sign-off-axi 0.6.3 → 0.6.4

package/README.md

@@ -105,6 +105,26 @@ Agents pass `--priority` when they know it, and set their project's icon when it
 
 Every card's screen also keeps its **Activity**, oldest first, from what the board already saved: who posted it, your answer and note (and the one a change replaced), when the agent picked it up, a new round you asked for and your comments. A ticket's page shows its cards' activity together.
 
+### The leash: what agents may do without you
+
+Every ask says what happens if you stay quiet (`--default`) and when (`--silent-by`). Your leash decides whether it happens. Set it in Today's More, or tap the **Leash** chip by the count on Decide. It is saved as `leash:` in the `config.yaml` beside the board.
+
+- **Ask me first** (`ask`): nothing happens; agents wait for you on every ask.
+- **When it matters** (`matters`, the default): when an ask's `--silent-by` time passes with no answer, the open board takes its default as the answer. Its card says **Taken by default at 13:00**, and the waiting agent gets it at once. A default that fell due while the board was closed is taken when it starts. An ask with no `--silent-by` waits.
+- **Act, then tell me** (`act`): the agent's recommended pick is taken the moment it raises the ask. Its card says **Agent picked B: Friday, tell me if wrong**.
+
+Both kinds wait under **Taken without you** in Decide until you open them, each with a one-tap **Change** on a phone. You can still answer or change them. The change reaches the agent as an answer that replaces the taken one, and the card's trail and Activity say what happened: Taken or Picked, then Delivered and Read.
+
+Some asks are never answered for you, whatever the leash: an ask raised with `--guard destructive|irreversible|money|credential|security`, and an ask whose words talk of spending money, deleting, what can't be undone, passwords and keys, or access. Designs, plans and sign-ins always wait too. Such an ask says **Always waits for you** and why.
+
+<table>
+  <tr>
+    <td align="center" width="33%"><picture><source media="(prefers-color-scheme: dark)" srcset="docs/media/phone-leash-decide-dark.webp"><img src="docs/media/phone-leash-decide.webp" alt="Decide: the asks that wait, then Taken without you with a default taken and an agent's pick, each with Change, and the Leash chip by the count"></picture><br><b>Taken without you</b><br>What the leash answered, with Change.</td>
+    <td align="center" width="33%"><picture><source media="(prefers-color-scheme: dark)" srcset="docs/media/phone-leash-agent-dark.webp"><img src="docs/media/phone-leash-agent.webp" alt="An ask the agent picked: Agent picked B: Friday, tell me if wrong, its reason, its trail from Picked to Read, and Change"></picture><br><b>Agent picked</b><br>On Act, then tell me: its pick, and Change.</td>
+    <td align="center" width="33%"><picture><source media="(prefers-color-scheme: dark)" srcset="docs/media/phone-leash-guard-dark.webp"><img src="docs/media/phone-leash-guard.webp" alt="An ask that spends money: Always waits for you, so no default or agent pick is ever taken"></picture><br><b>Always waits for you</b><br>Money, deletes, keys and access.</td>
+  </tr>
+</table>
+
 ## What you can ask
 
 One line on what the agent runs per kind; the full reference is [docs/question-kinds.md](docs/question-kinds.md) and the message rules are in [docs/contract.md](docs/contract.md).
@@ -113,11 +133,11 @@ One line on what the agent runs per kind; the full reference is [docs/question-k
 |---|---|---|
 | Yes or no, pick one | `raise --ask-ref <captain-message-id-or-hold-id> --title ... --recommend ...` | buttons, the recommended one first |
 | Design pick (mocks A/B/C) | `post --type design --mock a=... --mock b=... --link a=<url>` | mocks side by side, an Open live link under each option that has a `--link`, a note on any part, and Open full screen: the prototype over the whole screen with its own navigation, Phone or Desktop width and another option as a reference |
-| Design review (screens of a product) | `post --kind design --from design.json` | nothing in Decide: it waits under **Designs** for Main to review; once Main passes every screen, the lead posts one card per product that opens them all, phone and desktop, and Main's `promote <key>` puts that card in Decide |
+| Design review (one plain question) | `post --kind design --from design.json` | one question answered with **Yes** (a note optional) or **Change** (a note needed): each screen's frames side by side (Before and After, or Today, New and Target design), the changed area outlined and named on each and the frame Yes approves marked; post refuses an internal title and frames that look the same. Nothing in Decide: it waits under **Designs** for Main to review, and Main's `promote <key>` puts it in Decide |
 | Proof update | `post --type evidence --media shot.png` | the capture, its result, Pass / Fail / Needs work |
 | Proof with a file to install | `post --type evidence --media shot.png --attach app.apk` | the capture, and the file with its size and a Download button (any type, up to 1 GB, `SIGN_OFF_ATTACH_MAX_MB` to change) |
 | Explainer video | `post --type explainer --media clip.mp4 --chapter 0:00=Start` | a player with chapter buttons, then Yes or No |
-| Report | `report init <folder>`, fill `report.json`, then `post --kind report --from <folder>/report.json` | one scroll: the answer and a picture, what I understood, what I found, the next step; numbers behind Details, Go deeper on every part, who read it and when |
+| Report | `report init <folder>`, fill `report.json`, then `post --kind report --from <folder>/report.json` | one scroll: the answer and a picture, what I understood, what I found, the next step; numbers under their part, one bar (Agree, Disagree, Comment, Ask) that acts on the part in view, and one Activity of every note, ask, reply and read |
 | Diagram, interactive page | `post --type diagram --view flow.svg` | the picture on the card; interactive pages run sandboxed, and open full screen at phone or desktop width |
 | Plan | `report init <folder> --plan`, fill `plan.json`, then `post --kind plan --from plan.json` | the same scroll, plus each decision with my pick and a Go ahead |
 | Sign-in link | `post --type signin --service npm --link <url> --unlocks ...` | an Open button and the time left |

package/dist/cli.js

@@ -14,10 +14,10 @@ import { parseArgs } from 'node:util';
 import { encode } from '@toon-format/toon';
 import { acknowledgeOwner, checkOwner, deliveries, dispatchOwners, registerOwner } from './owner.js';
 import { AxiError, runAxiCli } from 'axi-sdk-js';
-import { ATTACH_DEFAULT_MB, ATTACH_MAX, ATTACH_NAME, CHAPTERS_MAX, SIGNED_IN, CLEARED, InputError, MEDIA_MAX, NOTE_MAX, REPLY, answersPath, appendAnnotation, appendPartComment, annotationsPath, markCommentsRead, readPartComments, replyComment, asks, appendAnswer, appendDismissed, DISCARD_REASONS, readDiscards, UNDO_MS, appendPromoted, appendSendBack, appendTicket, readTickets, rollUp, appendTicketComment, ticketCommentFault, ticketFault, appendProject, readProjects, projectFault, iconPathFault, iconContentFault, ICON_BYTES, ICON_TYPES, PRIORITIES, REPORT_PARTS, REPORT_PURPOSES, appendDesignAnswer, answerLines, appendMark, readTrail, trailPath, appendMessage, appendRound, awaitsVerdict, lapsed, askEngagement, checkEngagement, markEngagementSeen, appendRead, appendOpened, readOpened, answerDeeper, askDeeper, deeperPath, guidePart, markDeeperRead, readDeeper, readReads, seenAt, isKey, loadDecisions, markDelivered, markSeen, messagesPath, readAnnotations, readAnswers, reading, readDismissed, readItems, readPromoted, sameDecision, readMessages, readRounds, roundsPath, sameRound, seenBy, seenPath, sentIds, unreadable as reasonOf, writeItems } from './store.js';
+import { ATTACH_DEFAULT_MB, ATTACH_MAX, ATTACH_NAME, guardOf, plainAsk, CHAPTERS_MAX, SIGNED_IN, CLEARED, InputError, MEDIA_MAX, NOTE_MAX, REPLY, answersPath, appendAnnotation, appendPartComment, annotationsPath, markCommentsRead, readPartComments, replyComment, asks, appendAnswer, appendDismissed, DISCARD_REASONS, readDiscards, UNDO_MS, appendPromoted, appendSendBack, appendTicket, readTickets, rollUp, appendTicketComment, ticketCommentFault, ticketFault, appendProject, readProjects, projectFault, iconPathFault, iconContentFault, ICON_BYTES, ICON_TYPES, PRIORITIES, REPORT_PARTS, REPORT_PURPOSES, appendDesignAnswer, answerLines, appendMark, readTrail, trailPath, appendMessage, appendRound, awaitsVerdict, lapsed, askEngagement, checkEngagement, markEngagementSeen, appendRead, appendOpened, readOpened, answerDeeper, askDeeper, deeperPath, guidePart, markDeeperRead, readDeeper, readReads, screenViews, seenAt, isKey, loadDecisions, markDelivered, markSeen, messagesPath, readAnnotations, readAnswers, reading, readDismissed, readItems, readPromoted, sameDecision, readMessages, readRounds, roundsPath, sameRound, seenBy, seenPath, sentIds, unreadable as reasonOf, writeItems } from './store.js';
 import { ContractError, KINDS, MEDIA_BYTES, REPORT_INIT, checkMessage, diagramPages, diagramViews, guided, mediaFiles, parseMessage, reportPage } from './contract.js';
 import { faults, isStill } from './evidence-text.js';
-import { copiesOf } from './images.js';
+import { copiesOf, differs } from './images.js';
 import { deliverVault, errors, readVaultExpiry, sweepVault, takeVaultExpiries, VaultError } from './vault.js';
 /** The version this copy runs, read from package.json once: a pre-release version says so, and a git checkout whose HEAD carries no tag
  * for that version is a dev build ahead of its release, `<version>-dev`. An installed copy has no .git, so it shows its version as published.
@@ -84,7 +84,7 @@ examples:
   sign-off-axi
   sign-off-axi list ./decisions.json --full
 `,
-    raise: `usage: sign-off-axi raise [board.json] --title "<question>" [--key <key>] [--about <text>] [--detail <text>] --why <text> [--option <value>=<label>]... --outcome <value>=<text>... --recommend <value> --recommend-reason <text> --default <value> [--silent-by <ISO time>] [--merge <key>]... [--proof <key>] [--close done|release] [--filer <id>] [--ticket <id>] [--priority P0-P3]
+    raise: `usage: sign-off-axi raise [board.json] --title "<question>" [--key <key>] [--about <text>] [--detail <text>] --why <text> [--option <value>=<label>]... --outcome <value>=<text>... --recommend <value> --recommend-reason <text> --default <value> [--silent-by <ISO time>] [--guard <why>] [--merge <key>]... [--proof <key>] [--close done|release] [--filer <id>] [--ticket <id>] [--priority P0-P3]
        sign-off-axi raise [board.json] --from <decisions.json> [--filer <id>] [--ticket <id>] [--priority P0-P3]
 Adds questions to the board: yes/no, or 2 to 6 choices with one --option each. --key defaults to a slug of the title.
 raise is the alias for post --type decision: same flags, same output.
@@ -96,7 +96,13 @@ Every question meets the question standard (docs/contract.md, "Asking a good que
   --why says what it is about and why it needs an answer now (200 characters or fewer).
   --outcome <value>=<text> says what happens next if that answer is picked (120 or fewer), one for every option: yes and no without --option.
   --recommend names the answer you would pick, --recommend-reason why in one line (160 or fewer).
-  --default is what happens if the user stays quiet, shown and never applied; --silent-by (an ISO UTC time such as 2026-10-18T09:00Z) says when.
+  --default is what happens if the user stays quiet; --silent-by (an ISO UTC time such as 2026-10-18T09:00Z) says when. The leash (leash: in config.yaml, the board's Leash control) says what is applied:
+    ask (Ask me first): nothing; every ask waits for the user.
+    matters (When it matters, the default): at --silent-by with no answer, the open board takes --default as the answer, saved with taken: default; an ask with no --silent-by waits.
+    act (Act, then tell me): raise takes your --recommend at once, saved with taken: agent; go ahead with it. The user sees it on the card and can change it.
+  Either way wait and answers hand it over like an answer, with its taken; the user can still answer or change it, and a change comes back with replaces.
+  --guard destructive|irreversible|money|credential|security marks an ask only the user may answer: no default or pick is ever taken for it, whatever the leash.
+  An ask whose title, why or outcomes talk of deleting, money, passwords, keys, access or what can't be undone is guarded the same way without it; designs, plans, sign-ins, gates and findings always wait.
   The buttons match the text: a title or why that names choices A, B, C needs one --option per letter, each label starting with its letter, never Yes/No.
   yes and no are labelled Yes and No; a question never takes Done, OK or Not now buttons.
 One decision is one card: look at the open cards first. --merge <key> (up to 10) names other cards on the board that ask the same thing and offer every option of this one:
@@ -117,7 +123,7 @@ examples:
 `,
     validate: `usage: sign-off-axi validate <message.json>... [--kind <kind>] [--expect-invalid]
 Checks message files against the communication contract without posting them: ${CONTRACT}
-A message is one JSON object with "contract": 1, its "kind" and its "schema". This build checks kinds ask, evidence, gate, finding and design at schema 1, report at schema 5 (schemas 2 to 4 still pass) and plan at schema 3 (schemas 1 and 2 still pass).
+A message is one JSON object with "contract": 1, its "kind" and its "schema". This build checks kinds ask, evidence, gate and finding at schema 1, design at schema 2 (schema 1 still passes), report at schema 5 (schemas 2 to 4 still pass) and plan at schema 3 (schemas 1 and 2 still pass).
 A report 3 to 5 and a plan 2 or 3 are guided pages: fields the board draws as one scroll, no page of your own (see report init). A report 5 names what it is for in "purpose".
 An evidence message's media paths read from the message file's folder: each file must be there, inside it, and 50 MB or less.
 A report is a page to tap through: its "view" (.html) and "preview" (its picture, beside it) are checked for their shape here; the files themselves are checked at post, from the board file's folder, filled with no FILL: lines left (see report init).
@@ -273,7 +279,10 @@ examples:
   sign-off-axi post --kind finding --from finding.json --filer learn-from-mistakes
   sign-off-axi post --kind plan --from plan.json --filer agent-41
   sign-off-axi post --kind design --from design.json --filer agent-41
-A design message lists project journeys, per-screen image or HTML view variants, and a card preview; post checks every asset stays under the board folder.
+A design (schema 2) asks one plain question Yes answers: its title, 12 words or fewer, ending in "?". Each screen shows 1-3 frames side by side (today, built or proposed, target),
+each with the changed area as fractions of its picture and a one-line caption, and "accepts" names the frame Yes approves. Post refuses a new design without a plain question title,
+words for agents in what the person reads (task or branch names, PR or #number, slice, agent or ticket codes, file names, commits), and two frames that look the same;
+it checks every asset stays under the board folder. See docs/contract.md (design, schema 2) and fixtures/contract/design.v2.
 A design shows under Designs for Main to review, never in the user's Decide or any count of asks, until Main runs promote (see promote --help).
   sign-off-axi post .sign-off/decisions.json --type interactive --title "Does the sign-in flow feel right?" --view mocks/sign-in/demo.html --option yes=Yes --option no="Needs work" --recommend yes
   sign-off-axi post --type evidence --title "Sign-in screen on a phone" --about "The new screen loads in 1 second." --media phone.png --media flow.mp4 --link https://github.com/acme/app/pull/12
@@ -352,7 +361,7 @@ examples:
 `,
     promote: `usage: sign-off-axi promote <key> [board.json] [--undo]
 For Main only, never a lead. A design review a lead posts (post --kind design) shows under Designs, where Main reviews it; it never waits in Decide or counts as the user's ask.
-Once Main has passed every screen, the lead posts one design per product that opens all its screens, phone and desktop, and Main promotes that one card:
+Once Main has passed a design, Main promotes that one card (a design 2 asks the user one plain question, with Yes or Change):
 it then waits in Decide, counts there and notifies like any ask until the user answers it. --undo puts it back under Designs only.
 It writes one line to <board>.promoted.jsonl beside the board; no post, feed or board request writes that file.
 examples:
@@ -493,7 +502,7 @@ function fits(title, key) {
         throw fail(`${key ? `key ${key}: ` : ''}title is ${n} characters, over ${TITLE_MAX}`, 'VALIDATION_ERROR', `Shorten the title to ${TITLE_MAX} characters and put the rest in about`);
 }
 /** The question standard's flags: a decision's why, each option's outcome, the reason for the recommendation, when silence decides, the cards it merges. */
-const ASK_FLAGS = ['why', 'outcome', 'recommend-reason', 'silent-by', 'merge', 'proof', 'report'];
+const ASK_FLAGS = ['why', 'outcome', 'recommend-reason', 'silent-by', 'guard', 'merge', 'proof', 'report'];
 const MANY = ['option', 'outcome', 'merge'];
 /** Board types that are contract kinds: a decision (the default type) is an ask. */
 const CONTRACT_TYPES = ['decision', 'ask', 'evidence', 'report', 'plan', 'design'];
@@ -554,7 +563,7 @@ function contractItems(items, from, file, replace = false) {
     });
 }
 function designFiles(m, base) {
-    const paths = [m.preview, ...m.journeys.flatMap((j) => j.screens.flatMap((s) => Object.values(s.views)))];
+    const paths = [m.preview, ...m.journeys.flatMap((j) => j.screens.flatMap(screenViews))];
     for (const path of paths) {
         let actual;
         try {
@@ -576,6 +585,19 @@ function designFiles(m, base) {
             throw new ContractError(`design path ${JSON.stringify(path)} cannot be read`, 'Make the design view readable');
         }
     }
+    // Two frames of a screen that look the same compare nothing: the person would look for a change that is not there. Under 0.1% of pixels moved is the same look.
+    for (const j of m.journeys)
+        for (const s of j.screens)
+            (s.frames ?? []).forEach((f, i, frames) => {
+                for (const g of frames.slice(0, i))
+                    for (const [v, p] of Object.entries(f.views)) {
+                        if (g.views[v] === undefined)
+                            continue;
+                        const share = differs(readFileSync(resolve(base, g.views[v])), extname(g.views[v]), readFileSync(resolve(base, p)), extname(p));
+                        if (share !== undefined && share < 0.001)
+                            throw new ContractError(`screen ${s.id}: the ${g.role} and ${f.role} frames look the same (${v}: ${+(share * 100).toPrecision(2)}% of pixels differ)`, `Drop the ${g.role === 'today' ? 'today' : f.role} frame, or capture the screen in the state that shows the change`);
+                    }
+            });
 }
 const RAISE_FIELDS = ['title', 'key', 'about', 'detail', 'option', 'recommend', 'default', 'close', ...ASK_FLAGS];
 /** Parses one command's flags strictly; `on` carries a given board file into the next-step hints. */
@@ -724,7 +746,7 @@ function printAnswers(file, rows, waiting, values, help) {
     const gone = rows.flatMap((d) => (d.discarded ? [{ key: d.key, reason: d.discarded.reason, label: DISCARD_REASONS[d.discarded.reason], at: d.discarded.at, title: d.title }] : []));
     if (values.json) {
         const asked = (key) => rounds.filter((r) => r.key === key).map(({ note, at, comments }) => ({ note, at, comments }));
-        const out = Object.fromEntries(done.map(({ key, answer, label, close, at, note, comments, notes, decisions, pick, replaces }) => [key, { answer, label, close, at, note, comments, notes, decisions, pick, replaces, ...(asked(key).length && { rounds: asked(key) }) }]));
+        const out = Object.fromEntries(done.map(({ key, answer, label, close, at, note, comments, notes, decisions, pick, replaces, taken, reason }) => [key, { answer, label, close, at, note, comments, notes, decisions, pick, replaces, taken, reason, ...(asked(key).length && { rounds: asked(key) }) }]));
         for (const r of rounds)
             if (!out[r.key])
                 out[r.key] = { rounds: asked(r.key) };
@@ -732,7 +754,7 @@ function printAnswers(file, rows, waiting, values, help) {
             out[key] = { ...out[key], discarded: { reason, label, at } };
         return JSON.stringify(out);
     }
-    const notes = done.some((a) => a.note), changed = done.some((a) => a.replaces), sent = [...done, ...rounds].flatMap(({ key, comments = [] }) => comments.map(({ mock, ref, tag, words, text }) => ({ key, mock, ref, tag, words, text })));
+    const notes = done.some((a) => a.note), changed = done.some((a) => a.replaces), took = done.some((a) => a.taken), sent = [...done, ...rounds].flatMap(({ key, comments = [] }) => comments.map(({ mock, ref, tag, words, text }) => ({ key, mock, ref, tag, words, text })));
     const plan = done.flatMap(({ key, notes: sections = [], decisions: picks = {} }) => [
         ...sections.map((n) => ({ key, section: n.section ?? `${n.journey}/${n.screen}`, verdict: n.verdict ?? 'change', note: n.note ?? '' })),
         ...Object.entries(picks).map(([decision, pick]) => ({ key, decision, pick })),
@@ -740,7 +762,8 @@ function printAnswers(file, rows, waiting, values, help) {
     return toon({
         board: tilde(file),
         // A changed answer names the one it replaces, which the agent may already have acted on.
-        answers: done.length ? done.map(({ key, answer, at, label, close, title, note = '', replaces }) => ({ key, answer, at, ...(values.full && { label, close, title }), ...(notes && { note }), ...(changed && { replaces: replaces?.answer ?? '' }) })) : '0 saved yet',
+        // An answer the leash took says how: default (the board took the ask's default at its silent_by) or agent (your recommended pick, on Act, then tell me).
+        answers: done.length ? done.map(({ key, answer, at, label, close, title, note = '', replaces, taken = '' }) => ({ key, answer, at, ...(values.full && { label, close, title }), ...(notes && { note }), ...(changed && { replaces: replaces?.answer ?? '' }), ...(took && { taken }) })) : '0 saved yet',
         ...(rounds.length && { rounds: rounds.map(({ key, note, at }) => ({ key, note, at })) }),
         // Comments on mock elements that went with an answer or a round, each with the element it points at.
         ...(sent.length && { comments: sent }),
@@ -748,7 +771,7 @@ function printAnswers(file, rows, waiting, values, help) {
         ...(plan.length && { plan }),
         ...(gone.length && { discarded: gone.map(({ key, label, at }) => ({ key, reason: label, at })) }),
         waiting,
-    }, help);
+    }, [...(took ? ['taken: default is the default the board took at the ask\'s silent_by, agent your own recommended pick (the leash Act, then tell me): go ahead, and keep waiting, as the person can still change it'] : []), ...help]);
 }
 function answers(args) {
     const { file, values, on } = parse('answers', args, { ...TIERS, key: { type: 'string' } });
@@ -771,7 +794,7 @@ function eventLines(file, rows, answers, rounds) {
     const kind = kindOf(file), item = new Map(rows.map((d) => [d.key, d]));
     const head = (event, key) => ({ event, ...kind(key), key, title: item.get(key)?.title });
     const tail = (key, comments) => ({ ...(item.get(key)?.filer && { filer: item.get(key).filer }), ...(comments?.length && { comments }) });
-    return [...answers.map(({ key, answer, label, close, at, note, comments, notes, decisions, pick, replaces }) => ({ at, line: { ...head('answer', key), answer, label, close, at, ...(note && { note }), ...(notes && { notes, decisions }), ...(pick !== undefined && { pick }), ...(replaces && { replaces }), ...tail(key, comments) } })),
+    return [...answers.map(({ key, answer, label, close, at, note, comments, notes, decisions, pick, replaces, taken, reason }) => ({ at, line: { ...head('answer', key), answer, label, close, at, ...(note && { note }), ...(notes && { notes, decisions }), ...(pick !== undefined && { pick }), ...(replaces && { replaces }), ...(taken && { taken, reason }), ...tail(key, comments) } })),
         ...rounds.map(({ key, note, at, comments }) => ({ at, line: { ...head('round', key), note, at, ...tail(key, comments) } }))]
         .sort((a, b) => (a.at < b.at ? -1 : a.at > b.at ? 1 : 0)).map(({ line }) => JSON.stringify(line)).join('\n');
 }
@@ -1770,7 +1793,7 @@ function postMedia(file, named, on, values, type, filer, message) {
                 writeFileSync(join(dir, `${i + 1}${extname(src).toLowerCase()}`), bytes, { mode: 0o600 });
                 // The original stays as it was posted; the board shows a lighter copy of a still where one weighs less.
                 const made = isStill(src) ? copiesOf(bytes, extname(src)) : {}, refs = {};
-                for (const size of ['light', 'thumb']) {
+                for (const size of ['light', 'thumb', 'tile']) {
                     const c = made[size];
                     if (!c)
                         continue;
@@ -1863,8 +1886,9 @@ async function postKind(file, named, on, values, built) {
                     throw new ContractError(`${f} ${typeof m[f] === 'string' ? m[f] : JSON.stringify(m[f])} is not --${f} ${values[f]}`, `Leave "${f}" out of the message, or pass the same --${f}`);
                 m[f] = values[f];
             }
-        const existingAsk = !built && kind === 'ask' && existsSync(file) && readItems(file).items.some((i) => i?.key === m.key);
-        checkMessage(m, built ? 'report' : kind, !built && kind === 'ask' && !existingAsk);
+        // A new ask is held to the question standard, and so is a new design's title; a card already on the board still re-posts as it was.
+        const existing = !built && ['ask', 'design'].includes(kind) && existsSync(file) && readItems(file).items.some((i) => i?.key === m.key);
+        checkMessage(m, built ? 'report' : kind, !built && kind === 'ask' && !existing, !built && kind === 'design' && !existing);
         // Media paths read from the message file's folder, or from the current folder for stdin.
         if (m.kind === 'evidence')
             sources = mediaFiles(m, from === '-' ? process.cwd() : dirname(resolve(from)));
@@ -1998,7 +2022,7 @@ function buildIncoming(values, extra, filer, file) {
     try {
         const { title, key = slug(title), about, detail, why, recommend: recommend_value, default: default_if_silent, close } = values;
         const ask = !Object.hasOwn(extra, 'type'), options = ask ? outcomesOf(values) : optionsOf(values);
-        const told = ask && { why, recommend_reason: values['recommend-reason'], silent_by: values['silent-by'], merges: values.merge, proof: values.proof, report: values.report, ask_ref: values['ask-ref'] };
+        const told = ask && { why, recommend_reason: values['recommend-reason'], silent_by: values['silent-by'], guard: values.guard, merges: values.merge, proof: values.proof, report: values.report, ask_ref: values['ask-ref'] };
         writeFileSync(source, JSON.stringify({ schema: 2, items: [{ key, title, about, detail, ...told, options, recommend_value, default_if_silent, close, ticket: values.ticket, priority: values.priority, ...extra, filer }] }));
         const incoming = loadDecisions(source, board), raw = readItems(source).items;
         if (!ask)
@@ -2109,18 +2133,27 @@ function storeIncoming(file, named, on, { incoming, raw }, filer, exact = false)
             }
             return { key: d.key, status: !had ? 'raised' : had.answer && !awaitsVerdict(had.type, had.answer) ? `already answered ${had.answer.answer}` : waits({ ...had, dismissed: false }) ? 'already waiting' : 'already posted', title: d.title };
         });
+        let picked = [];
         if (raised.some((r) => r.status === 'raised')) {
             const before = waitingKeys(file);
             writeItems(file, items);
+            // On the leash Act, then tell me, a new ask takes its agent's recommended pick at once: the person sees it and can still change it.
+            if (leashOf(named) === 'act')
+                picked = leashTake(file, 'act', raised.flatMap((r) => (r.status === 'raised' ? [r.key] : []))).took.map(({ a }) => a);
+            for (const a of picked)
+                raised.find((r) => r.key === a.key).status = `picked ${a.answer}`;
             notifyEntered(file, named, before);
         }
         const key = raised.length === 1 ? ` --key ${raised[0].key}` : '';
+        const goAhead = picked.map((a) => `The leash is Act, then tell me: go ahead with ${a.label} on ${a.key}; the person can still change it`);
         // Reports take no answer, so a post with nothing waiting asks the user to read it, never to answer.
-        const anyWaiting = incoming.some((d, i) => waits(d) && !raised[i].status.startsWith('already answered'));
+        const anyWaiting = incoming.some((d, i) => waits(d) && !raised[i].status.startsWith('already answered') && !raised[i].status.startsWith('picked'));
+        if (picked.length && !anyWaiting)
+            return toon({ board: tilde(file), raised }, [...goAhead, ...(filer ? [`Run \`sign-off-axi wait${on} --filer ${filer}\` to hear if the person changes it`] : [`Run \`sign-off-axi answers${on}${key}\` to read ${key ? 'the answer' : 'the answers'}`])]);
         if (incoming.length && !anyWaiting)
             return toon({ board: tilde(file), raised }, [`Run \`sign-off-axi open${on}\` so the user can read ${incoming.length > 1 ? 'them' : 'it'}`]);
         const open = anyWaiting ? [`Run \`sign-off-axi open${on}\` so the user can answer`] : [];
-        return toon({ board: tilde(file), raised }, [...open, ...(filer ? [waitFor(on, filer)] : []), `Run \`sign-off-axi answers${on}${key}\` to read ${key ? 'the answer' : 'the answers'}`]);
+        return toon({ board: tilde(file), raised }, [...goAhead, ...open, ...(filer ? [waitFor(on, filer)] : []), `Run \`sign-off-axi answers${on}${key}\` to read ${key ? 'the answer' : 'the answers'}`]);
     });
 }
 async function open(args) {
@@ -2867,9 +2900,12 @@ async function serve(args) {
             return;
         await sweep('periodic');
         reap();
+        await holdLeash();
         if (server.listening)
             setTimeout(repeat, 5_000).unref();
     };
+    // Defaults that fell due while the board was closed are taken now; the next is timed to its silent_by, and every pass looks again.
+    await holdLeash();
     setTimeout(repeat, 5_000).unref();
     const url = `http://${urlHost(bind)}:${bound}/`;
     process.on('exit', () => { if (existsSync(record(file)) && readFileSync(record(file), 'utf8').split(' ')[0] === String(process.pid))
@@ -2939,7 +2975,7 @@ async function exportBoard(args) {
         if (d.preview)
             await inline(at(d.key, '', d.preview));
         for (const [i, m] of (d.media ?? []).entries())
-            for (const v of ['', ...['light', 'thumb'].filter((v) => m[v])])
+            for (const v of ['', ...['light', 'thumb', 'tile'].filter((v) => m[v])])
                 await inline(`/api/media?key=${q(d.key)}&i=${i}${v && `&v=${v}`}`);
         for (const m of d.evidenceCard?.media ?? [])
             await inline(m.url);
@@ -3073,6 +3109,14 @@ const warmGuard = () => new Promise((done) => {
  * silent-by time, the default) or act (take the recommended pick now and report it). With the name: line it is the page's only setting. */
 const LEASHES = ['ask', 'matters', 'act'];
 const configLine = (text, key) => new RegExp(`^[ \\t]*${key}[ \\t]*:([^#\\n]*)`, 'm').exec(text)?.[1].trim() || undefined;
+const leashIn = (text) => ((leash) => (LEASHES.includes(leash) ? leash : 'matters'))(configLine(text, 'leash') ?? '');
+/** The leash of the config.yaml beside a board: matters when it has none, or no config.yaml. */
+const leashOf = (named) => { try {
+    return leashIn(readFileSync(join(dirname(named), 'config.yaml'), 'utf8'));
+}
+catch {
+    return 'matters';
+} };
 /** The user's name and leash; none for a board with no config.yaml beside it. */
 function profile() {
     let text;
@@ -3082,8 +3126,34 @@ function profile() {
     catch {
         return {};
     }
-    const leash = configLine(text, 'leash') ?? '';
-    return { name: configLine(text, 'name')?.slice(0, 40), leash: LEASHES.includes(leash) ? leash : 'matters' };
+    return { name: configLine(text, 'name')?.slice(0, 40), leash: leashIn(text) };
+}
+/** What the leash answers for the person; run under the board lock, so a raise and the board never both take one ask. On Act, then tell me an open plain ask takes its
+ * recommended pick at once (the agent's own pick, made when it is raised); on When it matters, and on Act for an ask with no pick, the board takes its default once its
+ * silent_by has passed. A guarded ask (guardOf), one with neither, an ask a waiting ask merges, and every ask on Ask me first wait for the person.
+ * `raised` limits it to the agent picks of those keys, as a raise takes them. Returns what it took and when the next default falls due. */
+function leashTake(file, leash, raised) {
+    const took = [];
+    let next;
+    if (leash === 'ask' || !existsSync(file) || readItems(file).extra.readonly === true)
+        return { took };
+    const rows = board(file, () => { }), at = Date.now();
+    for (const d of rows) {
+        if ((raised && !raised.includes(d.key)) || d.answer || d.discarded || !plainAsk(d) || guardOf(d) || rows.some((x) => !x.answer && x.merges?.includes(d.key)))
+            continue;
+        const pick = leash === 'act' ? d.options.find((o) => o.value === d.recommend_value) : undefined, fallback = d.options.find((o) => o.value === d.default_if_silent);
+        const due = d.silent_by ? Date.parse(d.silent_by) : NaN, save = (o, how) => { const a = appendAnswer(file, d, o, '', [], how); if (a)
+            took.push({ d, a }); };
+        if (pick)
+            save(pick, { taken: 'agent', reason: `The leash is Act, then tell me: ${d.filer ?? 'the agent'} took its recommended pick` });
+        else if (raised || !fallback || Number.isNaN(due))
+            continue;
+        else if (due <= at)
+            save(fallback, { taken: 'default', reason: `No answer by ${d.silent_by}: the leash When it matters took the default` });
+        else
+            next = Math.min(next ?? due, due);
+    }
+    return { took, next };
 }
 const SESSION_ID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 const state = () => {
@@ -3099,7 +3169,7 @@ const state = () => {
         mockBase: `/mock/${loopback(bind) ? 'local' : mockPass(tokenOf(file))}/`,
         // Who filed an item stays in the file, except as `by`, the name a card's thread says posted it and took its answer: never a bare session id, which names nobody.
         // A sign-in's start command stays on this host too: the page only learns that a tap makes a new link, and how the last run went.
-        decisions: items.filter((d) => !fakeEvidence(d)).map(({ filer, start, ...d }) => ({ ...d, ...(filer && !SESSION_ID.test(filer) && { by: filer }), ...(d.type === 'design' && answers[d.key]?.answer === 'approve' && { status: 'approved' }), ...(d.type === 'design' && designState(d, answers[d.key], lines)), ...(start && { start: true, run: signinState(d.key) }), evidenceCard: d.evidence ? evidenceCard(d.evidence) : null,
+        decisions: items.filter((d) => !fakeEvidence(d)).map(({ filer, start, ...d }) => ({ ...d, ...(filer && !SESSION_ID.test(filer) && { by: filer }), ...(plainAsk(d) && guardOf(d) && { guard: guardOf(d) }), ...(d.type === 'design' && answers[d.key]?.answer === 'approve' && { status: 'approved' }), ...(d.type === 'design' && designState(d, answers[d.key], lines)), ...(start && { start: true, run: signinState(d.key) }), evidenceCard: d.evidence ? evidenceCard(d.evidence) : null,
             ...(d.mocks && { mocks: d.mocks.map((m) => ({ ...m, hash: mockHash(m.path) })) }) })),
         readonly: extra.readonly === true,
         answers_only: extra.answers_only === true,
@@ -3140,7 +3210,7 @@ const mockHash = (path) => {
     }
 };
 /** A design's files as the board serves them: its preview and every screen view. */
-const designPaths = (d) => [...new Set([d.preview, ...(d.journeys ?? []).flatMap((j) => j.screens.flatMap((s) => Object.values(s.views)))])].filter((p) => !!p);
+const designPaths = (d) => [...new Set([d.preview, ...(d.journeys ?? []).flatMap((j) => j.screens.flatMap(screenViews))])].filter((p) => !!p);
 /** A design's round: its time, screens and options and the bytes of its files, so the same key posted again with a new time or a changed screen is a new round. */
 const designRound = (d) => sha256(Buffer.from(JSON.stringify([d.filed, d.journeys, d.options, designPaths(d).map((p) => [p, mockHash(p)])])));
 /** What the page needs to know of a design beyond its fields: whether its answer is from an earlier round, the last answer given on an earlier round
@@ -3252,7 +3322,7 @@ async function route(req) {
     if (req.method === 'GET' && req.url?.startsWith('/design/')) {
         const [, , , key, ...parts] = new URL(req.url, 'http://localhost').pathname.split('/');
         const path = parts.map(decodeURIComponent).join('/'), d = loadDecisions(file).find(x => x.key === key && x.type === 'design');
-        const allowed = d?.preview === path || d?.journeys?.some(j => j.screens.some(s => Object.values(s.views).includes(path)));
+        const allowed = d?.preview === path || d?.journeys?.some(j => j.screens.some(s => screenViews(s).includes(path)));
         const type = assetTypes[extname(path).toLowerCase()];
         try {
             if (!allowed || !type)
@@ -3306,9 +3376,9 @@ async function route(req) {
     }
     if (req.method === 'GET' && req.url?.startsWith('/api/media?')) {
         const q = new URL(req.url, 'http://localhost').searchParams;
-        // v=light or v=thumb asks for the copy post made of a still; with no v, the file as it was posted.
+        // v=light, v=thumb or v=tile asks for the copy post made of a still; with no v, the file as it was posted.
         const v = q.get('v'), posted = loadDecisions(file).find((d) => d.key === q.get('key'))?.media?.[Number(q.get('i') || NaN)];
-        const m = v === null ? posted : v === 'light' || v === 'thumb' ? posted?.[v] : undefined, type = m && mediaTypes[extname(m.path).toLowerCase()];
+        const m = v === null ? posted : v === 'light' || v === 'thumb' || v === 'tile' ? posted?.[v] : undefined, type = m && mediaTypes[extname(m.path).toLowerCase()];
         if (!m || !type)
             return [404, { error: 'Evidence is unavailable' }];
         try {
@@ -3376,9 +3446,10 @@ async function route(req) {
         return [404, { error: 'Not found' }];
     if (readOnly())
         return [403, { error: 'This board is read-only' }];
+    // The leash is the person's own setting in config.yaml, which the board applies to the answers it takes, so an answers-only board takes it too.
     // Dismiss only hides an item on this page and sends nothing to the feeding program, a reply opened (/api/trail) is only the person's own mark, and Go deeper and a comment
     // on a part of a guided page go to the page's own author through its wait, so an answers-only board takes them all; a comment on a mock, a round and a prompt are for the feeding program, below.
-    if (!['/api/answers', '/api/dismiss', '/api/signin', '/api/reads', '/api/trail', '/api/deeper', '/api/engagement', '/api/engagement/seen', '/api/annotations'].includes(req.url) && answersOnly())
+    if (!['/api/answers', '/api/dismiss', '/api/signin', '/api/reads', '/api/trail', '/api/deeper', '/api/engagement', '/api/engagement/seen', '/api/annotations', '/api/leash'].includes(req.url) && answersOnly())
         return [403, { error: 'This board takes answers only' }];
     if (!req.headers['content-type']?.startsWith('application/json'))
         return [415, { error: 'Send JSON' }];
@@ -3471,6 +3542,7 @@ async function route(req) {
         }
         const line = /^[ \t]*leash[ \t]*:.*$/m;
         writeFileSync(config, line.test(text) ? text.replace(line, `leash: ${leash}`) : `${text.replace(/\n?$/, '\n')}leash: ${leash}\n`);
+        await holdLeash();
         return [200, state()];
     }
     if (req.url === '/api/dismiss') {
@@ -3494,9 +3566,9 @@ async function route(req) {
         return [200, state()];
     }
     if (req.url === '/api/trail') {
-        // The person opened a card with a reply on it: the reply leaves Today.
+        // The person opened a card with a reply on it, or an answer the leash took: the reply leaves Today, the answer leaves Taken without you.
         const { key } = JSON.parse(body) ?? {};
-        if (!readTrail(file, loadDecisions(file)).some((t) => t.key === key && t.reply))
+        if (!readTrail(file, loadDecisions(file)).some((t) => t.key === key && (t.reply || t.taken)))
             return [404, { error: 'No reply on this card' }];
         appendMark(file, { op: 'seen', key });
         return [200, state()];
@@ -3601,6 +3673,27 @@ function answered(a, d) {
     child.stdin.on('error', () => { });
     child.stdin.end(`${JSON.stringify({ event: 'answer', ...kindOf(file)(a.key), ...a, ...(d && { title: d.title }), ...(d?.filer && { filer: d.filer }) })}\n`);
 }
+/** Takes what the leash allows now (leashTake) and times the next default to its silent_by: run when the board starts, every few seconds, and when the leash changes. */
+let leashTimer;
+async function holdLeash() {
+    clearTimeout(leashTimer);
+    if (!server.listening)
+        return;
+    let next;
+    try {
+        ({ next } = await locked(`${file}.lock`, () => {
+            const r = leashTake(file, profile().leash ?? 'matters');
+            for (const { d, a } of r.took)
+                answered(a, d);
+            return r;
+        }, 'another raise is still writing the board'));
+    }
+    catch (e) {
+        warn(`The leash took no answers: ${e.message}`);
+    }
+    if (next !== undefined)
+        leashTimer = setTimeout(holdLeash, Math.min(Math.max(0, next - Date.now()), 2 ** 31 - 1)).unref();
+}
 const runs = new Map(), failures = new Map();
 const SIGNIN_WAIT = 20_000, SIGNIN_LIFE = 600_000;
 const signinState = (key) => (runs.get(key)?.url ? 'live' : runs.has(key) ? 'starting' : failures.has(key) ? `failed: ${failures.get(key)}` : 'none');