domma-cms 1.6.37 → 1.6.39

package/plugins/booking/admin/views/people.js

@@ -22,6 +22,31 @@ const ROW = `
   <button type="button" class="bk-kebab" aria-label="Actions" title="Actions">⋮</button>
 </div>`;
 
+// One weekday in the editor: its windows (a keyed list of their own) or "Closed".
+const DAY_ROW = `
+<div class="bk-day">
+  <span class="bk-day-name" data-bind-text="name"></span>
+  <div class="bk-windows">
+    <span class="bk-muted" data-bind-hidden="windows.value.length">Closed</span>
+    {{#each windows.value key=id}}<span class="bk-window">
+      <input type="time" class="form-input" step="300" data-model="from.value" data-bind-aria-label="$parent.name + ' from'">
+      <span>-</span>
+      <input type="time" class="form-input" step="300" data-model="to.value" data-bind-aria-label="$parent.name + ' to'">
+      <button type="button" class="btn btn-xs btn-ghost bk-x" title="Remove these hours" aria-label="Remove these hours" data-on-click="$root.dropWindow($parent, $data)"><span data-icon="x" data-icon-size="12"></span></button></span>{{/each}}
+  </div>
+  <button type="button" class="btn btn-xs btn-ghost" data-bind-title="'Add hours on ' + name" data-on-click="$parent.addWindow($data)"><span data-icon="plus" data-icon-size="12"></span> Hours</button>
+</div>`;
+
+// One spell of days off.
+const OFF_ROW = `
+<div class="bk-off">
+  <input type="date" class="form-input" data-model="from.value" aria-label="From" data-on-change="$parent.offFrom($data)">
+  <span>to</span>
+  <input type="date" class="form-input" data-model="to.value" aria-label="To">
+  <input class="form-input" data-model="label.value" placeholder="Holiday, training…" maxlength="80" aria-label="Why">
+  <button type="button" class="btn btn-xs btn-ghost bk-x" title="Remove" aria-label="Remove" data-on-click="$parent.dropOff($data)"><span data-icon="x" data-icon-size="12"></span></button>
+</div>`;
+
 /** "Mon-Fri 09:00-17:00" style summary of weekly hours. */
 export function hoursSummary(hours) {
     const txt = (d) => (hours?.[d] || []).map(w => `${w.from}-${w.to}`).join(', ');
@@ -123,43 +148,43 @@ export async function mount(root, ctx) {
         const f = {};
         for (const k of ['name', 'kind', 'description', 'userId', 'email', 'colour']) f[k] = M.observable(start[k] ?? '');
         const bools = {calendarBusy: M.observable(start.calendarBusy !== false), active: M.observable(start.active !== false)};
-        const hours = Object.fromEntries(DAY_KEYS.map(d => [d, (start.hours?.[d] || []).map(w => ({...w}))]));
-        let daysOff = (start.daysOff || []).map(o => ({...o}));
+        // Hours and days off are keyed lists (see DAY_ROW / OFF_ROW): a day's
+        // windows live in an observable so adding or removing one redraws only
+        // that day; each field is an observable the inputs write through.
+        let seq = 0;
+        const windowRow = (w) => ({id: `w${++seq}`, from: M.observable(w.from || ''), to: M.observable(w.to || '')});
+        const offRow = (o) => ({id: `o${++seq}`, from: M.observable(o.from || ''), to: M.observable(o.to || ''), label: M.observable(o.label || '')});
+        const days = M.observable(WEEK.map(d => ({id: d, name: DAY_NAMES[d], windows: M.observable((start.hours?.[d] || []).map(windowRow))})));
+        const daysOff = M.observable((start.daysOff || []).map(offRow));
+        const hoursOut = () => Object.fromEntries(days.peek().map(d => [d.id, d.windows.peek().map(w => ({from: w.from.peek(), to: w.to.peek()}))]));
+        const daysOffOut = () => daysOff.peek().map(o => ({from: o.from.peek(), to: o.to.peek(), label: o.label.peek()}));
         const isPerson = M.computed(() => f.kind.value === 'person');
         const saving = M.observable(false);
-        const snapshot = () => JSON.stringify([Object.values(f).map(o => o.peek()), Object.values(bools).map(o => o.peek()), hours, daysOff]);
+        const snapshot = () => JSON.stringify([Object.values(f).map(o => o.peek()), Object.values(bools).map(o => o.peek()), hoursOut(), daysOffOut()]);
         const opened = snapshot();
         let panel = null;
-
-        const drawHours = (el) => {
-            const box = el.querySelector('[data-part="hours"]');
-            box.innerHTML = WEEK.map(d => `<div class="bk-day" data-day="${d}">
-  <span class="bk-day-name">${DAY_NAMES[d]}</span>
-  <div class="bk-windows">${hours[d].length ? hours[d].map((w, i) => `<span class="bk-window">
-    <input type="time" class="form-input" step="300" value="${esc(w.from)}" data-i="${i}" data-k="from" aria-label="${DAY_NAMES[d]} from">
-    <span>-</span>
-    <input type="time" class="form-input" step="300" value="${esc(w.to)}" data-i="${i}" data-k="to" aria-label="${DAY_NAMES[d]} to">
-    <button type="button" class="btn btn-xs btn-ghost bk-x" data-drop="${i}" title="Remove these hours" aria-label="Remove these hours"><span data-icon="x" data-icon-size="12"></span></button></span>`).join('') : '<span class="bk-muted">Closed</span>'}</div>
-  <button type="button" class="btn btn-xs btn-ghost" data-add title="Add hours on ${DAY_NAMES[d]}"><span data-icon="plus" data-icon-size="12"></span> Hours</button>
-</div>`).join('');
-            I.scan(box);
-        };
-        const drawDaysOff = (el) => {
-            const box = el.querySelector('[data-part="daysoff"]');
-            box.innerHTML = daysOff.length ? daysOff.map((o, i) => `<div class="bk-off" data-i="${i}">
-  <input type="date" class="form-input" value="${esc(o.from)}" data-k="from" aria-label="From">
-  <span>to</span>
-  <input type="date" class="form-input" value="${esc(o.to)}" data-k="to" aria-label="To">
-  <input class="form-input" value="${esc(o.label)}" data-k="label" placeholder="Holiday, training…" maxlength="80" aria-label="Why">
-  <button type="button" class="btn btn-xs btn-ghost bk-x" data-drop title="Remove" aria-label="Remove"><span data-icon="x" data-icon-size="12"></span></button></div>`).join('')
-                : '<p class="bk-note">None. Add holidays and other days they cannot be booked.</p>';
-            I.scan(box);
-        };
+        // New rows carry icons; they are drawn once the list has rendered.
+        const rescan = () => { M.flushSync?.(); if (panel) { I.scan(panel.panel); requestAnimationFrame(() => panel?.panel.isConnected && I.scan(panel.panel)); } };
 
         panel = await openPanel({
             title: b ? `Edit ${b.name}` : 'Add a person or room',
             size: 'lg',
-            model: {...f, saving, isPerson},
+            model: {
+                ...f, saving, isPerson, days, daysOff,
+                addWindow(day) {
+                    const list = day.windows.peek();
+                    const last = list[list.length - 1];
+                    day.windows.value = [...list, windowRow(last ? {from: last.to.peek(), to: last.to.peek() < '17:00' ? '17:00' : last.to.peek()} : {from: '09:00', to: '17:00'})];
+                    rescan();
+                },
+                dropWindow(day, w) { day.windows.value = day.windows.peek().filter(x => x !== w); },
+                dropOff(o) { daysOff.value = daysOff.peek().filter(x => x !== o); },
+                // An end before the start is never meant: it follows the start.
+                offFrom(o, e) {
+                    const v = e?.target?.value ?? o.from.peek();
+                    if (!o.to.peek() || o.to.peek() < v) o.to.value = v;
+                }
+            },
             dirty: () => snapshot() !== opened,
             html: `<div class="bk-form">
   <div class="bk-grid">
@@ -182,10 +207,11 @@ export async function mount(root, ctx) {
     </div>
   </div>
   <h4 class="bk-sub">Opening hours <span data-help-title="Opening hours" data-help="When they can be booked, in ${esc(ctx.tz)}. Add several windows for a day with a break (09:00-12:30, 13:30-17:00). A day with no hours is closed."></span></h4>
-  <div class="bk-hours" data-part="hours"></div>
+  <div class="bk-hours" data-each="days.value key=id">${DAY_ROW}</div>
   <div class="bk-actions bk-actions-start"><button type="button" class="btn btn-xs btn-outline" data-on-click="copyMonday"><span data-icon="copy" data-icon-size="12"></span> Copy Monday to Tuesday-Friday</button></div>
   <h4 class="bk-sub">Days off <span data-help-title="Days off" data-help="Holidays and other days they cannot be booked. For days the whole business is closed, use Closed days in Booking settings."></span></h4>
-  <div data-part="daysoff"></div>
+  <p class="bk-note" data-bind-hidden="daysOff.value.length">None. Add holidays and other days they cannot be booked.</p>
+  <div data-each="daysOff.value key=id">${OFF_ROW}</div>
   <div class="bk-actions bk-actions-start"><button type="button" class="btn btn-xs btn-outline" data-on-click="addOff"><span data-icon="plus" data-icon-size="12"></span> Add days off</button></div>
   <div class="bk-actions"><span class="bk-spacer"></span>
     <button type="button" class="btn btn-sm btn-ghost" data-on-click="cancel">Cancel</button>
@@ -196,52 +222,24 @@ export async function mount(root, ctx) {
                     box.checked = bools[box.dataset.bool].peek();
                     box.addEventListener('change', () => { bools[box.dataset.bool].value = box.checked; });
                 }
-                drawHours(el);
-                drawDaysOff(el);
-                const hoursBox = el.querySelector('[data-part="hours"]');
-                hoursBox.addEventListener('input', (e) => {
-                    const day = e.target.closest('[data-day]')?.dataset.day;
-                    if (!day || e.target.dataset.k === undefined) return;
-                    hours[day][Number(e.target.dataset.i)][e.target.dataset.k] = e.target.value;
-                });
-                hoursBox.addEventListener('click', (e) => {
-                    const day = e.target.closest('[data-day]')?.dataset.day;
-                    if (!day) return;
-                    const drop = e.target.closest('[data-drop]');
-                    if (drop) { hours[day].splice(Number(drop.dataset.drop), 1); drawHours(el); return; }
-                    if (e.target.closest('[data-add]')) {
-                        const last = hours[day][hours[day].length - 1];
-                        hours[day].push(last ? {from: last.to, to: last.to < '17:00' ? '17:00' : last.to} : {from: '09:00', to: '17:00'});
-                        drawHours(el);
-                    }
-                });
-                const offBox = el.querySelector('[data-part="daysoff"]');
-                offBox.addEventListener('input', (e) => {
-                    const row = e.target.closest('[data-i]');
-                    if (!row) return;
-                    const o = daysOff[Number(row.dataset.i)];
-                    o[e.target.dataset.k] = e.target.value;
-                    if (e.target.dataset.k === 'from' && (!o.to || o.to < o.from)) { o.to = o.from; row.querySelector('[data-k="to"]').value = o.from; }
-                });
-                offBox.addEventListener('click', (e) => {
-                    const row = e.target.closest('[data-i]');
-                    if (row && e.target.closest('[data-drop]')) { daysOff.splice(Number(row.dataset.i), 1); drawDaysOff(el); }
-                });
             },
             after: (el) => setTimeout(() => el.querySelector('input')?.focus(), 60),
             methods: {
                 cancel: () => panel?.close(),
                 copyMonday() {
-                    for (const d of ['tue', 'wed', 'thu', 'fri']) hours[d] = hours.mon.map(w => ({...w}));
-                    drawHours(panel.panel);
+                    const byId = Object.fromEntries(days.peek().map(d => [d.id, d]));
+                    for (const d of ['tue', 'wed', 'thu', 'fri']) byId[d].windows.value = byId.mon.windows.peek().map(w => windowRow({from: w.from.peek(), to: w.to.peek()}));
+                    rescan();
                 },
                 addOff() {
-                    daysOff = [...daysOff, {from: boot.today, to: boot.today, label: ''}];
-                    drawDaysOff(panel.panel);
+                    daysOff.value = [...daysOff.peek(), offRow({from: boot.today, to: boot.today, label: ''})];
+                    rescan();
                 },
                 async save() {
                     if (saving.peek()) return;
                     // Say which hours are wrong rather than let the server drop them quietly.
+                    const hours = hoursOut();
+                    const daysOff = daysOffOut();
                     for (const d of DAY_KEYS) {
                         for (const w of hours[d]) {
                             if (!(toMinutes(w.to) > toMinutes(w.from))) { E.toast(`${DAY_NAMES[d]}: ${w.from || '?'}-${w.to || '?'} - the end must be after the start.`, {type: 'warning'}); return; }

package/plugins/booking/admin/views/settings.js

@@ -15,6 +15,15 @@ const SECTIONS = [
     {key: 'tools', label: 'Other Tools', icon: 'plug'},
     {key: 'closed', label: 'Closed days', icon: 'ban'}
 ];
+// One spell of closed days.
+const CLOSURE_ROW = `
+<div class="bk-off">
+  <input type="date" class="form-input" data-model="from.value" aria-label="From" data-on-change="$parent.closureFrom($data)"><span>to</span>
+  <input type="date" class="form-input" data-model="to.value" aria-label="To">
+  <input class="form-input" data-model="label.value" placeholder="Bank holiday…" maxlength="80" aria-label="Why">
+  <button type="button" class="btn btn-xs btn-ghost bk-x" title="Remove" aria-label="Remove" data-on-click="$parent.dropClosure($data)"><span data-icon="x" data-icon-size="12"></span></button>
+</div>`;
+
 const BOOL_KEYS = ['askPhone', 'phoneRequired', 'allowCancel', 'allowMove', 'sendConfirmation', 'addToContacts', 'calendarBusy'];
 const FIELD_SECTION = {pageTitle: 'page', bookingPath: 'page', timeZone: 'page', termsUrl: 'page', notifyAddress: 'emails'};
 
@@ -32,13 +41,26 @@ export async function openSettings(ctx, section = 'page') {
     const s = info.settings;
     const f = {};
     for (const [k, v] of Object.entries(s)) if (k !== 'closures') f[k] = M.observable(v);
-    let closures = (s.closures || []).map(c => ({...c}));
+    // Closed days are a keyed list (CLOSURE_ROW); each field is an observable the inputs write through.
+    let seq = 0;
+    const closureRow = (c) => ({id: `c${++seq}`, from: M.observable(c.from || ''), to: M.observable(c.to || ''), label: M.observable(c.label || '')});
+    const closures = M.observable((s.closures || []).map(closureRow));
+    const closuresOut = () => closures.peek().map(o => ({from: o.from.peek(), to: o.to.peek(), label: o.label.peek()}));
     const tab = M.observable(SECTIONS.some(x => x.key === section) ? section : 'page');
     const saving = M.observable(false);
-    const snapshot = () => JSON.stringify([Object.entries(f).map(([k, o]) => [k, o.peek()]), closures]);
+    const snapshot = () => JSON.stringify([Object.entries(f).map(([k, o]) => [k, o.peek()]), closuresOut()]);
     const opened = snapshot();
+    let panel = null;
+    // New rows carry icons; they are drawn once the list has rendered.
+    const rescan = () => { M.flushSync?.(); if (panel) { I.scan(panel.panel); requestAnimationFrame(() => panel?.panel.isConnected && I.scan(panel.panel)); } };
     const model = {
-        ...f, tab, saving,
+        ...f, tab, saving, closures,
+        dropClosure(o) { closures.value = closures.peek().filter(x => x !== o); },
+        // An end before the start is never meant: it follows the start.
+        closureFrom(o, e) {
+            const v = e?.target?.value ?? o.from.peek();
+            if (!o.to.peek() || o.to.peek() < v) o.to.value = v;
+        },
         pageUrl: M.computed(() => `${location.origin}${f.bookingPath.value || '/booking'}`),
         noPhone: M.computed(() => !f.askPhone.value),
         remindText: M.computed(() => (Number(f.reminderHours.value) > 0 ? `${f.reminderHours.value} hours before` : 'off'))
@@ -110,7 +132,8 @@ export async function openSettings(ctx, section = 'page') {
 
   <section data-bind-hidden="!is_closed.value">
     <p class="bk-note">Days the whole business is closed - bank holidays, a closure. Nobody can be booked. (For one person's holiday, use their days off.)</p>
-    <div data-part="closures"></div>
+    <p class="bk-note" data-bind-hidden="closures.value.length">None yet.</p>
+    <div data-each="closures.value key=id">${CLOSURE_ROW}</div>
     <div class="bk-actions bk-actions-start"><button type="button" class="btn btn-xs btn-outline" data-on-click="addClosure"><span data-icon="plus" data-icon-size="12"></span> Add closed days</button></div>
   </section>
 
@@ -121,18 +144,6 @@ export async function openSettings(ctx, section = 'page') {
   </div>
 </div>`;
 
-    const drawClosures = (el) => {
-        const box = el.querySelector('[data-part="closures"]');
-        box.innerHTML = closures.length ? closures.map((o, i) => `<div class="bk-off" data-i="${i}">
-  <input type="date" class="form-input" value="${esc(o.from)}" data-k="from" aria-label="From"><span>to</span>
-  <input type="date" class="form-input" value="${esc(o.to)}" data-k="to" aria-label="To">
-  <input class="form-input" value="${esc(o.label)}" data-k="label" placeholder="Bank holiday…" maxlength="80" aria-label="Why">
-  <button type="button" class="btn btn-xs btn-ghost bk-x" data-drop title="Remove" aria-label="Remove"><span data-icon="x" data-icon-size="12"></span></button></div>`).join('')
-            : '<p class="bk-note">None yet.</p>';
-        I.scan(box);
-    };
-
-    let panel = null;
     panel = await openPanel({
         title: 'Booking settings',
         size: 'md',
@@ -148,27 +159,15 @@ export async function openSettings(ctx, section = 'page') {
                 const b = e.target.closest('[data-tab]');
                 if (b) tab.value = b.dataset.tab;
             });
-            drawClosures(el);
-            const box = el.querySelector('[data-part="closures"]');
-            box.addEventListener('input', (e) => {
-                const row = e.target.closest('[data-i]');
-                if (!row) return;
-                const o = closures[Number(row.dataset.i)];
-                o[e.target.dataset.k] = e.target.value;
-                if (e.target.dataset.k === 'from' && (!o.to || o.to < o.from)) { o.to = o.from; row.querySelector('[data-k="to"]').value = o.from; }
-            });
-            box.addEventListener('click', (e) => {
-                const row = e.target.closest('[data-i]');
-                if (row && e.target.closest('[data-drop]')) { closures.splice(Number(row.dataset.i), 1); drawClosures(el); }
-            });
         },
         methods: {
             cancel: () => panel?.close(),
             copyUrl: () => copy(model.pageUrl.peek(), 'Booking page address copied'),
-            addClosure() { closures = [...closures, {from: ctx.boot.today, to: ctx.boot.today, label: ''}]; drawClosures(panel.panel); },
+            addClosure() { closures.value = [...closures.peek(), closureRow({from: ctx.boot.today, to: ctx.boot.today, label: ''})]; rescan(); },
             async save() {
                 if (saving.peek()) return;
-                for (const o of closures) {
+                const closed = closuresOut();
+                for (const o of closed) {
                     if (!isDate(o.from) || !isDate(o.to) || o.to < o.from) { tab.value = 'closed'; E.toast('Closed days: each needs a start date, and an end on or after it.', {type: 'warning'}); return; }
                 }
                 const out = {};
@@ -176,7 +175,7 @@ export async function openSettings(ctx, section = 'page') {
                 for (const k of BOOL_KEYS) out[k] = Boolean(out[k]);
                 out.changeNoticeHours = Number(out.changeNoticeHours) || 0;
                 out.reminderHours = Number(out.reminderHours) || 0;
-                out.closures = closures;
+                out.closures = closed;
                 saving.value = true;
                 const el = panel.panel;
                 try {

package/plugins/booking/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "booking",
   "displayName": "Booking",
-  "version": "1.6.3",
+  "version": "1.6.4",
   "tier": "free",
   "description": "Let people book appointments with you or your team, and rooms or equipment, from a booking page on your site. Opening hours, days off and buffers; confirmation and reminder emails with a link to change or cancel; a diary in the admin. Book straight from a contact or an email.",
   "author": "Domma CMS",

package/plugins/booking/tests/admin-diary.test.js

@@ -3,7 +3,7 @@
  */
 import {test} from 'node:test';
 import assert from 'node:assert/strict';
-import {datesFor, gridHours, layoutColumn, minuteAt, placeOf, weekStart, dayLabel} from '../admin/lib/diary-layout.js';
+import {datesFor, gridHours, layoutColumn, mergeWindows, minuteAt, placeOf, weekStart, dayLabel} from '../admin/lib/diary-layout.js';
 
 test('weeks start on Monday', () => {
     assert.equal(weekStart('2031-07-15'), '2031-07-14');
@@ -71,3 +71,11 @@ test('booking details: who, where from, answers, places', () => {
     assert.equal(placesLabel(1), '1 place left');
     assert.equal(placesLabel(3), '3 places left');
 });
+
+test('week bands: windows merged where they touch or overlap, sorted, inputs untouched', () => {
+    const input = [{from: 780, to: 1020}, {from: 540, to: 750}, {from: 600, to: 780}, {from: 1080, to: 1140}];
+    assert.deepEqual(mergeWindows(input), [{from: 540, to: 1020}, {from: 1080, to: 1140}]);
+    assert.deepEqual(input[0], {from: 780, to: 1020}, 'no input is changed');
+    assert.deepEqual(mergeWindows([]), []);
+    assert.deepEqual(mergeWindows(undefined), []);
+});

package/plugins/feedback/CLAUDE.md

@@ -118,3 +118,65 @@ Replying in the inbox to a `_manager` report you filed yourself marks it seen fo
 
 - Cache-busters follow the manifest: `feedback.js?v=1.1.4` in plugin.json and `V = '1.1.4'` for the sub-views - bump
   both with the version. Fleet-token note above corrected (tokens are on disk since 2026-10-04).
+
+## 1.1.5 (2026-10-13 Tool sweep - caching)
+
+- **`allReports()` is cached 30 s** (`lib/cache.js`; promise kept, concurrent reads share one). It served the
+  manager badge (every minute per `manage` tab), every site's `/fleet/mine` and `receive()`'s dedupe. Every write
+  in lib/receiver.js (`receive`, `applyPatch` - and so `issueMoved` - `removeReport`) calls `forget()` after the
+  write, so the inbox and badge show it on the next read. A test that writes the collection directly must call
+  `forget()` itself. Test: `tests/api.test.js` "the inbox memory".
+
+## 1.1.6 (2026-10-13) - attachments
+
+Up to 3 files per report, 2 MB each: PNG, JPEG, GIF, WebP, PDF, plain text (`ATTACHMENTS` / `ATTACHMENT_TYPES` in
+lib/shape.js; no SVG or HTML - they can carry script). Chosen with "Attach a file" or pasted into the description.
+
+- **Not the CMS media API, on purpose.** `/api/media` saves into the PUBLIC media folder (anyone with the URL reads
+  it) and needs `media.create`, which a `feedback.send` user may lack. These are screenshots of admin screens, so the
+  plugin has its own upload route that mirrors media.js's checks (mime whitelist, `request.file()` from the engine's
+  @fastify/multipart, size cap, sanitised name) and keeps files in its own `data/attachments/` (0600 files, 0700
+  folders, `lib/attachments.js createStore`). Every path is built from a cleaned attachment (`cleanAttachment`: id
+  `[A-Za-z0-9-]{8,64}`, made by `randomUUID()` on upload) - nothing from a request reaches `path.join` raw.
+- **Flow.** Site: `POST /attachments` (multipart) -> `{id, name, type, size}` saved with a `<id>.json` sidecar.
+  `POST /send {..., attachments: [{id}]}` takes each file's description from the SIDECAR, never the form, and the
+  payload announces them. `flush()` (now single-flight, like Support's) submits the report, then posts each file RAW to
+  `POST /fleet/attach/:reportId/:attId` (`application/octet-stream`; a plugin-scoped parser, bodyLimit 2 MB + 1 KB;
+  its own throttle, perSiteMax x 3). The manager takes only a file the report announced, at the announced size, on a
+  report of the token's site (else 404), saves it under `data/attachments/<report id>/` and sets `stored: true`
+  (`rx.markStored`). Outbox items record `filesSent` / `filesRefused` (a 4xx other than 401/408/429, or a file this
+  site no longer has), so a file is retried until it lands or is refused for good.
+- **Reading them.** Inbox: `GET /reports/:id/attachments/:att` (`manage`). Site: `GET /attachments/:id` - its own
+  copy, so a file shows before Domma's copy lands. Served with the stored type, `nosniff`, inline, private cache.
+  The admin fetches with the session token into a `blob:` URL (`kit.blobUrl`) for thumbnails and "open in a new tab".
+- The level-0 role's own feedback: uploads stage in `data/attachments/_staging/`, `POST /send` moves them into the
+  report's folder and marks them stored; `GET /attachments/:id` finds staged or filed ones.
+- Deleting a report deletes its folder. A site drops files never sent (no outbox item names them) after a day, on the
+  sync timer; the manager prunes `_staging` on each upload.
+- UI: `kit.FILES` (data-each row template, bound on its own host AFTER the panel's bindings - the panel model has no
+  `files`; no icons in rows because they land after the icon scan) and `kit.showFiles()` for detail panels.
+- Also: `GET /meta` asks for `manage` on the manager (a manage-only role used to 403 and the screen failed), and
+  answers the attachment caps; `text()` strips all control characters (as Support's).
+- Tests: shape.test.js (cleanAttachment, caps, store perms and prune), api.test.js (upload -> travel -> inbox
+  download, refusals, offline wait then both go). Not covered by tests: the level-0 role's own attachments.
+
+## 1.1.7 (2026-10-13) - settings cog
+
+- Settings are read when used, per side (`cleanSettings(raw, current, side)`, `SIDE_SETTINGS` in lib/shape.js):
+  the site's `syncMinutes`, the manager's `perSiteMax` / `perSiteMinutes`. `GET/PUT /settings` answers this side
+  only - a site's for `requireAdmin` (from `options.auth`; `send` on an engine without it), the manager's for
+  `manage`; the save merges over the stored object (the other side's keys and `storage` survive). Tests inject
+  `options.readSettings` / `options.writeSettings` (tests/api.test.js passes the test's limits that way).
+- The sync timer is a self-re-arming `setTimeout` that asks for `syncMinutes` before each wait, and a save
+  re-arms it. The two throttles (`createThrottle()` now takes `{max, windowMs}` per call) get the live limits on
+  each report or file. Before, all three were read at boot and needed a restart.
+- `admin/lib/settings.js`: the banner cog, added by `feedback.js` once the mode is known, only when the silent
+  `GET /settings` answers; a slideover through kit's `openPanel` with M bindings, data-help per field, discard
+  guard, Ctrl+Enter. Tests: tests/settings.test.js, and "the per-site throttle" in tests/api.test.js (live limit).
+
+## 1.1.8 (2026-10-13) - a report deleted on the manager leaves the site too
+Deleting a report in the inbox hid it from the site, but the site's outbox kept the sent item - its text and, through
+`pruneFiles`' keep list, its screenshots - for good. `sync()` now calls `outbox.forgetDropped(remote)` whenever the
+manager answered `/fleet/mine` (its list for the site is complete): a SENT item the manager no longer has is dropped
+(`droppedByManager`, PURE, tested); waiting/refused items and an unreachable manager keep everything. The files go
+at the next prune (older than a day, no longer named). Found on the dcm click-through.

package/plugins/feedback/admin/css/index.css

@@ -1,7 +1,7 @@
 /* Feedback - admin styles. Theme tokens only (every one below is defined by every Domma theme). */
 
 /* data-bind-hidden sets [hidden]; any display rule below would otherwise beat it. */
-.fb [hidden], .fb-detail [hidden], .fb-form [hidden] { display: none !important; }
+.fb [hidden], .fb-detail [hidden], .fb-form [hidden], .fb-files-host [hidden] { display: none !important; }
 
 .fb { max-width: 60rem; }
 .fb-card { background: var(--dm-surface); border: 1px solid var(--dm-border); border-radius: var(--dm-radius-lg); padding: 1rem 1.1rem; }
@@ -74,6 +74,21 @@
 .fb-history li { display: flex; justify-content: space-between; gap: 1rem; padding: .3rem 0; border-top: 1px solid var(--dm-border); }
 .fb-history small { color: var(--dm-text-secondary); }
 
+/* Attached files: a thumbnail or the file's kind, its name and size */
+.fb-attach { display: flex; align-items: center; gap: .6rem; flex-wrap: wrap; }
+.fb-files { list-style: none; margin: .3rem 0; padding: 0; display: grid; grid-template-columns: repeat(auto-fill, minmax(13rem, 1fr)); gap: .4rem; }
+.fb-file { display: flex; align-items: center; gap: .55rem; padding: .35rem .5rem; border: 1px solid var(--dm-border); border-radius: var(--dm-radius-md);
+  background: var(--dm-background); cursor: pointer; min-width: 0; }
+.fb-file:hover, .fb-file:focus-visible { border-color: var(--dm-primary); outline: none; }
+.fb-thumb { width: 2.6rem; height: 2.6rem; object-fit: cover; border-radius: var(--dm-radius-md); flex: none; }
+.fb-file-ext { width: 2.6rem; height: 2.6rem; display: inline-flex; align-items: center; justify-content: center; flex: none; font-size: var(--dm-font-size-xs);
+  font-weight: 700; color: var(--dm-text-secondary); background: var(--dm-hover-bg); border-radius: var(--dm-radius-md); }
+.fb-file-main { flex: 1; min-width: 0; display: flex; flex-direction: column; }
+.fb-file-main strong { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; font-size: var(--dm-font-size-sm); }
+.fb-file-main small { color: var(--dm-text-secondary); font-size: var(--dm-font-size-xs); }
+.fb-file-x { border: 0; background: none; color: var(--dm-text-secondary); cursor: pointer; font-size: 1.1rem; line-height: 1; padding: .1rem .35rem; border-radius: var(--dm-radius-md); }
+.fb-file-x:hover { background: var(--dm-hover-bg); color: var(--dm-danger); }
+
 @media (max-width: 640px) {
   .fb-grid3 { grid-template-columns: 1fr; }
   .fb-row { flex-wrap: wrap; }

package/plugins/feedback/admin/lib/kit.js

@@ -46,9 +46,115 @@ export const api = {
     update: (id, d) => H.put(`${BASE}/reports/${seg(id)}`, d),
     remove: (id) => H.delete(`${BASE}/reports/${seg(id)}`),
     waypoint: () => H.get(`${BASE}/waypoint`),
+    /** Where a file is read from: this site's (or the manager's own) copy, or a report's in the inbox. */
+    ownFileUrl: (id) => `${BASE}/attachments/${seg(id)}`,
+    reportFileUrl: (id, att) => `${BASE}/reports/${seg(id)}/attachments/${seg(att)}`,
     promote: (id, d) => H.post(`${BASE}/reports/${seg(id)}/promote`, d)
 };
 
+// ---------------------------------------------------------------------------------
+// Attachments
+// ---------------------------------------------------------------------------------
+
+const authHeaders = () => { const t = (() => { try { return S.get('auth_token'); } catch { return ''; } })(); return t ? {Authorization: `Bearer ${t}`} : {}; };
+
+/** Upload one file for the report being written. H has no multipart helper, so this is the admin's own upload pattern. */
+export async function uploadFile(file) {
+    const fd = new FormData();
+    fd.append('file', file, file.name);
+    const res = await fetch(`${BASE}/attachments`, {method: 'POST', headers: authHeaders(), body: fd});
+    const body = await res.json().catch(() => ({}));
+    if (!res.ok) throw new Error(body.error || `Upload failed (${res.status}).`);
+    return body;
+}
+
+/** A file behind the session as a blob: URL (an <img src> or a new tab cannot send the token). Revoke it when done. */
+export async function blobUrl(url) {
+    const res = await fetch(url, {headers: authHeaders()});
+    if (!res.ok) throw new Error((await res.json().catch(() => ({}))).error || `Could not open the file (${res.status}).`);
+    return URL.createObjectURL(await res.blob());
+}
+
+export const FILE_TYPES = 'image/png,image/jpeg,image/gif,image/webp,application/pdf,text/plain';
+export const isImage = (type) => /^image\//.test(String(type || ''));
+const EXT = {'image/png': 'PNG', 'image/jpeg': 'JPG', 'image/gif': 'GIF', 'image/webp': 'WEBP', 'application/pdf': 'PDF', 'text/plain': 'TXT'};
+
+/** 812 B, 14 KB, 1.2 MB. */
+export function fileSize(n) {
+    const b = Number(n) || 0;
+    if (b < 1024) return `${b} B`;
+    if (b < 1024 * 1024) return `${Math.round(b / 1024)} KB`;
+    return `${(b / 1024 / 1024).toFixed(1)} MB`;
+}
+
+/**
+ * A list of files, bound to a `files` observable of fileRow()s. Text bindings only;
+ * the thumbnail is a blob: URL or nothing. No icons in the row - rows arrive after
+ * the panel's icon scan.
+ */
+export const FILES = `
+<ul class="fb-files" data-bind-hidden="!files.value.length" data-each="files.value key=key"><li class="fb-file" data-key="{{key}}" tabindex="0" role="button" data-bind-title="title">
+  <img class="fb-thumb" alt="" data-bind-src="thumb || false" data-bind-hidden="!thumb">
+  <span class="fb-file-ext" data-bind-hidden="thumb" data-bind-text="ext"></span>
+  <span class="fb-file-main"><strong data-bind-text="name"></strong><small data-bind-text="meta"></small></span>
+  <button type="button" class="fb-file-x" data-bind-hidden="!removable" aria-label="Remove this file" title="Remove">&times;</button>
+</li></ul>`;
+
+/** One row for FILES. */
+export function fileRow(a, extra = {}) {
+    return {key: a.id || a.key, id: a.id || '', name: a.name, type: a.type, ext: EXT[a.type] || 'FILE', thumb: '',
+        meta: fileSize(a.size), title: `Open ${a.name}`, removable: false, ...extra};
+}
+
+/**
+ * Show a report's attached files in a panel: thumbnails for the images that are
+ * there, and click (or Enter) to open one in a new tab.
+ *
+ * @param {HTMLElement} host - an element holding FILES
+ * @param {object[]} list - attachments {id, name, type, size, stored?}
+ * @param {(a) => string} urlOf - where the file is fetched from
+ * @param {string} [missing] - said of a file that has not arrived yet
+ * @returns {{files, dispose: () => void}}
+ */
+export function showFiles(host, list, urlOf, missing = 'not arrived yet') {
+    const urls = [];
+    const files = M.observable((list || []).map(a => fileRow(a, {meta: [fileSize(a.size), a.stored === false ? missing : ''].filter(Boolean).join(' · ')})));
+    const handle = M.applyBindings({files}, host);
+    let live = true;
+    for (const a of list || []) {
+        if (!isImage(a.type) || a.stored === false) continue;
+        blobUrl(urlOf(a)).then((u) => {
+            if (!live) { URL.revokeObjectURL(u); return; }
+            urls.push(u);
+            files.value = files.peek().map(r => (r.key === a.id ? {...r, thumb: u} : r));
+        }).catch(() => { /* no thumbnail; the row still opens */ });
+    }
+    const openOne = async (key) => {
+        const a = (list || []).find(x => x.id === key);
+        if (!a) return;
+        if (a.stored === false) { E.toast(`${a.name} has not arrived yet - it follows its report.`, {type: 'info'}); return; }
+        try {
+            const u = await blobUrl(urlOf(a));
+            urls.push(u);
+            window.open(u, '_blank', 'noopener');
+        } catch (err) { E.toast(err.message || String(err), {type: 'error'}); }
+    };
+    const onClick = (e) => { const li = e.target.closest('.fb-file'); if (li) openOne(li.dataset.key); };
+    const onKey = (e) => { const li = e.target.closest('.fb-file'); if (li && (e.key === 'Enter' || e.key === ' ')) { e.preventDefault(); openOne(li.dataset.key); } };
+    host.addEventListener('click', onClick);
+    host.addEventListener('keydown', onKey);
+    return {
+        files,
+        dispose() {
+            live = false;
+            host.removeEventListener('click', onClick);
+            host.removeEventListener('keydown', onKey);
+            handle.dispose();
+            for (const u of urls.splice(0)) URL.revokeObjectURL(u);
+        }
+    };
+}
+
 /** E.confirm and slideover titles render HTML: user text goes in escaped. */
 export const esc = (s) => String(s ?? '').replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/"/g, '&quot;');