know, so its files cannot be checked.',
+    auto_pickup_files_unreadable: "The pull request's files could not be read in full, so an automatic round cannot be checked.",
+  }[r.code];
+  return `${why} The pull request was closed; the round waits for a person (ADR 0371 D8).`;
+}
+
+module.exports = {
+  SHIP_WRITES,
+  pageIdFromRef,
+  pageFiles,
+  decideFiles,
+  readRound,
+  autoPickupFileRefusal,
+  refusalMessage,
+};

package/modules/lifecycle/db-ship.js

@@ -1038,7 +1038,8 @@ async function confirmTask({ taskId, builderId }, deps = {}) {
     // degenerate state, e.g. status set directly via SQL) so a legitimate
     // confirm is never refused. Mirrors the #538 fix on the override path.
     const creditedBuilderId = (await mostRecentClaimHolderId(client, taskId)) ?? builderId;
-
+    const { rows: srcRows } = await client.query('SELECT source FROM tasks WHERE id = $1', [taskId]); // ADR 0371 D8 (task 1004678): never past the artist
+    if (isPageTweak(srcRows[0] || null)) throw Object.assign(new Error('a page tweak is confirmed only by its artist'), { code: 'PAGE_TWEAK_NEEDS_ARTIST' });
     const { rows } = await client.query(
       `UPDATE tasks
           SET status = 'confirmed',

package/modules/lifecycle/routes/tasks.js

@@ -36,7 +36,7 @@ const { gradeQualityWhere } = require('../db-shared');
 const { helperJoinSql } = require('../page-tweak-artist'); // task 1004432: a page tweak's applier as a helper
 const auth = api;
 const db = require('../db');
-const pageTweakReads = require('../page-tweak-reads'); const { HELD_NOT_ARMED, prMergeSentence } = require('../page-tweak-hold'); // ADR 0341 D7 (tests stub the read)
+const pageTweakReads = require('../page-tweak-reads'); const { HELD_NOT_ARMED, prMergeSentence } = require('../page-tweak-hold'); const autoPickupFiles = require('../autopickup-files'); const githubPrClose = require('../github-pr-close'); // ADR 0341 D7 (tests stub the read); ADR 0371 D8
 const hierarchy = require('../hierarchy');
 const { suggestCriteria } = require('../criterion-suggest');
 // The orphan-task advisory (task 1002539) — pure, fail-open; see goal-advisory.js.
@@ -696,9 +696,8 @@ module.exports = function buildTasksRouter() {
       const result = await db.confirmTask({ taskId: id, builderId: req.builder.id });
       res.json({ ok: true, ...result });
     } catch (err) {
-      if (err.code === 'TASK_NOT_COMPLETED') {
-        return res.fail('task_not_completed', 409);
-      }
+      if (err.code === 'TASK_NOT_COMPLETED') return res.fail('task_not_completed', 409);
+      if (err.code === 'PAGE_TWEAK_NEEDS_ARTIST') return res.fail('page_tweak_needs_artist', { status: 409, message: `Task #${id} is a page tweak: it is confirmed only when its artist approves it in the studio, or by the owner's override request (ADR 0371 D8).` });
       log.error('[gds] POST /tasks/:id/confirm', err);
       res.fail('confirm_failed', { status: 500, message: 'internal error' });
     }
@@ -1184,6 +1183,7 @@ module.exports = function buildTasksRouter() {
         `Merging triggers .github/workflows/deploy-prod.yml -> ${branding().domains.publicOrigin}. ` +
         prMergeSentence(held);
       const pr = await githubPush.openOrFindPullRequest({ branch, title, body });
+      const apRefusal = await autoPickupFiles.autoPickupFileRefusal({ taskId: id, prNumber: pr.number }); if (apRefusal) { await githubPrClose.closePullRequest({ number: pr.number }).catch(() => null); return res.fail(apRefusal.code, 409, { ...apRefusal, message: autoPickupFiles.refusalMessage(apRefusal) }); } // ADR 0371 D8 (task 1004678)
       // Best-effort by contract (pr-assign.js never rejects); the catch is for a future
       // edit that forgets — an assignment must not be able to fail a pushed ship.
       const assignment = await prAssign.assignPullRequest({ number: pr.number, login: builderLogin })

package/package-lock.json

@@ -1,12 +1,12 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.109",
+  "version": "1.21.111",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@bongos/core",
-      "version": "1.21.109",
+      "version": "1.21.111",
       "license": "AGPL-3.0-or-later",
       "dependencies": {
         "express": "^4.21.2",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bongos/core",
-  "version": "1.21.109",
+  "version": "1.21.111",
   "description": "Cloud Bongos — the AI-first build platform core (GDS + platform surfaces + module system), installed as a versioned dependency (ADR 0108).",
   "license": "AGPL-3.0-or-later",
   "main": "src/platform-server.js",

package/release-notes.json

@@ -9508,5 +9508,21 @@
       "id": "1004675",
       "text": "Planning sessions now keep the work tied to the design the owner agreed. Each goal's done-when line must carry the agreed model (the named states and rules), and each proof task must describe a scenario a wrong build would fai"
     }
+  ],
+  "1.21.110": [
+    {
+      "id": "1004686",
+      "text": "Artists can now review the hall through anyone's eyes. In Artistry mode, hovering the Review button opens a menu: Ideator, Governing, Building or Artistry experience. Picking one shows every page the way a builder in that mode"
+    },
+    {
+      "id": "1004678",
+      "text": "The page-tweak helper can now run on its own: given one page, it applies the artist's words without asking anything, and if anything goes wrong it hands the page back with a plain note. The server enforces the safety rules its"
+    }
+  ],
+  "1.21.111": [
+    {
+      "id": "1004667",
+      "text": "Lost bug screenshots can now be brought back. We used to tell people a missing screenshot from the Discord bugs channel was gone for good. That was wrong: only the link expires, and the picture stays in Discord as long as the"
+    }
   ]
 }

package/scripts/gds/bug-attachment-audit.js

@@ -2,9 +2,12 @@
 // scripts/gds/bug-attachment-audit.js — do the images our task descriptions
 // promise actually exist? (task 1003918)
 //
-// WHY THIS EXISTS. A re-hosted #bugs screenshot is the one artefact in this
-// system that cannot be regenerated: the Discord CDN URL it was copied from is
-// signed and expires in about a day, so our copy IS the image. They live on disk
+// WHY THIS EXISTS. A re-hosted #bugs screenshot is the hardest artefact in this
+// system to get back: the Discord CDN URL it was copied from carries a signature
+// that expires in about a day. The FILE does not expire — Discord keeps it while
+// the message exists, and bug-attachment-recover.js re-fetches it by the message
+// id the filename carries (task 1004667) — but once that message or the channel
+// history is gone, our copy IS the image. They live on disk
 // under var/bug-attachments — outside Postgres, outside git — and nothing
 // noticed when all five this instance had ever stored disappeared in the
 // 2026-07-05 droplet move. The loss surfaced on 2026-09-14, two months later,
@@ -124,7 +127,8 @@ async function main() {
   if (argv.includes('--line')) {
     if (r.missing.length) {
       console.log(`Bug attachments: ${r.missing.length} of ${r.described.length} linked screenshot(s) are MISSING from ${dir} `
-        + '— every task describing one renders a broken image. These cannot be re-fetched (the Discord URL has expired).');
+        + '— every task describing one renders a broken image. '
+        + 'Try node scripts/gds/bug-attachment-recover.js --missing (it re-fetches from the original Discord message while that message still exists).');
     }
     return;
   }
@@ -132,12 +136,14 @@ async function main() {
   console.log(`  Store: ${dir}`);
   for (const m of r.missing) console.log(`    missing  ${m.name}  (task ${m.taskId})`);
   if (r.missing.length) {
-    console.log('  These cannot be re-fetched — the Discord CDN URL they were copied from has expired.');
-    console.log('  Restore from a nightly attachments archive: /var/backups/gds/<db>-attachments-*.tar.gz');
+    console.log('  The stored Discord URL has expired, but only its signature: the message usually still holds the file,');
+    console.log('  and each filename carries its message id. Re-fetch them to their original names with:');
+    console.log('    node scripts/gds/bug-attachment-recover.js --missing');
+    console.log('  If the message is gone, restore from a nightly attachments archive: /var/backups/gds/<db>-attachments-*.tar.gz');
     process.exit(1);
   }
 }
 
 if (require.main === module) main();
 
-module.exports = { describedAttachments, auditRows, LINK_RE };
+module.exports = { describedAttachments, auditRows, fetchRows, LINK_RE };