slidemind 0.3.20 → 0.4.1

package/src/cli/deck.mjs

@@ -1,17 +1,92 @@
+import { draftLineTier, imageCountLines, lineShapeLines, listLines, missingAssetLines, repeatLines } from "../builders/draft-lines.mjs";
 import fs from "node:fs";
 import path from "node:path";
+import crypto from "node:crypto";
 import { pathToFileURL } from "node:url";
-import { fail, requirePlanApproved, requireReviewApproved, resolveDeckArg, runNode, splitDeckArg, renderProgressPrinter, dataUriToPng, freshenDeckBundle, withUnboundHint, SRC_DIR, BUILDERS_DIR } from "./common.mjs";
+import { requireAuthorizedEdits, seedRenderedSlides } from "./revision.mjs";
+import { scopedSlideFiles } from "../lib/edit-transitions.mjs";
+import { fail, loadBridgeModule, requirePlanApproved, requireReviewApproved, requireSlidesDraftChecked, requireSlidesPreserved, resolveDeckArg, runNode, splitDeckArg, renderProgressPrinter, dataUriToPng, freshenDeckBundle, withUnboundHint, SRC_DIR, BUILDERS_DIR } from "./common.mjs";
+import { readDesignName } from "./designs.mjs";
+import { deckSlug, previewPath, readPlanOwner, statePath } from "../lib/deck-paths.mjs";
+import { currentSpec } from "../lib/concept-spec-binding.mjs";
 
 export async function cmdPlan(rest) {
   const { deck, passthrough } = splitDeckArg(rest, "plan");
+  const deckDir = resolveDeckArg(deck);
+  // A plan written one directory up (the deck folder instead of its
+  // workspace) left the gate approving an empty record and `concepts`
+  // generating nothing, four rounds in a row (x51 cloud). Say where it goes.
+  const record = path.join(deckDir, "plan.md");
+  const slides = (f) => { try { return /```storyboard-canvas/.test(fs.readFileSync(f, "utf8")); } catch { return false; } };
+  const stray = path.join(path.dirname(deckDir), "plan.md");
+  if (!slides(record) && stray !== record && slides(stray)) {
+    fail(`plan: the deck's plan record is ${record}, which has no storyboard-canvas slides; ${stray} has them. Move it (mv "${stray}" "${record}") and re-run \`slidemind plan ${deckSlug(deckDir)}\`.`);
+  }
+  // The agent writes the plan; the person reviews it. A record with no slides is
+  // never asked about: a gate that approves itself then made `concepts` generate
+  // nothing (7 of 9 x44–x52 batches), and with a person it handed them the
+  // scaffold's placeholder to review (a Codex agent chained `new && plan`,
+  // 2026-10-11). An extension-owned plan (a proposal pack) keeps its record
+  // elsewhere and its plan.md is deck metadata only: there are no storyboards.
+  const owner = readPlanOwner(deckDir)?.owner;
+  if (!slides(record) && (!owner || owner === "core")) {
+    fail(`plan: ${record} has no slides yet — write \`## Red thread\` and \`## Per-slide storyboards\` with one \`\`\`storyboard-canvas JSON block per slide (the design bundle's workflow/plan.md has the exact shape), then re-run \`slidemind plan ${deckSlug(deckDir)}\`.`);
+  }
+  if (!owner || owner === "core") {
+    if ((await ensurePlanDesign(deckDir)) === "blocked") return;
+  }
   await runNode(path.join(BUILDERS_DIR, "plan.mjs"), [
     "--deck",
-    resolveDeckArg(deck),
+    deckDir,
     ...passthrough,
   ]);
 }
 
+/**
+ * The plan page opens on the deck's design, so the deck must have one before it
+ * is asked about. A deck nobody bound (the agent wrote the plan without `new
+ * --brand`) is bound here the way `new` binds: the one design open in
+ * PowerPoint, else the one design cached on this machine. With several at hand
+ * the user named one — the agent binds it (`ready <deck> --brand`) and asks
+ * again: BLOCKED, exit 2. Nothing at hand (offline, nothing downloaded) leaves
+ * the choice to the page's own menu.
+ */
+async function ensurePlanDesign(deckDir) {
+  const bundle = await loadBridgeModule("bundle");
+  if (bundle.readDeckBundleRef(deckDir)?.presFP) return "bound";
+  const cfg = await loadBridgeModule("config");
+  if (cfg.readSessions().length === 0) return "none";
+  const cached = bundle.listCachedBundles();
+  let presFP = null;
+  try {
+    const client = await loadBridgeModule("client");
+    const { presentations } = await client.listOpenPresentationsDetailed();
+    const resolution = client.resolveDesignSource(presentations, {});
+    if (resolution.status === "resolved") presFP = resolution.entry.brandId;
+  } catch {
+    // no window to ask: the cache decides
+  }
+  if (!presFP && cached.length === 1) presFP = cached[0].presFP;
+  const meta = presFP ? bundle.readMaterializedBundleMeta(presFP) : null;
+  if (meta?.presFP) {
+    bundle.writeDeckBundleRef(deckDir, { presFP: meta.presFP, etag: meta.etag ?? null });
+    process.stderr.write(`slidemind: bound ${deckSlug(deckDir)} to design ${readDesignName(bundle.bundleDirForPresFP(meta.presFP)) ?? meta.presFP}\n`);
+    return "bound";
+  }
+  if (cached.length < 2) return "none";
+  const slug = deckSlug(deckDir);
+  const list = cached.map((b) => `${readDesignName(b.dir) ?? b.presFP} (${b.presFP})`).join(", ");
+  process.stdout.write(
+    "BLOCKED: deck_unbound\n" +
+      `${slug} has no corporate design yet and several are at hand, so the plan page could not open on one. ` +
+      "Bind it to the design the user asked for, then run this again:\n" +
+      `  slidemind ready ${slug} --brand <presFP>\n` +
+      `Designs on this machine: ${list}. The user named none? Ask which one — \`slidemind ls designs\` lists every design the backend serves.\n`,
+  );
+  process.exitCode = 2;
+  return "blocked";
+}
+
 export async function cmdReview(rest) {
   const { deck, passthrough } = splitDeckArg(rest, "review");
   const deckDir = resolveDeckArg(deck);
@@ -86,7 +161,7 @@ export async function cmdImagen(rest) {
   const ref = bundleMod.readDeckBundleRef(deckDir);
   if (!ref?.presFP) {
     fail(
-      `deck ${path.basename(deckDir)} is not bound to a design yet — run ` +
+      `deck ${deckSlug(deckDir)} is not bound to a design yet — run ` +
         `'slidemind ready ${deck}' first (imagen routes by the deck's bound design).`,
     );
   }
@@ -231,11 +306,17 @@ export async function cmdBuildPptx(rest) {
   let outPath = null;
   let packDir = null;
   let force = false;
+  let refreshDesign = false;
   let asJson = false;
+  let publish = true;
   for (let i = 0; i < passthrough.length; i++) {
     const a = passthrough[i];
     if (a === "--force") {
       force = true;
+    } else if (a === "--no-publish") {
+      publish = false;
+    } else if (a === "--refresh-design") {
+      refreshDesign = true;
     } else if (a === "--json") {
       asJson = true;
     } else if (a === "--to") {
@@ -272,9 +353,16 @@ export async function cmdBuildPptx(rest) {
     fail(`explicit --pack ${path.resolve(packDir)} is mode ${deckMode.mode}, not fill-template`);
   }
   // Template packs have no HTML preview to review and carry their own plan
-  // sign-off; compose decks ship only from an approved, unchanged preview.
+  // sign-off; compose decks ship only once their preview has been approved
+  // (one-time per deck — a change after the approval is not re-reviewed).
   if (deckMode.mode !== "fill-template") {
     await requireReviewApproved(deckDir);
+    requireAuthorizedEdits(deckDir);
+    await requireSlidesPreserved(deckDir);
+    const { deliveredSlideFiles } = await import(
+      pathToFileURL(path.join(SRC_DIR, "bridge", "build-and-push.mjs")).href
+    );
+    await requireSlidesDraftChecked(deckDir, { files: deliveredSlideFiles(deckDir, { refreshDesign }) });
     await freshenDeckBundle(deckDir);
   }
   if (deckMode.mode === "fill-template") {
@@ -342,35 +430,78 @@ export async function cmdBuildPptx(rest) {
       presentationId: to,
       outPath,
       force,
+      refreshDesign,
       onProgress: renderProgressPrinter(),
     })
     .catch((err) => fail(withUnboundHint(deckDir, err)));
-  if (asJson) {
-    process.stdout.write(
-      `${JSON.stringify({ outPath: result.outPath, slideCount: result.slideCount ?? null, presId: result.presId ?? null, windowless: Boolean(result.windowless), warnings: result.warnings ?? [], skippedSlides: result.skippedSlides ?? [], preview: result.preview ?? null }, null, 2)}\n`,
-    );
-  } else {
+  // The package's measured lines, classed by the shared table as the add-in's
+  // build classes them.
+  const { splitPackageLines, packageDefectsText } = await import(
+    pathToFileURL(path.join(BUILDERS_DIR, "draft-check.mjs")).href
+  );
+  const { defects: packageDefects, notes: packageNotes } = splitPackageLines(result.warnings);
+  if (packageDefects.length > 0) process.exitCode = 1;
+  if (!asJson) {
     process.stdout.write(
       `Wrote ${result.outPath} (${result.slideCount ?? "?"} slides) via the slidemind add-in` +
         `${result.windowless ? " (no PowerPoint window needed)" : ""}\n`,
     );
-    // LOOK at what shipped — the .pptx is opaque from here.
-    if (result.preview?.dir) {
+    const preview = result.packagePreview?.status === "rendered" ? result.packagePreview : result.preview;
+    if (preview?.dir) {
       process.stdout.write(
-        `  ${result.preview.files.length} slide png(s) in ${path.relative(process.cwd(), result.preview.dir)}/ — read them before handing the deck over\n`,
+        `  ${preview.files.length} ${preview.kind === "pptx" ? "exported PPTX" : "browser source"} slide png(s) in ${path.relative(process.cwd(), preview.dir)}/ — judge a <Chart> here (view-draft paints a stand-in); the concept comparison was the draft check's\n`,
       );
-    } else if (result.preview?.note) {
-      process.stdout.write(`  ${result.preview.note}\n`);
     }
+    if (result.packagePreview?.note) process.stderr.write(`  ${result.packagePreview.note}\n`);
+    if (packageDefects.length > 0) process.stdout.write(packageDefectsText(packageDefects, deckSlug(deckDir)));
   }
-  for (const w of result.warnings ?? []) {
+  for (const w of packageNotes) {
     process.stderr.write(`  warning: ${w}\n`);
   }
   for (const s of result.skippedSlides ?? []) {
     process.stderr.write(`  skipped ${s.stem}: ${s.reason}\n`);
   }
+  // A deck connected to SharePoint — the file it was opened from, or a folder
+  // the user connected in the workspace — is delivered THERE, so the build
+  // publishes the candidate it just wrote. The connection is read from the
+  // deck's own state at every build: a folder connected mid-session is honoured
+  // by the next build without the agent having to know. `--no-publish` keeps a
+  // build local; `slidemind publish` retries one whose publish did not save.
+  // A build that ends on package defects is not ready for the user, so it does
+  // not go to SharePoint either: fixed and rebuilt, that build publishes.
+  const published = publish && result.candidate
+    ? await (await import("./remote.mjs")).publishAfterBuild(deckDir, {
+        candidateId: result.candidate.candidateId,
+        withheld: packageDefects.length > 0
+          ? { reason: "package_defects", message: `held back: ${packageDefects.length} package defect(s) — fix them and build again` }
+          : null,
+      })
+    : null;
+  if (published) process.stderr.write(published.text);
+  if (asJson) {
+    process.stdout.write(
+      `${JSON.stringify({ outPath: result.outPath, slideCount: result.slideCount ?? null, presId: result.presId ?? null, windowless: Boolean(result.windowless), packageDefects, warnings: result.warnings ?? [], skippedSlides: result.skippedSlides ?? [], targeted: result.targeted ?? null, preview: result.preview ?? null, packagePreview: result.packagePreview ?? null, publish: published?.json ?? null }, null, 2)}\n`,
+    );
+  }
+  if (published?.exitCode) process.exit(published.exitCode);
 }
 
+// `transcribe` names every asset it fetches `NN-<element id>` for the slide it
+// fetched it FOR, and recolours it for THAT slide's background. So a slide that
+// points at another slide's numbered asset is not reusing imagery, it is
+// clearing an `[asset:error]` with the nearest file on disk — x44: nine such
+// refs, four white glyphs landed on white cards and one blue glyph on a blue
+// disc, all invisible, on the two worst-scoring slides of the deck. Existence
+// is not evidence that the file is the right glyph, or legible where it now
+// sits. Returns the owning slide number, or null when the reference is fine:
+// an unnumbered asset (a deck image used on several slides) is never borrowed,
+// and neither is a slide file that carries no number of its own.
+export { borrowedAssetOwner } from "../builders/draft-lines.mjs";
+
+// What a concept is to the draft check, in both outputs (text and --json).
+// Same words as the add-in's see_draft caption (build-and-push.ts).
+const CONCEPT_GUIDANCE = "the blueprint, not the target: every element it shows inside the content slot is on the render as that kind of thing (the same hero, grouping, order, hierarchy and focal element), every connector present with its line shape (straight, elbow, curve or arc) and one shape per cycle or fan. Build it cleaner than the painting: siblings the same size, even gaps, straight edges straight, round forms round, token colours; a cleaner, aligned build of the same elements needs no change. Delete what the painting drew by accident or in the template's chrome (a footer mark, a guide box, a stray stroke, a second wordmark) (workflow/create.md, Execute, don't trace).";
+
 export async function cmdViewDraft(rest) {
   const { deck, passthrough } = splitDeckArg(rest, "view-draft");
   let to = null;
@@ -382,7 +513,11 @@ export async function cmdViewDraft(rest) {
   // with a note when the backend is unreachable; --translate insists, and
   // --no-translate keeps the check purely local.
   let translate = "auto";
-  let fix = false;
+  // Autofix is the default: the deterministic token conversions (raw px →
+  // --sp-*/--fs-*, em → px) were the largest lint class agents fought by hand
+  // (137 raw-spacing warnings on one 8-slide deck, x20 2026-09-18) and carry
+  // no design decision. --no-fix keeps a file byte-exact for inspection.
+  let fix = true;
   let lintOnly = false;
   let asJson = false;
   // Converted slides only: promote the dialect lint's warnings (an empty
@@ -392,6 +527,8 @@ export async function cmdViewDraft(rest) {
     const a = passthrough[i];
     if (a === "--fix") {
       fix = true;
+    } else if (a === "--no-fix") {
+      fix = false;
     } else if (a === "--strict") {
       strict = true;
     } else if (a === "--lint-only") {
@@ -431,15 +568,22 @@ export async function cmdViewDraft(rest) {
     only = onlySpec.split(",").map((t) => t.trim()).filter(Boolean).map((t) => {
       if (files.includes(t)) return t;
       if (/^\d{1,3}$/.test(t)) {
-        const hit = files.find((f) => Number(/^(\d{1,3})[-_.]/.exec(f)?.[1]) === Number(t));
+        // Numeric prefix first (`03-loop.jsx`); then any file whose first
+        // number is that slide (`slide-03.jsx`, `s03-loop.jsx`) — three sim
+        // sessions named files that way and burned 6–13 failed `--only`
+        // calls each on "no slide file matches".
+        const hit =
+          files.find((f) => Number(/^(\d{1,3})[-_.]/.exec(f)?.[1]) === Number(t)) ??
+          files.find((f) => Number(/(\d{1,3})/.exec(f)?.[1]) === Number(t));
         if (hit) return hit;
       }
       fail(`--only: no slide file matches '${t}' under ${path.join(deckDir, "slides")}`);
     });
   }
+  requireAuthorizedEdits(deckDir);
   await requirePlanApproved(deckDir);
   await freshenDeckBundle(deckDir);
-  // The HTML build runs FIRST — it is what lints every slide against the
+  // The HTML build runs FIRST — it lints the selected slides against the
   // bundle's capability table and copies the bundle's corporate-design.css +
   // assets into the deck, which the type-ramp check below reads. (This is the
   // work the retired `slidemind build` command used to do in a separate call;
@@ -447,22 +591,35 @@ export async function cmdViewDraft(rest) {
   const { buildDeck } = await import(
     pathToFileURL(path.join(BUILDERS_DIR, "build.mjs")).href
   );
-  if (fix) {
+  // An open edit scope bounds slidemind's own rewrites too: the autofix of a
+  // slide outside it would be the out-of-scope change the gate refuses.
+  const fixOnly = only ?? scopedSlideFiles(deckDir);
+  if (fix && fixOnly?.length !== 0) {
     const { fixDeckSlides } = await import(
       pathToFileURL(path.join(BUILDERS_DIR, "lint-fix.mjs")).href
     );
-    const fixed = fixDeckSlides(deckDir);
+    const fixed = fixDeckSlides(deckDir, { only: fixOnly });
     if (fixed.fixes > 0) {
-      process.stdout.write(
+      // stderr, like the `[fix:withheld]` lines below it: `--json` must parse
+      // as ONE document, and this sentence used to sit in front of the payload.
+      process.stderr.write(
         `Autofixed ${fixed.fixes} lint issue(s) in ${fixed.files} slide file(s) — re-read any file before patching it.\n`,
       );
     }
+    // Source someone else owns is reported, never rewritten — otherwise the
+    // next preview quietly undoes an edit. Stderr, so --json stays one payload.
+    for (const w of fixed.withheld ?? []) {
+      process.stderr.write(
+        `[fix:withheld] ${w.file} — autofix (${w.fixes.join(", ")}) NOT applied: ${w.reason}. ` +
+          `Its lint findings below still stand; apply them by hand if you want them.\n`,
+      );
+    }
   }
   // Advisory here: the converted rules print as warnings while slides are
   // still being edited, and block at `review` / `build-pptx`. --strict gates now.
-  await buildDeck(deckDir, { strict, enforceConverted: strict });
+  await buildDeck(deckDir, { strict, enforceConverted: strict, only });
   if (lintOnly) {
-    if (asJson) process.stdout.write(`${JSON.stringify({ deck: path.basename(deckDir), lint: "clean" })}\n`);
+    if (asJson) process.stdout.write(`${JSON.stringify({ deck: deckSlug(deckDir), lint: "clean" })}\n`);
     else process.stdout.write("Lint clean (no render — drop --lint-only for the draft previews).\n");
     return;
   }
@@ -471,6 +628,9 @@ export async function cmdViewDraft(rest) {
   const mod = await import(
     pathToFileURL(path.join(SRC_DIR, "bridge", "build-and-push.mjs")).href
   );
+  // A concurrent edit during capture cannot inherit a passing preview hash.
+  const capturedSources = new Map((only ?? fs.readdirSync(path.join(deckDir, "slides")).filter(f => f.endsWith(".jsx")))
+    .map(file => [file, fs.readFileSync(path.join(deckDir, "slides", file), "utf8")]));
   // The capture engine lints every slide again and prints the same lines the
   // build just did; mute that second copy (its warnings still ride the result).
   const stderrWrite = process.stderr.write.bind(process.stderr);
@@ -482,8 +642,8 @@ export async function cmdViewDraft(rest) {
       presentationId: to,
       onProgress: renderProgressPrinter(),
       only,
-      // The server's export gate (slot-fit, diagram geometry, connector
-      // endpoints) on the captured slides, verdict only, no .pptx, no review
+      // The server's export gate (slot-fit, diagram geometry, text escape,
+      // chrome) on the captured slides, verdict only, no .pptx, no review
       // gate — so a slide is proven buildable before hand-over.
       translate,
     });
@@ -499,7 +659,7 @@ export async function cmdViewDraft(rest) {
 
   const previewDir = outDir
     ? path.resolve(process.cwd(), outDir)
-    : path.join(deckDir, ".draft-preview");
+    : previewPath(deckDir, "draft");
   fs.mkdirSync(previewDir, { recursive: true });
 
   // The measured half of the draft check — the same mechanics the add-in's
@@ -518,11 +678,6 @@ export async function cmdViewDraft(rest) {
     const file = path.join(conceptsDir, `concept-slide-${String(Number(m[1])).padStart(2, "0")}.png`);
     return fs.existsSync(file) ? file : null;
   };
-  const inventory = check.inventoryWarnings(
-    deckDir,
-    (result.slides ?? []).map((s) => s.fileName).filter((f) => f.endsWith(".jsx")),
-  );
-  const deckLevel = inventory.filter((l) => l.includes("] assets/"));
   // The measured rules come from the add-in's capture engine in the bundle —
   // the same fill / type-scale / overlap checks see_draft runs in-app.
   const { loadDraftChecks } = await import(
@@ -537,24 +692,168 @@ export async function cmdViewDraft(rest) {
       "the design bundle's capture engine exports no draft checks — the connected add-in predates them. Update the add-in deployment, then run `slidemind download-bundle <deck>` and retry.",
     );
   }
-  // Type ramp from the deck's own copy of the bundle css (build copies it in).
+  // Type ramp from the bundle's css — the deck carries no copy of the design.
   let typeTokens = null;
   try {
+    const { resolveSkillForDeck } = await import(
+      pathToFileURL(path.join(BUILDERS_DIR, "resolve-skill.mjs")).href
+    );
     typeTokens = rules.typeScaleTokens(
-      fs.readFileSync(path.join(deckDir, "corporate-design.css"), "utf8"),
+      fs.readFileSync(resolveSkillForDeck(deckDir).cssFile, "utf8"),
     );
   } catch {
     typeTokens = null;
   }
+  // The tiers are the shared table's (draft-lines.mjs → draftLineTier). The
+  // measured rules below run on authored slides only, as in the add-in: a
+  // converted slide keeps its source deck's geometry. Fill and type (and the
+  // split advice) print on the deck-wide pass only — a stretched region is
+  // information about density, not a defect; body sizes are the agent's call.
   const measuredLines = (stem, render) =>
     [
-      ...rules.fill([{ stem, render }]),
-      ...rules.typeScale([{ stem, render }], typeTokens),
       ...rules.overlap([{ stem, render }]),
       // Text leaving its painted card — engines from 2026-09-06 on; older
       // ones simply have no rule here.
       ...(typeof rules.escape === "function" ? rules.escape([{ stem, render }]) : []),
+      ...(typeof rules.chrome === "function" ? rules.chrome([{ stem, render }]) : []),
+      // A word PowerPoint would break inside its frame — engines from
+      // 2026-09-27 on.
+      ...(typeof rules.wordFit === "function" ? rules.wordFit([{ stem, render }]) : []),
+      // One text set as separate boxes (a declared block split, a sentence
+      // run on across two boxes) — engines from 2026-10-08 on.
+      ...(typeof rules.splitText === "function" ? rules.splitText([{ stem, render }]) : []),
     ].map((l) => l.trim());
+  const advisoryLines = (stem, render) =>
+    [
+      ...rules.fill([{ stem, render }]),
+      ...rules.typeScale([{ stem, render }], typeTokens),
+      // Pieces set close on one row that only the agent can tell apart from
+      // two columns — engines from 2026-10-08 on (`splitText` carries the
+      // blocking ones: one declared block in several boxes, a sentence run on).
+      ...(typeof rules.splitTextAdvice === "function" ? rules.splitTextAdvice([{ stem, render }]) : []),
+    ].map((l) => l.trim());
+
+  // The image line — the slide's own count contract, written by the agent
+  // right after it looked at the concept: `// image: nodes=5 arrows=5 charts=0
+  // icons=5`. Arrows are compared against authored data-connector directives,
+  // charts against <Chart> elements, icons against <img> tags. FEWER in the
+  // JSX than the line says is a recorded defect; the omission this catches
+  // (sol@low shipped a loop with zero arrows and a scorecard with zero charts
+  // on x22, 2026-09-19) is invisible to every other check. No line, no check.
+  // The first count the agent wrote is the one that binds: x25 showed sol
+  // resolving `icons=8, JSX has 0` by editing the line down to icons=0. A
+  // lowered count is itself a defect; raising one (a miscount upward) is fine.
+  const imageLinesFile = statePath(deckDir, "image-lines.json");
+  let imageLines = {};
+  try {
+    imageLines = JSON.parse(fs.readFileSync(imageLinesFile, "utf8"));
+  } catch {}
+  // Counts come from the RENDER, not the source: a `.map()` over one <img>
+  // renders eleven icons but greps as one, and that false shortfall is what
+  // taught sol to lower its counts (x24). The capture boxes carry `imgSrc`,
+  // a non-native `connector` payload and a `chart` payload per element.
+  // When the add-in extracted a concept spec (concepts/concept-slide-NN.spec.json),
+  // ITS counts are the expectation and the agent's own line is ignored: the
+  // spec is machine-read from the mockup and cannot be edited down.
+  const specMod = await import(pathToFileURL(path.join(BUILDERS_DIR, "concept-spec.mjs")).href);
+  // What each slide still OWES, by element identity. This is what the old
+  // `ownership()` gate has been replaced by: the spec's counts used to switch
+  // themselves OFF as soon as a slide's bytes stopped matching
+  // state/transcribed.json, which is precisely when an edit is most likely to
+  // have dropped something (E09). A preservation record never lapses on a
+  // rewrite, so a hand-edited slide is now checked, not excused.
+  // Seed first, as the add-in's render does: a slide without a record gets one
+  // from its current evidence before its verdict is computed.
+  if (!outDir) seedRenderedSlides(deckDir, (result.slides ?? []).map((s) => s.fileName));
+  const preserve = await check.preservationDiagnostics(
+    deckDir,
+    (result.slides ?? []).map((s) => ({ fileName: s.fileName, render: s.render })),
+    { persist: !outDir },
+  );
+  // Counting elements is the weaker check of the two: where a record stands,
+  // every element is checked by its own id instead, and an intentional removal
+  // has a legal exit (a scoped amendment) that a count never had.
+  // What the reader flagged on the concept, and the template's own marks the
+  // mapper left out: the agent judges the pair with these in hand (the add-in's
+  // see_draft prints the same `[concept:flaw]` lines).
+  const conceptNotesFor = (fileName) => {
+    const m = /^(\d{1,3})[-_.]/.exec(fileName);
+    const notes = m ? currentSpec(deckDir, Number(m[1]))?.notes ?? [] : [];
+    return notes
+      .filter((n) => /^concept flaw —|^left out as the template's own marks/.test(n))
+      .map((n) => `[concept:flaw] ${n}`);
+  };
+  const specCountsFor = (fileName) => {
+    const m = /^(\d{1,3})[-_.]/.exec(fileName);
+    if (!m || preserve.covered.has(fileName)) return null;
+    return specMod.expectedCountsFromSpec(currentSpec(deckDir, Number(m[1])));
+  };
+  const imageLineDefects = (fileName, render) => {
+    let src = "";
+    try {
+      src = fs.readFileSync(path.join(deckDir, "slides", fileName), "utf8");
+    } catch {
+      return [];
+    }
+    const fromSpec = specCountsFor(fileName);
+    const m = /^\s*\/\/\s*image:\s*([^\n]*)$/m.exec(src);
+    if (!fromSpec && !m) return [];
+    const want = {};
+    const lowered = [];
+    if (fromSpec) {
+      Object.assign(want, fromSpec);
+    } else {
+      for (const [, k, v] of m[1].matchAll(/\b(arrows|charts|icons)\s*=\s*(\d+)/g)) want[k] = Number(v);
+      const first = imageLines[fileName] ?? {};
+      for (const k of ["arrows", "charts", "icons"]) {
+        if (first[k] != null && want[k] != null && want[k] < first[k]) {
+          lowered.push(`${k} ${first[k]}→${want[k]}`);
+          want[k] = first[k];
+        }
+      }
+      if (!imageLines[fileName]) {
+        imageLines[fileName] = { ...want };
+        fs.mkdirSync(path.dirname(imageLinesFile), { recursive: true });
+        fs.writeFileSync(imageLinesFile, JSON.stringify(imageLines, null, 2) + "\n");
+      }
+    }
+    return imageCountLines({ fileName, src, render, want, fromSpec, lowered });
+  };
+  // Every rendered line keeps the concept's shape, hand-edited slides included.
+  const lineShapeDefects = (fileName, render) => {
+    const m = /^(\d{1,3})[-_.]/.exec(fileName);
+    if (!m) return [];
+    let spec = null;
+    try { spec = currentSpec(deckDir, Number(m[1])); } catch { return []; }
+    // Declared repeated sets keep one size, one inner layout and their arrangement.
+    return [...lineShapeLines({ fileName, spec, src: capturedSources.get(fileName) ?? "", render }), ...repeatLines({ fileName, spec, render }), ...listLines({ fileName, spec, src: capturedSources.get(fileName) ?? "" })];
+  };
+
+  // A slide that references an asset file that is not on disk renders a
+  // broken image here and a 422 at build-pptx (x28: one icon the fetcher never
+  // delivered failed the whole deck AFTER review). Deterministic, so it is a
+  // blocking defect the review gate holds on.
+  let bundleAssetDir;
+  const bundleHasAsset = (file) => {
+    if (bundleAssetDir === undefined) {
+      try {
+        bundleAssetDir = path.join(resolveBundleDirForDeck(deckDir), "assets");
+      } catch {
+        bundleAssetDir = null;
+      }
+    }
+    return bundleAssetDir ? fs.existsSync(path.join(bundleAssetDir, file)) : false;
+  };
+
+  const missingAssetDefects = (fileName) => {
+    let src = "";
+    try {
+      src = fs.readFileSync(path.join(deckDir, "slides", fileName), "utf8");
+    } catch {
+      return [];
+    }
+    return missingAssetLines({ fileName, src, hasAsset: (file) => fs.existsSync(path.join(deckDir, "assets", file)), hasBundleAsset: bundleHasAsset });
+  };
 
   const written = [];
   const record = [];
@@ -565,59 +864,94 @@ export async function cmdViewDraft(rest) {
       const stem = slide.fileName.replace(/\.[^.]+$/, "");
       const file = path.join(previewDir, `${stem}.png`);
       fs.writeFileSync(file, png);
+      if (!outDir) {
+        const first = path.join(statePath(deckDir, "first-draft"), stem);
+        if (!fs.existsSync(path.join(first, "preview.png"))) {
+          fs.mkdirSync(first, { recursive: true });
+          fs.writeFileSync(path.join(first, "slide.jsx"), capturedSources.get(slide.fileName) ?? "");
+          fs.writeFileSync(path.join(first, "preview.png"), png);
+        }
+      }
       written.push(file);
       const flag = slide.status === "degraded" ? " (DEGRADED)" : "";
       out(`  ${slide.fileName}${flag} → ${file}\n`);
       if (slide.note) process.stderr.write(`    note: ${slide.note}\n`);
       const concept = conceptFor(slide.fileName);
-      const defects =
+      // A Set: the chrome rule runs locally AND in the export gate over the
+      // same capture, so its verdict arrives twice — it is one defect.
+      const allLines =
         slide.status === "ok"
-          ? [
-              ...measuredLines(stem, slide.render),
-              ...inventory.filter((l) => l.includes(` slides/${slide.fileName} `)),
+          ? [...new Set([
+              ...(slide.converted ? [] : measuredLines(stem, slide.render)),
+              ...imageLineDefects(slide.fileName, slide.render),
+              ...lineShapeDefects(slide.fileName, slide.render),
+              ...missingAssetDefects(slide.fileName),
               ...(slide.translateErrors ?? []),
-            ]
+              // Approved image obligations: a source that is gone or changed,
+              // and an original the render places nowhere (or twice). Blocking
+              // — `build-pptx` refuses the same deck, so the draft is where it
+              // gets repaired, not after review.
+              ...(slide.imageIntentIssues ?? []),
+              // Preservation: named element obligations, reported here and
+              // enforced at delivery (build-pptx / push).
+              ...(preserve.byFile[slide.fileName] ?? []),
+            ])]
           : [];
-      if (concept) {
-        out(
-          `    concept: ${concept} — compare against the render above: every organism present at the same relative position and share, every connector present, no region emptier than in the concept.\n`,
-        );
-      }
+      // Everything the shared table does not class as advisory is recorded and
+      // holds review and delivery: its defects, every gate refusal, and a
+      // refusal's plain-text continuation lines.
+      const defects = allLines.filter((l) => draftLineTier(l) !== "advisory");
+      const capturedSource = capturedSources.get(slide.fileName);
+      const capturedHash = crypto.createHash("sha256").update(capturedSource ?? "").digest("hex");
+      const currentSourceFile = path.join(deckDir, "slides", slide.fileName);
+      if (!fs.existsSync(currentSourceFile) || check.hashFile(currentSourceFile) !== capturedHash)
+        defects.push(`[draft:stale] ${slide.fileName} changed during capture. Render and inspect it again.`);
+      const notes = allLines.filter((l) => draftLineTier(l) === "advisory");
+      const flaws = concept ? conceptNotesFor(slide.fileName) : [];
+      if (concept) out(`    concept: ${concept} — ${CONCEPT_GUIDANCE}\n`);
+      for (const line of flaws) out(`    ${line}\n`);
       for (const line of defects) out(`    ${line}\n`);
+      for (const line of notes) out(`    ${line}\n`);
+      // Advisory lines only on the deck-wide pass: in a per-slide `--only`
+      // round they are noise next to the defects the agent is fixing (x23:
+      // sol spent rounds on 48 fill and 26 nested-paint lines that block
+      // nothing).
+      if (slide.status === "ok" && !slide.converted && !only) {
+        for (const line of advisoryLines(stem, slide.render)) {
+          out(`    ${line}  (advisory)\n`);
+        }
+      }
       measured += defects.length;
-      slidesOut.push({ file: slide.fileName, status: slide.status, png: file, concept, defects, note: slide.note ?? null });
+      // `notes` carries the advisory lines — without it an agent on --json
+      // never sees them at all.
+      slidesOut.push({ file: slide.fileName, status: slide.status, png: file, concept, flaws, defects, notes, note: slide.note ?? null });
       const jsxFile = path.join(deckDir, "slides", slide.fileName);
       if (slide.status === "ok" && fs.existsSync(jsxFile)) {
-        record.push({ fileName: slide.fileName, hash: check.hashFile(jsxFile), defects });
+        record.push({ fileName: slide.fileName, hash: capturedHash, defects });
       }
     } else {
       out(`  ${slide.fileName} — ${slide.note ?? slide.status}\n`);
+      // A purpose-built layout has no freeform region: checked, nothing to
+      // measure. Delivery asks every shipped slide for a current check.
+      const jsxFile = path.join(deckDir, "slides", slide.fileName);
+      if (slide.status === "no-preview" && fs.existsSync(jsxFile)) {
+        const capturedHash = crypto.createHash("sha256").update(capturedSources.get(slide.fileName) ?? "").digest("hex");
+        if (check.hashFile(jsxFile) === capturedHash) record.push({ fileName: slide.fileName, hash: capturedHash, defects: [] });
+      }
       slidesOut.push({ file: slide.fileName, status: slide.status, png: null, concept: null, defects: [], note: slide.note ?? null });
     }
   }
-  for (const line of deckLevel) out(`  ${line}\n`);
-  measured += deckLevel.length;
   const translateRan = translate && result.translateRan !== false;
   if (translateRan) {
     const failed = (result.slides ?? []).filter((s) => s.translateErrors?.length).length;
     out(
       failed
         ? `  TRANSLATE GATE: ${failed} slide${failed === 1 ? "" : "s"} refused by the export gate (lines above) — these are the errors build-pptx would stop on.\n`
-        : "  TRANSLATE GATE: every rendered slide passed the export gate (slot-fit, diagram geometry, connector endpoints).\n",
-    );
-    for (const w of result.translateWarnings ?? []) process.stderr.write(`  note: ${w}\n`);
-  }
-  const verdict = check.verdictBlocker(deckDir);
-  if (verdict) {
-    out(
-      `  self-check: ${verdict.replace(/\n\s+/g, "; ")}\n` +
-        "  (under each slide in asset-plan.md: `draft-check:` then `- [x] <organism>` per organism found in the render, `- [ ] <organism> — <what differs>` otherwise; `review` refuses until every organism is ticked [x])\n",
+        : "  TRANSLATE GATE: every rendered slide passed the export gate (slot-fit, diagram geometry, text escape, chrome).\n",
     );
+    if (!only) for (const w of result.translateWarnings ?? []) process.stderr.write(`  note: ${w}\n`);
   }
   if (record.length > 0 && !outDir) {
-    // Deck-level asset lines are recorded on the first slide so they stand
-    // until that slide (or the asset plan) changes.
-    if (deckLevel.length > 0) record[0].defects.push(...deckLevel);
     // A partial run (--only) updates its slides and keeps the others' record.
     const prior = only ? check.loadDraftCheck(deckDir)?.slides ?? {} : {};
     const rendered = new Set(record.map((r) => r.fileName));
@@ -633,7 +967,7 @@ export async function cmdViewDraft(rest) {
   } else if (measured > 0) {
     out(
       `DRAFT CHECK: ${measured} measured defect${measured === 1 ? "" : "s"} (above) — fix them in the JSX and re-run ` +
-        "`slidemind view-draft`; `slidemind review` does not open while they stand. " +
+        "`slidemind view-draft`; `review` and delivery refuse while they stand. " +
         `Previews in ${previewDir} — NOT pushed.\n`,
     );
   } else {
@@ -649,13 +983,15 @@ export async function cmdViewDraft(rest) {
     process.stdout.write(
       `${JSON.stringify(
         {
-          deck: path.basename(deckDir),
+          deck: deckSlug(deckDir),
           previewDir,
+          // The pair rule the text output prints per slide: an agent on
+          // --json must read it too.
+          conceptGuidance: `Open each slide's concept and png together, in one look. The concept is ${CONCEPT_GUIDANCE}`,
           slides: slidesOut,
           measuredDefects: measured,
           translateGate: translateRan ? (slidesOut.some((s) => s.defects.some((d) => /:error\]/.test(d))) ? "failed" : "passed") : "skipped",
-          selfCheck: verdict ? "incomplete" : "ok",
-          reviewCanOpen: measured === 0 && !verdict,
+          reviewCanOpen: measured === 0,
           warnings,
         },
         null,