slidemind 0.3.5 → 0.3.12

package/src/builders/build.mjs

@@ -29,9 +29,12 @@
 
 import { spawn } from "node:child_process";
 import fs from "node:fs";
+import os from "node:os";
 import path from "node:path";
 import { fileURLToPath, pathToFileURL } from "node:url";
 
+import { resolveBundleDirForDeck } from "../bridge/bundle.mjs";
+import { loadChartPreview } from "../bridge/capture.mjs";
 import { FAVICON_LINK } from "./gate-server.mjs";
 import { lintSlidesOrThrow } from "./lint.mjs";
 import { resolveSkillForDeck } from "./resolve-skill.mjs";
@@ -145,6 +148,98 @@ function copyDesignSystem(deckDir, skill) {
   fs.writeFileSync(path.join(deckDir, "layouts.css"), cssChunks.join("\n\n"));
 }
 
+// First concrete (non-generic) family of a CSS var's font stack, or null.
+function firstConcreteFamily(cssText, varName) {
+  const match = cssText.match(new RegExp(`--${varName}\\s*:\\s*([^;]+);`));
+  if (!match) return null;
+  const generics = new Set([
+    "sans-serif",
+    "serif",
+    "monospace",
+    "system-ui",
+    "ui-sans-serif",
+    "ui-serif",
+    "ui-monospace",
+    "cursive",
+    "fantasy",
+  ]);
+  for (const part of match[1].split(",")) {
+    const family = part.trim().replace(/^['"]|['"]$/g, "");
+    if (family && !generics.has(family.toLowerCase())) return family;
+  }
+  return null;
+}
+
+// Copy the materialized bundle's brand fonts next to the preview and emit the
+// same @font-face block the server's capture page uses: one rule per FACE
+// under its canonical family plus the CSS-token alias (--font-sans/--font-mono),
+// with real weight/style descriptors so bold/italic render (and later measure)
+// with the real face instead of a synthesized one. Without this the preview
+// showed system fallbacks while capture/export used the brand face.
+function brandFontFaces(deckDir, skill) {
+  const bundleDir = skill.bundleDir;
+  if (!bundleDir || !fs.existsSync(bundleDir)) return "";
+  let meta = {};
+  try {
+    meta = JSON.parse(
+      fs.readFileSync(path.join(bundleDir, "bundle.json"), "utf8"),
+    );
+  } catch {
+    return "";
+  }
+  const fonts = Array.isArray(meta.fonts) ? meta.fonts : [];
+  if (fonts.length === 0) return "";
+
+  let css = "";
+  try {
+    css = fs.readFileSync(path.join(deckDir, "corporate-design.css"), "utf8");
+  } catch {
+    /* alias resolution degrades to canonical families only */
+  }
+  const aliasByRole = {
+    primary: firstConcreteFamily(css, "font-sans"),
+    mono: firstConcreteFamily(css, "font-mono"),
+  };
+
+  const outFonts = path.join(deckDir, "fonts");
+  const rules = [];
+  for (const font of fonts) {
+    if (!font?.family || !font?.filename) continue;
+    const filename = path.basename(font.filename);
+    const src = path.join(bundleDir, "fonts", filename);
+    if (!fs.existsSync(src)) continue;
+    fs.mkdirSync(outFonts, { recursive: true });
+    fs.copyFileSync(src, path.join(outFonts, filename));
+
+    const weight =
+      font.variable &&
+      typeof font.variable.minWeight === "number" &&
+      typeof font.variable.maxWeight === "number"
+        ? `${font.variable.minWeight} ${font.variable.maxWeight}`
+        : String(
+            typeof font.weight === "number" &&
+              font.weight >= 100 &&
+              font.weight <= 900
+              ? font.weight
+              : 400,
+          );
+    const style = font.style === "italic" ? "italic" : "normal";
+    const format = filename.toLowerCase().endsWith(".otf")
+      ? "opentype"
+      : "truetype";
+    const rule = (family) =>
+      `@font-face { font-family: ${JSON.stringify(family)}; ` +
+      `src: url(${JSON.stringify(`./fonts/${filename}`)}) format("${format}"); ` +
+      `font-weight: ${weight}; font-style: ${style}; font-display: block; }`;
+    rules.push(rule(font.family));
+    const alias = aliasByRole[font.role];
+    if (alias && alias.toLowerCase() !== font.family.toLowerCase()) {
+      rules.push(rule(alias));
+    }
+  }
+  return rules.join("\n");
+}
+
 function loadOverrides(deckDir) {
   const file = path.join(deckDir, "overrides.json");
   if (!fs.existsSync(file)) return { version: 1, slides: {} };
@@ -258,6 +353,10 @@ const HTML_TEMPLATE = `<!doctype html>
       font-style: italic;
     }
   </style>
+  <style id="brand-font-faces">__BRAND_FONT_FACES__</style>
+  <!-- Chart palette for the <Chart> stand-in (from the bundle's capture engine;
+       empty when the bundle carries no chart runtime). -->
+  <style id="chart-theme-tokens">__CHART_THEME_TOKENS__</style>
   <style>
     html, body { margin: 0; padding: 0; height: 100%; background: #0a0a0a; overflow: hidden; }
     :root {
@@ -470,6 +569,11 @@ __SLIDES__
   <script crossorigin src="https://unpkg.com/react@18/umd/react.production.min.js"></script>
   <script crossorigin src="https://unpkg.com/react-dom@18/umd/react-dom.production.min.js"></script>
   <script src="https://unpkg.com/@babel/standalone/babel.min.js"></script>
+  <!-- The <Chart> stand-in runtime: the add-in's own vendored scripts, inlined
+       from the bundle's capture engine (this CLI ships no chart source). They
+       install window.SlidemindChart, which the bootstrap below binds as Chart
+       before any slide is evaluated. -->
+__CHART_PREVIEW_SCRIPTS__
   <script>window.__SLIDE_EDITOR_OVERRIDES__ = __OVERRIDES__;</script>
   <script>window.SVG_ASSETS = __SVG_ASSETS__;</script>
   <script>
@@ -500,8 +604,11 @@ __RUNTIME_APPLIER__
                 var nameNode = node.name;
                 // Intrinsic elements only: a lowercase JSXIdentifier. Skip
                 // components (<SlideCover>), member/namespaced names, fragments.
+                // <Chart> is the one component that opts in (as in the add-in's
+                // instrument-source-loc): it forwards the attribute onto its
+                // root div, so a review pin on a chart resolves to its tag.
                 if (!nameNode || nameNode.type !== "JSXIdentifier") return;
-                if (!/^[a-z]/.test(nameNode.name)) return;
+                if (!/^[a-z]/.test(nameNode.name) && nameNode.name !== "Chart") return;
                 for (var i = 0; i < node.attributes.length; i++) {
                   var a = node.attributes[i];
                   if (a.type === "JSXAttribute" && a.name &&
@@ -649,6 +756,14 @@ __RUNTIME_APPLIER__
         }
       });
 
+      // The Chart binding slide jsx is compiled against — installed by the
+      // bundle's chart-preview scripts above; without them a chart renders
+      // nothing, exactly as the add-in's page behaves.
+      var Chart = window.SlidemindChart
+        ? window.SlidemindChart.createComponent(React)
+        : function () { return null; };
+      var slideScope = Object.assign({ Chart: Chart }, LAYOUTS);
+
       var slides = [];
       document.querySelectorAll('script[data-kind="slide"]').forEach(function (s) {
         var idx = parseInt(s.dataset.index, 10);
@@ -657,7 +772,7 @@ __RUNTIME_APPLIER__
           var Component = evalJsx(
             s.textContent,
             "slides/" + name + ".jsx",
-            LAYOUTS
+            slideScope
           );
           slides[idx] = { name: name, Component: Component };
         } catch (err) {
@@ -898,6 +1013,11 @@ export async function buildDeck(deckDir, opts = {}) {
   );
   await lintSlidesOrThrow({ deckDir, slideFiles, layoutSources });
 
+  // The <Chart> stand-in runtime rides in the same bundle cache (see
+  // loadChartPreview) — resolved after lint, which already proved the bundle
+  // is materialized.
+  const chartPreview = await loadChartPreview(resolveBundleDirForDeck(deckDir));
+
   copyDesignSystem(deckDir, skill);
 
   const layoutsBlock = layoutFiles.map(inlineLayout).join("\n");
@@ -908,11 +1028,22 @@ export async function buildDeck(deckDir, opts = {}) {
   const svgAssets = collectSvgAssets(deckDir);
 
   const html = HTML_TEMPLATE.replace("__TITLE__", path.basename(deckDir))
+    .replace("__BRAND_FONT_FACES__", brandFontFaces(deckDir, skill))
     .replace("__LAYOUTS__", layoutsBlock)
     .replace("__SLIDES__", slidesBlock)
     .replace("__OVERRIDES__", safeInlineJson(loadOverrides(deckDir)))
     .replace("__SVG_ASSETS__", safeInlineJson(svgAssets))
-    .replace("__RUNTIME_APPLIER__", safeInline(fs.readFileSync(RUNTIME_APPLIER, "utf8")));
+    .replace("__RUNTIME_APPLIER__", safeInline(fs.readFileSync(RUNTIME_APPLIER, "utf8")))
+    // Function replacers: script sources may contain `$&`-style patterns that a
+    // string replacement would expand.
+    .replace("__CHART_THEME_TOKENS__", () => (chartPreview ? chartPreview.tokensCss : ""))
+    .replace("__CHART_PREVIEW_SCRIPTS__", () =>
+      chartPreview
+        ? chartPreview.scripts
+            .map((script) => `  <script>\n${safeInline(script.source)}\n  </script>`)
+            .join("\n")
+        : "",
+    );
 
   const out = path.join(deckDir, "presentation.html");
   fs.writeFileSync(out, html);
@@ -965,6 +1096,35 @@ const OPENER_EXIT_GRACE_MS = 2000;
 // user to open manually unless `quiet` — callers with their own messaging (the
 // review/plan gates) pass quiet:true and speak for themselves.
 export function openInBrowser(target, { quiet = false } = {}) {
+  // Machine-level browser kill-switch for headless simulation batches
+  // (scripts/codex-sim.mjs writes it for the batch, removes it after): every
+  // env/PATH/cwd channel for reaching a sim session proved lossy at least
+  // once, so the LAST line of defense is a HOME-scoped marker no shell can
+  // strip. Stale-guarded to 6h so a crashed batch can't silently disable the
+  // browser for real use forever.
+  // Two locations: the config dir, and THIS MODULE'S OWN DIRECTORY — session
+  // shells have shown unreliable HOME/XDG resolution, but a session that runs
+  // this code by definition resolves __dirname correctly.
+  for (const kill of [
+    path.join(
+      process.env.XDG_CONFIG_HOME || path.join(os.homedir(), ".config"),
+      "slidemind",
+      "suppress-browser",
+    ),
+    path.join(__dirname, ".sim-suppress-browser"),
+  ]) {
+    try {
+      const age = Date.now() - fs.statSync(kill).mtimeMs;
+      if (age < 6 * 60 * 60 * 1000) {
+        if (!quiet) {
+          process.stderr.write(`browser suppressed (simulation) — open ${target} manually\n`);
+        }
+        return Promise.resolve(false);
+      }
+    } catch {
+      // marker absent — keep checking / open normally
+    }
+  }
   const chain = openerChain(target);
   return new Promise((resolve) => {
     const tryAt = (i) => {
@@ -1012,10 +1172,15 @@ function parseArgs(argv) {
       args.deck = argv[++i];
     } else if (a === "--open") {
       args.open = true;
+    } else if (a === "--fix") {
+      args.fix = true;
     } else if (a === "-h" || a === "--help") {
       process.stdout.write(
-        "Usage: slidemind build <deck> [--open]\n" +
-          "       node src/builders/build.mjs --deck <deck> [--open]\n",
+        "Usage: slidemind build <deck> [--open] [--fix]\n" +
+          "       node src/builders/build.mjs --deck <deck> [--open] [--fix]\n" +
+          "  --fix  apply the deterministic lint autofixes to slides/*.jsx before building\n" +
+          "         (pin inline-svg px size from its viewBox; letter-spacing em→px where the\n" +
+          "         block's px font-size makes the conversion exact)\n",
       );
       process.exit(0);
     } else {
@@ -1033,6 +1198,15 @@ function parseArgs(argv) {
 async function main() {
   const args = parseArgs(process.argv.slice(2));
   const deckDir = path.resolve(args.deck);
+  if (args.fix) {
+    const { fixDeckSlides } = await import("./lint-fix.mjs");
+    const fixed = fixDeckSlides(deckDir);
+    if (fixed.fixes) {
+      process.stdout.write(
+        `Autofixed ${fixed.fixes} lint issue(s) in ${fixed.files} slide file(s) — re-read any file before patching it.\n`,
+      );
+    }
+  }
   const { out, slideCount } = await buildDeck(deckDir);
   const rel = path.relative(process.cwd(), out) || out;
   process.stdout.write(`Built ${rel}  (${slideCount} slides)\n`);

package/src/builders/gate-server.mjs

@@ -22,8 +22,9 @@ const GATE_SESSION_PATH = path.join(__dirname, "gate-session.js");
 // overlays as CFG.pollMs / CFG.pollTtlMs:
 //   GRACE_MS  > POLL_MS so a waiting tab always lands one poll inside the
 //              open-browser grace window;
-//   POLL_TTL_MS > the gates' 30-min decision timeout so an abandoned tab stops
-//              polling only after the server side has certainly given up.
+//   POLL_TTL_MS caps how long an abandoned tab keeps polling for a NEXT round
+//              (the gates themselves have no decision timeout — a live gate
+//              serves its own tab directly; polling only matters between runs).
 // One favicon for every page slidemind opens in a browser (gates, previews,
 // sign-in): an inline data URI, so no server needs a /favicon.ico route and
 // the static preview file stays self-contained.
@@ -87,7 +88,14 @@ export function serveStaticFile({ roots, pathname, res }) {
       continue; // missing here — try the next root
     }
     const ext = path.extname(resolved).toLowerCase();
-    res.writeHead(200, { "Content-Type": MIME[ext] || "application/octet-stream" });
+    // Gate tabs deliberately reuse a stable localhost URL across review rounds
+    // while build.mjs overwrites CSS, fonts and assets in place.  Without an
+    // explicit no-cache policy the browser can combine fresh HTML with stale
+    // design resources, making the review diverge from the generated PPTX.
+    res.writeHead(200, {
+      "Content-Type": MIME[ext] || "application/octet-stream",
+      "Cache-Control": "no-store, max-age=0",
+    });
     res.end(data);
     return true;
   }
@@ -96,8 +104,8 @@ export function serveStaticFile({ roots, pathname, res }) {
 
 // Read a JSON POST body off a gate request and hand the parsed object to `cb`
 // (an unparseable/absent body becomes `{}` — a gate normalizes its own fields
-// anyway). Shared by every gate POST route (plan decision, plan backlog, and
-// the preview gate's decision + backlog next), so the 5 MB flood guard lives in
+// anyway). Shared by every gate POST route (both gates' decision POSTs), so
+// the 5 MB flood guard lives in
 // exactly one place. The guard matters: these servers bind loopback but any
 // page in the user's browser can POST to a known localhost port.
 export function readJsonBody(req, cb) {
@@ -130,13 +138,13 @@ export function readJsonBody(req, cb) {
 // ---------------------------------------------------------------------------
 // shared gate ROUTES + comment normalization
 //
-// Both gates ran byte-identical copies of the backlog route, the approve-409
-// guard and the row-normalization preamble. One copy, two per-gate field shapes.
+// Both gates ran byte-identical copies of the approve-409 guard and the
+// row-normalization preamble. One copy, two per-gate field shapes.
 // ---------------------------------------------------------------------------
 
 // The identity + text core every gate row shares: `id` dedupes a client retry
 // of the same batch, `round` says which round the comment was written against
-// (a queued row is delivered a round later, so the two can differ), and a row
+// (rounds print it so the agent knows which render a pin sits on), and a row
 // without text is dropped — an empty row prints as an instruction-free bullet.
 // `fields(c)` contributes the gate's own anchor columns.
 export function normalizeGateComments(raw, fields) {
@@ -161,37 +169,18 @@ export function normalizeGateComments(raw, fields) {
   return out;
 }
 
-// The reloaded tab flushes its queued rows here. Non-empty ⇒ that run never
-// parks: it resolves at once as a drain round. (The page only POSTs when it HAS
-// a backlog, so the empty branch is just a defensive ack.)
-//
-// `isSuperseded` (the gate's settled check): once another tab's drain or
-// decision has resolved this run, a late backlog must NOT be acked "drained" —
-// the client would flip its rows to "sent" while gate.resolve is a no-op and
-// the reviewer's comments silently vanish. "superseded" keeps them queued, and
-// the tab's heartbeat poll carries them into the next run.
-export function serveBacklogPost(req, res, { normalize, onDrained, isSuperseded = () => false }) {
-  readJsonBody(req, (payload) => {
-    const comments = normalize(payload.comments);
-    const state = !comments.length ? "parked" : isSuperseded() ? "superseded" : "drained";
-    res.writeHead(200, { "Content-Type": MIME[".json"] });
-    res.end(JSON.stringify({ ok: state !== "superseded", state }));
-    if (state === "drained") onDrained(comments);
-  });
-}
-
-// The decision POST, with the shared 409 guard: once this run has settled —
-// a backlog drained (the displayed round is superseded by comments the agent
-// has already been told to work) or another tab's decision landed — a late
+// The decision POST, with the shared 409 guard: once this run has settled
+// (another tab's decision landed — every waiting tab reloads into a new round,
+// so two windows posting into one run is the normal multi-window case) a late
 // decision of EITHER kind is refused. Acking a late "comments" with 200 would
-// mark them sent while gate.resolve is a no-op; the 409 keeps them queued
-// client-side for the next round.
+// mark them sent while gate.resolve is a no-op; the 409 lets the tab keep them
+// as unsent drafts for the next round.
 export function serveDecisionPost(req, res, { normalize, isSuperseded, onDecision }) {
   readJsonBody(req, (payload) => {
     const decision = payload.decision === "comments" ? "comments" : "approve";
     if (isSuperseded()) {
       res.writeHead(409, { "Content-Type": MIME[".json"] });
-      res.end(JSON.stringify({ ok: false, error: "backlog_pending" }));
+      res.end(JSON.stringify({ ok: false, error: "round_settled" }));
       return;
     }
     res.writeHead(200, { "Content-Type": MIME[".json"] });
@@ -217,7 +206,7 @@ export function stripModuleSyntax(src) {
 
 // gate-session.js as a browser IIFE exposing window.__SLIDEMIND_GATE__. Both
 // gate pages inline this BEFORE their overlay script — the overlays' whole
-// ledger/backlog/round machinery is that one shared factory.
+// ledger/round machinery is that one shared factory.
 export function bundleGateSession() {
   return (
     "(function () {\n" +
@@ -249,8 +238,8 @@ export function createDecisionGate({
       isSettled = true;
       resolveDecision(value);
     },
-    // Whether a decision/drain already resolved this run — the POST routes
-    // refuse late input on it, because a resolve after the first is a no-op.
+    // Whether a decision already resolved this run — the POST route refuses
+    // late input on it, because a resolve after the first is a no-op.
     settled() {
       return isSettled;
     },

package/src/builders/gate-session.js

@@ -1,9 +1,17 @@
 // Shared browser-side session machinery for the CLI's two blocking gates —
 // the plan sign-off gate (plan-overlay.js) and the spatial preview gate
 // (review-overlay.js). Both overlays used to carry byte-identical copies of the
-// sessionStorage ledger, the backlog flush, the round-transition detection, the
-// round-ready announcement and the heartbeat poll; a fix landed in one and not
-// the other is exactly how the two drifted apart. This module is the ONE copy.
+// sessionStorage ledger, the round-transition detection, the round-ready
+// announcement and the heartbeat poll; a fix landed in one and not the other is
+// exactly how the two drifted apart. This module is the ONE copy.
+//
+// ROUNDS ARE SYNCHRONOUS (add-in parity). A round is: the reviewer comments,
+// sends, the agent works, the next run presents a new round. Nothing is queued
+// behind the agent's back: while the agent works the gate is not accepting
+// input, and the tab says so. (An earlier design let the tab keep collecting
+// comments in sessionStorage and flushed them to the next run as a "drain
+// round" — that made the add-in and the CLI behave differently and was
+// removed.)
 //
 // It is plain dependency-free ESM so a test can `import` it directly, and the
 // gates inline it into their page (import-free, `export ` stripped) as
@@ -24,7 +32,7 @@
 
 // The wire shape each gate's server persists and prints. Per-gate because the
 // anchors differ (spatial pin vs. slide-anchored comment), shared here because
-// flushBacklog posts it and the gate's normalizer has to accept it.
+// the gate's normalizer has to accept exactly this.
 const WIRE = {
   // Preview pins carry FULL-PRECISION 0..1 fractions. Rounding to whole percent
   // on the wire cost ±6px on a 1280px stage and collapsed sub-1% offsets; the
@@ -66,9 +74,9 @@ export function createGateSession(cfg) {
   const store = cfg.storage;
   const doFetch = cfg.fetch;
   const wire = cfg.wire || WIRE[name];
-  // Deck-scoped, NOT round-scoped: the rows carry their own round, and keying
-  // the store by the round would strand the queue on exactly the reload that
-  // has to flush it (a new round's key differs by definition).
+  // Deck-scoped, NOT round-scoped: the rows carry their own round, and the
+  // ledger has to survive the reload INTO the next round (a new round's key
+  // would differ by definition).
   const LEDGER_KEY = "slidemind-" + name + "-ledger:" + deck;
   const CTX_KEY = "slidemind-" + name + "-ctx:" + deck;
   const ROUND_READY_FLAG = "slidemind-" + name + "-round-ready";
@@ -113,19 +121,18 @@ export function createGateSession(cfg) {
     }, DRAFT_DEBOUNCE_MS);
   }
 
-  // The backlog: written in this tab, not yet delivered to any gate run.
-  function queued(ledger) {
-    return (ledger || []).filter(function (c) {
-      return c.status === "queued";
-    });
-  }
-
   // Restore this tab's session and work out whether THIS load is a new round.
   // Returns the ledger plus the round state; the caller applies its own ctx
   // fields from the returned `ctx` and its own round-arrival cosmetics.
   function restore(seed) {
     let ledger = read(LEDGER_KEY, []) || [];
     if (!Array.isArray(ledger)) ledger = [];
+    // A tab left open across the upgrade from the queueing release still holds
+    // "queued" rows: undelivered, so they are the reviewer's drafts — never
+    // silently relabelled as sent.
+    ledger.forEach(function (c) {
+      if (c.status === "queued") c.status = "draft";
+    });
     let ctx = read(CTX_KEY, null);
     if (!ctx || typeof ctx !== "object") ctx = null;
     let roundNo = ctx && typeof ctx.round === "number" ? ctx.round : 1;
@@ -154,41 +161,16 @@ export function createGateSession(cfg) {
       row.status = s.status === "addressed" ? "addressed" : "sent";
       ledger.push(row);
     });
-    // Queued rows mean the agent is still working on the round they were
-    // written against — this load is a drain round, not a park.
-    return { ledger, roundNo, working: queued(ledger).length > 0, newRound, ctx };
-  }
-
-  // POST the queued backlog to the gate. A non-empty backlog resolves that run
-  // at once (drain round), so the rows flip to "sent". A failure (the command
-  // already exited) leaves them queued for the next run — nothing is dropped.
-  function flushBacklog(ledger) {
-    const pending = queued(ledger);
-    if (!pending.length) return Promise.resolve(false);
-    return doFetch(cfg.backlogEndpoint, {
-      method: "POST",
-      headers: { "Content-Type": "application/json" },
-      body: JSON.stringify({ comments: pending.map(wire) }),
-    })
-      .then(function (r) {
-        return r.ok ? r.json() : null;
-      })
-      .then(function (data) {
-        if (!data || data.state !== "drained") return false;
-        pending.forEach(function (c) {
-          c.status = "sent";
-        });
-        saveLedger(ledger);
-        return true;
-      })
-      .catch(function () {
-        return false; // gate gone — the rows stay queued for the next run
-      });
+    // WORKING survives a plain refresh of the same run (the reviewer already
+    // sent this round; approving the same render again would only 409), and
+    // ends the moment a newer run serves the page.
+    const working = !newRound && !!(ctx && ctx.working);
+    return { ledger, roundNo, working, newRound, ctx };
   }
 
   // Where a row stands, for the ledger rail / sidebar chip.
   function statusLabel(c) {
-    if (c.status === "queued") return "queued";
+    if (c.status === "draft") return "not sent yet";
     if (c.status === "addressed") {
       return "addressed" + (c.addressedInRound ? " · round " + c.addressedInRound : "");
     }
@@ -225,7 +207,7 @@ export function createGateSession(cfg) {
     }
     location.reload();
   }
-  // Always consumed at boot (a drain round must not leave the flag armed for a
+  // Always consumed at boot (a refresh must not leave the flag armed for a
   // later parked load), but only ACTED on when this round parks.
   function consumeRoundFlag() {
     try {
@@ -341,9 +323,7 @@ export function createGateSession(cfg) {
     saveLedger,
     saveCtx,
     saveCtxSoon,
-    queued,
     restore,
-    flushBacklog,
     statusLabel,
     notifyPermission,
     requestNotifyPermission,

package/src/builders/lint-fix.mjs

@@ -0,0 +1,88 @@
+// Deterministic autofixes for the two lint warnings agents statistically never
+// clear by hand (measured across seven sim campaigns: 7-66 unique warnings
+// left standing at the final build in 8/10 sessions, resistant to four
+// instruction shapes — see experiments/LEDGER.md). Both rewrites are safe
+// because the fixed value is derived from the file itself, never guessed:
+//
+//   1. An inline `<svg>` with a `viewBox` but no explicit `width`/`height`
+//      gets both, taken verbatim from the viewBox — the aspect the author
+//      drew is preserved exactly, and the render's aspect check stops
+//      drifting with the flex cell.
+//   2. `letter-spacing: <n>em` becomes px ONLY when the same declaration
+//      block names a px `font-size` to multiply against; without that context
+//      the correct px value is unknowable, so the declaration is left for the
+//      lint warning to report.
+//
+// Everything else the lint engine flags (raw colors, token choices, spacing
+// scales) is a judgment call and deliberately NOT auto-fixed.
+
+import fs from "node:fs";
+import path from "node:path";
+
+// Declaration blocks inside a <style> string or a style attribute: convert
+// `letter-spacing: Nem` when the SAME block carries `font-size: Mpx`.
+const DECL_BLOCK = /\{[^{}]*\}/g;
+const LS_EM = /letter-spacing\s*:\s*(-?[\d.]+)em/g;
+const FS_PX = /font-size\s*:\s*([\d.]+)px/;
+
+function fixLetterSpacingBlock(block) {
+  const fs_ = block.match(FS_PX);
+  if (!fs_) return null;
+  const base = Number(fs_[1]);
+  if (!Number.isFinite(base) || base <= 0) return null;
+  let changed = false;
+  const fixed = block.replace(LS_EM, (m, em) => {
+    const px = Math.round(Number(em) * base * 100) / 100;
+    if (!Number.isFinite(px)) return m;
+    changed = true;
+    return `letter-spacing: ${px}px`;
+  });
+  return changed ? fixed : null;
+}
+
+/** Fix one slide source. Returns { src, fixes } — fixes is a list of labels. */
+export function fixSlideSource(src) {
+  const fixes = [];
+  // NOTE: svg pinning (adding width/height from the viewBox) was measured to
+  // HARM fidelity and is disabled: the viewBox dimensions are drawing-space
+  // coordinates, not the layout size the author's flex cell implied, so the
+  // pinned svg resizes out of its cell (collisions/clipping) — the lint
+  // warning was satisfied by breaking the layout (sim batch 2026-08-28T06-34-11:
+  // fidelity 0.809 → 0.660). The correct px size is not statically knowable;
+  // that warning stays a judgment call for the author.
+  let out = src;
+  out = out.replace(DECL_BLOCK, (block) => {
+    const fixed = fixLetterSpacingBlock(block);
+    if (!fixed) return block;
+    fixes.push("letter-spacing-px");
+    return fixed;
+  });
+  return { src: out, fixes };
+}
+
+/**
+ * Fix every slides/*.jsx in a deck, writing only changed files.
+ * Returns { files: <changed file count>, fixes: <total fix count> }.
+ */
+export function fixDeckSlides(deckDir) {
+  const slidesDir = path.join(deckDir, "slides");
+  let files = 0;
+  let fixes = 0;
+  let entries = [];
+  try {
+    entries = fs.readdirSync(slidesDir).filter((f) => f.endsWith(".jsx"));
+  } catch {
+    return { files, fixes };
+  }
+  for (const f of entries) {
+    const p = path.join(slidesDir, f);
+    const src = fs.readFileSync(p, "utf8");
+    const res = fixSlideSource(src);
+    if (res.fixes.length) {
+      fs.writeFileSync(p, res.src);
+      files += 1;
+      fixes += res.fixes.length;
+    }
+  }
+  return { files, fixes };
+}