From 4914018be91d31e4e4040a763a48ebfa83843909 Mon Sep 17 00:00:00 2001
From: Robin-ELM <64148042+Robin-ELM@users.noreply.github.com>
Date: Wed, 4 Nov 2026 08:38:05 +0000
Subject: [PATCH 1/5] Promote dev to prod (6048800)

---
 .env.example                       |   3 +
 .gitignore                         |   1 +
 apphosting.dev.yaml                |   7 +
 apphosting.prod.yaml               |   5 +
 docs/14-design-system.md           |   2 +-
 docs/17-showcase-sets.md           | 198 +++++++++++++++---
 docs/DEPLOY.md                     |   7 +-
 eval/showcase/README.md            |   2 +-
 package.json                       |   1 +
 scripts/showcase-build.mjs         | 239 ++++++++++++++++++++++
 scripts/showcase/driver.mjs        | 309 +++++++++++++++++++++++++++++
 scripts/showcase/driver.test.mjs   | 225 +++++++++++++++++++++
 scripts/showcase/photos.mjs        | 141 +++++++++++++
 scripts/showcase/photos.test.mjs   | 168 ++++++++++++++++
 scripts/showcase/serve.mjs         |  63 ++++++
 scripts/showcase/serve.test.mjs    |  71 +++++++
 scripts/showcase/sheet.mjs         |  98 +++++++++
 scripts/showcase/sheet.test.mjs    |  88 ++++++++
 scripts/showcase/spec.mjs          | 215 ++++++++++++++++++++
 scripts/showcase/spec.test.mjs     | 210 ++++++++++++++++++++
 scripts/showcase/test-support.mjs  | 143 +++++++++++++
 scripts/showcase/web.mjs           | 171 ++++++++++++++++
 scripts/showcase/web.test.mjs      | 211 ++++++++++++++++++++
 src/app/_legal/LegalParts.tsx      |  36 +++-
 src/app/g/[slug]/board.module.css  |   2 +
 src/app/landing-page.test.ts       | 104 +++++++++-
 src/app/new/start-flow.css         |   2 +-
 src/app/page.tsx                   |  60 +++++-
 src/config.test.ts                 |  12 ++
 src/config.ts                      |  26 +++
 src/domain/landing-actions.test.ts |  19 ++
 src/domain/landing-actions.ts      |  29 +++
 src/i18n/messages/de.json          |   9 +-
 src/i18n/messages/de.lock.json     |   9 +-
 src/i18n/messages/en.json          |   9 +-
 src/i18n/messages/es.json          |   9 +-
 src/i18n/messages/es.lock.json     |   9 +-
 src/i18n/messages/fr.json          |   9 +-
 src/i18n/messages/fr.lock.json     |   9 +-
 src/i18n/messages/id.json          |   9 +-
 src/i18n/messages/id.lock.json     |   9 +-
 src/i18n/messages/it.json          |   9 +-
 src/i18n/messages/it.lock.json     |   9 +-
 src/i18n/messages/pt-BR.json       |   9 +-
 src/i18n/messages/pt-BR.lock.json  |   9 +-
 src/server/landing-viewer.ts       |  34 ++++
 src/server/my-boards.test.ts       |  43 +++-
 src/server/my-boards.ts            |  26 +++
 src/ui/icons.tsx                   |   3 +
 src/ui/kit.test.ts                 |   6 +-
 src/ui/pinneds.css                 |  37 +++-
 vitest.config.ts                   |   2 +-
 52 files changed, 3049 insertions(+), 87 deletions(-)
 create mode 100644 scripts/showcase-build.mjs
 create mode 100644 scripts/showcase/driver.mjs
 create mode 100644 scripts/showcase/driver.test.mjs
 create mode 100644 scripts/showcase/photos.mjs
 create mode 100644 scripts/showcase/photos.test.mjs
 create mode 100644 scripts/showcase/serve.mjs
 create mode 100644 scripts/showcase/serve.test.mjs
 create mode 100644 scripts/showcase/sheet.mjs
 create mode 100644 scripts/showcase/sheet.test.mjs
 create mode 100644 scripts/showcase/spec.mjs
 create mode 100644 scripts/showcase/spec.test.mjs
 create mode 100644 scripts/showcase/test-support.mjs
 create mode 100644 scripts/showcase/web.mjs
 create mode 100644 scripts/showcase/web.test.mjs
 create mode 100644 src/domain/landing-actions.test.ts
 create mode 100644 src/domain/landing-actions.ts
 create mode 100644 src/server/landing-viewer.ts

diff --git a/.env.example b/.env.example
index cfa4f8e4..0ea8a244 100644
--- a/.env.example
+++ b/.env.example
@@ -22,6 +22,9 @@ DEMO_BOARD_SLUG=
 # everyone; set it in the host env, never commit a value here. Unset =
 # the pages link to GitHub issues for non-private questions.
 LEGAL_CONTACT_EMAIL=
+# PIN-263: judging-week landing links (https only; unset = hidden)
+DEMO_VIDEO_URL=
+PROMO_POST_URL=
 # Board Plus billing (PIN-103/PIN-149, docs/15-board-plus.md): off (default)
 # answers every checkout "unavailable" and writes nothing; mock grants
 # Plus instantly for demos (labelled source "mock", no money moves).
diff --git a/.gitignore b/.gitignore
index 178706cd..b9d9e092 100644
--- a/.gitignore
+++ b/.gitignore
@@ -37,3 +37,4 @@ coverage/
 .DS_Store
 
 .spike-work/
+.showcase-work/
diff --git a/apphosting.dev.yaml b/apphosting.dev.yaml
index 29b0359a..c03137b4 100644
--- a/apphosting.dev.yaml
+++ b/apphosting.dev.yaml
@@ -30,6 +30,13 @@ env:
   # address is printed on both pages, so it is not a secret.
   - variable: LEGAL_CONTACT_EMAIL
     value: contact@moriacrew.com
+  # PIN-263: judging-week links on the landing, public plain values.
+  # Unset a value to take its link down (no code change).
+  - variable: DEMO_VIDEO_URL
+    value: https://youtu.be/q6lkrA6fsCI
+  # A test post until the launch post is published.
+  - variable: PROMO_POST_URL
+    value: https://x.com/MoriaCrew/status/2099512136368071033
   - variable: DATA_BACKEND
     value: firestore
   - variable: FIREBASE_PROJECT_ID
diff --git a/apphosting.prod.yaml b/apphosting.prod.yaml
index 4edeef53..ef005df9 100644
--- a/apphosting.prod.yaml
+++ b/apphosting.prod.yaml
@@ -52,6 +52,11 @@ env:
   # address is printed on both pages, so it is not a secret.
   - variable: LEGAL_CONTACT_EMAIL
     value: contact@moriacrew.com
+  # PIN-263: judging-week links on the landing, public plain values.
+  # Unset a value to take its link down (no code change).
+  - variable: DEMO_VIDEO_URL
+    value: https://youtu.be/q6lkrA6fsCI
+  # PROMO_POST_URL: add the launch post's link here once it is published.
   - variable: DATA_BACKEND
     value: firestore
   - variable: FIREBASE_PROJECT_ID
diff --git a/docs/14-design-system.md b/docs/14-design-system.md
index e7dc98e4..66ffa7e9 100644
--- a/docs/14-design-system.md
+++ b/docs/14-design-system.md
@@ -41,7 +41,7 @@ Principles:
 ## UI kit
 
 - `src/ui/` holds the components (`import { … } from "../ui"`):
-  Icon (24 line icons), Wordmark, Button/ButtonLink, IconButton,
+  Icon (26 line icons), Wordmark, Button/ButtonLink, IconButton,
   Chip, Tag, Avatar/AvatarStack, TextField, Hint, Sticker, Pin,
   CreditLine, SceneCard, Developing, BoardHeader, SectionHead,
   FilterChips, Dock, Sheet, EmptyState, Menu, SkinPicker, TryOnBar,
diff --git a/docs/17-showcase-sets.md b/docs/17-showcase-sets.md
index 17374e64..2dfd65b9 100644
--- a/docs/17-showcase-sets.md
+++ b/docs/17-showcase-sets.md
@@ -34,9 +34,38 @@ Related:
 | 8 | Check | tests, phone and desktop screenshots | the PR |
 | 9 | Record provenance | per-set table and prompts | `public/landing/README.md` |
 
-Steps 2 to 6 run on scratch scripts today. PIN-172 adds the set
-manifest (`eval/showcase/sets.json`) and PIN-173 turns the driver into
-`scripts/showcase-build.mjs`. This page is the contract they follow.
+Steps 2 to 6 run with one script, `scripts/showcase-build.mjs`
+(PIN-173; helpers in `scripts/showcase/`, tests next to them):
+
+| Step | Command |
+| --- | --- |
+| 2 | `photos <items.json> --live` |
+| 3 | `serve [--live --env-file <file>]` |
+| 4 | `plan <spec>`, then `run <spec> [set...]` |
+| 5 | `run` writes `contact-sheet.html`; `sheet <set>` rebuilds it |
+| 6 | `web <web-spec>` |
+
+Run it as `node scripts/showcase-build.mjs <command>` or
+`npm run showcase -- <command>`; `--help` prints the options.
+
+- **Paths and env.** Every path and the env file come from an option or
+  an environment variable (`--work-dir` / `SHOWCASE_WORK_DIR`,
+  `--photos-dir` / `SHOWCASE_PHOTOS_DIR`, `--base-url` /
+  `SHOWCASE_BASE_URL`, `--env-file` / `SHOWCASE_ENV_FILE`). The work
+  folder defaults to `.showcase-work/`, which git ignores. Nothing
+  about the operator's machine is written into the repo.
+- **Paid calls need a flag.** `photos` only plans until you pass
+  `--live`. `serve` starts a mock app (`AI_MOCK=1`, free) unless you
+  pass `--live`. `run` refuses a live app unless you pass `--live`.
+- **Specs hold no local paths.** A friend's photo is a relative name
+  inside the photos folder (`cat/aye.webp`), so a spec can be
+  committed. PIN-172's manifest (`eval/showcase/sets.json`) is read the
+  same way: `plan` and `run` take one set spec, or a manifest
+  `{ "sets": [ ... ] }` plus set ids.
+- **Nothing secret in output.** Board slugs, session cookies and keys
+  are never printed, logged or written to `run.json`.
+
+This page stays the contract the script follows.
 
 ## 1. Write the brief
 
@@ -99,6 +128,33 @@ returns 1280x1920 or 1920x1280 **WebP**, whatever name you save it
 under. Save it as `.webp`: the upload takes the picture's type from the
 file extension.
 
+The `photos` command does this. Its items file has one entry per photo,
+named relative to the photos folder:
+
+```json
+[
+  { "out": "cat/aye.webp", "size": "1536x1024", "prompt": "Casual smartphone photo of ..." }
+]
+```
+
+```sh
+node scripts/showcase-build.mjs photos items.json --env-file <env file> --live
+```
+
+- It makes one photo at a time and saves each under its real type
+  (WebP, whatever name you asked for).
+- It skips a photo that already exists; `--force` makes it again.
+- It counts every generated image in `photos-state.json` in the work
+  folder, against `--image-cap` (40 by default, PIN-172's cap), and
+  stops before a call that would pass the cap. Start the count from the
+  images made elsewhere with `--baseline N` on the first run. A call
+  whose picture cannot be fetched or is not an image still counts (it
+  was paid for), is reported as failed, and the next photo carries on.
+- The state file also keeps each image's model, size, request id and
+  time, for the provenance table.
+- Without `--live` it only prints the plan. The log shows status,
+  time and size, never the key, a prompt or an answer.
+
 What cuts well, from the runs so far:
 
 - **Contrast.** Put a thing on a plain surface of another colour. A
@@ -118,9 +174,16 @@ What cuts well, from the runs so far:
 ## 3. Run the app locally with live models
 
 Run the worktree's app on `localhost:3000` with the operator's env
-file loaded at start-up. For example, a small launcher outside the
-repo calls `process.loadEnvFile(<path>)`, sets the overrides below and
-starts `next dev`.
+file loaded at start-up:
+
+```sh
+node scripts/showcase-build.mjs serve --live --env-file <env file>
+```
+
+`serve` loads the env file, forces the overrides below, and starts
+`next dev` listening on localhost only. Without `--live` it starts a
+mock app (`AI_MOCK=1`): free, and its scenes are collages. Use that
+for a dry run of the whole chain before any live run.
 
 | Variable | Value | Why |
 | --- | --- | --- |
@@ -133,8 +196,11 @@ starts `next dev`.
 | `AI_DAILY_CALL_LIMIT` | `2000` | room for a full run |
 
 Also unset the Stripe variables, `DEMO_BOARD_SLUG` and
-`FIRESTORE_EMULATOR_HOST`. Live calls run only on the operator's
-machine. CI stays on `AI_MOCK=1`.
+`FIRESTORE_EMULATOR_HOST` (`serve` does). A live server also gets
+longer model timeouts through `POLICY_OVERRIDES_JSON` (Spark 90 s,
+SAM 60 s, scene 180 s; a longer value in the env file wins), and a
+throwaway `SESSION_SECRET` when the env has none. Live calls run only on
+the operator's machine. CI stays on `AI_MOCK=1`.
 
 Limits that matter on a local run:
 
@@ -152,8 +218,14 @@ Limits that matter on a local run:
 
 ## 4. Drive one board per set
 
-Drive the local app over its public boards API, one board per set.
-These are the same calls `scripts/seed-demo-board.mjs` makes:
+```sh
+node scripts/showcase-build.mjs plan spec.json          # no network: checks the spec and the photos
+node scripts/showcase-build.mjs run spec.json cat --live # one set; --live only for a live app
+```
+
+`run` drives the local app over its public boards API, one board per
+set, and sets run one after another. These are the same calls
+`scripts/seed-demo-board.mjs` makes:
 
 1. `POST /api/boards` with `{ title, themeId }` creates the board.
    Keep its slug in memory only. A board slug is the board's access
@@ -179,16 +251,17 @@ Pick a scene's elements by a pattern on the label or description, not
 by an exact label. Spark names the same thing differently from run to
 run ("Smiling Woman", then "Selfie Woman").
 
-The spike's driver read a spec like this one, with photo paths
-pointing into the work folder:
+`run` reads a set spec like this one. Photo names are relative to the
+photos folder, so the spec holds no local path:
 
 ```json
 {
+  "id": "cat",
   "title": "Showcase: cat (synthetic)",
   "friends": [
-    { "name": "Aye", "photo": "<work folder>/cat.webp" },
-    { "name": "Ben", "photo": "<work folder>/beanie.webp" },
-    { "name": "Kim", "photo": "<work folder>/skateboard.webp" }
+    { "name": "Aye", "photo": "cat/aye.webp" },
+    { "name": "Ben", "photo": "cat/ben.webp" },
+    { "name": "Kim", "photo": "cat/kim.webp" }
   ],
   "scenes": [
     {
@@ -199,20 +272,63 @@ pointing into the work folder:
         { "friend": "Ben", "match": "beanie|hat" },
         { "friend": "Ben", "match": "heart|sunglass|glasses" },
         { "friend": "Kim", "match": "skate|board" }
-      ]
+      ],
+      "names": ["cat", "beanie", "sunglasses", "skateboard"]
     }
   ]
 }
 ```
 
-It wrote the downloads and a run record next to them: status and time
-per photo, labels, face flags, and each scene's status, kind and
-prompt version. Keep all of it in the work folder.
+The script checks the spec before it starts, so a mistake costs nothing:
+
+- 2 to 6 friends with made-up first names, and at most 3 scenes.
+- A scene prompt is at most 500 characters and has 1 to 4 picks
+  (`Policy.pinsPerScene`), from at least 2 friends.
+- The prompt must name every picked thing (each `match` must match
+  the prompt).
+- **Every item the prompt names must be a picked pin.** List those
+  items in `names`: each must be in the prompt and match some pick.
+  Muse Image draws an unpinned item from the text alone (PIN-171).
+- A scene runs only if every pick found a thing in the photos. A pick
+  prefers a label match to a description match, and one thing never
+  fills two picks.
+
+What `run` does and refuses:
+
+- It only talks to `localhost`, `127.0.0.1` or `[::1]`. A deployed app
+  needs `--allow-remote-base`.
+- It reads `/api/health` first. A live app (`aiMock: false`) needs
+  `--live`, because the run then makes paid calls.
+- It retries a failed photo once and logs each job's `errorCode`. A
+  refusal is not retried. It tries a scene up to `--scene-tries` times
+  (3) when it is refused, failed or came back as a collage.
+- It counts every photo and scene job against `--max-jobs` (24), and
+  refuses to start if the sets need more than that at the least.
+- It fails loudly (exit 1) on a scene that is refused or, on a live
+  app, a collage; a photo with no usable pin; a pick with no thing;
+  and a run over the cap. It still writes `run.json` and the contact
+  sheet, so the evidence is kept. After a failing set it stops
+  without starting the next.
+- A set's folder `out/<id>/` that already exists is moved aside to
+  `out/<id>-<time>/`, never overwritten or deleted.
+
+It writes, in `<work folder>/out/<set id>/`: each friend's photo
+(`photos/`), every cut-out (`<friend>-<n>-<label>-cutout.png`) and
+flattened picture (`...-flat.jpg`), each scene image, and `run.json`.
+The run record holds the labels, descriptions and mask boxes; face
+flags; each attempt's status, error code and time; each scene's status,
+kind, prompt version and pixel size; the model ids and the prompt
+versions (`elements.v1`, `scene.v1`); the job count and the failures.
+Keep all of it in the work folder.
 
 ## 5. Review and pick
 
-Put every cut-out and scene on one contact sheet (the spike's is
-`eval/contact-sheets/PIN-171-showcase-spike.jpg`). Pick:
+`run` writes `contact-sheet.html` next to `run.json` (open it in a
+browser; `node scripts/showcase-build.mjs sheet <set id>` rebuilds it).
+It shows each photo with the mask boxes and labels the app found, every
+cut-out on the Paper background with the sticker keyline, and every
+scene with its status, kind and tries. (The spike's was
+`eval/contact-sheets/PIN-171-showcase-spike.jpg`.) Pick:
 
 - the scene;
 - the step-1 photo and the two things to tag on it;
@@ -235,6 +351,33 @@ Write the picks into the set's folder, `public/landing/sets/<id>/`:
 360x640 is about twice the largest pile slot on a phone. A set weighs
 at most 220 KB in total (try-on: 148 KB, cat: 151 KB).
 
+`web` builds the files from the set's run record. Its spec names each
+picked file by a pattern on the label (as `run` does), never by a path:
+
+```json
+{
+  "set": "cat",
+  "items": [
+    { "type": "cutout", "id": "ginger-cat", "friend": "Aye", "match": "cat|tabby" },
+    { "type": "photo", "name": "photo-shelf-beanie-glasses", "friend": "Ben", "left": 0.14, "top": 0 },
+    { "type": "scene", "name": "scene-street-skate", "scene": "c1-street", "left": 0, "top": 0.1 }
+  ]
+}
+```
+
+```sh
+node scripts/showcase-build.mjs web web-spec.json            # writes public/landing/sets/<set>/
+node scripts/showcase-build.mjs web web-spec.json --out-dir <folder> --quality 78
+```
+
+- `left` and `top` place the square crop, as fractions of the picture's
+  width and height; the crop is kept inside the picture.
+- It writes only the files in the spec. It never deletes: a file left
+  from an earlier build stays, and the test fails on unused files, so
+  delete it yourself.
+- It reads each file back and fails (exit 1) on any EXIF, any IPTC
+  block, any XMP but the marker, or a set over the 220 KB budget.
+
 Metadata: write one XMP packet holding only the IPTC marker for media
 made by a trained model. Muse Image writes the same marker into its own
 output. Nothing else: no EXIF, no IPTC block, no other XMP. With sharp,
@@ -361,12 +504,17 @@ work folder, outside git.
 
 - Use synthetic pictures only, never a real person or a real photo,
   and made-up first names only.
-- Source photos, raw outputs, run records and specs stay outside git;
-  specs hold local paths.
+- Source photos, raw outputs and run records stay outside git: the
+  script's work folder, `.showcase-work/`, is git-ignored. A spec holds
+  only relative photo names, so it holds no local path and may be
+  committed (PIN-172's manifest is one).
 - The model key lives in the operator's env file outside the repo.
   Never copy, print or log it, and never paste it into a PR or Linear.
-- Board slugs are access keys: drivers keep them in memory and never
-  print them.
+  The script takes the env file path from `--env-file` or
+  `SHOWCASE_ENV_FILE`; the path is not written anywhere.
+- Board slugs are access keys: the driver keeps them in memory and never
+  prints them, logs them or writes them to `run.json` (a test checks
+  this, and every log line and error goes through a redactor).
 - Shipped pictures carry the AI-generated marker and no other
   metadata.
 
diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md
index 630e0abf..deabf3f0 100644
--- a/docs/DEPLOY.md
+++ b/docs/DEPLOY.md
@@ -43,6 +43,8 @@ Manager references by name.
 | `PINNED_LAB` | off | 1 | — (lab routes 404) |
 | `DEMO_BOARD_SLUG` | — | — | secret ref after seeding (§6) |
 | `LEGAL_CONTACT_EMAIL` | — (legal pages link to public GitHub issues) | `contact@moriacrew.com` | `contact@moriacrew.com` (a plain value: it is shown on `/privacy` and `/terms`) |
+| `DEMO_VIDEO_URL` | — (no video link) | `https://youtu.be/q6lkrA6fsCI` | `https://youtu.be/q6lkrA6fsCI` (PIN-263: "Watch the 3-minute demo" under How it works; https only, unset to hide) |
+| `PROMO_POST_URL` | — (no post link) | a test post | — until the launch post is published (PIN-263: "See the post on X" in the landing footer; https only) |
 | `runConfig` | — | base: min 0, max 2, 512 MiB | min **1**, max **4**, **1024 MiB**, concurrency 10 |
 | Secrets | — | `META_API_KEY`, `SESSION_SECRET`, `STRIPE_SECRET_KEY`, `STRIPE_WEBHOOK_SECRET`, `NEXT_PUBLIC_FIREBASE_API_KEY`, `NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN` | `META_API_KEY`, `SESSION_SECRET`, `NEXT_PUBLIC_FIREBASE_API_KEY`, `NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN` (+ Stripe and `DEMO_BOARD_SLUG` later) |
 
@@ -171,8 +173,9 @@ curl -s https://pinneds.com/api/health   # ok:true, aiMock:false, authMode:"opti
 curl -s -o /dev/null -w "%{http_code}\n" https://pinneds.com/lab/sam          # 404
 curl -s -o /dev/null -w "%{http_code}\n" https://pinneds.com/__/auth/handler  # 200
 curl -s -o /dev/null -w "%{http_code}\n" https://pinneds.com/api/me           # 401 when signed out
-curl -s -o /dev/null -w "%{http_code}\n" -X POST -H "Stripe-Signature: t=1,v1=bad" https://pinneds.com/api/billing/stripe/webhook   # 400: billing on, signature checked
-curl -s https://pinneds.com/ | grep -c 'href="/g/'   # 1: the landing demo link (DEMO_BOARD_SLUG); 0 on dev
+curl -s -o /dev/null -w "%{http_code}\n" -X POST -H "Stripe-Signature: t=1,v1=bad" -H "Content-Type: application/json" -d '{}' https://pinneds.com/api/billing/stripe/webhook   # 400: billing on, signature checked (411 without a body: the byte cap needs Content-Length)
+curl -s https://pinneds.com/ | grep -c 'action="/api/demo"'   # 1: the landing "See a board" form (DEMO_BOARD_SLUG set, PIN-251); 0 when the demo is off. The landing never links a board.
+curl -s -o /dev/null -w "%{http_code} %{redirect_url}\n" -X POST -H "sec-fetch-site: same-origin" -H "Content-Length: 0" https://pinneds.com/api/demo | sed -E 's#/g/[A-Za-z0-9_-]{22}#/g/<slug>#'   # 303 to a fresh demo board (a copy of the template, swept after its TTL); a second POST from the same address → 303 /?demo=busy (the per-address cap). Never record the slug; each POST uses one of this address's demo slots.
 # Languages (PIN-227): French browser → French, saved English wins, unknown → English
 curl -s -H "Accept-Language: fr-FR" https://pinneds.com/ | grep -o '<html lang="fr"\|Nos trucs, épinglés ensemble'
 curl -s -H "Accept-Language: fr-FR" -H "Cookie: pinneds_locale=en" https://pinneds.com/ | grep -o '<html lang="en"'
diff --git a/eval/showcase/README.md b/eval/showcase/README.md
index c05d2924..09090bd2 100644
--- a/eval/showcase/README.md
+++ b/eval/showcase/README.md
@@ -137,7 +137,7 @@ metadata (PIN-174).
 
 - Original photos, raw cut-outs and scenes stay outside git.
 - This note and the contact sheet are the only spike files in the repo.
-- The scratch driver becomes `scripts/showcase-build.mjs` in PIN-173.
+- The scratch driver became `scripts/showcase-build.mjs` (PIN-173).
 - The living step-by-step recipe for making, adding or changing a set
   is `docs/17-showcase-sets.md` (PIN-175); this note stays as the
   spike's record.
diff --git a/package.json b/package.json
index a514bed3..aff117e2 100644
--- a/package.json
+++ b/package.json
@@ -19,6 +19,7 @@
     "smoke:meta": "node scripts/meta-smoke.mjs",
     "spike:studio": "node scripts/studio-spike.mjs",
     "seed:demo": "node scripts/seed-demo-board.mjs",
+    "showcase": "node scripts/showcase-build.mjs",
     "seed:stripe-catalog": "node scripts/seed-stripe-catalog.mjs",
     "usage:report": "node scripts/usage-report.mjs",
     "usage:costs": "node scripts/usage-costs.mjs",
diff --git a/scripts/showcase-build.mjs b/scripts/showcase-build.mjs
new file mode 100644
index 00000000..85123aed
--- /dev/null
+++ b/scripts/showcase-build.mjs
@@ -0,0 +1,239 @@
+#!/usr/bin/env node
+/**
+ * PIN-173 showcase set builder (manual/operator, never in CI).
+ *
+ * Makes the landing's showcase sets (docs/17-showcase-sets.md) with the
+ * product's own code paths: source photos from Muse Image, then the local
+ * app turns them into cut-outs and scenes over its public boards API, then
+ * sharp builds the small WebP files with the AI-generated marker.
+ *
+ *   node scripts/showcase-build.mjs plan   <spec> [set...]        check the spec; no network
+ *   node scripts/showcase-build.mjs photos <items.json> [--live]  Muse Image source photos (PAID with --live)
+ *   node scripts/showcase-build.mjs serve  [--live --env-file F]  start the local app (mock unless --live)
+ *   node scripts/showcase-build.mjs run    <spec> [set...]        drive the local app, one set at a time
+ *   node scripts/showcase-build.mjs sheet  <set>...               rebuild a set's contact sheet
+ *   node scripts/showcase-build.mjs web    <web-spec>             build public/landing/sets/<set>/ files
+ *
+ * Every path comes from an option or an environment variable; nothing
+ * about this machine lives in the repo:
+ *   --work-dir    SHOWCASE_WORK_DIR    work folder, outside git or gitignored (default .showcase-work)
+ *   --photos-dir  SHOWCASE_PHOTOS_DIR  source photos (default <work>/photos)
+ *   --base-url    SHOWCASE_BASE_URL    the app (default http://localhost:3000; localhost only)
+ *   --env-file    SHOWCASE_ENV_FILE    the operator's env file, read only by live commands
+ *   --out-dir                          where `web` writes (default public/landing/sets)
+ *
+ * Board slugs, cookies and keys are never printed, logged or written.
+ * `run` fails loudly (exit 1) on a refused or collage scene on a live app,
+ * a photo with no usable pin, or a run over --max-jobs, and still writes
+ * run.json and the contact sheet so the evidence is kept.
+ */
+import { existsSync, mkdirSync, readFileSync, renameSync } from "node:fs";
+import path from "node:path";
+import { parseArgs } from "node:util";
+import { assertLocalBase, latestPromptVersion, listPromptFiles, missingPhotos, modelsFromEnv, readHealth, runSet } from "./showcase/driver.mjs";
+import { DEFAULT_IMAGE_CAP, generatePhotos, validatePhotoItems } from "./showcase/photos.mjs";
+import { REPO_ROOT, serveEnv, startServer } from "./showcase/serve.mjs";
+import { writeSheet } from "./showcase/sheet.mjs";
+import { JobBudget, listSetIds, parseSpec, planJobs } from "./showcase/spec.mjs";
+import { buildWeb, validateWebSpec } from "./showcase/web.mjs";
+
+const USAGE = readFileSync(new URL(import.meta.url), "utf8").split("*/")[0].split("\n").filter((l) => l.startsWith(" *")).map((l) => l.slice(3)).join("\n");
+
+const { values: opt, positionals } = parseArgs({
+  allowPositionals: true,
+  options: {
+    "work-dir": { type: "string" },
+    "photos-dir": { type: "string" },
+    "base-url": { type: "string" },
+    "env-file": { type: "string" },
+    "out-dir": { type: "string" },
+    port: { type: "string" },
+    live: { type: "boolean", default: false },
+    "allow-remote-base": { type: "boolean", default: false },
+    "max-jobs": { type: "string", default: "24" },
+    "scene-tries": { type: "string", default: "3" },
+    "image-cap": { type: "string", default: String(DEFAULT_IMAGE_CAP) },
+    baseline: { type: "string", default: "0" },
+    quality: { type: "string" },
+    force: { type: "boolean", default: false },
+    help: { type: "boolean", short: "h", default: false },
+  },
+});
+const [command, ...args] = positionals;
+
+const log = (text) => console.error(`[showcase] ${text}`);
+const die = (text, code = 2) => {
+  console.error(`[showcase] ${text}`);
+  process.exit(code);
+};
+const int = (name, text, min = 1) => {
+  const n = Number(text);
+  if (!Number.isInteger(n) || n < min) die(`--${name} must be a whole number of at least ${min}`);
+  return n;
+};
+
+const workDir = path.resolve(opt["work-dir"] ?? process.env.SHOWCASE_WORK_DIR ?? ".showcase-work");
+const photosDir = path.resolve(opt["photos-dir"] ?? process.env.SHOWCASE_PHOTOS_DIR ?? path.join(workDir, "photos"));
+const outRoot = path.join(workDir, "out");
+const envFile = opt["env-file"] ?? process.env.SHOWCASE_ENV_FILE;
+
+function loadEnvFile() {
+  if (!envFile) die("a live command needs the operator's env file: pass --env-file or set SHOWCASE_ENV_FILE");
+  if (typeof process.loadEnvFile !== "function") die("this Node cannot load an env file; use Node 20.12 or newer");
+  process.loadEnvFile(path.resolve(envFile));
+}
+
+/** The specs to use: the named sets, or every set in the file. All are checked before anything starts. */
+function loadSpecs(specPath, ids) {
+  if (!specPath) die("name the spec file");
+  const text = readFileSync(path.resolve(specPath), "utf8");
+  try {
+    return (ids.length ? ids : listSetIds(text)).map((id) => parseSpec(text, id));
+  } catch (error) {
+    return die(error.message);
+  }
+}
+
+async function plan() {
+  const specs = loadSpecs(args[0], args.slice(1));
+  const sceneTries = int("scene-tries", opt["scene-tries"]);
+  const jobs = planJobs(specs, { sceneTries });
+  let missing = 0;
+  for (const spec of specs) {
+    log(`${spec.id}: ${spec.friends.length} photos, ${spec.scenes.length} scenes`);
+    for (const photo of missingPhotos(spec, photosDir)) {
+      missing += 1;
+      log(`  missing photo ${photo}`);
+    }
+  }
+  log(`jobs: ${jobs.min} at least, ${jobs.max} at most (cap ${opt["max-jobs"]}); photos folder ${missing ? `is missing ${missing}` : "is complete"}`);
+  process.exit(missing || jobs.min > int("max-jobs", opt["max-jobs"]) ? 1 : 0);
+}
+
+async function photos() {
+  if (!args[0]) die("name the items file");
+  const items = JSON.parse(readFileSync(path.resolve(args[0]), "utf8"));
+  const problems = validatePhotoItems(items);
+  if (problems.length) die(`invalid items file:\n- ${problems.join("\n- ")}`);
+  const cap = int("image-cap", opt["image-cap"]);
+  const stateFile = path.join(workDir, "photos-state.json");
+  if (!opt.live) {
+    log(`${items.length} photos planned against an image cap of ${cap}. Nothing was generated: add --live to make them (paid calls).`);
+    return;
+  }
+  loadEnvFile();
+  const result = await generatePhotos(items, {
+    photosDir,
+    stateFile,
+    cap,
+    baseline: int("baseline", opt.baseline, 0),
+    force: opt.force,
+    baseUrl: process.env.META_API_BASE_URL,
+    key: process.env.META_API_KEY,
+    model: process.env.META_MODEL_IMAGE,
+    log,
+  });
+  log(`made ${result.made.length}, skipped ${result.skipped.length}, failed ${result.failed.length}`);
+  process.exit(result.failed.length ? 1 : 0);
+}
+
+async function serve() {
+  const port = int("port", opt.port ?? "3000");
+  if (opt.live) {
+    loadEnvFile();
+    log("LIVE app: model calls are paid. Daily stop: $10 and 2000 calls. Listening on localhost only.");
+  } else {
+    log("MOCK app (AI_MOCK=1): free, scenes are collages. Add --live --env-file for real models.");
+  }
+  process.exit(await startServer(serveEnv(process.env, { live: opt.live, port }), { port }));
+}
+
+/** Keep an earlier run of the set: move its folder aside instead of overwriting or deleting it. */
+function freshOutDir(id) {
+  const dir = path.join(outRoot, id);
+  if (existsSync(dir)) renameSync(dir, `${dir}-${new Date().toISOString().replace(/[-:]|\.\d+Z$/g, "")}`);
+  mkdirSync(dir, { recursive: true });
+  return dir;
+}
+
+async function run() {
+  const specs = loadSpecs(args[0], args.slice(1));
+  const maxJobs = int("max-jobs", opt["max-jobs"]);
+  const sceneTries = int("scene-tries", opt["scene-tries"]);
+  const jobs = planJobs(specs, { sceneTries });
+  if (jobs.min > maxJobs) die(`these sets need at least ${jobs.min} model jobs; --max-jobs is ${maxJobs}`);
+  // Before an earlier run's folder is moved aside: a run that cannot start must not touch it.
+  for (const spec of specs) {
+    const absent = missingPhotos(spec, photosDir);
+    if (absent.length) die(`${spec.id}: photos not found in the photos folder: ${absent.join(", ")} (see plan)`);
+  }
+  let base;
+  try {
+    base = assertLocalBase(opt["base-url"] ?? process.env.SHOWCASE_BASE_URL ?? "http://localhost:3000", { allowRemote: opt["allow-remote-base"] });
+  } catch (error) {
+    return die(error.message);
+  }
+  if (envFile) loadEnvFile(); // only to record the model ids the app was started with
+  const { aiMock } = await readHealth(base).catch((error) => die(error.message));
+  if (!aiMock && !opt.live) die("the app is LIVE, so this run makes paid model calls: pass --live to go ahead");
+  log(`${aiMock ? "mock" : "LIVE"} app at ${base}; up to ${jobs.max} model jobs (cap ${maxJobs})`);
+
+  const promptFiles = listPromptFiles(path.join(REPO_ROOT, "prompts"));
+  const budget = new JobBudget(maxJobs);
+  let failed = 0;
+  for (const spec of specs) {
+    const outDir = freshOutDir(spec.id);
+    let outcome;
+    try {
+      outcome = await runSet(spec, {
+        base,
+        photosDir,
+        outDir,
+        budget,
+        sceneTries,
+        mock: aiMock,
+        log,
+        models: modelsFromEnv(process.env),
+        promptVersions: { elements: latestPromptVersion(promptFiles, "elements"), scene: latestPromptVersion(promptFiles, "scene") },
+      });
+    } catch (error) {
+      die(`${spec.id}: ${error.message}`, 1);
+    }
+    writeSheet(outcome.run, outDir);
+    log(`${spec.id}: ${outcome.failures.length ? `${outcome.failures.length} FAILURES` : "ok"}, ${outcome.run.jobs} jobs; contact-sheet.html and run.json in ${path.relative(process.cwd(), outDir) || "."}`);
+    failed += outcome.failures.length;
+    if (outcome.failures.length) break; // stop at the first set that fails: do not spend on the next
+  }
+  process.exit(failed ? 1 : 0);
+}
+
+async function sheet() {
+  if (!args.length) die("name the set(s)");
+  for (const id of args) {
+    const dir = path.join(outRoot, id);
+    if (!existsSync(path.join(dir, "run.json"))) die(`no run record for "${id}" in the work folder`);
+    log(`wrote ${path.relative(process.cwd(), writeSheet(JSON.parse(readFileSync(path.join(dir, "run.json"), "utf8")), dir))}`);
+  }
+}
+
+async function web() {
+  if (!args[0]) die("name the web spec");
+  const spec = JSON.parse(readFileSync(path.resolve(args[0]), "utf8"));
+  const errors = validateWebSpec(spec);
+  if (errors.length) die(`invalid web spec:\n- ${errors.join("\n- ")}`);
+  const dir = path.join(outRoot, spec.set);
+  if (!existsSync(path.join(dir, "run.json"))) die(`no run record for "${spec.set}" in the work folder`);
+  const destDir = path.resolve(opt["out-dir"] ?? path.join("public", "landing", "sets"), spec.set);
+  const quality = opt.quality === undefined ? undefined : int("quality", opt.quality, 40);
+  const { written, folderBytes, problems } = await buildWeb(spec, JSON.parse(readFileSync(path.join(dir, "run.json"), "utf8")), { outDir: dir, destDir, quality });
+  log(`${written.length} files, ${(folderBytes / 1024).toFixed(1)} KB in ${path.relative(process.cwd(), destDir)}`);
+  for (const problem of problems) log(`PROBLEM ${problem}`);
+  process.exit(problems.length ? 1 : 0);
+}
+
+const COMMANDS = { plan, photos, serve, run, sheet, web };
+if (opt.help || !COMMANDS[command]) {
+  console.error(USAGE);
+  process.exit(opt.help ? 0 : 2);
+}
+await COMMANDS[command]();
diff --git a/scripts/showcase/driver.mjs b/scripts/showcase/driver.mjs
new file mode 100644
index 00000000..ed423888
--- /dev/null
+++ b/scripts/showcase/driver.mjs
@@ -0,0 +1,309 @@
+/**
+ * Drive one showcase set through the local app (PIN-173, docs/17 step 4).
+ *
+ * Uses only the public boards API, like scripts/seed-demo-board.mjs:
+ * create board -> join each friend -> upload the photo -> poll the
+ * decompose job -> confirm the pins -> make each scene from the picked
+ * things -> download every cut-out, flattened picture and scene.
+ *
+ * A board slug is the board's access key: it stays in memory. Every log
+ * line and error goes through a redactor that knows the slug and the
+ * session cookies, and run.json never holds either.
+ */
+import { copyFileSync, existsSync, mkdirSync, readdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { BudgetError, resolveScenePicks } from "./spec.mjs";
+
+/** Mirrors DEFAULT_META_MODELS in src/config.ts (PIN-59); a test keeps the two in step. */
+export const DEFAULT_MODELS = Object.freeze({ spark: "muse-spark-1.3", sam: "sam-3.1", image: "muse-image-1.0" });
+
+const LOCAL_BASE_RE = /^http:\/\/(localhost|127\.0\.0\.1|\[::1\])(:\d{1,5})?$/;
+const MIME = { ".png": "image/png", ".webp": "image/webp", ".jpg": "image/jpeg", ".jpeg": "image/jpeg" };
+const EXT = { "image/png": ".png", "image/webp": ".webp", "image/jpeg": ".jpg" };
+const ENDED = new Set(["ready", "failed", "refused"]);
+
+/**
+ * The app's base URL. Only localhost is allowed, because a run uploads photos and starts
+ * model jobs; `allowRemote` is the explicit flag for any other http(s) origin.
+ */
+export function assertLocalBase(url, { allowRemote = false } = {}) {
+  const base = String(url).replace(/\/+$/, "");
+  if (LOCAL_BASE_RE.test(base)) return base;
+  if (allowRemote && /^https?:\/\/[^/\s@?#]+$/.test(base)) return base;
+  throw new Error("the base URL must be http://localhost, http://127.0.0.1 or http://[::1] (pass --allow-remote-base only on purpose)");
+}
+
+/** A function that replaces every known secret in a string. The list can grow while the run goes on. */
+export function makeRedactor(secrets) {
+  return (text) => secrets.reduce((out, secret) => (secret ? out.split(secret).join("[redacted]") : out), String(text));
+}
+
+/** `name=value` pairs from Set-Cookie headers, ready for a Cookie header. */
+export const cookieHeader = (setCookies) => setCookies.map((c) => c.split(";")[0]).join("; ");
+
+export const slugify = (text, fallback = "thing") =>
+  String(text).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 40) || fallback;
+
+/** The newest template version in the prompts folder for a name, e.g. "elements.v1". */
+export function latestPromptVersion(fileNames, name) {
+  const versions = fileNames
+    .map((file) => file.match(new RegExp(`^${name}\\.v(\\d+)\\.md$`))?.[1])
+    .filter(Boolean)
+    .map(Number);
+  return versions.length ? `${name}.v${Math.max(...versions)}` : null;
+}
+
+export const modelsFromEnv = (env) => ({
+  spark: env.META_MODEL_SPARK || DEFAULT_MODELS.spark,
+  sam: env.META_MODEL_SAM || DEFAULT_MODELS.sam,
+  image: env.META_MODEL_IMAGE || DEFAULT_MODELS.image,
+});
+
+/** The photo names of a set that are not in the photos folder. */
+export const missingPhotos = (spec, photosDir) => spec.friends.map((f) => f.photo).filter((photo) => !existsSync(path.join(photosDir, photo)));
+
+/** What the server says about itself (/api/health): whether models are mocked. */
+export async function readHealth(base, fetchImpl = fetch) {
+  let res;
+  try {
+    res = await fetchImpl(`${base}/api/health`);
+  } catch {
+    throw new Error("cannot reach the app: start it with `node scripts/showcase-build.mjs serve`");
+  }
+  const body = await res.json().catch(() => ({}));
+  if (!res.ok || body.ok !== true || typeof body.aiMock !== "boolean") throw new Error(`the app's health check failed (HTTP ${res.status})`);
+  return { aiMock: body.aiMock };
+}
+
+/**
+ * Run one set. `ctx`: { base, photosDir, outDir, budget, sceneTries, mock, log,
+ * models, promptVersions, fetchImpl, sleep, pollMs, timeoutMs }.
+ * Always writes <outDir>/run.json and returns { run, failures }; the caller exits non-zero on failures.
+ */
+export async function runSet(spec, ctx) {
+  const { base, photosDir, outDir, budget, log } = ctx;
+  const fetchImpl = ctx.fetchImpl ?? fetch;
+  const sleep = ctx.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+  const pollMs = ctx.pollMs ?? 1500;
+  const timeoutMs = ctx.timeoutMs ?? 300_000;
+  const sceneTries = ctx.sceneTries ?? 3;
+  const secrets = [];
+  const redact = makeRedactor(secrets);
+  const say = (text) => log(redact(`[${spec.id}] ${text}`));
+  const failures = [];
+  const fail = (text) => {
+    failures.push(redact(text));
+    say(`FAILED ${text}`);
+  };
+
+  const absent = missingPhotos(spec, photosDir);
+  if (absent.length) throw new Error(`photos not found in the photos folder: ${absent.join(", ")}`);
+  mkdirSync(path.join(outDir, "photos"), { recursive: true });
+
+  const t0 = Date.now();
+  const run = {
+    schema: 1,
+    set: spec.id,
+    title: spec.title,
+    startedAt: new Date(t0).toISOString(),
+    mock: Boolean(ctx.mock),
+    models: ctx.models,
+    promptVersions: { ...ctx.promptVersions },
+    jobs: 0,
+    friends: [],
+    scenes: [],
+    failures,
+  };
+
+  async function api(route, { method = "GET", cookie, json, form } = {}) {
+    const res = await fetchImpl(`${base}${route}`, {
+      method,
+      headers: { origin: base, ...(cookie ? { cookie } : {}), ...(json !== undefined ? { "content-type": "application/json" } : {}) },
+      body: form ?? (json !== undefined ? JSON.stringify(json) : undefined),
+    });
+    const text = await res.text();
+    let body = {};
+    try {
+      body = JSON.parse(text);
+    } catch {
+      /* a non-JSON body: the status is enough */
+    }
+    return { res, body };
+  }
+  // The app's friendly error line only, capped: never a whole body.
+  const httpError = (step, r) => new Error(redact(`${step}: HTTP ${r.res.status} ${typeof r.body?.error === "string" ? r.body.error.slice(0, 200) : ""}`.trim()));
+
+  async function pollUntil(label, step) {
+    const deadline = Date.now() + timeoutMs;
+    for (;;) {
+      const out = await step();
+      if (out.done) return out.value;
+      if (Date.now() > deadline) throw new Error(`${label} timed out after ${Math.round(timeoutMs / 1000)} s`);
+      await sleep(pollMs);
+    }
+  }
+
+  async function download(route, stem, cookie) {
+    const res = await fetchImpl(`${base}${route}`, { headers: cookie ? { cookie } : {} });
+    if (!res.ok) throw new Error(`download ${path.basename(stem)}: HTTP ${res.status}`);
+    const ext = EXT[(res.headers.get("content-type") || "").split(";")[0].trim()];
+    if (!ext) throw new Error(`download ${path.basename(stem)}: not an image`);
+    writeFileSync(`${stem}${ext}`, Buffer.from(await res.arrayBuffer()));
+    return path.basename(`${stem}${ext}`);
+  }
+
+  try {
+    const created = await api("/api/boards", { method: "POST", json: { title: spec.title, themeId: spec.themeId || "paper" } });
+    if (!created.res.ok) throw httpError("create board (10 per hour per server; restart it to reset)", created);
+    const slug = created.body.board?.slug;
+    if (!slug) throw new Error("create board: no board in the answer");
+    secrets.push(slug);
+    say("board created (slug withheld)");
+
+    const cookies = {};
+    const elements = []; // { id, friend, label, description, maskBox, faceFlag, files }
+
+    for (const friend of spec.friends) {
+      const joined = await api(`/api/boards/${slug}/participants`, { method: "POST", json: { displayName: friend.name } });
+      if (!joined.res.ok) throw httpError(`join ${friend.name}`, joined);
+      const cookie = cookieHeader(joined.res.headers.getSetCookie?.() ?? []);
+      cookies[friend.name] = cookie;
+      secrets.push(...cookie.split("; ").map((pair) => pair.slice(pair.indexOf("=") + 1)).filter((v) => v.length >= 8));
+
+      const photoPath = path.join(photosDir, friend.photo);
+      const photoExt = path.extname(friend.photo).toLowerCase();
+      const photoFile = `photos/${slugify(friend.name)}${photoExt}`;
+      copyFileSync(photoPath, path.join(outDir, photoFile));
+      const record = { name: friend.name, photo: friend.photo, photoFile, status: "pending", attempts: [], faceNote: null, elements: [] };
+      run.friends.push(record);
+
+      // One retry: a photo failed once while two sets decomposed at once and worked on the second go (PIN-171).
+      let view = null;
+      for (let attempt = 1; attempt <= 2 && !view; attempt += 1) {
+        budget.spend(`the photo of ${friend.name}`);
+        run.jobs += 1;
+        const form = new FormData();
+        form.append("photo", new Blob([readFileSync(photoPath)], { type: MIME[photoExt] }), path.basename(friend.photo));
+        const tStart = Date.now();
+        const up = await api(`/api/boards/${slug}/photos`, { method: "POST", cookie, form });
+        if (!up.res.ok) throw httpError(`upload ${friend.name}`, up);
+        const jobId = up.body.job?.id;
+        const polled = await pollUntil(`the photo of ${friend.name}`, async () => {
+          const p = await api(`/api/boards/${slug}/jobs/${jobId}`, { cookie });
+          if (!p.res.ok) throw httpError("job poll", p);
+          return ENDED.has(p.body.job?.status) ? { done: true, value: p.body } : { done: false };
+        });
+        const usable = polled.job.status === "ready" && (polled.elements?.length ?? 0) > 0 && (polled.pins?.length ?? 0) > 0;
+        record.attempts.push({
+          status: polled.job.status,
+          usable,
+          errorCode: polled.job.errorCode ?? null,
+          ms: Date.now() - tStart,
+        });
+        say(`${friend.name}: attempt ${attempt} ${polled.job.status}${polled.job.errorCode ? ` (${polled.job.errorCode})` : ""}${usable ? "" : " - no usable pin"}`);
+        if (usable) view = polled;
+        else if (polled.job.status === "refused") break; // a refusal is the answer; do not retry
+      }
+      record.status = view ? "ready" : record.attempts.at(-1)?.status === "refused" ? "refused" : "failed";
+      if (!view) {
+        fail(`${friend.name}: no usable pin from ${record.photo} (${record.attempts.map((a) => a.errorCode ?? a.status).join(", ")})`);
+        continue;
+      }
+      record.faceNote = view.job.faceNote ?? null;
+
+      // Keep the full candidate list: the scene picks come from it.
+      const confirmed = await api(`/api/boards/${slug}/pins/confirm`, {
+        method: "POST",
+        cookie,
+        json: { jobId: view.job.id, pinIds: view.pins.map((p) => p.id) },
+      });
+      if (!confirmed.res.ok) throw httpError(`confirm ${friend.name}`, confirmed);
+
+      let n = 0;
+      for (const e of view.elements) {
+        const stem = path.join(outDir, `${slugify(friend.name)}-${n}-${slugify(e.label)}`);
+        n += 1;
+        const files = {
+          cutout: await download(`/api/boards/${slug}/elements/${e.id}/image?kind=cutout`, `${stem}-cutout`, cookie),
+          flat: await download(`/api/boards/${slug}/elements/${e.id}/image?kind=flattened`, `${stem}-flat`, cookie),
+        };
+        elements.push({ id: e.id, friend: friend.name, label: e.label, description: e.description, maskBox: e.maskBox, faceFlag: e.faceFlag, files });
+        record.elements.push({ label: e.label, description: e.description, maskBox: e.maskBox, faceFlag: e.faceFlag, files });
+      }
+      say(`${friend.name}: ${record.elements.map((e) => e.label + (e.faceFlag ? " [face]" : "")).join(", ")}`);
+    }
+
+    for (const scene of spec.scenes) {
+      const { ids, picked, missing } = resolveScenePicks(scene, elements);
+      const entry = { id: scene.id, prompt: scene.prompt, picked, attempts: [], status: "skipped", kind: null, file: null };
+      run.scenes.push(entry);
+      if (missing.length) {
+        // Never run it: Muse Image would draw the missing thing from the prompt text alone.
+        fail(`scene ${scene.id}: no pin for ${missing.map((m) => `${m.friend} /${m.match}/`).join(", ")}`);
+        continue;
+      }
+      const cookie = cookies[scene.as ?? spec.friends[0].name];
+      let result = null;
+      let refused = false; // the server said no outright: a limit or a bad request, not worth a retry
+      for (let attempt = 1; attempt <= sceneTries && !result && !refused; attempt += 1) {
+        budget.spend(`scene ${scene.id}`);
+        run.jobs += 1;
+        const tStart = Date.now();
+        const posted = await api(`/api/boards/${slug}/scenes`, { method: "POST", cookie, json: { elementIds: ids, prompt: scene.prompt } });
+        if (!posted.res.ok) {
+          // Recorded as an attempt; it becomes a failure only if no later try works.
+          entry.attempts.push({ status: `http-${posted.res.status}`, error: httpError("request", posted).message, ms: Date.now() - tStart });
+          refused = posted.res.status < 500;
+          continue;
+        }
+        let card = posted.body.scene;
+        if (card && !ENDED.has(card.status)) {
+          card = await pollUntil(`scene ${scene.id}`, async () => {
+            const p = await api(`/api/boards/${slug}/scenes/${card.id}`, { cookie });
+            if (!p.res.ok) throw httpError(`scene ${scene.id} poll`, p);
+            const s = p.body.scene;
+            return s && ENDED.has(s.status) ? { done: true, value: s } : { done: false };
+          });
+        }
+        const accepted = card?.status === "ready" && (card.kind === "ai" || ctx.mock);
+        entry.attempts.push({
+          status: card?.status ?? "unknown",
+          kind: card?.kind ?? null,
+          refusalReason: card?.refusalReason ?? null,
+          errorCode: posted.body.job?.errorCode ?? null,
+          ms: Date.now() - tStart,
+        });
+        say(`scene ${scene.id}: attempt ${attempt} ${card?.status} (${card?.kind})`);
+        if (accepted) result = card;
+      }
+      const last = entry.attempts.at(-1);
+      if (!result) {
+        entry.status = last?.status ?? "skipped";
+        entry.kind = last?.kind ?? null;
+        const why = last?.error
+          ? last.error
+          : last?.status === "ready"
+            ? `came back as ${last.kind}, not an AI scene`
+            : `${last?.status}${last?.refusalReason ? ` (${last.refusalReason})` : ""}`;
+        fail(`scene ${scene.id}: ${why} after ${entry.attempts.length} tries`);
+        continue;
+      }
+      entry.status = result.status;
+      entry.kind = result.kind;
+      entry.promptVersion = result.promptVersion ?? null;
+      entry.width = result.width ?? null;
+      entry.height = result.height ?? null;
+      if (result.promptVersion) run.promptVersions.scene = result.promptVersion;
+      entry.file = await download(`/api/boards/${slug}/scenes/${result.id}/image`, path.join(outDir, `scene-${slugify(scene.id)}`), cookie);
+    }
+  } catch (error) {
+    fail(error instanceof BudgetError ? error.message : `stopped: ${error.message}`);
+  } finally {
+    run.totalMs = Date.now() - t0;
+    writeFileSync(path.join(outDir, "run.json"), `${JSON.stringify(run, null, 1)}\n`);
+  }
+  return { run, failures };
+}
+
+/** Prompt template file names, for `latestPromptVersion`. */
+export const listPromptFiles = (promptsDir) => (existsSync(promptsDir) ? readdirSync(promptsDir) : []);
diff --git a/scripts/showcase/driver.test.mjs b/scripts/showcase/driver.test.mjs
new file mode 100644
index 00000000..aeda1233
--- /dev/null
+++ b/scripts/showcase/driver.test.mjs
@@ -0,0 +1,225 @@
+import { existsSync, readFileSync, readdirSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { DEFAULT_MODELS, assertLocalBase, cookieHeader, latestPromptVersion, makeRedactor, modelsFromEnv, readHealth, runSet, slugify } from "./driver.mjs";
+import { JobBudget } from "./spec.mjs";
+import { SLUG, catSpec, cookieFor, makeWorkspace, startFakeApp } from "./test-support.mjs";
+
+describe("assertLocalBase", () => {
+  it("allows the local app only", () => {
+    expect(assertLocalBase("http://localhost:3000/")).toBe("http://localhost:3000");
+    expect(assertLocalBase("http://127.0.0.1:3100")).toBe("http://127.0.0.1:3100");
+    expect(assertLocalBase("http://[::1]:3000")).toBe("http://[::1]:3000");
+    for (const url of ["https://localhost:3000", "http://example.com", "http://localhost.evil.com", "http://localhost@evil.com", "http://evil.com/localhost", "http://192.168.1.5:3000", "ftp://localhost"]) {
+      expect(() => assertLocalBase(url), url).toThrow("the base URL must be http://localhost");
+    }
+  });
+
+  it("allows another origin only when asked, and never one with credentials or a path", () => {
+    expect(assertLocalBase("https://dev.example.com", { allowRemote: true })).toBe("https://dev.example.com");
+    expect(() => assertLocalBase("https://user:pw@dev.example.com", { allowRemote: true })).toThrow();
+    expect(() => assertLocalBase("https://dev.example.com/api", { allowRemote: true })).toThrow();
+  });
+});
+
+describe("small helpers", () => {
+  it("redacts every known secret", () => {
+    const secrets = ["slug-1234567"];
+    const redact = makeRedactor(secrets);
+    expect(redact("board slug-1234567 failed")).toBe("board [redacted] failed");
+    secrets.push("cookie-abcdef");
+    expect(redact("slug-1234567 / cookie-abcdef / slug-1234567")).toBe("[redacted] / [redacted] / [redacted]");
+  });
+
+  it("builds a cookie header, file slugs, prompt versions and model ids", () => {
+    expect(cookieHeader(["a=1; Path=/; HttpOnly", "b=2; Path=/"])).toBe("a=1; b=2");
+    expect(slugify("Red Heart-Shaped Sunglasses!")).toBe("red-heart-shaped-sunglasses");
+    expect(slugify("???")).toBe("thing");
+    expect(latestPromptVersion(["elements.v1.md", "elements.v2.md", "scene.v1.md", "README.md"], "elements")).toBe("elements.v2");
+    expect(latestPromptVersion(["scene.v1.md"], "elements")).toBeNull();
+    expect(modelsFromEnv({})).toEqual(DEFAULT_MODELS);
+    expect(modelsFromEnv({ META_MODEL_IMAGE: "muse-image-2" }).image).toBe("muse-image-2");
+  });
+
+  it("uses the model ids the app defaults to (src/config.ts)", () => {
+    const config = readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), "../../src/config.ts"), "utf8");
+    const block = config.match(/DEFAULT_META_MODELS = \{([^}]*)\}/)[1];
+    for (const [key, value] of Object.entries(DEFAULT_MODELS)) expect(block).toContain(`${key}: "${value}"`);
+  });
+});
+
+describe("runSet against a fake app", () => {
+  let app;
+  let work;
+  let logs;
+  beforeEach(() => {
+    work = makeWorkspace();
+    logs = [];
+  });
+  afterEach(async () => {
+    await app?.close();
+  });
+
+  const run = (spec = catSpec(), extra = {}) =>
+    runSet(spec, {
+      base: app.base,
+      photosDir: work.photosDir,
+      outDir: work.outDir,
+      budget: new JobBudget(20),
+      sceneTries: 3,
+      mock: false,
+      log: (line) => logs.push(line),
+      models: DEFAULT_MODELS,
+      promptVersions: { elements: "elements.v1", scene: null },
+      sleep: async () => {},
+      pollMs: 0,
+      timeoutMs: 5000,
+      ...extra,
+    });
+  const sceneRequests = () => app.requests.filter((r) => r.route === "POST /api/boards/:slug/scenes");
+
+  it("drives a whole set and writes the run record and the downloads", async () => {
+    app = await startFakeApp();
+    const { run: record, failures } = await run();
+
+    expect(failures).toEqual([]);
+    expect(record.jobs).toBe(4); // 3 photos + 1 scene
+    expect(record.friends.map((f) => [f.name, f.status, f.elements.map((e) => e.label)])).toEqual([
+      ["Aye", "ready", ["Ginger Tabby Cat"]],
+      ["Ben", "ready", ["Green Beanie", "Red Heart Sunglasses"]],
+      ["Kim", "ready", ["Patterned Skateboard"]],
+    ]);
+    expect(record.friends[1].elements[0]).toMatchObject({ maskBox: { x1: 0.1, y1: 0.2, x2: 0.5, y2: 0.8 }, faceFlag: false, files: { cutout: "ben-0-green-beanie-cutout.png", flat: "ben-0-green-beanie-flat.png" } });
+    expect(record.scenes[0]).toMatchObject({ id: "c1-street", status: "ready", kind: "ai", promptVersion: "scene.v1", width: 1280, height: 1920, file: "scene-c1-street.webp" });
+    expect(record.promptVersions).toEqual({ elements: "elements.v1", scene: "scene.v1" });
+    expect(readdirSync(work.outDir).sort()).toContain("scene-c1-street.webp");
+    expect(existsSync(path.join(work.outDir, "photos", "ben.webp"))).toBe(true);
+    expect(JSON.parse(readFileSync(path.join(work.outDir, "run.json"), "utf8")).set).toBe("cat");
+  });
+
+  it("sends the picked things to the scene in pick order", async () => {
+    app = await startFakeApp();
+    await run();
+    const body = JSON.parse(sceneRequests()[0].body);
+    expect(body.elementIds).toEqual(["el-Aye-0", "el-Ben-0", "el-Ben-1", "el-Kim-0"]);
+    expect(body.prompt).toContain("riding the skateboard");
+  });
+
+  it("never prints or saves the board slug or a session cookie", async () => {
+    app = await startFakeApp({ uploadError: true });
+    const { run: record } = await run();
+    const everything = [...logs, JSON.stringify(record), readFileSync(path.join(work.outDir, "run.json"), "utf8")].join("\n");
+    expect(everything).not.toContain(SLUG);
+    for (const name of ["Aye", "Ben", "Kim"]) expect(everything).not.toContain(cookieFor(name));
+    expect(logs.join("\n")).toContain("board created (slug withheld)");
+    // The upload error carried the slug in its message; it came out redacted.
+    expect(record.failures.join("\n")).toContain("[redacted]");
+  });
+
+  it("shows at most a short line of the app's error, never a whole body", async () => {
+    app = await startFakeApp({ uploadError: "x".repeat(5000) });
+    const { failures } = await run();
+    expect(failures).toHaveLength(1);
+    expect(failures[0]).toContain("upload Aye: HTTP 500");
+    expect(failures[0].length).toBeLessThan(300);
+  });
+
+  it("retries a failed photo once and records the error code", async () => {
+    app = await startFakeApp({ photo: { Ben: ["failed", "ready"] } });
+    const { run: record, failures } = await run();
+    expect(failures).toEqual([]);
+    expect(record.jobs).toBe(5);
+    expect(record.friends[1].attempts).toMatchObject([
+      { status: "failed", usable: false, errorCode: "model_timeout" },
+      { status: "ready", usable: true, errorCode: null },
+    ]);
+  });
+
+  it("fails loudly when a photo has no usable pin twice, and does not spend on the scene", async () => {
+    app = await startFakeApp({ photo: { Kim: ["failed", "failed"] } });
+    const { run: record, failures } = await run();
+    expect(record.friends[2].status).toBe("failed");
+    expect(failures).toEqual([expect.stringContaining("Kim: no usable pin from cat/kim.webp (model_timeout, model_timeout)"), expect.stringContaining("scene c1-street: no pin for Kim /skate|board/")]);
+    expect(sceneRequests()).toHaveLength(0);
+    expect(record.scenes[0].status).toBe("skipped");
+  });
+
+  it("fails after the scene tries are spent on refusals", async () => {
+    app = await startFakeApp({ scene: [{ status: "refused", kind: "ai" }] });
+    const { run: record, failures } = await run();
+    expect(sceneRequests()).toHaveLength(3);
+    expect(record.jobs).toBe(6);
+    expect(record.scenes[0].attempts.map((a) => a.status)).toEqual(["refused", "refused", "refused"]);
+    expect(failures).toEqual(["scene c1-street: refused (policy) after 3 tries"]);
+  });
+
+  it("takes a later try that works", async () => {
+    app = await startFakeApp({ scene: [{ status: "refused", kind: "ai" }, { status: "ready", kind: "ai" }] });
+    const { run: record, failures } = await run();
+    expect(failures).toEqual([]);
+    expect(record.scenes[0].attempts.map((a) => a.status)).toEqual(["refused", "ready"]);
+  });
+
+  it("retries a scene request the server failed on, and counts it as a failure only if no try works", async () => {
+    app = await startFakeApp({ sceneHttp: [503] });
+    const { run: record, failures } = await run();
+    expect(failures).toEqual([]);
+    expect(record.scenes[0].attempts.map((a) => a.status)).toEqual(["http-503", "ready"]);
+    expect(record.jobs).toBe(5);
+
+    work = makeWorkspace();
+    await app.close();
+    app = await startFakeApp({ sceneHttp: [503, 503, 503] });
+    const spent = await run();
+    expect(spent.failures).toEqual(["scene c1-street: request: HTTP 503 busy after 3 tries"]);
+  });
+
+  it("does not retry a scene the server turned down with a limit", async () => {
+    app = await startFakeApp({ sceneHttp: [429] });
+    const { run: record, failures } = await run();
+    expect(sceneRequests()).toHaveLength(1);
+    expect(failures).toEqual(["scene c1-street: request: HTTP 429 busy after 1 tries"]);
+    expect(record.scenes[0].status).toBe("http-429");
+  });
+
+  it("rejects a collage from a live app, and accepts it from a mock one", async () => {
+    app = await startFakeApp({ scene: [{ status: "ready", kind: "collage" }] });
+    const live = await run();
+    expect(live.failures).toEqual(["scene c1-street: came back as collage, not an AI scene after 3 tries"]);
+    expect(live.run.scenes[0].file).toBeNull();
+
+    work = makeWorkspace();
+    const mock = await run(catSpec(), { mock: true });
+    expect(mock.failures).toEqual([]);
+    expect(mock.run).toMatchObject({ mock: true, scenes: [{ status: "ready", kind: "collage", file: "scene-c1-street.webp" }] });
+  });
+
+  it("stops at the job cap and still writes the run record", async () => {
+    app = await startFakeApp();
+    const { run: record, failures } = await run(catSpec(), { budget: new JobBudget(2) });
+    expect(failures).toEqual([expect.stringContaining("job cap of 2 reached before the photo of Kim")]);
+    expect(record.jobs).toBe(2);
+    expect(existsSync(path.join(work.outDir, "run.json"))).toBe(true);
+  });
+
+  it("does not start when a photo is missing from the photos folder", async () => {
+    app = await startFakeApp();
+    const spec = catSpec();
+    spec.friends[1].photo = "cat/missing.webp";
+    await expect(run(spec)).rejects.toThrow("photos not found in the photos folder: cat/missing.webp");
+    expect(app.requests).toHaveLength(0);
+  });
+});
+
+describe("readHealth", () => {
+  it("reports whether the app mocks its models", async () => {
+    const app = await startFakeApp({ mock: true });
+    expect(await readHealth(app.base)).toEqual({ aiMock: true });
+    await app.close();
+  });
+
+  it("explains when the app is not running", async () => {
+    await expect(readHealth("http://127.0.0.1:9")).rejects.toThrow("cannot reach the app");
+  });
+});
diff --git a/scripts/showcase/photos.mjs b/scripts/showcase/photos.mjs
new file mode 100644
index 00000000..c9ccb086
--- /dev/null
+++ b/scripts/showcase/photos.mjs
@@ -0,0 +1,141 @@
+/**
+ * Muse Image text-to-image for the friends' source photos (PIN-173, docs/17 step 2).
+ *
+ * One call per photo (`POST {META_API_BASE_URL}/images/generations`), one at a
+ * time, against a hard image cap counted in a state file in the work folder.
+ * The key comes from the environment (the operator's env file) and is sent only
+ * to that endpoint. Logs hold status, timing and size, never the key, a prompt
+ * or the response body. These are PAID calls: the CLI plans by default and
+ * needs `--live` to make them.
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import path from "node:path";
+import { isRelativePhotoName } from "./spec.mjs";
+
+export const PHOTO_SIZES = ["1024x1536", "1536x1024", "1024x1024"];
+export const DEFAULT_IMAGE_CAP = 40;
+const PROMPT_MAX = 2000;
+const DEFAULT_BASE = "https://api.meta.ai/v1";
+const DEFAULT_MODEL = "muse-image-1.0"; // DEFAULT_META_MODELS.image in src/config.ts
+
+/** The items file: `[ { "out": "cat/aye.webp", "size": "1536x1024", "prompt": "..." } ]`. Returns the problems found. */
+export function validatePhotoItems(items) {
+  if (!Array.isArray(items) || items.length === 0) return ["the items file must be a list of photos"];
+  const errors = [];
+  const seen = new Set();
+  items.forEach((item, i) => {
+    const at = `items[${i}]`;
+    if (!isRelativePhotoName(item?.out)) errors.push(`${at}: out must be a relative .webp, .jpg or .png name`);
+    else if (seen.has(item.out)) errors.push(`${at}: "${item.out}" appears twice`);
+    else seen.add(item.out);
+    if (!PHOTO_SIZES.includes(item?.size)) errors.push(`${at}: size must be one of ${PHOTO_SIZES.join(", ")}`);
+    if (typeof item?.prompt !== "string" || !item.prompt.trim() || item.prompt.length > PROMPT_MAX) errors.push(`${at}: prompt must be 1 to ${PROMPT_MAX} characters`);
+  });
+  return errors;
+}
+
+/** The real image type from its first bytes. Muse Image answers WebP whatever name was asked for. */
+export function detectImageType(buf) {
+  if (buf.length >= 12 && buf.toString("ascii", 0, 4) === "RIFF" && buf.toString("ascii", 8, 12) === "WEBP") return ".webp";
+  if (buf.length >= 8 && buf.subarray(0, 8).equals(Buffer.from([0x89, 0x50, 0x4e, 0x47, 0x0d, 0x0a, 0x1a, 0x0a]))) return ".png";
+  if (buf.length >= 3 && buf[0] === 0xff && buf[1] === 0xd8 && buf[2] === 0xff) return ".jpg";
+  return null;
+}
+
+/** The first inline image or image URL in an answer, however the API nests it. */
+export function findImage(value, depth = 0) {
+  if (depth > 6 || value === null || typeof value !== "object") return null;
+  for (const [key, item] of Object.entries(value)) {
+    if (typeof item === "string" && (key === "b64_json" || key === "base64")) return { b64: item };
+    if (typeof item === "string" && key === "url" && /^https:/.test(item)) return { url: item };
+    const hit = findImage(item, depth + 1);
+    if (hit) return hit;
+  }
+  return null;
+}
+
+export function readState(stateFile, baseline = 0) {
+  if (existsSync(stateFile)) return JSON.parse(readFileSync(stateFile, "utf8"));
+  return { generated: baseline, log: [] };
+}
+
+/**
+ * Generate the photos that do not exist yet. `opts`: { photosDir, stateFile, cap, baseline, force, baseUrl, key,
+ * model, fetchImpl, log }. Stops before any call that would pass the cap. Returns { made, skipped, failed }.
+ */
+export async function generatePhotos(items, opts) {
+  const { photosDir, stateFile, cap = DEFAULT_IMAGE_CAP, baseline = 0, force = false, key, log } = opts;
+  const fetchImpl = opts.fetchImpl ?? fetch;
+  const baseUrl = (opts.baseUrl || DEFAULT_BASE).replace(/\/+$/, "");
+  const model = opts.model || DEFAULT_MODEL;
+  if (!key) throw new Error("META_API_KEY is missing: load the operator's env file with --env-file");
+  mkdirSync(path.dirname(stateFile), { recursive: true });
+  const state = readState(stateFile, baseline);
+  const result = { made: [], skipped: [], failed: [] };
+
+  for (const item of items) {
+    const exists = [".webp", ".jpg", ".png"].some((ext) => existsSync(path.join(photosDir, item.out.replace(/\.\w+$/, ext))));
+    if (exists && !force) {
+      result.skipped.push(item.out);
+      log(`${item.out}: already there, skipped (use --force to make it again)`);
+      continue;
+    }
+    if (state.generated >= cap) {
+      log(`image cap of ${cap} reached (${state.generated} generated): stopping before ${item.out}. Raise --image-cap only on purpose.`);
+      result.failed.push(item.out);
+      break;
+    }
+    const t0 = Date.now();
+    let res;
+    try {
+      res = await fetchImpl(`${baseUrl}/images/generations`, {
+        method: "POST",
+        headers: { authorization: `Bearer ${key}`, "content-type": "application/json" },
+        body: JSON.stringify({ model, prompt: item.prompt, size: item.size, n: 1 }),
+      });
+    } catch {
+      log(`${item.out}: FAIL network error`);
+      result.failed.push(item.out);
+      continue;
+    }
+    const json = await res.json().catch(() => ({}));
+    const hit = res.ok ? findImage(json) : null;
+    if (!hit) {
+      log(`${item.out}: FAIL http=${res.status} ms=${Date.now() - t0}`);
+      result.failed.push(item.out);
+      continue;
+    }
+    // The generation is paid for whatever happens next, so it counts against the cap even if
+    // the picture then cannot be fetched or is not an image.
+    state.generated += 1;
+    let bytes = null;
+    let failure = null;
+    try {
+      bytes = hit.b64 ? Buffer.from(hit.b64, "base64") : Buffer.from(await (await fetchImpl(hit.url)).arrayBuffer());
+    } catch {
+      failure = "could not fetch the picture";
+    }
+    const ext = bytes ? detectImageType(bytes) : null;
+    if (bytes && !ext) failure = "the answer was not an image";
+    const dest = ext ? path.join(photosDir, item.out.replace(/\.\w+$/, ext)) : null;
+    state.log.push({
+      out: path.basename(dest ?? item.out),
+      model,
+      size: item.size,
+      requestId: res.headers.get("x-request-id") ?? json.id ?? null,
+      at: new Date().toISOString(),
+      ...(failure ? { failed: failure } : {}),
+    });
+    writeFileSync(stateFile, `${JSON.stringify(state, null, 1)}\n`);
+    if (failure) {
+      log(`${item.out}: FAIL ${failure} (still counted: image ${state.generated} of ${cap})`);
+      result.failed.push(item.out);
+      continue;
+    }
+    mkdirSync(path.dirname(dest), { recursive: true });
+    writeFileSync(dest, bytes);
+    result.made.push(path.relative(photosDir, dest));
+    log(`${item.out}: OK ms=${Date.now() - t0} bytes=${bytes.length} image ${state.generated} of ${cap}`);
+  }
+  return result;
+}
diff --git a/scripts/showcase/photos.test.mjs b/scripts/showcase/photos.test.mjs
new file mode 100644
index 00000000..5a0ac975
--- /dev/null
+++ b/scripts/showcase/photos.test.mjs
@@ -0,0 +1,168 @@
+import { existsSync, mkdtempSync, readFileSync, writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+import os from "node:os";
+import path from "node:path";
+import { afterEach, describe, expect, it } from "vitest";
+import { DEFAULT_IMAGE_CAP, PHOTO_SIZES, detectImageType, findImage, generatePhotos, validatePhotoItems } from "./photos.mjs";
+
+const webp = Buffer.concat([Buffer.from("RIFF"), Buffer.from([1, 0, 0, 0]), Buffer.from("WEBPVP8 "), Buffer.alloc(16)]);
+const KEY = "test-key-never-printed-0123456789";
+const items = (...outs) => outs.map((out) => ({ out, size: "1536x1024", prompt: `Casual smartphone photo of ${out}` }));
+
+describe("validatePhotoItems", () => {
+  it("accepts a list of photos", () => {
+    expect(validatePhotoItems(items("cat/aye.webp", "cat/ben.webp"))).toEqual([]);
+    expect(PHOTO_SIZES).toContain("1024x1536");
+    expect(DEFAULT_IMAGE_CAP).toBe(40);
+  });
+
+  it("rejects local paths, odd sizes, empty prompts and repeats", () => {
+    const errors = validatePhotoItems([
+      { out: "C:/photos/a.webp", size: "1536x1024", prompt: "x" },
+      { out: "b.webp", size: "800x600", prompt: "x" },
+      { out: "c.webp", size: "1024x1024", prompt: " " },
+      { out: "c.webp", size: "1024x1024", prompt: "x" },
+    ]);
+    expect(errors).toEqual([
+      expect.stringContaining("items[0]: out must be a relative"),
+      expect.stringContaining("items[1]: size must be one of"),
+      expect.stringContaining("items[2]: prompt must be 1 to 2000"),
+      expect.stringContaining('items[3]: "c.webp" appears twice'),
+    ]);
+    expect(validatePhotoItems([])).toEqual(["the items file must be a list of photos"]);
+  });
+});
+
+describe("image helpers", () => {
+  it("reads the real type from the first bytes", () => {
+    expect(detectImageType(webp)).toBe(".webp");
+    expect(detectImageType(Buffer.from("89504e470d0a1a0a00", "hex"))).toBe(".png");
+    expect(detectImageType(Buffer.from("ffd8ffe000", "hex"))).toBe(".jpg");
+    expect(detectImageType(Buffer.from("<html>not an image</html>"))).toBeNull();
+  });
+
+  it("finds an inline image or an https URL, however it is nested", () => {
+    expect(findImage({ data: [{ b64_json: "AAAA" }] })).toEqual({ b64: "AAAA" });
+    expect(findImage({ output: { items: [{ url: "https://cdn.example/x.webp" }] } })).toEqual({ url: "https://cdn.example/x.webp" });
+    expect(findImage({ data: [{ url: "http://insecure.example/x" }] })).toBeNull();
+    expect(findImage({ error: { message: "no" } })).toBeNull();
+  });
+});
+
+describe("generatePhotos against a stub endpoint", () => {
+  let server;
+  afterEach(() => new Promise((resolve) => (server ? server.close(resolve) : resolve())));
+
+  async function stub(handler) {
+    const seen = [];
+    server = createServer((req, res) => {
+      const chunks = [];
+      req.on("data", (c) => chunks.push(c));
+      req.on("end", () => {
+        seen.push({ method: req.method, url: req.url, auth: req.headers.authorization, body: JSON.parse(Buffer.concat(chunks).toString() || "{}") });
+        handler(res, seen.length);
+      });
+    });
+    await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+    return { baseUrl: `http://127.0.0.1:${server.address().port}/v1`, seen };
+  }
+  const okImage = (res) => {
+    res.writeHead(200, { "content-type": "application/json", "x-request-id": "req-1" });
+    res.end(JSON.stringify({ data: [{ b64_json: webp.toString("base64") }] }));
+  };
+  const setup = () => {
+    const dir = mkdtempSync(path.join(os.tmpdir(), "showcase-photos-"));
+    return { photosDir: path.join(dir, "photos"), stateFile: path.join(dir, "state.json"), logs: [] };
+  };
+
+  it("makes each photo, saves it under its real type and counts it", async () => {
+    const { baseUrl, seen } = await stub(okImage);
+    const s = setup();
+    const result = await generatePhotos(items("cat/aye.png", "cat/ben.webp"), { ...s, baseUrl, key: KEY, log: (l) => s.logs.push(l) });
+    expect(result).toEqual({ made: [path.join("cat", "aye.webp"), path.join("cat", "ben.webp")], skipped: [], failed: [] });
+    expect(seen).toHaveLength(2);
+    expect(seen[0]).toMatchObject({ method: "POST", url: "/v1/images/generations", auth: `Bearer ${KEY}`, body: { model: "muse-image-1.0", size: "1536x1024", n: 1 } });
+    expect(readFileSync(path.join(s.photosDir, "cat", "aye.webp")).equals(webp)).toBe(true);
+    const state = JSON.parse(readFileSync(s.stateFile, "utf8"));
+    expect(state.generated).toBe(2);
+    expect(state.log[0]).toMatchObject({ out: "aye.webp", model: "muse-image-1.0", size: "1536x1024", requestId: "req-1" });
+    expect(s.logs.join("\n")).not.toContain(KEY);
+    expect(s.logs.join("\n")).not.toContain("Casual smartphone photo");
+  });
+
+  it("stops before a call that would pass the image cap, counting the baseline", async () => {
+    const { baseUrl, seen } = await stub(okImage);
+    const s = setup();
+    const result = await generatePhotos(items("a.webp", "b.webp", "c.webp"), { ...s, baseUrl, key: KEY, cap: 12, baseline: 10, log: (l) => s.logs.push(l) });
+    expect(result.made).toEqual(["a.webp", "b.webp"]);
+    expect(result.failed).toEqual(["c.webp"]);
+    expect(seen).toHaveLength(2);
+    expect(s.logs.at(-1)).toContain("image cap of 12 reached (12 generated)");
+    // A second run starts from the saved count, not the baseline.
+    const again = await generatePhotos(items("d.webp"), { ...s, baseUrl, key: KEY, cap: 12, baseline: 0, log: () => {} });
+    expect(again.failed).toEqual(["d.webp"]);
+    expect(seen).toHaveLength(2);
+  });
+
+  it("skips a photo that exists unless forced", async () => {
+    const { baseUrl, seen } = await stub(okImage);
+    const s = setup();
+    await generatePhotos(items("a.webp"), { ...s, baseUrl, key: KEY, log: () => {} });
+    const again = await generatePhotos(items("a.webp"), { ...s, baseUrl, key: KEY, log: () => {} });
+    expect(again.skipped).toEqual(["a.webp"]);
+    expect(seen).toHaveLength(1);
+    const forced = await generatePhotos(items("a.webp"), { ...s, baseUrl, key: KEY, force: true, log: () => {} });
+    expect(forced.made).toEqual(["a.webp"]);
+    expect(JSON.parse(readFileSync(s.stateFile, "utf8")).generated).toBe(2);
+  });
+
+  it("reports a failed call without saving or counting it", async () => {
+    const { baseUrl } = await stub((res) => {
+      res.writeHead(429, { "content-type": "application/json" });
+      res.end(JSON.stringify({ error: { message: `secret detail ${KEY}` } }));
+    });
+    const s = setup();
+    const result = await generatePhotos(items("a.webp"), { ...s, baseUrl, key: KEY, log: (l) => s.logs.push(l) });
+    expect(result.failed).toEqual(["a.webp"]);
+    expect(existsSync(path.join(s.photosDir, "a.webp"))).toBe(false);
+    expect(existsSync(s.stateFile)).toBe(false);
+    expect(s.logs.join("\n")).toContain("FAIL http=429");
+    expect(s.logs.join("\n")).not.toContain("secret detail");
+  });
+
+  it("does not save an answer that is not an image, but still counts the paid call", async () => {
+    const { baseUrl } = await stub((res) => {
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(JSON.stringify({ data: [{ b64_json: Buffer.from("<html>").toString("base64") }] }));
+    });
+    const s = setup();
+    const result = await generatePhotos(items("a.webp"), { ...s, baseUrl, key: KEY, log: (l) => s.logs.push(l) });
+    expect(result.failed).toEqual(["a.webp"]);
+    expect(existsSync(path.join(s.photosDir, "a.webp"))).toBe(false);
+    const state = JSON.parse(readFileSync(s.stateFile, "utf8"));
+    expect(state.generated).toBe(1);
+    expect(state.log[0]).toMatchObject({ out: "a.webp", failed: "the answer was not an image" });
+  });
+
+  it("carries on with the next photo when a picture URL cannot be fetched, and counts the paid call", async () => {
+    const { baseUrl } = await stub((res, n) => {
+      res.writeHead(200, { "content-type": "application/json" });
+      res.end(JSON.stringify({ data: [n === 1 ? { url: "https://cdn.example/dropped.webp" } : { b64_json: webp.toString("base64") }] }));
+    });
+    const s = setup();
+    const fetchImpl = (url, init) => (String(url).startsWith("https://cdn.example") ? Promise.reject(new TypeError("fetch failed")) : fetch(url, init));
+    const result = await generatePhotos(items("a.webp", "b.webp"), { ...s, baseUrl, key: KEY, fetchImpl, log: (l) => s.logs.push(l) });
+    expect(result).toEqual({ made: ["b.webp"], skipped: [], failed: ["a.webp"] });
+    const state = JSON.parse(readFileSync(s.stateFile, "utf8"));
+    expect(state.generated).toBe(2);
+    expect(state.log.map((e) => [e.out, e.failed ?? null])).toEqual([["a.webp", "could not fetch the picture"], ["b.webp", null]]);
+    expect(s.logs.join("\n")).toContain("FAIL could not fetch the picture");
+    expect(s.logs.join("\n")).not.toContain("cdn.example");
+  });
+
+  it("needs a key", async () => {
+    const s = setup();
+    writeFileSync(path.join(path.dirname(s.stateFile), "unused"), "");
+    await expect(generatePhotos(items("a.webp"), { ...s, log: () => {} })).rejects.toThrow("META_API_KEY is missing");
+  });
+});
diff --git a/scripts/showcase/serve.mjs b/scripts/showcase/serve.mjs
new file mode 100644
index 00000000..b90ac42e
--- /dev/null
+++ b/scripts/showcase/serve.mjs
@@ -0,0 +1,63 @@
+/**
+ * Start this checkout's Next dev server for a showcase run (PIN-173, docs/17 step 3).
+ *
+ * The environment is built from the caller's (plus, for a live run, the
+ * operator's env file, which the CLI loads first), then local-only
+ * overrides are forced: memory backend, link-only auth, no paywall, no
+ * Stripe, a hard daily spend stop, and live-model timeouts raised for a
+ * full run. The default is a MOCK server (`AI_MOCK=1`), so nothing paid
+ * can start by accident; a live server needs `--live`.
+ */
+import { spawn } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import { createRequire } from "node:module";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+
+export const REPO_ROOT = path.join(path.dirname(fileURLToPath(import.meta.url)), "..", "..");
+
+/** Live-model timeouts for a full run (Policy.timeoutsMs defaults are Spark 30 s, SAM 20 s: too tight, PIN-171). */
+export const LIVE_TIMEOUTS_MS = Object.freeze({ spark: 90_000, sam: 60_000, scene: 180_000 });
+
+/** Variables a local showcase run must not inherit from an env file. */
+const DROP = [/^STRIPE_/, /^DEMO_BOARD_SLUG$/, /^FIRESTORE_EMULATOR_HOST$/];
+
+/** Env for `next dev`: a copy of `base` with the overrides forced. Never changes `base`. */
+export function serveEnv(base, { live = false, port = 3000, newSecret = () => randomBytes(32).toString("hex") } = {}) {
+  const env = Object.fromEntries(Object.entries(base).filter(([key]) => !DROP.some((re) => re.test(key))));
+  Object.assign(env, {
+    // Board sessions need a signing secret. The memory backend forgets every board when the server
+    // stops, so a throwaway one is enough when the environment has none.
+    SESSION_SECRET: base.SESSION_SECRET || newSecret(),
+    AI_MOCK: live ? "0" : "1",
+    DATA_BACKEND: "memory",
+    AUTH_MODE: "link-only",
+    PLUS_MODE: "off",
+    APP_BASE_URL: `http://localhost:${port}`,
+    AI_DAILY_BUDGET_USD: "10",
+    AI_DAILY_CALL_LIMIT: "2000",
+  });
+  if (live) {
+    let overrides = {};
+    if (env.POLICY_OVERRIDES_JSON) {
+      try {
+        overrides = JSON.parse(env.POLICY_OVERRIDES_JSON);
+      } catch {
+        throw new Error("POLICY_OVERRIDES_JSON is not valid JSON");
+      }
+    }
+    // The env file's own timeouts win only when they are longer.
+    const timeouts = { ...LIVE_TIMEOUTS_MS };
+    for (const [key, ms] of Object.entries(overrides.timeoutsMs ?? {})) timeouts[key] = Math.max(ms, timeouts[key] ?? 0);
+    env.POLICY_OVERRIDES_JSON = JSON.stringify({ ...overrides, timeoutsMs: timeouts });
+  }
+  return env;
+}
+
+/** Spawn `next dev` on localhost only (a live server must not listen on the network). Resolves with its exit code. */
+export function startServer(env, { port = 3000 } = {}) {
+  // Resolved like an import, so a worktree that shares its parent folder's install works too.
+  const next = createRequire(path.join(REPO_ROOT, "package.json")).resolve("next/dist/bin/next");
+  const child = spawn(process.execPath, [next, "dev", "-H", "localhost", "-p", String(port)], { cwd: REPO_ROOT, stdio: "inherit", env });
+  return new Promise((resolve) => child.on("exit", (code) => resolve(code ?? 0)));
+}
diff --git a/scripts/showcase/serve.test.mjs b/scripts/showcase/serve.test.mjs
new file mode 100644
index 00000000..3a99c9c1
--- /dev/null
+++ b/scripts/showcase/serve.test.mjs
@@ -0,0 +1,71 @@
+import { describe, expect, it } from "vitest";
+import { LIVE_TIMEOUTS_MS, serveEnv } from "./serve.mjs";
+
+const operatorEnv = {
+  PATH: "/bin",
+  META_API_KEY: "key-from-the-operators-env-file",
+  STRIPE_SECRET_KEY: "sk_test_x",
+  STRIPE_WEBHOOK_SECRET: "whsec_x",
+  STRIPE_API_VERSION: "2099-01-01",
+  DEMO_BOARD_SLUG: "slug",
+  FIRESTORE_EMULATOR_HOST: "localhost:8080",
+  DATA_BACKEND: "firestore",
+  AI_MOCK: "0",
+  AUTH_MODE: "firebase",
+  PLUS_MODE: "on",
+};
+
+describe("serveEnv", () => {
+  it("is a mock server by default, so nothing paid can start by accident", () => {
+    const env = serveEnv(operatorEnv);
+    expect(env.AI_MOCK).toBe("1");
+    expect(env.POLICY_OVERRIDES_JSON).toBeUndefined();
+  });
+
+  it("forces the local-only overrides on a live server", () => {
+    const env = serveEnv(operatorEnv, { live: true, port: 3100 });
+    expect(env).toMatchObject({
+      AI_MOCK: "0",
+      DATA_BACKEND: "memory",
+      AUTH_MODE: "link-only",
+      PLUS_MODE: "off",
+      APP_BASE_URL: "http://localhost:3100",
+      AI_DAILY_BUDGET_USD: "10",
+      AI_DAILY_CALL_LIMIT: "2000",
+    });
+    expect(JSON.parse(env.POLICY_OVERRIDES_JSON)).toEqual({ timeoutsMs: LIVE_TIMEOUTS_MS });
+  });
+
+  it("clears Stripe, the demo board and the Firestore emulator, and keeps the rest", () => {
+    const env = serveEnv(operatorEnv, { live: true });
+    expect(Object.keys(env).filter((k) => /^STRIPE_|DEMO_BOARD_SLUG|FIRESTORE_EMULATOR_HOST/.test(k))).toEqual([]);
+    expect(env.META_API_KEY).toBe(operatorEnv.META_API_KEY);
+    expect(env.PATH).toBe("/bin");
+  });
+
+  it("signs sessions with a throwaway secret unless the environment has one", () => {
+    expect(serveEnv({}, { newSecret: () => "throwaway" }).SESSION_SECRET).toBe("throwaway");
+    expect(serveEnv({ SESSION_SECRET: "from-the-env-file" }, { newSecret: () => "throwaway" }).SESSION_SECRET).toBe("from-the-env-file");
+    const [a, b] = [serveEnv({}).SESSION_SECRET, serveEnv({}).SESSION_SECRET];
+    expect(a).toMatch(/^[0-9a-f]{64}$/);
+    expect(a).not.toBe(b);
+  });
+
+  it("leaves the caller's environment alone", () => {
+    const before = JSON.stringify(operatorEnv);
+    serveEnv(operatorEnv, { live: true });
+    expect(JSON.stringify(operatorEnv)).toBe(before);
+  });
+
+  it("keeps the other policy overrides and the longer timeouts of the env file", () => {
+    const env = serveEnv({ POLICY_OVERRIDES_JSON: JSON.stringify({ scenesPerBoardDay: 1, timeoutsMs: { spark: 200_000, sam: 5_000, voice: 1000 } }) }, { live: true });
+    expect(JSON.parse(env.POLICY_OVERRIDES_JSON)).toEqual({
+      scenesPerBoardDay: 1,
+      timeoutsMs: { spark: 200_000, sam: 60_000, scene: 180_000, voice: 1000 },
+    });
+  });
+
+  it("refuses overrides that are not JSON", () => {
+    expect(() => serveEnv({ POLICY_OVERRIDES_JSON: "{nope" }, { live: true })).toThrow("POLICY_OVERRIDES_JSON is not valid JSON");
+  });
+});
diff --git a/scripts/showcase/sheet.mjs b/scripts/showcase/sheet.mjs
new file mode 100644
index 00000000..9a8e965f
--- /dev/null
+++ b/scripts/showcase/sheet.mjs
@@ -0,0 +1,98 @@
+/**
+ * Contact sheet for one showcase set (PIN-173, docs/17 step 5): a single
+ * self-contained HTML page next to run.json. It shows each photo with the
+ * mask boxes and labels the app found, every cut-out on the Paper
+ * background with the sticker keyline (the CSS of `.pn-sticker img` in
+ * src/ui/pinneds.css), and every scene with its status.
+ *
+ * Labels, descriptions and prompts come from a model or a spec, so every
+ * string is escaped. The page loads nothing from the network.
+ */
+import { writeFileSync } from "node:fs";
+import path from "node:path";
+
+const escapeHtml = (text) =>
+  String(text ?? "").replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" })[c]);
+
+/** A relative file path as a URL: each part encoded, slashes kept. */
+const src = (file) => file.split("/").map(encodeURIComponent).join("/");
+
+const pct = (n) => `${(Math.min(Math.max(Number(n) || 0, 0), 1) * 100).toFixed(2)}%`;
+
+const CSS = `
+:root { --surface: #f3efe6; --raised: #fffdf8; --ink: #1a1611; --muted: #5f574a; --line: #ddd5c6; --accent: #b8300f; --keyline: #fff; }
+* { box-sizing: border-box; }
+body { margin: 0; padding: 24px 16px 48px; background: var(--surface); color: var(--ink); font: 15px/1.45 system-ui, sans-serif; }
+main { max-width: 1100px; margin: 0 auto; }
+h1 { margin: 0 0 4px; font-size: 22px; } h2 { margin: 28px 0 8px; font-size: 17px; }
+.meta { color: var(--muted); margin: 0 0 12px; } .fail { color: var(--accent); font-weight: 600; }
+.row { display: flex; flex-wrap: wrap; gap: 16px; align-items: flex-start; }
+.photo { position: relative; width: 240px; margin: 0; background: var(--raised); border: 1px solid var(--line); border-radius: 8px; padding: 8px; }
+.frame { position: relative; line-height: 0; } .frame img { width: 100%; height: auto; display: block; border-radius: 4px; }
+.box { position: absolute; border: 2px solid var(--accent); border-radius: 2px; }
+.box b { position: absolute; left: -2px; top: 0; transform: translateY(-100%); background: var(--accent); color: #fff; font: 600 11px/1.3 system-ui, sans-serif; padding: 1px 4px; white-space: nowrap; max-width: 160px; overflow: hidden; text-overflow: ellipsis; }
+figcaption { line-height: 1.35; margin-top: 8px; font-size: 13px; color: var(--muted); }
+.cut { margin: 0; width: 150px; text-align: center; }
+.cut .pad { height: 170px; display: grid; place-items: center; background: var(--surface); border: 1px dashed var(--line); border-radius: 8px; }
+.cut img { max-width: 130px; max-height: 150px; object-fit: contain;
+  filter: drop-shadow(3px 0 0 var(--keyline)) drop-shadow(-3px 0 0 var(--keyline)) drop-shadow(0 3px 0 var(--keyline)) drop-shadow(0 -3px 0 var(--keyline)) drop-shadow(0 4px 4px rgba(40, 28, 12, .32)); }
+.scene { width: 300px; margin: 0; background: var(--raised); border: 1px solid var(--line); border-radius: 8px; padding: 8px; }
+.scene img { width: 100%; height: auto; display: block; border-radius: 4px; }
+`;
+
+/** The contact sheet's HTML for a run record. */
+export function renderSheet(run) {
+  const photos = run.friends
+    .map((f) => {
+      const boxes = f.elements
+        .map((e) => `<span class="box" style="left:${pct(e.maskBox?.x1)};top:${pct(e.maskBox?.y1)};width:${pct((e.maskBox?.x2 ?? 0) - (e.maskBox?.x1 ?? 0))};height:${pct((e.maskBox?.y2 ?? 0) - (e.maskBox?.y1 ?? 0))}"><b>${escapeHtml(e.label)}</b></span>`)
+        .join("");
+      const attempts = f.attempts.map((a) => `${a.status}${a.errorCode ? ` ${escapeHtml(a.errorCode)}` : ""} ${(a.ms / 1000).toFixed(1)}s`).join(", ");
+      return `<figure class="photo"><div class="frame"><img src="${escapeHtml(src(f.photoFile))}" alt="${escapeHtml(f.name)}'s photo">${boxes}</div>
+<figcaption><strong>${escapeHtml(f.name)}</strong> - ${escapeHtml(f.status)} (${attempts || "no job"})${f.faceNote ? `<br>face note: ${escapeHtml(f.faceNote)}` : ""}</figcaption></figure>`;
+    })
+    .join("\n");
+
+  const cutouts = run.friends
+    .flatMap((f) => f.elements.map((e) => ({ friend: f.name, ...e })))
+    .map(
+      (e) => `<figure class="cut"><div class="pad"><img src="${escapeHtml(src(e.files.cutout))}" alt="${escapeHtml(e.label)}"></div>
+<figcaption>${escapeHtml(e.label)}<br>${escapeHtml(e.friend)}${e.faceFlag ? " - face" : ""}</figcaption></figure>`,
+    )
+    .join("\n");
+
+  const scenes = run.scenes
+    .map((s) => {
+      const picked = s.picked.map((p) => `${escapeHtml(p.friend)}: ${escapeHtml(p.label)}`).join(" + ");
+      const tries = s.attempts.map((a) => `${a.status}${a.kind ? `/${a.kind}` : ""} ${(a.ms / 1000).toFixed(1)}s`).join(", ");
+      return `<figure class="scene">${s.file ? `<img src="${escapeHtml(src(s.file))}" alt="${escapeHtml(s.id)}">` : ""}
+<figcaption><strong>${escapeHtml(s.id)}</strong> - ${escapeHtml(s.status)}${s.kind ? ` (${escapeHtml(s.kind)})` : ""}${s.promptVersion ? `, ${escapeHtml(s.promptVersion)}` : ""}<br>${tries ? `tries: ${tries}<br>` : ""}pins: ${picked || "none"}<br>${escapeHtml(s.prompt)}</figcaption></figure>`;
+    })
+    .join("\n");
+
+  const failures = run.failures.length
+    ? `<ul class="fail">${run.failures.map((f) => `<li>${escapeHtml(f)}</li>`).join("")}</ul>`
+    : "";
+  const models = Object.entries(run.models ?? {}).map(([k, v]) => `${escapeHtml(k)} ${escapeHtml(v)}`).join(", ");
+  const versions = Object.values(run.promptVersions ?? {}).filter(Boolean).map(escapeHtml).join(", ");
+
+  return `<!doctype html>
+<html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width, initial-scale=1">
+<title>${escapeHtml(run.set)} contact sheet</title><style>${CSS}</style></head>
+<body><main>
+<h1>${escapeHtml(run.title)}</h1>
+<p class="meta">set ${escapeHtml(run.set)} - ${run.mock ? "MOCK run (collages expected)" : "live run"} - ${run.jobs} model jobs - ${((run.totalMs ?? 0) / 1000).toFixed(0)} s - models: ${models} - prompts: ${versions || "unknown"}</p>
+${failures}
+<h2>Photos, with the mask boxes the app found</h2><div class="row">${photos}</div>
+<h2>Cut-outs on Paper, with the sticker keyline</h2><div class="row">${cutouts}</div>
+<h2>Scenes</h2><div class="row">${scenes || "<p class=\"meta\">No scenes in this set.</p>"}</div>
+</main></body></html>
+`;
+}
+
+/** Write contact-sheet.html next to run.json and return its path. */
+export function writeSheet(run, outDir) {
+  const file = path.join(outDir, "contact-sheet.html");
+  writeFileSync(file, renderSheet(run));
+  return file;
+}
diff --git a/scripts/showcase/sheet.test.mjs b/scripts/showcase/sheet.test.mjs
new file mode 100644
index 00000000..c416f8cb
--- /dev/null
+++ b/scripts/showcase/sheet.test.mjs
@@ -0,0 +1,88 @@
+import { mkdtempSync, readFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import { renderSheet, writeSheet } from "./sheet.mjs";
+
+const run = () => ({
+  schema: 1,
+  set: "cat",
+  title: "Showcase: cat (synthetic)",
+  mock: false,
+  jobs: 4,
+  totalMs: 61_000,
+  models: { spark: "muse-spark-1.3", sam: "sam-3.1", image: "muse-image-1.0" },
+  promptVersions: { elements: "elements.v1", scene: "scene.v1" },
+  friends: [
+    {
+      name: "Aye",
+      photoFile: "photos/aye.webp",
+      status: "ready",
+      faceNote: null,
+      attempts: [{ status: "ready", errorCode: null, ms: 13_200 }],
+      elements: [{ label: "Ginger Tabby Cat", description: "", maskBox: { x1: 0.1, y1: 0.2, x2: 0.6, y2: 0.9 }, faceFlag: false, files: { cutout: "aye-0-ginger-tabby-cat-cutout.png", flat: "aye-0-ginger-tabby-cat-flat.png" } }],
+    },
+  ],
+  scenes: [
+    {
+      id: "c1-street",
+      prompt: "The cat rides a skateboard.",
+      picked: [{ friend: "Aye", label: "Ginger Tabby Cat" }],
+      attempts: [{ status: "ready", kind: "ai", ms: 15_900 }],
+      status: "ready",
+      kind: "ai",
+      promptVersion: "scene.v1",
+      file: "scene-c1-street.webp",
+    },
+  ],
+  failures: [],
+});
+
+describe("renderSheet", () => {
+  it("shows the photo with its mask box and label, the cut-out and the scene", () => {
+    const html = renderSheet(run());
+    expect(html).toContain('<img src="photos/aye.webp"');
+    expect(html).toContain("left:10.00%;top:20.00%;width:50.00%;height:70.00%");
+    expect(html).toContain("<b>Ginger Tabby Cat</b>");
+    expect(html).toContain('<img src="aye-0-ginger-tabby-cat-cutout.png"');
+    expect(html).toContain("drop-shadow(3px 0 0 var(--keyline))");
+    expect(html).toContain('<img src="scene-c1-street.webp"');
+    expect(html).toContain("scene.v1");
+    expect(html).toContain("muse-image-1.0");
+    expect(html).toContain("live run");
+  });
+
+  it("escapes what a model or a spec wrote", () => {
+    const record = run();
+    record.friends[0].elements[0].label = '<img src=x onerror="alert(1)">';
+    record.friends[0].elements[0].files.cutout = 'a"b c.png';
+    record.scenes[0].prompt = "<script>alert(1)</script>";
+    record.failures = ["<b>boom</b>"];
+    const html = renderSheet(record);
+    expect(html).not.toContain("<script>alert");
+    expect(html).not.toContain("<img src=x");
+    expect(html).not.toContain("<b>boom</b>");
+    expect(html).toContain("&lt;img src=x onerror=&quot;alert(1)&quot;&gt;");
+    expect(html).toContain('src="a%22b%20c.png"');
+  });
+
+  it("lists failures and marks a mock run", () => {
+    const record = run();
+    record.mock = true;
+    record.failures = ["Kim: no usable pin"];
+    const html = renderSheet(record);
+    expect(html).toContain("<li>Kim: no usable pin</li>");
+    expect(html).toContain("MOCK run (collages expected)");
+  });
+
+  it("needs no network", () => {
+    expect(renderSheet(run())).not.toMatch(/https?:\/\//);
+  });
+
+  it("writes contact-sheet.html next to run.json", () => {
+    const dir = mkdtempSync(path.join(os.tmpdir(), "showcase-sheet-"));
+    const file = writeSheet(run(), dir);
+    expect(path.basename(file)).toBe("contact-sheet.html");
+    expect(readFileSync(file, "utf8")).toContain("<!doctype html>");
+  });
+});
diff --git a/scripts/showcase/spec.mjs b/scripts/showcase/spec.mjs
new file mode 100644
index 00000000..b46089e7
--- /dev/null
+++ b/scripts/showcase/spec.mjs
@@ -0,0 +1,215 @@
+/**
+ * Showcase set spec: validation, the element pick by pattern, and the
+ * job budget (PIN-173). Pure: no I/O, so `spec.test.mjs` covers it
+ * without a server. `docs/17-showcase-sets.md` is the contract.
+ *
+ * A set spec (one board) looks like this. Photo names are relative to
+ * the photos folder, so a spec never holds a local path:
+ *
+ *   { "id": "cat", "title": "Showcase: cat (synthetic)", "themeId": "paper",
+ *     "friends": [{ "name": "Aye", "photo": "cat/aye.webp" }, ...],
+ *     "scenes": [{ "id": "c1-street", "prompt": "...",
+ *                  "pick": [{ "friend": "Aye", "match": "cat|tabby" }, ...],
+ *                  "names": ["cat", "beanie"] }] }
+ *
+ * A manifest file may hold several: `{ "sets": [ <set spec>, ... ] }`.
+ */
+
+// Mirrors the Policy defaults in src/policy/policy.ts (PIN-59): keep in sync.
+export const SCENE_PROMPT_MAX = 500; // Policy.scenePromptMaxChars
+export const PINS_PER_SCENE_MAX = 4; // Policy.pinsPerScene.max
+export const BOARD_TITLE_MAX = 80; // Policy.boardTitleMaxChars
+
+const MAX_FRIENDS = 6;
+const MAX_SCENES = 3;
+const MAX_PATTERN_CHARS = 120;
+const ID_RE = /^[a-z0-9][a-z0-9-]{0,39}$/;
+const NAME_RE = /^\p{Lu}[\p{L}'-]{0,23}$/u;
+const PHOTO_RE = /\.(webp|jpe?g|png)$/i;
+
+const isObject = (v) => typeof v === "object" && v !== null && !Array.isArray(v);
+
+/** A photo name must stay inside the photos folder: relative, no `..`, no drive letter. */
+export function isRelativePhotoName(name) {
+  if (typeof name !== "string" || name.length === 0 || name.length > 120) return false;
+  if (/[\\\0]/.test(name) || name.startsWith("/") || /^[A-Za-z]:/.test(name)) return false;
+  return name.split("/").every((part) => part !== "" && part !== "." && part !== "..") && PHOTO_RE.test(name);
+}
+
+/** Compile a pick pattern: case-insensitive, no flags, bounded length. Throws on a bad pattern. */
+export function compileMatch(pattern) {
+  if (typeof pattern !== "string" || pattern.length === 0 || pattern.length > MAX_PATTERN_CHARS) {
+    throw new Error(`pattern must be 1 to ${MAX_PATTERN_CHARS} characters`);
+  }
+  return new RegExp(pattern, "i");
+}
+
+function validateScene(scene, at, friendNames, errors) {
+  const err = (message) => errors.push(`${at}: ${message}`);
+  if (!isObject(scene)) return err("must be an object");
+  if (typeof scene.id !== "string" || !ID_RE.test(scene.id)) err("id must be lowercase letters, digits and dashes");
+  const prompt = typeof scene.prompt === "string" ? scene.prompt.trim() : "";
+  if (!prompt || [...prompt].length > SCENE_PROMPT_MAX) err(`prompt must be 1 to ${SCENE_PROMPT_MAX} characters`);
+  if (!Array.isArray(scene.pick) || scene.pick.length < 1 || scene.pick.length > PINS_PER_SCENE_MAX) {
+    return err(`pick must list 1 to ${PINS_PER_SCENE_MAX} things`);
+  }
+  const patterns = [];
+  const pickedFriends = new Set();
+  scene.pick.forEach((pick, i) => {
+    const where = `${at}.pick[${i}]`;
+    if (!isObject(pick) || !friendNames.has(pick.friend)) return errors.push(`${where}: friend must be one of the set's friends`);
+    pickedFriends.add(pick.friend);
+    let re;
+    try {
+      re = compileMatch(pick.match);
+    } catch (e) {
+      return errors.push(`${where}: match ${e.message}`);
+    }
+    patterns.push(re);
+    // The prompt has to name each picked thing, or the pick has no effect on the scene.
+    if (prompt && !re.test(prompt)) errors.push(`${where}: the prompt never names this thing (match /${pick.match}/)`);
+  });
+  if (pickedFriends.size < 2) err("pick must take things from at least 2 friends");
+  if (scene.as !== undefined && !friendNames.has(scene.as)) err("as must be one of the set's friends");
+  if (scene.names !== undefined) {
+    if (!Array.isArray(scene.names) || scene.names.some((n) => typeof n !== "string" || !n.trim())) {
+      return err("names must be a list of words");
+    }
+    // Every item the prompt names must be a picked pin: Muse Image draws an unpinned item
+    // from the prompt text alone (PIN-171).
+    for (const name of scene.names) {
+      if (prompt && !prompt.toLowerCase().includes(name.toLowerCase())) err(`names: "${name}" is not in the prompt`);
+      if (!patterns.some((re) => re.test(name))) err(`names: "${name}" has no pick that matches it`);
+    }
+  }
+}
+
+/** Every problem with a set spec, as plain sentences. An empty list means the spec is fine. */
+export function validateSpec(spec) {
+  const errors = [];
+  const err = (message) => errors.push(message);
+  if (!isObject(spec)) return ["a set spec must be a JSON object"];
+  if (typeof spec.id !== "string" || !ID_RE.test(spec.id)) err("id must be lowercase letters, digits and dashes");
+  if (typeof spec.title !== "string" || !spec.title.trim() || [...spec.title].length > BOARD_TITLE_MAX) {
+    err(`title must be 1 to ${BOARD_TITLE_MAX} characters`);
+  }
+  if (spec.themeId !== undefined && typeof spec.themeId !== "string") err("themeId must be a string");
+  const friendNames = new Set();
+  if (!Array.isArray(spec.friends) || spec.friends.length < 2 || spec.friends.length > MAX_FRIENDS) {
+    err(`friends must list 2 to ${MAX_FRIENDS} people`);
+  } else {
+    spec.friends.forEach((friend, i) => {
+      const at = `friends[${i}]`;
+      if (!isObject(friend) || typeof friend.name !== "string" || !NAME_RE.test(friend.name)) {
+        return err(`${at}: name must be a made-up first name`);
+      }
+      if ([...friendNames].some((n) => n.toLowerCase() === friend.name.toLowerCase())) err(`${at}: duplicate name`);
+      friendNames.add(friend.name);
+      if (!isRelativePhotoName(friend.photo)) err(`${at}: photo must be a relative .webp, .jpg or .png name (no local paths)`);
+    });
+  }
+  if (!Array.isArray(spec.scenes) || spec.scenes.length > MAX_SCENES) {
+    err(`scenes must be a list of at most ${MAX_SCENES}`);
+  } else {
+    const ids = new Set();
+    spec.scenes.forEach((scene, i) => {
+      if (isObject(scene) && ids.has(scene.id)) err(`scenes[${i}]: duplicate id`);
+      if (isObject(scene)) ids.add(scene.id);
+      validateScene(scene, `scenes[${i}]`, friendNames, errors);
+    });
+  }
+  return errors;
+}
+
+/**
+ * The spec for one set from a file's text: a single spec, or a manifest with `sets`
+ * (then `setId` is required). Throws with every problem listed.
+ */
+export function parseSpec(text, setId) {
+  let json;
+  try {
+    json = JSON.parse(text);
+  } catch {
+    throw new Error("spec is not valid JSON");
+  }
+  let spec = json;
+  if (isObject(json) && Array.isArray(json.sets)) {
+    spec = json.sets.find((s) => isObject(s) && s.id === setId);
+    if (!spec) throw new Error(`no set "${setId ?? ""}" in the manifest (have: ${json.sets.map((s) => s?.id).join(", ")})`);
+  } else if (setId !== undefined && isObject(json) && json.id !== setId) {
+    throw new Error(`spec is for set "${json.id}", not "${setId}"`);
+  }
+  const errors = validateSpec(spec);
+  if (errors.length) throw new Error(`invalid spec:\n- ${errors.join("\n- ")}`);
+  return spec;
+}
+
+/** The ids of every set in a spec file's text (one, or the manifest's). */
+export function listSetIds(text) {
+  const json = JSON.parse(text);
+  return Array.isArray(json?.sets) ? json.sets.map((s) => s?.id) : [json?.id];
+}
+
+/**
+ * Pick a friend's element by pattern. A label match beats a description match
+ * (Spark words the same thing differently from run to run), and an element
+ * already used by another pick is skipped.
+ */
+export function pickElement(elements, friend, pattern, used = new Set()) {
+  return findByPattern(elements.filter((e) => e.friend === friend && !used.has(e.id)), pattern);
+}
+
+/** The first of `candidates` whose label matches, else the first whose description does. `run` and `web` both pick this way. */
+export function findByPattern(candidates, pattern) {
+  const re = compileMatch(pattern);
+  return candidates.find((e) => re.test(e.label ?? "")) ?? candidates.find((e) => re.test(e.description ?? "")) ?? null;
+}
+
+/**
+ * Resolve a scene's picks against the elements the photos produced.
+ * `missing` lists picks with no element: the scene must not run then,
+ * or Muse Image would draw the missing thing from the prompt alone.
+ */
+export function resolveScenePicks(scene, elements) {
+  const used = new Set();
+  const ids = [];
+  const picked = [];
+  const missing = [];
+  for (const pick of scene.pick) {
+    const element = pickElement(elements, pick.friend, pick.match, used);
+    if (!element) {
+      missing.push({ friend: pick.friend, match: pick.match });
+      continue;
+    }
+    used.add(element.id);
+    ids.push(element.id);
+    picked.push({ friend: element.friend, label: element.label });
+  }
+  return { ids, picked, missing };
+}
+
+/** Jobs a run starts: one decompose per photo (a retry is another) and one per scene attempt. */
+export function planJobs(specs, { sceneTries = 3 } = {}) {
+  let min = 0;
+  let max = 0;
+  for (const spec of specs) {
+    min += spec.friends.length + spec.scenes.length;
+    max += spec.friends.length * 2 + spec.scenes.length * sceneTries;
+  }
+  return { min, max };
+}
+
+export class BudgetError extends Error {}
+
+/** A hard cap on the model jobs one run may start; `spend` throws before the job over the cap. */
+export class JobBudget {
+  constructor(max) {
+    if (!Number.isInteger(max) || max < 1) throw new RangeError("the job cap must be a positive whole number");
+    this.max = max;
+    this.used = 0;
+  }
+  spend(what) {
+    if (this.used >= this.max) throw new BudgetError(`job cap of ${this.max} reached before ${what}; raise --max-jobs only on purpose`);
+    this.used += 1;
+  }
+}
diff --git a/scripts/showcase/spec.test.mjs b/scripts/showcase/spec.test.mjs
new file mode 100644
index 00000000..3688e047
--- /dev/null
+++ b/scripts/showcase/spec.test.mjs
@@ -0,0 +1,210 @@
+import { describe, expect, it } from "vitest";
+import {
+  BudgetError,
+  JobBudget,
+  compileMatch,
+  findByPattern,
+  isRelativePhotoName,
+  listSetIds,
+  parseSpec,
+  pickElement,
+  planJobs,
+  resolveScenePicks,
+  validateSpec,
+} from "./spec.mjs";
+import { catSpec } from "./test-support.mjs";
+
+const withScene = (patch) => {
+  const spec = catSpec();
+  Object.assign(spec.scenes[0], patch);
+  return spec;
+};
+
+describe("validateSpec", () => {
+  it("accepts the cat set of the spike", () => {
+    expect(validateSpec(catSpec())).toEqual([]);
+  });
+
+  it("rejects local paths and ways out of the photos folder", () => {
+    for (const photo of ["C:/photos/cat.webp", "C:\\cat.webp", "/etc/cat.webp", "../cat.webp", "cat/../../cat.webp", "cat\\ben.webp", "cat/", "cat.txt"]) {
+      const spec = catSpec();
+      spec.friends[0].photo = photo;
+      expect(validateSpec(spec), photo).toEqual([expect.stringContaining("no local paths")]);
+    }
+    expect(isRelativePhotoName("cat/aye.webp")).toBe(true);
+  });
+
+  it("wants made-up first names, each once", () => {
+    const spec = { ...catSpec(), scenes: [] };
+    spec.friends[1].name = "ben";
+    spec.friends[2].name = "Kim Jones";
+    expect(validateSpec(spec)).toEqual([
+      expect.stringContaining("friends[1]: name must be a made-up first name"),
+      expect.stringContaining("friends[2]: name must be a made-up first name"),
+    ]);
+    spec.friends[1].name = "Ben";
+    spec.friends[2].name = "BEN";
+    expect(validateSpec(spec)).toEqual([expect.stringContaining("friends[2]: duplicate name")]);
+  });
+
+  it("checks the set id, title and counts", () => {
+    const spec = { ...catSpec(), scenes: [] };
+    spec.id = "Cat Set";
+    spec.title = "x".repeat(81);
+    spec.friends = spec.friends.slice(0, 1);
+    expect(validateSpec(spec)).toEqual([
+      expect.stringContaining("id must be lowercase"),
+      expect.stringContaining("title must be 1 to 80"),
+      expect.stringContaining("friends must list 2 to 6"),
+    ]);
+  });
+
+  it("limits a scene's prompt, pins and friends", () => {
+    expect(validateSpec(withScene({ prompt: "cat beanie sunglasses skateboard ".repeat(20) }))).toEqual([expect.stringContaining("prompt must be 1 to 500")]);
+
+    const five = catSpec().scenes[0].pick;
+    expect(validateSpec(withScene({ pick: [...five, { friend: "Kim", match: "board" }] }))).toEqual([expect.stringContaining("pick must list 1 to 4")]);
+
+    expect(
+      validateSpec(
+        withScene({
+          prompt: "The cat in the beanie",
+          pick: [
+            { friend: "Aye", match: "cat" },
+            { friend: "Aye", match: "beanie" },
+          ],
+          names: undefined,
+        }),
+      ),
+    ).toEqual([expect.stringContaining("at least 2 friends")]);
+  });
+
+  it("rejects a pick for an unknown friend or a bad pattern", () => {
+    const pick = [...catSpec().scenes[0].pick];
+    pick[0] = { friend: "Zed", match: "cat" };
+    pick[1] = { friend: "Ben", match: "(beanie" };
+    const errors = validateSpec(withScene({ pick, names: undefined }));
+    expect(errors).toEqual([expect.stringContaining("friend must be one of the set's friends"), expect.stringContaining("match Invalid regular expression")]);
+  });
+
+  it("requires the prompt to name every picked thing", () => {
+    const errors = validateSpec(withScene({ prompt: "The orange tabby cat in the green beanie on a skateboard.", names: undefined }));
+    expect(errors).toEqual([expect.stringContaining("never names this thing (match /heart|sunglass|glasses/)")]);
+  });
+
+  it("requires every item named in the prompt to be a pick (PIN-171)", () => {
+    // The prompt names a jacket, but no pick can match one: Muse Image would draw it from the text alone.
+    const prompt = `${catSpec().scenes[0].prompt} Add a mustard jacket.`;
+    const errors = validateSpec(withScene({ prompt, names: ["cat", "beanie", "jacket"] }));
+    expect(errors).toEqual([expect.stringContaining('names: "jacket" has no pick that matches it')]);
+    expect(validateSpec(withScene({ names: ["scarf"] }))).toEqual([
+      expect.stringContaining('"scarf" is not in the prompt'),
+      expect.stringContaining('"scarf" has no pick that matches it'),
+    ]);
+  });
+});
+
+describe("parseSpec and listSetIds", () => {
+  const manifest = JSON.stringify({ sets: [catSpec(), { ...catSpec(), id: "second" }] });
+
+  it("reads a single spec", () => {
+    expect(parseSpec(JSON.stringify(catSpec())).id).toBe("cat");
+    expect(() => parseSpec(JSON.stringify(catSpec()), "dog")).toThrow('spec is for set "cat"');
+    expect(listSetIds(JSON.stringify(catSpec()))).toEqual(["cat"]);
+  });
+
+  it("picks one set out of a manifest", () => {
+    expect(parseSpec(manifest, "second").id).toBe("second");
+    expect(listSetIds(manifest)).toEqual(["cat", "second"]);
+    expect(() => parseSpec(manifest, "nope")).toThrow('no set "nope" in the manifest (have: cat, second)');
+  });
+
+  it("lists every problem when a spec is invalid", () => {
+    expect(() => parseSpec("{")).toThrow("not valid JSON");
+    expect(() => parseSpec(JSON.stringify({ id: "x" }))).toThrow(/invalid spec:\n- .*\n- /);
+  });
+});
+
+describe("pickElement", () => {
+  const elements = [
+    { id: "a1", friend: "Ben", label: "Knitted Hat", description: "a green beanie" },
+    { id: "a2", friend: "Ben", label: "Heart Sunglasses", description: "red heart glasses on a hat stand" },
+    { id: "a3", friend: "Kim", label: "Skateboard", description: "" },
+  ];
+
+  it("matches by pattern, ignoring case", () => {
+    expect(pickElement(elements, "Ben", "BEANIE|hat")?.id).toBe("a1");
+    expect(pickElement(elements, "Kim", "skate|board")?.id).toBe("a3");
+  });
+
+  it("prefers a label match to a description match", () => {
+    // "hat" is in the description of the sunglasses too, but the label of a1 matches first.
+    expect(pickElement([elements[1], elements[0]], "Ben", "hat")?.id).toBe("a1");
+    expect(pickElement(elements, "Ben", "stand")?.id).toBe("a2");
+  });
+
+  it("shares its rule with findByPattern, which web uses for cut-outs", () => {
+    const list = [elements[1], elements[0]];
+    expect(findByPattern(list, "hat")?.id).toBe("a1");
+    expect(findByPattern(list, "stand")?.id).toBe("a2");
+    expect(findByPattern(list, "zebra")).toBeNull();
+  });
+
+  it("only looks at that friend's things, and skips the ones already used", () => {
+    expect(pickElement(elements, "Kim", "hat")).toBeNull();
+    expect(pickElement(elements, "Ben", "hat", new Set(["a1"]))?.id).toBe("a2");
+  });
+
+  it("refuses a pattern that is empty or too long", () => {
+    expect(() => compileMatch("")).toThrow();
+    expect(() => compileMatch("a".repeat(121))).toThrow();
+  });
+});
+
+describe("resolveScenePicks", () => {
+  const elements = [
+    { id: "e1", friend: "Aye", label: "Ginger Tabby Cat", description: "" },
+    { id: "e2", friend: "Ben", label: "Green Beanie", description: "" },
+    { id: "e3", friend: "Ben", label: "Red Heart Sunglasses", description: "" },
+    { id: "e4", friend: "Kim", label: "Skateboard", description: "" },
+  ];
+
+  it("returns the element ids in pick order", () => {
+    const { ids, picked, missing } = resolveScenePicks(catSpec().scenes[0], elements);
+    expect(ids).toEqual(["e1", "e2", "e3", "e4"]);
+    expect(picked[2]).toEqual({ friend: "Ben", label: "Red Heart Sunglasses" });
+    expect(missing).toEqual([]);
+  });
+
+  it("lists the picks that found nothing", () => {
+    const { ids, missing } = resolveScenePicks(catSpec().scenes[0], elements.slice(0, 2));
+    expect(ids).toEqual(["e1", "e2"]);
+    expect(missing).toEqual([
+      { friend: "Ben", match: "heart|sunglass|glasses" },
+      { friend: "Kim", match: "skate|board" },
+    ]);
+  });
+
+  it("never picks one element for two things", () => {
+    const scene = { pick: [{ friend: "Ben", match: "green|beanie" }, { friend: "Ben", match: "beanie" }] };
+    expect(resolveScenePicks(scene, elements).missing).toEqual([{ friend: "Ben", match: "beanie" }]);
+  });
+});
+
+describe("job budget", () => {
+  it("plans the least and the most jobs a run can start", () => {
+    // 3 photos (retried once at worst) + 1 scene (3 tries at worst)
+    expect(planJobs([catSpec()], { sceneTries: 3 })).toEqual({ min: 4, max: 9 });
+    expect(planJobs([catSpec(), catSpec()], { sceneTries: 2 })).toEqual({ min: 8, max: 16 });
+  });
+
+  it("stops before the job over the cap", () => {
+    const budget = new JobBudget(2);
+    budget.spend("a");
+    budget.spend("b");
+    expect(() => budget.spend("scene c1")).toThrow(BudgetError);
+    expect(() => budget.spend("scene c1")).toThrow("job cap of 2 reached before scene c1");
+    expect(budget.used).toBe(2);
+    expect(() => new JobBudget(0)).toThrow(RangeError);
+  });
+});
diff --git a/scripts/showcase/test-support.mjs b/scripts/showcase/test-support.mjs
new file mode 100644
index 00000000..5fba3f9e
--- /dev/null
+++ b/scripts/showcase/test-support.mjs
@@ -0,0 +1,143 @@
+/**
+ * Shared helpers for the showcase script tests: a sample set spec and a
+ * fake boards API (a local HTTP server) that the driver can run against.
+ * Nothing here calls a model or leaves the machine.
+ */
+import { mkdirSync, mkdtempSync, writeFileSync } from "node:fs";
+import { createServer } from "node:http";
+import os from "node:os";
+import path from "node:path";
+
+/** The cat set of the PIN-171 spike, with photo names instead of local paths. */
+export const catSpec = () => ({
+  id: "cat",
+  title: "Showcase: cat (synthetic)",
+  themeId: "paper",
+  friends: [
+    { name: "Aye", photo: "cat/aye.webp" },
+    { name: "Ben", photo: "cat/ben.webp" },
+    { name: "Kim", photo: "cat/kim.webp" },
+  ],
+  scenes: [
+    {
+      id: "c1-street",
+      prompt: "The orange tabby cat wearing the green beanie and the red heart-shaped sunglasses, riding the skateboard down a sunny street. Low-angle action photo.",
+      pick: [
+        { friend: "Aye", match: "cat|tabby|kitten" },
+        { friend: "Ben", match: "beanie|hat" },
+        { friend: "Ben", match: "heart|sunglass|glasses" },
+        { friend: "Kim", match: "skate|board" },
+      ],
+      names: ["cat", "beanie", "sunglasses", "skateboard"],
+    },
+  ],
+});
+
+/** A temp folder with the cat set's three photos in it (any bytes will do for the fake app). */
+export function makeWorkspace() {
+  const root = mkdtempSync(path.join(os.tmpdir(), "showcase-test-"));
+  const photosDir = path.join(root, "photos");
+  mkdirSync(path.join(photosDir, "cat"), { recursive: true });
+  for (const name of ["aye", "ben", "kim"]) writeFileSync(path.join(photosDir, "cat", `${name}.webp`), Buffer.from(`not-a-real-photo-${name}`));
+  return { root, photosDir, outDir: path.join(root, "out", "cat") };
+}
+
+export const SLUG = "SECRETSLUGabcdef0123";
+export const cookieFor = (name) => `COOKIEVALUE${name}0123456789`;
+
+const ELEMENTS = {
+  Aye: [{ label: "Ginger Tabby Cat", description: "An orange tabby cat sitting upright" }],
+  Ben: [
+    { label: "Green Beanie", description: "A knitted bright-green beanie" },
+    { label: "Red Heart Sunglasses", description: "Heart-shaped red sunglasses" },
+  ],
+  Kim: [{ label: "Patterned Skateboard", description: "A skateboard with an orange and teal deck" }],
+};
+
+/**
+ * A fake boards API. `plan`:
+ *   photo[name]  statuses the friend's successive jobs end with (default ["ready"])
+ *   scene        { status, kind } the scenes end with, one entry per attempt (the last repeats)
+ *   sceneHttp    HTTP statuses the first scene requests answer with, before the normal answer
+ *   mock         what /api/health says
+ *   uploadError  make uploads answer 500 with a message that holds the slug
+ * Returns { base, requests, close }.
+ */
+export async function startFakeApp(plan = {}) {
+  const requests = [];
+  const jobs = new Map();
+  const photoCalls = {};
+  let sceneCalls = 0;
+  const scenes = new Map();
+  const png = Buffer.from("89504e470d0a1a0a", "hex");
+
+  const server = createServer((req, res) => {
+    const chunks = [];
+    req.on("data", (c) => chunks.push(c));
+    req.on("end", () => {
+      const url = new URL(req.url, "http://x");
+      const body = Buffer.concat(chunks);
+      const json = (status, value, headers = {}) => {
+        res.writeHead(status, { "content-type": "application/json", ...headers });
+        res.end(JSON.stringify(value));
+      };
+      const image = (type) => {
+        res.writeHead(200, { "content-type": type });
+        res.end(png);
+      };
+      const friend = Object.keys(ELEMENTS).find((n) => (req.headers.cookie ?? "").includes(cookieFor(n)));
+      const route = `${req.method} ${url.pathname.replace(SLUG, ":slug")}`;
+      requests.push({ route, search: url.search, body: body.toString("utf8").slice(0, 400) });
+
+      if (route === "GET /api/health") return json(200, { ok: true, aiMock: plan.mock ?? false });
+      if (route === "POST /api/boards") return json(201, { board: { slug: SLUG } });
+      if (route === "POST /api/boards/:slug/participants") {
+        const name = JSON.parse(body.toString()).displayName;
+        return json(201, {}, { "set-cookie": [`pinned_session=${cookieFor(name)}; Path=/; HttpOnly`] });
+      }
+      if (route === "POST /api/boards/:slug/photos") {
+        if (plan.uploadError) return json(500, { error: typeof plan.uploadError === "string" ? plan.uploadError : `Could not store the photo for board ${SLUG}` });
+        photoCalls[friend] = (photoCalls[friend] ?? 0) + 1;
+        const id = `job-${friend}-${photoCalls[friend]}`;
+        jobs.set(id, { friend, status: (plan.photo?.[friend] ?? ["ready"])[photoCalls[friend] - 1] ?? "ready" });
+        return json(201, { job: { id } });
+      }
+      const jobMatch = url.pathname.match(/\/jobs\/([\w-]+)$/);
+      if (jobMatch) {
+        const job = jobs.get(jobMatch[1]);
+        const ready = job.status === "ready";
+        const elements = ready ? ELEMENTS[job.friend].map((e, i) => ({ id: `el-${job.friend}-${i}`, ...e, maskBox: { x1: 0.1, y1: 0.2, x2: 0.5, y2: 0.8 }, faceFlag: false })) : [];
+        return json(200, {
+          job: { id: jobMatch[1], status: job.status, faceNote: null, ...(ready ? {} : { errorCode: "model_timeout" }) },
+          pins: elements.map((e) => ({ id: `pin-${e.id}` })),
+          elements,
+        });
+      }
+      if (route === "POST /api/boards/:slug/pins/confirm") return json(200, {});
+      if (url.pathname.includes("/elements/")) return image("image/png");
+      if (route === "POST /api/boards/:slug/scenes") {
+        const status = plan.sceneHttp?.[sceneCalls];
+        if (status) {
+          sceneCalls += 1;
+          return json(status, { error: "busy" });
+        }
+        const wanted = plan.scene ?? [{ status: "ready", kind: "ai" }];
+        const outcome = wanted[Math.min(sceneCalls, wanted.length - 1)];
+        sceneCalls += 1;
+        const scene = { id: `scene-${sceneCalls}`, status: outcome.status, kind: outcome.kind, promptVersion: "scene.v1", width: 1280, height: 1920, ...(outcome.status === "refused" ? { refusalReason: "policy" } : {}) };
+        scenes.set(scene.id, scene);
+        return json(201, { scene, job: { id: scene.id, status: scene.status } });
+      }
+      const sceneMatch = url.pathname.match(/\/scenes\/([\w-]+)(\/image)?$/);
+      if (sceneMatch && sceneMatch[2]) return image("image/webp");
+      if (sceneMatch) return json(200, { scene: scenes.get(sceneMatch[1]), job: null });
+      return json(404, { error: "not found" });
+    });
+  });
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  return {
+    base: `http://127.0.0.1:${server.address().port}`,
+    requests,
+    close: () => new Promise((resolve) => server.close(resolve)),
+  };
+}
diff --git a/scripts/showcase/web.mjs b/scripts/showcase/web.mjs
new file mode 100644
index 00000000..03c2e7ef
--- /dev/null
+++ b/scripts/showcase/web.mjs
@@ -0,0 +1,171 @@
+/**
+ * Build the web files of a showcase set (PIN-173, docs/17 step 6):
+ * resized WebPs that carry one XMP field, the IPTC "made by a trained
+ * model" marker, and no other metadata. `sharp` is loaded on use, so
+ * the pure parts (packet, parameters, crop maths, checks) need no
+ * native module.
+ */
+import { mkdirSync, readdirSync, statSync } from "node:fs";
+import path from "node:path";
+import { compileMatch, findByPattern } from "./spec.mjs";
+
+export const IPTC_AI_SOURCE = "http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia";
+
+/** The one XMP packet a shipped picture carries (docs/17 step 6). */
+export const XMP_PACKET = [
+  '<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?>',
+  '<x:xmpmeta xmlns:x="adobe:ns:meta/">',
+  '<rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">',
+  '<rdf:Description rdf:about="" xmlns:Iptc4xmpExt="http://iptc.org/std/Iptc4xmpExt/2008-02-29/">',
+  `<Iptc4xmpExt:DigitalSourceType>${IPTC_AI_SOURCE}</Iptc4xmpExt:DigitalSourceType>`,
+  "</rdf:Description>",
+  "</rdf:RDF>",
+  "</x:xmpmeta>",
+  '<?xpacket end="r"?>',
+].join("");
+
+/** The only XMP elements a landing picture may carry (src/app/landing-sets.test.ts keeps the same list). */
+const XMP_ALLOWED = new Set(["x:xmpmeta", "rdf:RDF", "rdf:Description", "Iptc4xmpExt:DigitalSourceType"]);
+
+/** What `src/app/landing-sets.test.ts` allows one set to weigh. */
+export const SET_BUDGET_BYTES = 220 * 1024;
+
+export const DEFAULT_QUALITY = 78;
+
+/**
+ * Build parameters for a cut-out (fit inside 360x640, never enlarged: about twice
+ * the largest pile slot on a phone), a photo (560 px square) and a scene (600 px square).
+ * Squares use `quality - 6`, as the first two sets did.
+ */
+export function webParams(quality = DEFAULT_QUALITY) {
+  if (!Number.isInteger(quality) || quality < 40 || quality > 95) throw new RangeError("quality must be a whole number from 40 to 95");
+  return {
+    cutout: { width: 360, height: 640, webp: { quality, alphaQuality: 90, effort: 6 } },
+    photo: { px: 560, webp: { quality: quality - 6, effort: 6 } },
+    scene: { px: 600, webp: { quality: quality - 6, effort: 6 } },
+  };
+}
+
+/** The square to cut from a picture: `left` and `top` are fractions of its width and height, kept inside the frame. */
+export function squareExtract(width, height, { left = 0, top = 0 } = {}) {
+  const side = Math.min(width, height);
+  const clamp = (value, max) => Math.min(Math.max(Math.round(value), 0), max);
+  return { left: clamp(left * width, width - side), top: clamp(top * height, height - side), width: side, height: side };
+}
+
+/** Problems with a built file's metadata: any EXIF, or any XMP but the marker packet. Empty means clean. */
+export function metadataProblems(meta) {
+  const problems = [];
+  if (meta.exif) problems.push("has EXIF");
+  if (meta.iptc) problems.push("has an IPTC block");
+  const xmp = meta.xmp?.toString("utf8") ?? "";
+  if (!xmp.includes(`<Iptc4xmpExt:DigitalSourceType>${IPTC_AI_SOURCE}</Iptc4xmpExt:DigitalSourceType>`)) problems.push("lacks the AI-generated marker");
+  const stray = [...xmp.matchAll(/<([A-Za-z][\w-]*:[\w-]+)/g)].map((m) => m[1]).filter((name) => !XMP_ALLOWED.has(name));
+  if (stray.length) problems.push(`has other XMP (${[...new Set(stray)].join(", ")})`);
+  return problems;
+}
+
+async function loadSharp() {
+  return (await import("sharp")).default;
+}
+
+/** Cut-out: the app's SAM cut-out (PNG with alpha) fit inside the box, as WebP with alpha. */
+export async function buildCutout(src, dest, params) {
+  const sharp = await loadSharp();
+  await sharp(src)
+    .resize({ width: params.width, height: params.height, fit: "inside", withoutEnlargement: true })
+    .webp(params.webp)
+    .withXmp(XMP_PACKET)
+    .toFile(dest);
+}
+
+/** Square crop of a photo or scene at `px`, as WebP. */
+export async function buildSquare(src, dest, box, params) {
+  const sharp = await loadSharp();
+  const { width, height } = await sharp(src).metadata();
+  await sharp(src).extract(squareExtract(width, height, box)).resize(params.px).webp(params.webp).withXmp(XMP_PACKET).toFile(dest);
+}
+
+/** True when `child` is inside `parent` (a run record must not point a build outside its folder). */
+const isInside = (parent, child) => {
+  const rel = path.relative(parent, child);
+  return rel !== "" && !rel.startsWith("..") && !path.isAbsolute(rel);
+};
+
+const FRACTION = (v) => v === undefined || (typeof v === "number" && v >= 0 && v <= 1);
+
+/**
+ * Check a web spec:
+ *   { "set": "cat", "items": [
+ *     { "type": "cutout", "id": "ginger-cat", "friend": "Aye", "match": "cat|tabby" },
+ *     { "type": "photo", "name": "photo-shelf-beanie-glasses", "friend": "Ben", "left": 0.14, "top": 0 },
+ *     { "type": "scene", "name": "scene-street-skate", "scene": "c1-street", "left": 0, "top": 0.1 } ] }
+ * Returns the problems found; an empty list means the spec is fine.
+ */
+export function validateWebSpec(spec) {
+  const errors = [];
+  if (typeof spec !== "object" || spec === null || typeof spec.set !== "string" || !Array.isArray(spec.items) || spec.items.length === 0) {
+    return ["a web spec needs a set id and a list of items"];
+  }
+  const files = new Set();
+  spec.items.forEach((item, i) => {
+    const at = `items[${i}]`;
+    const stem = item?.type === "cutout" ? `cutout-${item.id}` : item?.name;
+    if (!["cutout", "photo", "scene"].includes(item?.type)) return errors.push(`${at}: type must be cutout, photo or scene`);
+    if (typeof stem !== "string" || !/^[a-z0-9][a-z0-9-]*$/.test(stem.replace(/^cutout-/, ""))) errors.push(`${at}: ${item.type === "cutout" ? "id" : "name"} must be lowercase letters, digits and dashes`);
+    if (files.has(stem)) errors.push(`${at}: "${stem}" is built twice`);
+    files.add(stem);
+    if (typeof item.friend !== "string" && item.type !== "scene") errors.push(`${at}: friend is required`);
+    if (item.type === "cutout") {
+      try {
+        compileMatch(item.match);
+      } catch (e) {
+        errors.push(`${at}: match ${e.message}`);
+      }
+    }
+    if (item.type === "scene" && typeof item.scene !== "string") errors.push(`${at}: scene is required`);
+    if (!FRACTION(item.left) || !FRACTION(item.top)) errors.push(`${at}: left and top are fractions from 0 to 1`);
+  });
+  return errors;
+}
+
+/** Output file name of a web item. */
+export const webFileName = (item) => `${item.type === "cutout" ? `cutout-${item.id}` : item.name}.webp`;
+
+/**
+ * Build every item of a web spec from a set's run record. `outDir` is the set's work output folder
+ * (run.json and the downloads), `destDir` the set's web folder. Returns what was written and any problems.
+ */
+export async function buildWeb(spec, run, { outDir, destDir, quality }) {
+  const params = webParams(quality);
+  mkdirSync(destDir, { recursive: true });
+  const written = [];
+  const problems = [];
+  const file = (name) => path.join(outDir, name);
+  for (const item of spec.items) {
+    const dest = path.join(destDir, webFileName(item));
+    let src = null;
+    if (item.type === "cutout") {
+      // The same pick `run` makes for a scene: a label match beats a description match.
+      src = findByPattern(run.friends.find((f) => f.name === item.friend)?.elements ?? [], item.match)?.files.cutout;
+    } else if (item.type === "photo") {
+      src = run.friends.find((f) => f.name === item.friend)?.photoFile;
+    } else {
+      src = run.scenes.find((s) => s.id === item.scene)?.file;
+    }
+    if (!src || !isInside(outDir, file(src))) {
+      problems.push(`${webFileName(item)}: no source in the run record`);
+      continue;
+    }
+    if (item.type === "cutout") await buildCutout(file(src), dest, params.cutout);
+    else await buildSquare(file(src), dest, item, params[item.type]);
+    written.push(dest);
+    const built = metadataProblems(await (await loadSharp())(dest).metadata());
+    if (built.length) problems.push(`${webFileName(item)}: ${built.join(", ")}`);
+  }
+  const folderBytes = readdirSync(destDir)
+    .filter((n) => n.endsWith(".webp"))
+    .reduce((sum, n) => sum + statSync(path.join(destDir, n)).size, 0);
+  if (folderBytes > SET_BUDGET_BYTES) problems.push(`the set weighs ${(folderBytes / 1024).toFixed(1)} KB, over the ${SET_BUDGET_BYTES / 1024} KB budget`);
+  return { written, folderBytes, problems };
+}
diff --git a/scripts/showcase/web.test.mjs b/scripts/showcase/web.test.mjs
new file mode 100644
index 00000000..f264168c
--- /dev/null
+++ b/scripts/showcase/web.test.mjs
@@ -0,0 +1,211 @@
+import { mkdirSync, mkdtempSync, readFileSync, statSync, writeFileSync } from "node:fs";
+import os from "node:os";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+import sharp from "sharp";
+import { describe, expect, it } from "vitest";
+import { IPTC_AI_SOURCE, SET_BUDGET_BYTES, XMP_PACKET, buildCutout, buildSquare, buildWeb, metadataProblems, squareExtract, validateWebSpec, webFileName, webParams } from "./web.mjs";
+
+const tmp = () => mkdtempSync(path.join(os.tmpdir(), "showcase-web-"));
+
+/** A noisy RGB picture, so a WebP of it is not tiny. */
+async function makePicture(file, width, height, { alpha = false } = {}) {
+  const channels = alpha ? 4 : 3;
+  const raw = Buffer.alloc(width * height * channels);
+  for (let i = 0; i < raw.length; i += 1) raw[i] = (i * 31 + (i >> 3)) & 255;
+  await sharp(raw, { raw: { width, height, channels } }).png().toFile(file);
+}
+
+describe("the XMP packet", () => {
+  it("holds the IPTC marker and nothing else", () => {
+    expect(XMP_PACKET).toContain(`<Iptc4xmpExt:DigitalSourceType>${IPTC_AI_SOURCE}</Iptc4xmpExt:DigitalSourceType>`);
+    expect(IPTC_AI_SOURCE).toBe("http://cv.iptc.org/newscodes/digitalsourcetype/trainedAlgorithmicMedia");
+    const elements = [...XMP_PACKET.matchAll(/<([A-Za-z][\w-]*:[\w-]+)/g)].map((m) => m[1]);
+    expect(new Set(elements)).toEqual(new Set(["x:xmpmeta", "rdf:RDF", "rdf:Description", "Iptc4xmpExt:DigitalSourceType"]));
+    expect(XMP_PACKET.startsWith('<?xpacket begin="" id="W5M0MpCehiHzreSzNTczkc9d"?>')).toBe(true);
+    expect(XMP_PACKET.endsWith('<?xpacket end="r"?>')).toBe(true);
+  });
+
+  it("is what landing-sets.test.ts expects of every shipped picture", () => {
+    const test = readFileSync(path.join(path.dirname(fileURLToPath(import.meta.url)), "../../src/app/landing-sets.test.ts"), "utf8");
+    expect(test).toContain(IPTC_AI_SOURCE);
+    for (const name of ["x:xmpmeta", "rdf:RDF", "rdf:Description", "Iptc4xmpExt:DigitalSourceType"]) expect(test).toContain(`"${name}"`);
+    expect(test).toContain(`${SET_BUDGET_BYTES / 1024} * 1024`);
+  });
+});
+
+describe("build parameters", () => {
+  it("follow docs/17 step 6", () => {
+    expect(webParams()).toEqual({
+      cutout: { width: 360, height: 640, webp: { quality: 78, alphaQuality: 90, effort: 6 } },
+      photo: { px: 560, webp: { quality: 72, effort: 6 } },
+      scene: { px: 600, webp: { quality: 72, effort: 6 } },
+    });
+  });
+
+  it("takes a quality, squares 6 lower, and refuses a silly one", () => {
+    const params = webParams(70);
+    expect(params.cutout.webp.quality).toBe(70);
+    expect(params.photo.webp.quality).toBe(64);
+    expect(() => webParams(20)).toThrow(RangeError);
+    expect(() => webParams(78.5)).toThrow(RangeError);
+  });
+});
+
+describe("squareExtract", () => {
+  it("cuts the shorter side from a landscape or portrait picture", () => {
+    expect(squareExtract(1920, 1280, { left: 0.14, top: 0 })).toEqual({ left: 269, top: 0, width: 1280, height: 1280 });
+    expect(squareExtract(1280, 1920, { left: 0, top: 0.1 })).toEqual({ left: 0, top: 192, width: 1280, height: 1280 });
+  });
+
+  it("keeps the square inside the picture", () => {
+    expect(squareExtract(1920, 1280, { left: 0.9, top: 0.9 })).toEqual({ left: 640, top: 0, width: 1280, height: 1280 });
+    expect(squareExtract(1280, 1920, { left: -1, top: 1 })).toEqual({ left: 0, top: 640, width: 1280, height: 1280 });
+  });
+});
+
+describe("building files with sharp", () => {
+  it("makes a cut-out that fits the box, is never enlarged, keeps alpha and carries only the marker", async () => {
+    const dir = tmp();
+    await makePicture(path.join(dir, "big.png"), 1000, 1400, { alpha: true });
+    await makePicture(path.join(dir, "small.png"), 100, 150, { alpha: true });
+    const { cutout } = webParams();
+    await buildCutout(path.join(dir, "big.png"), path.join(dir, "big.webp"), cutout);
+    await buildCutout(path.join(dir, "small.png"), path.join(dir, "small.webp"), cutout);
+
+    const big = await sharp(path.join(dir, "big.webp")).metadata();
+    expect([big.format, big.width, big.height, big.hasAlpha]).toEqual(["webp", 360, 504, true]);
+    const small = await sharp(path.join(dir, "small.webp")).metadata();
+    expect([small.width, small.height]).toEqual([100, 150]);
+    expect(metadataProblems(big)).toEqual([]);
+    expect(metadataProblems(small)).toEqual([]);
+  });
+
+  it("makes a square crop at the asked size with only the marker", async () => {
+    const dir = tmp();
+    await makePicture(path.join(dir, "wide.png"), 1920, 1280);
+    await buildSquare(path.join(dir, "wide.png"), path.join(dir, "photo.webp"), { left: 0.14, top: 0 }, webParams().photo);
+    const meta = await sharp(path.join(dir, "photo.webp")).metadata();
+    expect([meta.format, meta.width, meta.height]).toEqual(["webp", 560, 560]);
+    expect(metadataProblems(meta)).toEqual([]);
+  });
+
+  it("drops the EXIF of its input", async () => {
+    const dir = tmp();
+    await sharp({ create: { width: 64, height: 64, channels: 3, background: "#c33" } }).withExif({ IFD0: { Copyright: "someone" } }).png().toFile(path.join(dir, "exif.png"));
+    await buildSquare(path.join(dir, "exif.png"), path.join(dir, "out.webp"), {}, webParams().scene);
+    expect(metadataProblems(await sharp(path.join(dir, "out.webp")).metadata())).toEqual([]);
+  });
+});
+
+describe("metadataProblems", () => {
+  it("names EXIF, a missing marker and other XMP", () => {
+    expect(metadataProblems({ exif: Buffer.from("x") })).toEqual(["has EXIF", "lacks the AI-generated marker"]);
+    const extra = XMP_PACKET.replace("</rdf:Description>", "<dc:creator>someone</dc:creator></rdf:Description>");
+    expect(metadataProblems({ xmp: Buffer.from(extra) })).toEqual(["has other XMP (dc:creator)"]);
+  });
+});
+
+describe("web spec", () => {
+  const spec = {
+    set: "cat",
+    items: [
+      { type: "cutout", id: "ginger-cat", friend: "Aye", match: "cat|tabby" },
+      { type: "photo", name: "photo-shelf", friend: "Ben", left: 0.14, top: 0 },
+      { type: "scene", name: "scene-street", scene: "c1-street", left: 0, top: 0.1 },
+    ],
+  };
+
+  it("accepts the three kinds of item and names their files", () => {
+    expect(validateWebSpec(spec)).toEqual([]);
+    expect(spec.items.map(webFileName)).toEqual(["cutout-ginger-cat.webp", "photo-shelf.webp", "scene-street.webp"]);
+  });
+
+  it("rejects what cannot be built", () => {
+    const bad = { set: "cat", items: [{ type: "cutout", id: "A B", friend: "Aye", match: "(" }, { type: "photo", name: "p", left: 2 }, { type: "movie" }, { type: "photo", name: "p", friend: "Ben" }] };
+    const errors = validateWebSpec(bad);
+    expect(errors.join("\n")).toMatch(/items\[0\]: id must be lowercase/);
+    expect(errors.join("\n")).toMatch(/items\[0\]: match Invalid regular expression/);
+    expect(errors.join("\n")).toMatch(/items\[1\]: friend is required/);
+    expect(errors.join("\n")).toMatch(/items\[1\]: left and top are fractions/);
+    expect(errors.join("\n")).toMatch(/items\[2\]: type must be/);
+    expect(errors.join("\n")).toMatch(/items\[3\]: "p" is built twice/);
+    expect(validateWebSpec({})).toEqual(["a web spec needs a set id and a list of items"]);
+  });
+});
+
+describe("buildWeb", () => {
+  it("builds each item from the run record, and reports what it cannot find", async () => {
+    const outDir = tmp();
+    const destDir = path.join(tmp(), "cat");
+    await makePicture(path.join(outDir, "aye-0-ginger-cat-cutout.png"), 400, 800, { alpha: true });
+    mkdirSync(path.join(outDir, "photos"));
+    await makePicture(path.join(outDir, "photos", "ben.png"), 1920, 1280);
+    await makePicture(path.join(outDir, "scene-c1-street.png"), 1280, 1920);
+    const run = {
+      friends: [
+        { name: "Aye", photoFile: "photos/aye.png", elements: [{ label: "Ginger Tabby Cat", description: "", files: { cutout: "aye-0-ginger-cat-cutout.png" } }] },
+        { name: "Ben", photoFile: "photos/ben.png", elements: [] },
+      ],
+      scenes: [{ id: "c1-street", file: "scene-c1-street.png" }],
+    };
+    const spec = {
+      set: "cat",
+      items: [
+        { type: "cutout", id: "ginger-cat", friend: "Aye", match: "cat|tabby" },
+        { type: "cutout", id: "beanie", friend: "Ben", match: "beanie" },
+        { type: "photo", name: "photo-shelf", friend: "Ben", left: 0.14, top: 0 },
+        { type: "scene", name: "scene-street", scene: "c1-street", top: 0.1 },
+      ],
+    };
+    const result = await buildWeb(spec, run, { outDir, destDir });
+    expect(result.written.map((f) => path.basename(f))).toEqual(["cutout-ginger-cat.webp", "photo-shelf.webp", "scene-street.webp"]);
+    expect(result.problems).toEqual(["cutout-beanie.webp: no source in the run record"]);
+    expect(result.folderBytes).toBe(result.written.reduce((sum, f) => sum + statSync(f).size, 0));
+  });
+
+  it("picks a cut-out the way run does: a label match beats a description match", async () => {
+    const outDir = tmp();
+    // The sunglasses come first and their description mentions a hat stand; the hat is the second element.
+    await makePicture(path.join(outDir, "sunglasses.png"), 100, 100, { alpha: true });
+    await makePicture(path.join(outDir, "hat.png"), 200, 300, { alpha: true });
+    const run = {
+      friends: [
+        {
+          name: "Ben",
+          photoFile: "photos/ben.png",
+          elements: [
+            { label: "Red Heart Sunglasses", description: "on a hat stand", files: { cutout: "sunglasses.png" } },
+            { label: "Knitted Hat", description: "", files: { cutout: "hat.png" } },
+          ],
+        },
+      ],
+      scenes: [],
+    };
+    const destDir = path.join(tmp(), "x");
+    const result = await buildWeb({ set: "x", items: [{ type: "cutout", id: "hat", friend: "Ben", match: "hat" }] }, run, { outDir, destDir });
+    expect(result.problems).toEqual([]);
+    const meta = await sharp(path.join(destDir, "cutout-hat.webp")).metadata();
+    expect([meta.width, meta.height]).toEqual([200, 300]); // hat.png, not sunglasses.png (100x100)
+  });
+
+  it("refuses a run record that points out of its folder", async () => {
+    const outDir = tmp();
+    const outside = tmp();
+    await makePicture(path.join(outside, "secret.png"), 64, 64);
+    const run = { friends: [{ name: "Aye", photoFile: path.relative(outDir, path.join(outside, "secret.png")), elements: [] }], scenes: [] };
+    const result = await buildWeb({ set: "x", items: [{ type: "photo", name: "p", friend: "Aye" }] }, run, { outDir, destDir: path.join(tmp(), "x") });
+    expect(result.written).toEqual([]);
+    expect(result.problems).toEqual(["p.webp: no source in the run record"]);
+  });
+
+  it("flags a set over the weight budget", async () => {
+    const outDir = tmp();
+    const destDir = tmp();
+    writeFileSync(path.join(destDir, "old.webp"), Buffer.alloc(SET_BUDGET_BYTES + 1));
+    await makePicture(path.join(outDir, "a.png"), 64, 64);
+    const run = { friends: [{ name: "Aye", photoFile: "a.png", elements: [] }], scenes: [] };
+    const result = await buildWeb({ set: "x", items: [{ type: "photo", name: "p", friend: "Aye" }] }, run, { outDir, destDir });
+    expect(result.problems).toEqual([expect.stringMatching(/the set weighs .* KB, over the 220 KB budget/)]);
+  });
+});
diff --git a/src/app/_legal/LegalParts.tsx b/src/app/_legal/LegalParts.tsx
index b3995588..ca774520 100644
--- a/src/app/_legal/LegalParts.tsx
+++ b/src/app/_legal/LegalParts.tsx
@@ -1,4 +1,4 @@
-import type { ReactNode } from "react";
+import { Children, type ReactNode } from "react";
 import { DEFAULT_LOCALE, t, type Locale } from "../../i18n";
 import { Wordmark } from "../../ui";
 import { LanguageLink } from "../auth/LanguageMenu";
@@ -22,7 +22,13 @@ export function plural(n: number, unit: string): string {
   return `${n} ${n === 1 ? unit : `${unit}s`}`;
 }
 
-/** Privacy, Terms and the source link (after any page-specific `children`): the landing footer and both legal pages. */
+/**
+ * Privacy, Terms and the source link (after any page-specific
+ * `children`), then the language: the landing footer, both legal
+ * pages and /models. PIN-265: one quiet row; each link is a list
+ * item and CSS draws the dots between them, so they are not read
+ * aloud and never become part of a link.
+ */
 export function SiteLinks({
   locale,
   current,
@@ -34,14 +40,24 @@ export function SiteLinks({
 }) {
   return (
     <nav className="pn-foot-links" aria-label={t(locale, "footer.label")}>
-      {children}
-      <a href="/privacy" aria-current={current === "privacy" ? "page" : undefined}>
-        {t(locale, "footer.privacy")}
-      </a>
-      <a href="/terms" aria-current={current === "terms" ? "page" : undefined}>
-        {t(locale, "footer.terms")}
-      </a>
-      <a href={SOURCE_URL}>{t(locale, "footer.source")}</a>
+      <ul className="pn-foot-list">
+        {Children.toArray(children).map((child, index) => (
+          <li key={index}>{child}</li>
+        ))}
+        <li>
+          <a href="/privacy" aria-current={current === "privacy" ? "page" : undefined}>
+            {t(locale, "footer.privacy")}
+          </a>
+        </li>
+        <li>
+          <a href="/terms" aria-current={current === "terms" ? "page" : undefined}>
+            {t(locale, "footer.terms")}
+          </a>
+        </li>
+        <li>
+          <a href={SOURCE_URL}>{t(locale, "footer.source")}</a>
+        </li>
+      </ul>
       <LanguageLink />
     </nav>
   );
diff --git a/src/app/g/[slug]/board.module.css b/src/app/g/[slug]/board.module.css
index 76d898fc..721aadb6 100644
--- a/src/app/g/[slug]/board.module.css
+++ b/src/app/g/[slug]/board.module.css
@@ -271,6 +271,8 @@
   flex-direction: column;
   max-height: 92vh;
   max-height: 92dvh;
+  /* The body below scrolls; the sheet itself must not (PIN-261). */
+  overflow: visible;
 }
 
 .lookSheet:focus {
diff --git a/src/app/landing-page.test.ts b/src/app/landing-page.test.ts
index 2ed044ed..ecc089c0 100644
--- a/src/app/landing-page.test.ts
+++ b/src/app/landing-page.test.ts
@@ -73,6 +73,20 @@ describe("landing page showcase sets (PIN-175)", () => {
     expect(css).toMatch(/\.pn-landing-pile \{[^}]*position: relative;/);
   });
 
+  it("keeps the utility row to Privacy, Terms and Source as list items, then the language (PIN-265)", async () => {
+    const html = await landing({ set: "classic" });
+    const row = /<nav class="pn-foot-links"[^>]*>([\s\S]*?)<\/nav>/.exec(html)?.[1] ?? "";
+    const items = [...row.matchAll(/<li><a href="([^"]+)"[^>]*>([^<]+)<\/a><\/li>/g)].map((m) => [m[1], m[2]]);
+    expect(items).toEqual([
+      ["/privacy", en["footer.privacy"]],
+      ["/terms", en["footer.terms"]],
+      ["https://github.com/MoriaCrew/Pinned", en["footer.source"]],
+    ]);
+    expect(en["footer.source"]).toBe("Source code");
+    // The dots are CSS on the list items, never text inside a link.
+    expect(row).not.toContain("·");
+  });
+
   it("links Privacy, Terms and the source from the footer (PIN-26)", async () => {
     const html = await landing({ set: "classic" });
     const foot = /<footer class="pn-landing-foot">([\s\S]*?)<\/footer>/.exec(html)?.[1] ?? "";
@@ -114,7 +128,11 @@ describe("landing Made with Meta AI credit (PIN-222)", () => {
     const html = await landing({ set: "classic" });
     for (const name of ["Muse Spark", "SAM 3.1", "Muse Image", "Muse Voice"]) expect(html).toContain(name);
     // PIN-237: the in-app explainer, not the developer doc on GitHub.
-    expect(html).toContain(`<a href="/models">${en["landing.meta.more"]}</a>`);
+    // PIN-265: the link closes the Meta AI list, with an arrow, and is no longer in the utility row.
+    const meta = /<ul class="pn-landing-meta-list">[\s\S]*?<\/ul>/.exec(html)?.[0] ?? "";
+    expect(meta).toMatch(new RegExp(`<a href="/models">${en["landing.meta.more"]}<svg`));
+    const row = /<nav class="pn-foot-links"[\s\S]*?<\/nav>/.exec(html)?.[0] ?? "";
+    expect(row).not.toContain('href="/models"');
     expect(html).not.toContain("docs/19-meta-models.md");
     expect(html).toContain(`>${en["footer.source"]}</a>`);
   });
@@ -160,3 +178,87 @@ describe("landing 'See a board' demo form (PIN-251)", () => {
     expect(plain).not.toContain(en["landing.demoUnavailable"]);
   });
 });
+
+describe("judging-week links (PIN-263)", () => {
+  const withLinks = async (links: { demoVideoUrl: string | null; promoPostUrl: string | null }) => {
+    const config = await import("../config");
+    const real = config.getConfig();
+    vi.spyOn(config, "getConfig").mockReturnValue({ ...real, demoBoardSlug: "tmplAAAAAAAAAAAAAAAAA1", ...links });
+  };
+  const anchor = (html: string, href: string) => new RegExp(`<a [^>]*href="${href.replace(/[.?/]/g, "\\$&")}"[^>]*>[\\s\\S]*?</a>`).exec(html)?.[0] ?? "";
+
+  it("closes How it works with the demo video and the post, both opening a new tab", async () => {
+    await withLinks({ demoVideoUrl: "https://youtu.be/q6lkrA6fsCI", promoPostUrl: "https://x.com/MoriaCrew/status/1" });
+    const html = await landing({ set: "classic" });
+    const video = anchor(html, "https://youtu.be/q6lkrA6fsCI");
+    expect(video).toContain(en["landing.video"]);
+    expect(video).toContain('target="_blank"');
+    expect(video).toContain('rel="noopener noreferrer"');
+    expect(video).toContain(en["landing.newTab"]);
+    // Inside "How it works", after the steps.
+    const how = /<section class="pn-landing-how"[\s\S]*?<\/section>/.exec(html)?.[0] ?? "";
+    expect(how).toContain("https://youtu.be/q6lkrA6fsCI");
+    const post = anchor(html, "https://x.com/MoriaCrew/status/1");
+    expect(post).toContain(en["landing.xPost"]);
+    expect(post).toContain('target="_blank"');
+    expect(post).toContain('rel="noopener noreferrer"');
+    // PIN-265: the post sits next to the video in How it works, not in the footer.
+    expect(how).toContain("https://x.com/MoriaCrew/status/1");
+    const foot = /<footer[\s\S]*?<\/footer>/.exec(html)?.[0] ?? "";
+    expect(foot).not.toContain("x.com/MoriaCrew");
+    // A link out, never an embedded player or widget.
+    expect(html).not.toContain("<iframe");
+    expect(html).not.toContain("platform.twitter.com");
+  });
+
+  it("shows neither link while its URL is unset", async () => {
+    await withLinks({ demoVideoUrl: null, promoPostUrl: null });
+    const html = await landing({ set: "classic" });
+    expect(html).not.toContain(en["landing.video"]);
+    expect(html).not.toContain(en["landing.xPost"]);
+  });
+
+  it("labels the demo button Demo board with the launch icon", async () => {
+    await withLinks({ demoVideoUrl: null, promoPostUrl: null });
+    const form = /<form [^>]*>[\s\S]*?<\/form>/.exec(await landing({ set: "classic" }))?.[0] ?? "";
+    expect(en["landing.demo"]).toBe("Demo board");
+    expect(form).toContain(en["landing.demo"]);
+  });
+});
+
+describe("signed-in visitors with boards (PIN-264)", () => {
+  const setup = async (slugs: string[] | null) => {
+    const config = await import("../config");
+    const real = config.getConfig();
+    vi.spyOn(config, "getConfig").mockReturnValue({ ...real, demoBoardSlug: "tmplAAAAAAAAAAAAAAAAA1" });
+    const viewer = await import("../server/landing-viewer");
+    vi.spyOn(viewer, "viewerBoardSlugs").mockResolvedValue(slugs);
+  };
+
+  it("opens the one board instead of the demo, and drops the demo note", async () => {
+    await setup(["boardAAAAAAAAAAAAAAAA1"]);
+    const html = await landing({ set: "classic" });
+    expect(html).toMatch(/<a [^>]*href="\/g\/boardAAAAAAAAAAAAAAAA1"[^>]*>[\s\S]*?See my board<\/a>/);
+    expect(html).not.toContain('action="/api/demo"');
+    expect(html).not.toContain("disappears after");
+  });
+
+  it("lists several boards on My boards", async () => {
+    await setup(["boardAAAAAAAAAAAAAAAA1", "boardBBBBBBBBBBBBBBBB2"]);
+    const html = await landing({ set: "classic" });
+    expect(html).toMatch(/<a [^>]*href="\/me\/boards"[^>]*>[\s\S]*?See my boards<\/a>/);
+    expect(html).not.toMatch(/href="\/g\//);
+    expect(html).not.toContain('action="/api/demo"');
+  });
+
+  it("keeps the demo for everyone else: signed out, or signed in with no boards", async () => {
+    for (const slugs of [null, []]) {
+      await setup(slugs);
+      const html = await landing({ set: "classic" });
+      expect(html).toContain('action="/api/demo"');
+      expect(html).not.toContain(en["landing.myBoard"]);
+      expect(html).not.toMatch(/href="\/g\//);
+      vi.restoreAllMocks();
+    }
+  });
+});
diff --git a/src/app/new/start-flow.css b/src/app/new/start-flow.css
index 86bccddf..b22b4810 100644
--- a/src/app/new/start-flow.css
+++ b/src/app/new/start-flow.css
@@ -15,7 +15,7 @@
 
 /* Seven skins make three rows: the title, the suggestion and the action stay in view while the picker
    scrolls, and the board's name stays visible above the sheet. */
-.pn-start-sheet { max-height: 86dvh; grid-template-rows: auto auto minmax(0, 1fr) auto; animation: pn-start-rise .24s ease-out both; }
+.pn-start-sheet { max-height: 86dvh; overflow: visible; grid-template-rows: auto auto minmax(0, 1fr) auto; animation: pn-start-rise .24s ease-out both; }
 .pn-start-sheet .pn-sheet-body { grid-template-rows: auto minmax(0, 1fr); min-height: 0; }
 /* Padding and negative margin give the focus ring and the check room inside the scroller. */
 .pn-start-picker { min-height: 0; overflow-y: auto; overscroll-behavior: contain; padding: 8px; margin: -8px; }
diff --git a/src/app/page.tsx b/src/app/page.tsx
index fb392981..647de820 100644
--- a/src/app/page.tsx
+++ b/src/app/page.tsx
@@ -2,10 +2,12 @@ import type { CSSProperties } from "react";
 import { getConfig } from "../config";
 import { BOARD_DELETED_PARAM, isBoardDeletedFlag } from "../domain/board-delete-ui";
 import { DEMO_NOTICE_PARAM, parseDemoNotice } from "../domain/demo-ui";
+import { landingSecondary } from "../domain/landing-actions";
 import { anotherLandingSet, pickLandingSet } from "../domain/landing-sets";
 import { t, tCount, tf, type Locale } from "../i18n";
 import { getLocale } from "../i18n/server";
 import { getPolicy } from "../policy/server";
+import { viewerBoardSlugs } from "../server/landing-viewer";
 import { Button, ButtonLink, Icon, Sticker, Tag, Wordmark, type IconName } from "../ui";
 import { SiteLinks } from "./_legal/LegalParts";
 import { You } from "./auth/You";
@@ -38,7 +40,12 @@ export default async function HomePage({
   searchParams: Promise<{ [key: string]: string | string[] | undefined }>;
 }) {
   const locale = await getLocale();
-  const demoEnabled = getConfig().demoBoardSlug !== null;
+  const config = getConfig();
+  const demoEnabled = config.demoBoardSlug !== null;
+  // PIN-263: judging-week links, each shown only while its env URL is set.
+  const { demoVideoUrl, promoPostUrl } = config;
+  // PIN-264: someone signed in with boards gets theirs instead of the demo.
+  const second = landingSecondary({ demoEnabled, myBoardSlugs: await viewerBoardSlugs() });
   const demoTtlHours = getPolicy().demo.ttlHours;
   const query = await searchParams;
   // PIN-168: the host lands here after deleting a board while signed out.
@@ -104,16 +111,24 @@ export default async function HomePage({
             <ButtonLink variant="primary" size="lg" icon="plus" href="/new">
               {t(locale, "landing.start")}
             </ButtonLink>
-            {demoEnabled ? (
+            {second.kind === "demo" ? (
               <form method="post" action="/api/demo" className="pn-landing-demo">
-                <Button type="submit" variant="secondary" size="lg" icon="scene">
+                <Button type="submit" variant="secondary" size="lg" icon="launch">
                   {t(locale, "landing.demo")}
                 </Button>
               </form>
+            ) : second.kind === "myBoard" ? (
+              <ButtonLink variant="secondary" size="lg" icon="arrow" href={`/g/${encodeURIComponent(second.slug)}`}>
+                {t(locale, "landing.myBoard")}
+              </ButtonLink>
+            ) : second.kind === "myBoards" ? (
+              <ButtonLink variant="secondary" size="lg" icon="arrow" href="/me/boards">
+                {t(locale, "landing.myBoards")}
+              </ButtonLink>
             ) : null}
           </div>
           <p className="pn-landing-note">{t(locale, "landing.noSignup")}</p>
-          {demoEnabled ? (
+          {second.kind === "demo" ? (
             <p className="pn-landing-note">{tCount(locale, "landing.demoNote", demoTtlHours)}</p>
           ) : null}
         </div>
@@ -184,6 +199,32 @@ export default async function HomePage({
               <StepText locale={locale} n={3} title={t(locale, "landing.step3")} body={t(locale, "landing.step3Body")} />
             </li>
           </ol>
+          {demoVideoUrl || promoPostUrl ? (
+            // PIN-263: links out, never an embedded player or widget (no third-party trackers on this page).
+            // PIN-265: the video and the launch post sit together, out of the footer.
+            <div className="pn-landing-promo">
+              {demoVideoUrl ? (
+                <ButtonLink
+                  variant="secondary"
+                  icon="play"
+                  href={demoVideoUrl}
+                  target="_blank"
+                  rel="noopener noreferrer"
+                  className="pn-landing-video"
+                >
+                  {t(locale, "landing.video")}
+                  <span className="pn-sr"> {t(locale, "landing.newTab")}</span>
+                </ButtonLink>
+              ) : null}
+              {promoPostUrl ? (
+                <a className="pn-landing-promo-link" href={promoPostUrl} target="_blank" rel="noopener noreferrer">
+                  {t(locale, "landing.xPost")}
+                  <Icon name="launch" size={18} />
+                  <span className="pn-sr"> {t(locale, "landing.newTab")}</span>
+                </a>
+              ) : null}
+            </div>
+          ) : null}
         </section>
 
         <footer className="pn-landing-foot">
@@ -199,11 +240,16 @@ export default async function HomePage({
                   {line.text}
                 </li>
               ))}
+              {/* PIN-265: the link that explains this list closes it. */}
+              <li className="pn-landing-meta-more">
+                <a href="/models">
+                  {t(locale, "landing.meta.more")}
+                  <Icon name="arrow" size={18} />
+                </a>
+              </li>
             </ul>
           </section>
-          <SiteLinks locale={locale}>
-            <a href="/models">{t(locale, "landing.meta.more")}</a>
-          </SiteLinks>
+          <SiteLinks locale={locale} />
         </footer>
       </div>
     </main>
diff --git a/src/config.test.ts b/src/config.test.ts
index 39a03d2b..a6f053f8 100644
--- a/src/config.test.ts
+++ b/src/config.test.ts
@@ -15,6 +15,18 @@ describe("parseConfig (FR8 fail-closed defaults)", () => {
     expect(parseConfig({ UI_LOCALES: "en,fr,es,pt-BR,de,it,id" }).uiLocales).toHaveLength(7);
   });
 
+  it("judging-week links: only an https URL is kept, anything else is null (PIN-263)", () => {
+    for (const key of ["DEMO_VIDEO_URL", "PROMO_POST_URL"] as const) {
+      const field = key === "DEMO_VIDEO_URL" ? "demoVideoUrl" : "promoPostUrl";
+      expect(parseConfig({})[field]).toBeNull();
+      expect(parseConfig({ [key]: " " })[field]).toBeNull();
+      expect(parseConfig({ [key]: " https://youtu.be/q6lkrA6fsCI " })[field]).toBe("https://youtu.be/q6lkrA6fsCI");
+      for (const junk of ["http://youtu.be/x", "javascript:alert(1)", "youtu.be/x", "https://user:pw@x.com/a", "https://x.com/a b", "not a url"]) {
+        expect(parseConfig({ [key]: junk })[field], junk).toBeNull();
+      }
+    }
+  });
+
   it("demo board slug: valid slug kept, anything else fails closed to null (PIN-73)", () => {
     expect(parseConfig({}).demoBoardSlug).toBeNull();
     expect(parseConfig({ DEMO_BOARD_SLUG: "" }).demoBoardSlug).toBeNull();
diff --git a/src/config.ts b/src/config.ts
index b86499a6..871c005a 100644
--- a/src/config.ts
+++ b/src/config.ts
@@ -75,6 +75,17 @@ export interface AppConfig {
    * issues instead of inventing an address.
    */
   legalContactEmail: string | null;
+  /**
+   * Judging-week links on the landing (PIN-263): the demo video
+   * (DEMO_VIDEO_URL, shown under "How it works") and the launch post
+   * (PROMO_POST_URL, in the footer). Public plain values in the App
+   * Hosting env yaml. Only an https URL is kept; anything else is
+   * null and the link is not shown, so unsetting the env value takes
+   * a link down without a code change. Both open in a new tab: no
+   * player or widget is embedded (no third-party trackers).
+   */
+  demoVideoUrl: string | null;
+  promoPostUrl: string | null;
   /**
    * Board Plus billing adapter (PIN-103, docs/15). "off" (the
    * default; anything but an exact known value) answers every
@@ -174,6 +185,19 @@ function parseContactEmail(value: string | undefined): string | null {
   return trimmed && CONTACT_EMAIL_PATTERN.test(trimmed) ? trimmed : null;
 }
 
+/** An absolute https URL, else null (PIN-263): no other scheme, no credentials, no spaces. */
+function parseHttpsUrl(value: string | undefined): string | null {
+  const trimmed = value?.trim();
+  if (!trimmed || /\s/.test(trimmed)) return null;
+  try {
+    const url = new URL(trimmed);
+    if (url.protocol !== "https:" || !url.hostname || url.username || url.password) return null;
+    return url.toString();
+  } catch {
+    return null;
+  }
+}
+
 /**
  * The one place the Stripe API version is pinned (PIN-149).
  * Matches the bundled stripe SDK's ApiVersion; a config test
@@ -287,6 +311,8 @@ export function parseConfig(
     }),
     demoBoardSlug: parseDemoBoardSlug(env.DEMO_BOARD_SLUG),
     legalContactEmail: parseContactEmail(env.LEGAL_CONTACT_EMAIL),
+    demoVideoUrl: parseHttpsUrl(env.DEMO_VIDEO_URL),
+    promoPostUrl: parseHttpsUrl(env.PROMO_POST_URL),
     plusMode: parsePlusMode(env),
     stripeSecretKey: nonEmpty(env.STRIPE_SECRET_KEY),
     stripeWebhookSecret: nonEmpty(env.STRIPE_WEBHOOK_SECRET),
diff --git a/src/domain/landing-actions.test.ts b/src/domain/landing-actions.test.ts
new file mode 100644
index 00000000..975fb92b
--- /dev/null
+++ b/src/domain/landing-actions.test.ts
@@ -0,0 +1,19 @@
+import { describe, expect, it } from "vitest";
+import { landingSecondary } from "./landing-actions";
+
+describe("landing second action (PIN-264)", () => {
+  it("offers the demo to anyone without boards, when the demo is on", () => {
+    expect(landingSecondary({ demoEnabled: true, myBoardSlugs: null })).toEqual({ kind: "demo" });
+    expect(landingSecondary({ demoEnabled: true, myBoardSlugs: [] })).toEqual({ kind: "demo" });
+    expect(landingSecondary({ demoEnabled: false, myBoardSlugs: null })).toEqual({ kind: "none" });
+    expect(landingSecondary({ demoEnabled: false, myBoardSlugs: [] })).toEqual({ kind: "none" });
+  });
+
+  it("opens the one board, or lists several, instead of the demo", () => {
+    expect(landingSecondary({ demoEnabled: true, myBoardSlugs: ["s1"] })).toEqual({ kind: "myBoard", slug: "s1" });
+    expect(landingSecondary({ demoEnabled: false, myBoardSlugs: ["s1"] })).toEqual({ kind: "myBoard", slug: "s1" });
+    expect(landingSecondary({ demoEnabled: true, myBoardSlugs: ["s1", "s2"] })).toEqual({ kind: "myBoards" });
+    // A blank slug never becomes a link.
+    expect(landingSecondary({ demoEnabled: true, myBoardSlugs: [""] })).toEqual({ kind: "demo" });
+  });
+});
diff --git a/src/domain/landing-actions.ts b/src/domain/landing-actions.ts
new file mode 100644
index 00000000..a0aa6f7c
--- /dev/null
+++ b/src/domain/landing-actions.ts
@@ -0,0 +1,29 @@
+/**
+ * The landing's second action (PIN-264), next to "Start a board".
+ * Pure: the page passes whether the demo is on and the signed-in
+ * visitor's own board slugs (null when signed out or unknown).
+ * Someone who already has boards gets their boards; everyone else
+ * gets the demo, when there is one.
+ */
+/**
+ * How many of the visitor's boards the landing needs to know about to
+ * choose: two tells "one" from "several". A decision threshold, not a
+ * tunable limit.
+ */
+export const LANDING_BOARDS_NEEDED = 2;
+
+export type LandingSecondary =
+  | { kind: "demo" }
+  | { kind: "myBoard"; slug: string }
+  | { kind: "myBoards" }
+  | { kind: "none" };
+
+export function landingSecondary(input: {
+  demoEnabled: boolean;
+  myBoardSlugs: readonly string[] | null;
+}): LandingSecondary {
+  const slugs = input.myBoardSlugs ?? [];
+  if (slugs.length === 1 && slugs[0]) return { kind: "myBoard", slug: slugs[0] };
+  if (slugs.length > 1) return { kind: "myBoards" };
+  return input.demoEnabled ? { kind: "demo" } : { kind: "none" };
+}
diff --git a/src/i18n/messages/de.json b/src/i18n/messages/de.json
index 34fe2947..b9d8d454 100644
--- a/src/i18n/messages/de.json
+++ b/src/i18n/messages/de.json
@@ -3,7 +3,9 @@
   "landing.tagline": "Deine Sachen, zusammen angepinnt.",
   "landing.body": "Mach ein Foto, wir stellen frei, was drauf ist, und Freund*innen pinnen ihre Sachen auf dieselbe Pinnwand.",
   "landing.start": "Pinnwand starten",
-  "landing.demo": "Pinnwand ansehen",
+  "landing.demo": "Demo-Pinnwand",
+  "landing.myBoard": "Meine Pinnwand ansehen",
+  "landing.myBoards": "Meine Pinnwände ansehen",
   "landing.demoTitle": "Demo-Pinnwand",
   "landing.demoNote.one": "Eine frische Demo-Pinnwand nur für dich. Sie verschwindet nach {n} Stunde.",
   "landing.demoNote.other": "Eine frische Demo-Pinnwand nur für dich. Sie verschwindet nach {n} Stunden.",
@@ -32,7 +34,10 @@
   "landing.meta.image": "Muse Image komponiert die Szene",
   "landing.meta.voice": "Muse Voice übernimmt dein Diktat",
   "landing.meta.more": "Wie jedes Modell genutzt wird",
-  "footer.source": "Open Source (AGPL-3.0)",
+  "landing.video": "3-Minuten-Demo ansehen",
+  "landing.xPost": "Post auf X ansehen",
+  "landing.newTab": "(öffnet in neuem Tab)",
+  "footer.source": "Quellcode",
   "footer.label": "Über Pinneds",
   "footer.privacy": "Datenschutz",
   "footer.terms": "AGB",
diff --git a/src/i18n/messages/de.lock.json b/src/i18n/messages/de.lock.json
index 1b524e1f..89c774d8 100644
--- a/src/i18n/messages/de.lock.json
+++ b/src/i18n/messages/de.lock.json
@@ -7,7 +7,9 @@
     "landing.tagline": "ac17cfe28cd6dfdd",
     "landing.body": "48ad4a1e001d5c4c",
     "landing.start": "27eae113a5a5d6fd",
-    "landing.demo": "cc031f55f56cfc19",
+    "landing.demo": "302ebf46889480e2",
+    "landing.myBoard": "9c778f4628bd0c15",
+    "landing.myBoards": "fcdb77c25cb33802",
     "landing.demoTitle": "302ebf46889480e2",
     "landing.demoNote.one": "973efdcc430f1da4",
     "landing.demoNote.other": "abb401f248419df6",
@@ -36,7 +38,10 @@
     "landing.meta.image": "9b0e20b08ba3fe00",
     "landing.meta.voice": "7f456bc539a6113f",
     "landing.meta.more": "b6f3126a5179a8fb",
-    "footer.source": "d6b7bb70cf454434",
+    "landing.video": "5eba963ff1a13091",
+    "landing.xPost": "ce76a335f6f51201",
+    "landing.newTab": "698f8eb0cb8b5d56",
+    "footer.source": "4130f282946fb482",
     "footer.label": "2f628f5fabb34b50",
     "footer.privacy": "7f2db785fccdbba3",
     "footer.terms": "49f776cc2a401984",
diff --git a/src/i18n/messages/en.json b/src/i18n/messages/en.json
index b19b4d0f..5c9c9449 100644
--- a/src/i18n/messages/en.json
+++ b/src/i18n/messages/en.json
@@ -3,7 +3,9 @@
   "landing.tagline": "Your stuff, pinned together.",
   "landing.body": "Snap a photo, we cut out what's in it, and friends pin theirs to the same board.",
   "landing.start": "Start a board",
-  "landing.demo": "See a board",
+  "landing.demo": "Demo board",
+  "landing.myBoard": "See my board",
+  "landing.myBoards": "See my boards",
   "landing.demoTitle": "Demo board",
   "landing.demoNote.one": "A fresh demo board just for you. It disappears after {n} hour.",
   "landing.demoNote.other": "A fresh demo board just for you. It disappears after {n} hours.",
@@ -32,7 +34,10 @@
   "landing.meta.image": "Muse Image composes the scene",
   "landing.meta.voice": "Muse Voice takes your dictation",
   "landing.meta.more": "How each model is used",
-  "footer.source": "Open source (AGPL-3.0)",
+  "landing.video": "Watch the 3-minute demo",
+  "landing.xPost": "See the post on X",
+  "landing.newTab": "(opens in a new tab)",
+  "footer.source": "Source code",
   "footer.label": "About Pinneds",
   "footer.privacy": "Privacy",
   "footer.terms": "Terms",
diff --git a/src/i18n/messages/es.json b/src/i18n/messages/es.json
index 7a8bcfac..2b10a075 100644
--- a/src/i18n/messages/es.json
+++ b/src/i18n/messages/es.json
@@ -3,7 +3,9 @@
   "landing.tagline": "Tus cosas, pineadas juntas.",
   "landing.body": "Toma una foto, recortamos lo que hay dentro y tus amigos pinean las suyas en el mismo tablero.",
   "landing.start": "Crear tablero",
-  "landing.demo": "Ver un tablero",
+  "landing.demo": "Tablero demo",
+  "landing.myBoard": "Ver mi tablero",
+  "landing.myBoards": "Ver mis tableros",
   "landing.demoTitle": "Tablero demo",
   "landing.demoNote.one": "Un tablero demo nuevo solo para ti. Desaparece en {n} hora.",
   "landing.demoNote.other": "Un tablero demo nuevo solo para ti. Desaparece en {n} horas.",
@@ -32,7 +34,10 @@
   "landing.meta.image": "Muse Image compone la escena",
   "landing.meta.voice": "Muse Voice toma tu dictado",
   "landing.meta.more": "Cómo se usa cada modelo",
-  "footer.source": "Código abierto (AGPL-3.0)",
+  "landing.video": "Mira la demo de 3 minutos",
+  "landing.xPost": "Ver la publicación en X",
+  "landing.newTab": "(se abre en una pestaña nueva)",
+  "footer.source": "Código fuente",
   "footer.label": "Sobre Pinneds",
   "footer.privacy": "Privacidad",
   "footer.terms": "Términos",
diff --git a/src/i18n/messages/es.lock.json b/src/i18n/messages/es.lock.json
index 1b524e1f..89c774d8 100644
--- a/src/i18n/messages/es.lock.json
+++ b/src/i18n/messages/es.lock.json
@@ -7,7 +7,9 @@
     "landing.tagline": "ac17cfe28cd6dfdd",
     "landing.body": "48ad4a1e001d5c4c",
     "landing.start": "27eae113a5a5d6fd",
-    "landing.demo": "cc031f55f56cfc19",
+    "landing.demo": "302ebf46889480e2",
+    "landing.myBoard": "9c778f4628bd0c15",
+    "landing.myBoards": "fcdb77c25cb33802",
     "landing.demoTitle": "302ebf46889480e2",
     "landing.demoNote.one": "973efdcc430f1da4",
     "landing.demoNote.other": "abb401f248419df6",
@@ -36,7 +38,10 @@
     "landing.meta.image": "9b0e20b08ba3fe00",
     "landing.meta.voice": "7f456bc539a6113f",
     "landing.meta.more": "b6f3126a5179a8fb",
-    "footer.source": "d6b7bb70cf454434",
+    "landing.video": "5eba963ff1a13091",
+    "landing.xPost": "ce76a335f6f51201",
+    "landing.newTab": "698f8eb0cb8b5d56",
+    "footer.source": "4130f282946fb482",
     "footer.label": "2f628f5fabb34b50",
     "footer.privacy": "7f2db785fccdbba3",
     "footer.terms": "49f776cc2a401984",
diff --git a/src/i18n/messages/fr.json b/src/i18n/messages/fr.json
index 8ff436ce..03dbf92b 100644
--- a/src/i18n/messages/fr.json
+++ b/src/i18n/messages/fr.json
@@ -3,7 +3,9 @@
   "landing.tagline": "Nos trucs, épinglés ensemble.",
   "landing.body": "Prends une photo, on détoure ce qu'il y a dedans, et tes amis épinglent les leurs sur le même tableau.",
   "landing.start": "Créer un tableau",
-  "landing.demo": "Voir un tableau",
+  "landing.demo": "Tableau de démo",
+  "landing.myBoard": "Voir mon tableau",
+  "landing.myBoards": "Voir mes tableaux",
   "landing.demoTitle": "Tableau démo",
   "landing.demoNote.one": "Un tableau démo tout frais rien que pour toi. Il disparaît après {n} heure.",
   "landing.demoNote.other": "Un tableau démo tout frais rien que pour toi. Il disparaît après {n} heures.",
@@ -32,7 +34,10 @@
   "landing.meta.image": "Muse Image compose la scène",
   "landing.meta.voice": "Muse Voice prend ta dictée",
   "landing.meta.more": "Comment chaque modèle est utilisé",
-  "footer.source": "Open source (AGPL-3.0)",
+  "landing.video": "Regarde la démo en 3 min",
+  "landing.xPost": "Vois le post sur X",
+  "landing.newTab": "(s’ouvre dans un nouvel onglet)",
+  "footer.source": "Code source",
   "footer.label": "À propos de Pinneds",
   "footer.privacy": "Confidentialité",
   "footer.terms": "Conditions",
diff --git a/src/i18n/messages/fr.lock.json b/src/i18n/messages/fr.lock.json
index 1b524e1f..89c774d8 100644
--- a/src/i18n/messages/fr.lock.json
+++ b/src/i18n/messages/fr.lock.json
@@ -7,7 +7,9 @@
     "landing.tagline": "ac17cfe28cd6dfdd",
     "landing.body": "48ad4a1e001d5c4c",
     "landing.start": "27eae113a5a5d6fd",
-    "landing.demo": "cc031f55f56cfc19",
+    "landing.demo": "302ebf46889480e2",
+    "landing.myBoard": "9c778f4628bd0c15",
+    "landing.myBoards": "fcdb77c25cb33802",
     "landing.demoTitle": "302ebf46889480e2",
     "landing.demoNote.one": "973efdcc430f1da4",
     "landing.demoNote.other": "abb401f248419df6",
@@ -36,7 +38,10 @@
     "landing.meta.image": "9b0e20b08ba3fe00",
     "landing.meta.voice": "7f456bc539a6113f",
     "landing.meta.more": "b6f3126a5179a8fb",
-    "footer.source": "d6b7bb70cf454434",
+    "landing.video": "5eba963ff1a13091",
+    "landing.xPost": "ce76a335f6f51201",
+    "landing.newTab": "698f8eb0cb8b5d56",
+    "footer.source": "4130f282946fb482",
     "footer.label": "2f628f5fabb34b50",
     "footer.privacy": "7f2db785fccdbba3",
     "footer.terms": "49f776cc2a401984",
diff --git a/src/i18n/messages/id.json b/src/i18n/messages/id.json
index 5d935269..387186f0 100644
--- a/src/i18n/messages/id.json
+++ b/src/i18n/messages/id.json
@@ -3,7 +3,9 @@
   "landing.tagline": "Barang-barangmu, tersemat bareng.",
   "landing.body": "Jepret foto, kami potong isinya, dan teman-teman menyematkan punya mereka di papan yang sama.",
   "landing.start": "Buat papan",
-  "landing.demo": "Lihat papan",
+  "landing.demo": "Papan demo",
+  "landing.myBoard": "Lihat papanku",
+  "landing.myBoards": "Lihat papan-papanku",
   "landing.demoTitle": "Papan demo",
   "landing.demoNote.one": "Papan demo baru khusus buat kamu. Hilang setelah {n} jam.",
   "landing.demoNote.other": "Papan demo baru khusus buat kamu. Hilang setelah {n} jam.",
@@ -32,7 +34,10 @@
   "landing.meta.image": "Muse Image menyusun adegan",
   "landing.meta.voice": "Muse Voice mencatat diktemu",
   "landing.meta.more": "Cara setiap model digunakan",
-  "footer.source": "Sumber terbuka (AGPL-3.0)",
+  "landing.video": "Tonton demo 3 menit",
+  "landing.xPost": "Lihat postingan di X",
+  "landing.newTab": "(buka di tab baru)",
+  "footer.source": "Kode sumber",
   "footer.label": "Tentang Pinneds",
   "footer.privacy": "Privasi",
   "footer.terms": "Syarat",
diff --git a/src/i18n/messages/id.lock.json b/src/i18n/messages/id.lock.json
index 1b524e1f..89c774d8 100644
--- a/src/i18n/messages/id.lock.json
+++ b/src/i18n/messages/id.lock.json
@@ -7,7 +7,9 @@
     "landing.tagline": "ac17cfe28cd6dfdd",
     "landing.body": "48ad4a1e001d5c4c",
     "landing.start": "27eae113a5a5d6fd",
-    "landing.demo": "cc031f55f56cfc19",
+    "landing.demo": "302ebf46889480e2",
+    "landing.myBoard": "9c778f4628bd0c15",
+    "landing.myBoards": "fcdb77c25cb33802",
     "landing.demoTitle": "302ebf46889480e2",
     "landing.demoNote.one": "973efdcc430f1da4",
     "landing.demoNote.other": "abb401f248419df6",
@@ -36,7 +38,10 @@
     "landing.meta.image": "9b0e20b08ba3fe00",
     "landing.meta.voice": "7f456bc539a6113f",
     "landing.meta.more": "b6f3126a5179a8fb",
-    "footer.source": "d6b7bb70cf454434",
+    "landing.video": "5eba963ff1a13091",
+    "landing.xPost": "ce76a335f6f51201",
+    "landing.newTab": "698f8eb0cb8b5d56",
+    "footer.source": "4130f282946fb482",
     "footer.label": "2f628f5fabb34b50",
     "footer.privacy": "7f2db785fccdbba3",
     "footer.terms": "49f776cc2a401984",
diff --git a/src/i18n/messages/it.json b/src/i18n/messages/it.json
index 5bd04d40..67b5cf08 100644
--- a/src/i18n/messages/it.json
+++ b/src/i18n/messages/it.json
@@ -3,7 +3,9 @@
   "landing.tagline": "La tua roba, appuntata insieme.",
   "landing.body": "Scatta una foto, noi ritagliamo quello che c'è dentro e i tuoi amici appuntano le loro sulla stessa bacheca.",
   "landing.start": "Crea una bacheca",
-  "landing.demo": "Vedi una bacheca",
+  "landing.demo": "Bacheca demo",
+  "landing.myBoard": "Vedi la mia bacheca",
+  "landing.myBoards": "Vedi le mie bacheche",
   "landing.demoTitle": "Bacheca demo",
   "landing.demoNote.one": "Una bacheca demo nuova solo per te. Scompare dopo {n} ora.",
   "landing.demoNote.other": "Una bacheca demo nuova solo per te. Scompare dopo {n} ore.",
@@ -32,7 +34,10 @@
   "landing.meta.image": "Muse Image compone la scena",
   "landing.meta.voice": "Muse Voice trascrive la tua voce",
   "landing.meta.more": "Come usiamo ogni modello",
-  "footer.source": "Open source (AGPL-3.0)",
+  "landing.video": "Guarda la demo di 3 minuti",
+  "landing.xPost": "Vedi il post su X",
+  "landing.newTab": "(si apre in una nuova scheda)",
+  "footer.source": "Codice sorgente",
   "footer.label": "Info su Pinneds",
   "footer.privacy": "Privacy",
   "footer.terms": "Termini",
diff --git a/src/i18n/messages/it.lock.json b/src/i18n/messages/it.lock.json
index 1b524e1f..89c774d8 100644
--- a/src/i18n/messages/it.lock.json
+++ b/src/i18n/messages/it.lock.json
@@ -7,7 +7,9 @@
     "landing.tagline": "ac17cfe28cd6dfdd",
     "landing.body": "48ad4a1e001d5c4c",
     "landing.start": "27eae113a5a5d6fd",
-    "landing.demo": "cc031f55f56cfc19",
+    "landing.demo": "302ebf46889480e2",
+    "landing.myBoard": "9c778f4628bd0c15",
+    "landing.myBoards": "fcdb77c25cb33802",
     "landing.demoTitle": "302ebf46889480e2",
     "landing.demoNote.one": "973efdcc430f1da4",
     "landing.demoNote.other": "abb401f248419df6",
@@ -36,7 +38,10 @@
     "landing.meta.image": "9b0e20b08ba3fe00",
     "landing.meta.voice": "7f456bc539a6113f",
     "landing.meta.more": "b6f3126a5179a8fb",
-    "footer.source": "d6b7bb70cf454434",
+    "landing.video": "5eba963ff1a13091",
+    "landing.xPost": "ce76a335f6f51201",
+    "landing.newTab": "698f8eb0cb8b5d56",
+    "footer.source": "4130f282946fb482",
     "footer.label": "2f628f5fabb34b50",
     "footer.privacy": "7f2db785fccdbba3",
     "footer.terms": "49f776cc2a401984",
diff --git a/src/i18n/messages/pt-BR.json b/src/i18n/messages/pt-BR.json
index 7500650c..7eb17b44 100644
--- a/src/i18n/messages/pt-BR.json
+++ b/src/i18n/messages/pt-BR.json
@@ -3,7 +3,9 @@
   "landing.tagline": "Suas coisas, fixadas juntas.",
   "landing.body": "Tire uma foto, a gente recorta o que tem nela e seus amigos fixam as deles no mesmo quadro.",
   "landing.start": "Criar quadro",
-  "landing.demo": "Ver um quadro",
+  "landing.demo": "Quadro demo",
+  "landing.myBoard": "Ver meu quadro",
+  "landing.myBoards": "Ver meus quadros",
   "landing.demoTitle": "Quadro demo",
   "landing.demoNote.one": "Um quadro demo novinho só para você. Desaparece depois de {n} hora.",
   "landing.demoNote.other": "Um quadro demo novinho só para você. Desaparece depois de {n} horas.",
@@ -32,7 +34,10 @@
   "landing.meta.image": "Muse Image cria a cena",
   "landing.meta.voice": "Muse Voice transcreve o que você dita",
   "landing.meta.more": "Como cada modelo é usado",
-  "footer.source": "Código aberto (AGPL-3.0)",
+  "landing.video": "Assista à demo de 3 minutos",
+  "landing.xPost": "Ver o post no X",
+  "landing.newTab": "(abre em nova aba)",
+  "footer.source": "Código-fonte",
   "footer.label": "Sobre o Pinneds",
   "footer.privacy": "Privacidade",
   "footer.terms": "Termos",
diff --git a/src/i18n/messages/pt-BR.lock.json b/src/i18n/messages/pt-BR.lock.json
index 1b524e1f..89c774d8 100644
--- a/src/i18n/messages/pt-BR.lock.json
+++ b/src/i18n/messages/pt-BR.lock.json
@@ -7,7 +7,9 @@
     "landing.tagline": "ac17cfe28cd6dfdd",
     "landing.body": "48ad4a1e001d5c4c",
     "landing.start": "27eae113a5a5d6fd",
-    "landing.demo": "cc031f55f56cfc19",
+    "landing.demo": "302ebf46889480e2",
+    "landing.myBoard": "9c778f4628bd0c15",
+    "landing.myBoards": "fcdb77c25cb33802",
     "landing.demoTitle": "302ebf46889480e2",
     "landing.demoNote.one": "973efdcc430f1da4",
     "landing.demoNote.other": "abb401f248419df6",
@@ -36,7 +38,10 @@
     "landing.meta.image": "9b0e20b08ba3fe00",
     "landing.meta.voice": "7f456bc539a6113f",
     "landing.meta.more": "b6f3126a5179a8fb",
-    "footer.source": "d6b7bb70cf454434",
+    "landing.video": "5eba963ff1a13091",
+    "landing.xPost": "ce76a335f6f51201",
+    "landing.newTab": "698f8eb0cb8b5d56",
+    "footer.source": "4130f282946fb482",
     "footer.label": "2f628f5fabb34b50",
     "footer.privacy": "7f2db785fccdbba3",
     "footer.terms": "49f776cc2a401984",
diff --git a/src/server/landing-viewer.ts b/src/server/landing-viewer.ts
new file mode 100644
index 00000000..a438d915
--- /dev/null
+++ b/src/server/landing-viewer.ts
@@ -0,0 +1,34 @@
+import "server-only";
+import { cookies } from "next/headers";
+import { getConfig } from "../config";
+import { getPolicy } from "../policy/server";
+import { getBoardRepository } from "./board-repository";
+import { LANDING_BOARDS_NEEDED } from "../domain/landing-actions";
+import { liveBoardSlugs } from "./my-boards";
+import { getUserRepository } from "./user-repository";
+import { resolveUserSession, USER_COOKIE_NAME } from "./user-session";
+
+/**
+ * The signed-in visitor's own live board slugs for the landing
+ * (PIN-264), at most LANDING_BOARDS_NEEDED: only the claim checks,
+ * never the My boards library reads. Null when sign-in
+ * is off, there is no session cookie (no read at all for anonymous
+ * visitors), the session is not valid, or anything fails: the
+ * landing then shows its usual demo button. The slugs only go back
+ * to their owner, in a page Next renders per request and never
+ * caches.
+ */
+export async function viewerBoardSlugs(): Promise<string[] | null> {
+  const cfg = getConfig();
+  if (cfg.authMode !== "optional") return null;
+  try {
+    const cookieValue = (await cookies()).get(USER_COOKIE_NAME)?.value ?? null;
+    if (!cookieValue) return null;
+    const users = getUserRepository();
+    const user = await resolveUserSession(cookieValue, { users, sessionSecret: cfg.sessionSecret, policy: getPolicy() });
+    if (!user) return null;
+    return await liveBoardSlugs(user, { boards: getBoardRepository(), users }, LANDING_BOARDS_NEEDED);
+  } catch {
+    return null;
+  }
+}
diff --git a/src/server/my-boards.test.ts b/src/server/my-boards.test.ts
index 5f858a78..7dd1b513 100644
--- a/src/server/my-boards.test.ts
+++ b/src/server/my-boards.test.ts
@@ -5,7 +5,7 @@ import { InMemoryBoardRepository } from "../domain/board-repository";
 import type { UserProfile } from "../domain/user";
 import { InMemoryUserRepository } from "../domain/user-repository";
 import { resolvePolicy } from "../policy/policy";
-import { listMyBoards, removeMyBoard } from "./my-boards";
+import { listMyBoards, liveBoardSlugs, removeMyBoard } from "./my-boards";
 import { findClaimedParticipant, linkParticipantToUser } from "./user-session";
 
 const USER: UserProfile = { uid: "synthetic-alice", createdAt: 1, updatedAt: 1 };
@@ -265,3 +265,44 @@ describe("removeMyBoard (PIN-166)", () => {
     expect(await users.getUserBoard(USER.uid, OTHER_SLUG)).not.toBeNull();
   });
 });
+
+describe("liveBoardSlugs (PIN-264)", () => {
+  async function setup() {
+    const boards = new InMemoryBoardRepository();
+    const users = new InMemoryUserRepository();
+    await users.putUser(USER);
+    for (const [slug, pid, owner] of [["b1", "p1", USER.uid], ["stale", "ps", "synthetic-bob"], ["b2", "p2", USER.uid], ["b3", "p3", USER.uid]] as const) {
+      await boards.createBoard(board(slug, 1));
+      await boards.putParticipant(participant(pid, slug, owner));
+    }
+    for (const [boardId, participantId, at] of [["b1", "p1", 10], ["gone", "pg", 15], ["stale", "ps", 20], ["b2", "p2", 30], ["b3", "p3", 40]] as const) {
+      await users.putUserBoard(USER.uid, { boardId, participantId, claimedAt: at, updatedAt: at });
+    }
+    return { boards, users };
+  }
+
+  it("keeps the same claim checks as My boards and stops at the limit", async () => {
+    const deps = await setup();
+    const all = await liveBoardSlugs(USER, deps, 10);
+    expect([...all].sort()).toEqual(["b1", "b2", "b3"]);
+    expect(await liveBoardSlugs(USER, deps, 2)).toHaveLength(2);
+    expect(await liveBoardSlugs(USER, deps, 0)).toEqual([]);
+    // Same set as the full library, never a gone or re-claimed board.
+    const cards = await listMyBoards(USER, deps);
+    expect([...all].sort()).toEqual(cards.map((c) => c.slug).sort());
+  });
+
+  it("never reads a board's elements, pins, scenes or events", async () => {
+    const deps = await setup();
+    const touched: string[] = [];
+    for (const name of ["listElementsByOwner", "listPins", "listScenes", "listEvents"] as const) {
+      const original = deps.boards[name].bind(deps.boards) as (...args: unknown[]) => unknown;
+      (deps.boards as unknown as Record<string, unknown>)[name] = (...args: unknown[]) => {
+        touched.push(name);
+        return original(...args);
+      };
+    }
+    await liveBoardSlugs(USER, deps, 2);
+    expect(touched).toEqual([]);
+  });
+});
diff --git a/src/server/my-boards.ts b/src/server/my-boards.ts
index 9a8e7390..b0ded376 100644
--- a/src/server/my-boards.ts
+++ b/src/server/my-boards.ts
@@ -24,6 +24,32 @@ export interface MyBoardsDeps {
   plusMode?: PlusMode;
 }
 
+/**
+ * The user's live board slugs, at most `limit` (PIN-264, Bugbot on
+ * #242): the same claim checks as listMyBoards (the board exists and
+ * the participant still carries this user's claim) without the
+ * per-board elements, pins, scenes and events reads. It stops as soon
+ * as it has `limit`. The landing only needs to tell none, one (and
+ * its slug) and several apart.
+ */
+export async function liveBoardSlugs(
+  user: UserProfile,
+  deps: Pick<MyBoardsDeps, "boards" | "users">,
+  limit: number,
+): Promise<string[]> {
+  const slugs: string[] = [];
+  if (limit <= 0) return slugs;
+  for (const entry of await deps.users.listUserBoards(user.uid)) {
+    const board = await deps.boards.getBoard(entry.boardId);
+    if (!board) continue;
+    const participant = await deps.boards.getParticipant(entry.boardId, entry.participantId);
+    if (!participant || participant.userId !== user.uid) continue;
+    slugs.push(board.slug);
+    if (slugs.length >= limit) break;
+  }
+  return slugs;
+}
+
 export async function listMyBoards(
   user: UserProfile,
   deps: MyBoardsDeps,
diff --git a/src/ui/icons.tsx b/src/ui/icons.tsx
index 10e64d2f..0a058a5d 100644
--- a/src/ui/icons.tsx
+++ b/src/ui/icons.tsx
@@ -28,6 +28,9 @@ export const ICON_PATHS = {
   mic: ["M12 3a3 3 0 0 1 3 3v5a3 3 0 0 1-6 0V6a3 3 0 0 1 3-3z", "M5.5 11a6.5 6.5 0 0 0 13 0", "M12 17.5V21"],
   stop: ["M8.5 6.5h7a2 2 0 0 1 2 2v7a2 2 0 0 1-2 2h-7a2 2 0 0 1-2-2v-7a2 2 0 0 1 2-2z"],
   globe: ["M21 12a9 9 0 1 1-18 0a9 9 0 1 1 18 0z", "M3 12h18", "M12 3c2.5 2.6 3.75 5.6 3.75 9S14.5 18.4 12 21", "M12 3c-2.5 2.6-3.75 5.6-3.75 9S9.5 18.4 12 21"],
+  /* PIN-263: launch (start something new, or open it in a new tab) and play (a video). */
+  launch: ["M14 4h6v6", "M20 4l-9 9", "M18 14v4.5A1.5 1.5 0 0 1 16.5 20h-11A1.5 1.5 0 0 1 4 18.5v-11A1.5 1.5 0 0 1 5.5 6H10"],
+  play: ["M21 12a9 9 0 1 1-18 0a9 9 0 1 1 18 0z", "M10 8.75v6.5l5.25-3.25z"],
 } as const;
 
 export type IconName = keyof typeof ICON_PATHS;
diff --git a/src/ui/kit.test.ts b/src/ui/kit.test.ts
index bf173fc7..ff1affd2 100644
--- a/src/ui/kit.test.ts
+++ b/src/ui/kit.test.ts
@@ -40,8 +40,10 @@ describe("UI kit helpers (PIN-97)", () => {
 });
 
 describe("UI kit components (PIN-97)", () => {
-  it("ships 24 icons, decorative unless titled", () => {
-    expect(ICON_NAMES).toHaveLength(24);
+  it("ships 26 icons, decorative unless titled", () => {
+    expect(ICON_NAMES).toHaveLength(26);
+    expect(ICON_NAMES).toContain("launch");
+    expect(ICON_NAMES).toContain("play");
     expect(ICON_NAMES).toContain("globe");
     expect(ICON_NAMES).toContain("mic");
     expect(ICON_NAMES).toContain("stop");
diff --git a/src/ui/pinneds.css b/src/ui/pinneds.css
index 49fd0603..2ce1eb0a 100644
--- a/src/ui/pinneds.css
+++ b/src/ui/pinneds.css
@@ -316,16 +316,19 @@
 .pn-print-wrap { display: block; rotate: calc(var(--tilt) * var(--t, 0) * var(--print-tilt) * .5); }
 .pn-print { position: relative; display: grid; gap: 0; margin: 0; background: var(--print-holes), var(--print-bg); padding: var(--print-pad) var(--print-pad) var(--print-pad-bottom);
   border-radius: var(--print-radius); box-shadow: var(--shadow-print); -webkit-mask: var(--print-mask); mask: var(--print-mask); padding-top: var(--print-pad-top); }
+/* PIN-262: one column that never grows past the paper, so a long tag or word can't push the picture past the card's edge. */
+.pn-print { grid-template-columns: minmax(0, 1fr); }
+.pn-print .pn-tag { white-space: normal; }
 .pn-print-frame { position: relative; overflow: hidden; border-radius: 2px; background: var(--surface-sunk); }
 .pn-print-frame > img:not(.pn-develop-cut) { display: block; width: 100%; height: 100%; object-fit: cover; }
 /* PIN-131: with onOpen the frame sits in a bare button that opens the scene viewer (no box of its own, so no shift). */
 .pn-print-open { display: block; width: 100%; padding: 0; border: 0; border-radius: 2px; background: none; color: inherit; cursor: zoom-in; -webkit-tap-highlight-color: transparent; }
 /* Kind tag and Nº sit on the paper under the picture, never on it (the tag has its own fill, the Nº is muted ink on the paper). */
-.pn-print-meta { display: flex; align-items: center; gap: var(--space-2); padding: var(--space-2) 2px 0; }
+.pn-print-meta { display: flex; flex-wrap: wrap; align-items: center; gap: var(--space-2); padding: var(--space-2) 2px 0; }
 .pn-print-no { margin-left: auto; font: 650 11px/14px var(--font-mono); letter-spacing: .08em; color: var(--ink-muted); white-space: nowrap; }
 .pn-print-body { display: grid; gap: var(--space-3); padding: var(--space-3) 2px 0; }
 .pn-print-meta + .pn-print-body { padding-top: var(--space-2); }
-.pn-print-idea { margin: 0; font: 650 16px/22px var(--font-ui); color: var(--ink); }
+.pn-print-idea { margin: 0; font: 650 16px/22px var(--font-ui); color: var(--ink); overflow-wrap: anywhere; }
 .pn-print-actions { display: flex; align-items: center; gap: var(--space-2); }
 .pn-print-actions .pn-spacer { flex: 1; }
 .pn-prints { display: flex; gap: var(--space-4); overflow-x: auto; scroll-snap-type: x mandatory; padding: 6px var(--space-4) 18px; margin: 0 calc(-1 * var(--space-4)); list-style: none; scrollbar-width: none; }
@@ -336,9 +339,9 @@
 .pn-develop-frame { position: relative; overflow: hidden; border-radius: 2px; background: var(--develop-bg); isolation: isolate; }
 .pn-develop-frame::after { content: ""; position: absolute; inset: 0; z-index: 2; background: linear-gradient(180deg, transparent, color-mix(in srgb, var(--surface-raised) 30%, transparent)); mix-blend-mode: soft-light; animation: pn-develop 4s ease-in-out infinite alternate; }
 .pn-develop-cut { position: absolute; z-index: 1; width: 34%; height: auto; max-height: 60%; object-fit: contain; translate: -50% -50%; rotate: calc(var(--tilt) * var(--t, 0)); opacity: .55; filter: drop-shadow(2px 0 0 var(--keyline)) drop-shadow(-2px 0 0 var(--keyline)) drop-shadow(0 2px 0 var(--keyline)) drop-shadow(0 -2px 0 var(--keyline)) sepia(.6) blur(.4px); animation: pn-float 3.2s ease-in-out infinite alternate; }
-.pn-develop-status { display: flex; align-items: center; justify-content: space-between; gap: var(--space-2); }
+.pn-develop-status { display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between; gap: var(--space-2); }
 .pn-develop-status .pn-tag { animation: pn-blink 1.4s steps(2, jump-none) infinite; }
-.pn-develop-line { margin: 0; color: var(--ink-muted); font: 500 14px/20px var(--font-ui); }
+.pn-develop-line { margin: 0; color: var(--ink-muted); font: 500 14px/20px var(--font-ui); overflow-wrap: anywhere; }
 @keyframes pn-develop { from { opacity: .2; } to { opacity: .9; } }
 @keyframes pn-float { from { translate: -50% -48%; } to { translate: -50% -53%; } }
 @keyframes pn-blink { 50% { opacity: .55; } }
@@ -371,6 +374,10 @@
 .pn-scrim { position: absolute; inset: 0; background: var(--scrim); }
 .pn-sheet { position: relative; display: grid; gap: var(--space-4); width: 100%; max-width: 560px; margin: 0 auto; padding: var(--space-2) var(--space-5) calc(var(--space-5) + env(safe-area-inset-bottom)); border-radius: var(--sheet-radius) var(--sheet-radius) 0 0; background: var(--surface-raised); color: var(--ink); box-shadow: var(--shadow-sheet); }
 .pn-sheet { border: var(--edge-w) solid var(--edge); border-bottom: 0; }
+/* PIN-261: a sheet in the Sheet layer never grows past the top of the screen; taller content scrolls inside it.
+   Zero specificity on purpose: sheets that scroll an inner region (Make, Change look, Start) keep their own
+   max-height and set overflow back to visible; the scene viewer's panel is not in the layer, so its menus aren't clipped. */
+:where(.pn-sheet-layer > .pn-sheet) { max-height: calc(100vh - var(--space-5)); max-height: calc(100dvh - var(--space-5)); overflow-y: auto; overscroll-behavior: contain; }
 .pn-sheet-grab { justify-self: center; width: 40px; height: 5px; border-radius: 3px; background: var(--line-strong); }
 .pn-sheet-head { display: flex; align-items: center; justify-content: space-between; gap: var(--space-3); }
 .pn-sheet-title { margin: 0; font-family: var(--skin-display); font-weight: var(--display-weight); font-style: var(--display-style); font-size: calc(24px * var(--display-scale)); line-height: 1.1; letter-spacing: var(--display-tracking); text-transform: var(--display-transform); }
@@ -633,6 +640,10 @@ a.pn-btn:not(.pn-btn-quiet) { text-decoration: none; }
 .pn-landing-note { margin: 0; font: 500 14px/20px var(--font-ui); color: var(--ink-muted); }
 .pn-landing-how { grid-area: how; display: grid; gap: var(--space-5); margin-top: var(--space-4); padding-top: var(--space-5); border-top: 2px dashed var(--line-strong); }
 .pn-landing-steps { display: grid; gap: var(--space-5); margin: 0; padding: 0; list-style: none; }
+/* PIN-263/265: the demo video and the launch post close "How it works" together; they size to their labels. */
+.pn-landing-promo { display: flex; flex-wrap: wrap; align-items: center; gap: var(--space-2) var(--space-5); }
+.pn-landing-promo-link { display: inline-flex; align-items: center; gap: 6px; min-height: var(--tap); color: var(--ink); font: 600 15px/20px var(--font-ui); text-decoration: underline; text-underline-offset: 4px; }
+.pn-landing-promo-link:focus-visible { outline: 2px solid var(--focus); outline-offset: 2px; }
 .pn-landing-step { display: grid; grid-template-columns: 124px minmax(0, 1fr); align-items: center; gap: var(--space-4); }
 .pn-landing-art { position: relative; aspect-ratio: 1; width: 100%; display: grid; place-items: center; }
 .pn-landing-art .pn-print-wrap { width: 88%; }
@@ -654,14 +665,22 @@ a.pn-btn:not(.pn-btn-quiet) { text-decoration: none; }
 .pn-landing-meta-list { display: grid; gap: var(--space-1) var(--space-5); margin: 0; padding: 0; list-style: none; font: 500 14px/20px var(--font-ui); }
 .pn-landing-meta-list li { display: flex; align-items: center; gap: var(--space-2); }
 .pn-landing-meta-list .pn-icon { flex: none; }
+/* PIN-265: the models link closes the credit it explains. */
+.pn-landing-meta-more a { gap: 6px; color: var(--ink); font-weight: 600; text-decoration: underline; }
 /* Footer links (PIN-26): Privacy, Terms, source; each a 44px target. */
-.pn-foot-links { display: flex; flex-wrap: wrap; column-gap: var(--space-5); }
-.pn-foot-links a { display: inline-flex; align-items: center; min-height: var(--tap); color: var(--ink-muted); font: 500 14px/20px var(--font-ui); text-underline-offset: 4px; }
+/* PIN-265: one quiet utility row. Links sit in a list; CSS draws the dots (empty alt text: never read aloud, never part of a link). */
+.pn-foot-links { display: flex; flex-wrap: wrap; align-items: center; justify-content: space-between; gap: 0 var(--space-4); }
+.pn-foot-list { display: flex; flex-wrap: wrap; align-items: center; margin: 0; padding: 0; list-style: none; }
+.pn-foot-list > li { display: inline-flex; align-items: center; }
+.pn-foot-list > li + li::before { content: "·"; content: "·" / ""; padding: 0 var(--space-2); color: var(--ink-muted); }
+.pn-foot-links a { display: inline-flex; align-items: center; min-height: var(--tap); color: var(--ink-muted); font: 500 13px/18px var(--font-ui); text-decoration: none; text-underline-offset: 4px; }
+.pn-foot-links a:hover { color: var(--ink); text-decoration: underline; }
 .pn-foot-links a[aria-current="page"] { color: var(--ink); text-decoration: none; }
+.pn-landing-foot .pn-foot-links { margin-top: var(--space-4); padding-top: var(--space-2); border-top: 2px dashed var(--line-strong); }
 .pn-foot-links a:focus-visible { outline: 2px solid var(--focus); outline-offset: 2px; }
 /* PIN-247: the footer's language switch, a link-sized button (globe + current language). */
-.pn-foot-lang { display: inline-flex; align-items: center; gap: 6px; min-height: var(--tap); padding: 0; border: 0; background: none; color: var(--ink-muted); font: 500 14px/20px var(--font-ui); text-decoration: underline; text-underline-offset: 4px; cursor: pointer; }
-.pn-foot-lang:hover { color: var(--ink); }
+.pn-foot-lang { display: inline-flex; align-items: center; gap: 6px; min-height: var(--tap); padding: 0; border: 0; background: none; color: var(--ink-muted); font: 500 13px/18px var(--font-ui); text-decoration: none; text-underline-offset: 4px; cursor: pointer; }
+.pn-foot-lang:hover { color: var(--ink); text-decoration: underline; }
 .pn-foot-lang:focus-visible { outline: 2px solid var(--focus); outline-offset: 2px; }
 
 @media (min-width: 540px) {
@@ -740,7 +759,7 @@ a.pn-btn:not(.pn-btn-quiet) { text-decoration: none; }
 /* ---------- Make sheet (PIN-100; chat-style composer PIN-216) ---------- */
 /* Long on a small phone: the body scrolls, the title and the composer (the foot) stay put. */
 /* Rides above the on-screen keyboard (PIN-226): the sheet's hook measures --pn-keyboard-inset (0px when closed); the sheet lifts by it and its scrolling middle gives up the same height. */
-.pn-sheet.pn-make-sheet { display: flex; flex-direction: column; margin-bottom: var(--pn-keyboard-inset, 0px); max-height: calc(92vh - var(--pn-keyboard-inset, 0px)); max-height: calc(92dvh - var(--pn-keyboard-inset, 0px)); transition: margin-bottom .2s ease, max-height .2s ease; }
+.pn-sheet.pn-make-sheet { display: flex; flex-direction: column; overflow: visible; margin-bottom: var(--pn-keyboard-inset, 0px); max-height: calc(92vh - var(--pn-keyboard-inset, 0px)); max-height: calc(92dvh - var(--pn-keyboard-inset, 0px)); transition: margin-bottom .2s ease, max-height .2s ease; }
 @media (prefers-reduced-motion: reduce) {
   .pn-sheet.pn-make-sheet { transition: none; }
 }
diff --git a/vitest.config.ts b/vitest.config.ts
index e4e2be5b..293f583f 100644
--- a/vitest.config.ts
+++ b/vitest.config.ts
@@ -13,6 +13,6 @@ export default defineConfig({
   },
   test: {
     environment: "node",
-    include: ["src/**/*.test.ts"],
+    include: ["src/**/*.test.ts", "scripts/**/*.test.mjs"],
   },
 });

From 5b3595040d0e9b6a682f8fefd93ebf8fbe99ee1c Mon Sep 17 00:00:00 2001
From: Robin ELM <64148042+Robin-ELM@users.noreply.github.com>
Date: Wed, 4 Nov 2026 19:03:51 +0300
Subject: [PATCH 2/5] Promote dev to prod (d958f29)

---
 .github/workflows/report-sweep.yml            | 119 +++++++
 .gitignore                                    |   1 +
 docs/11-studio.md                             |   1 +
 docs/14-design-system.md                      |   1 +
 docs/20-abuse-runbook.md                      | 327 +++++++++--------
 docs/DEPLOY.md                                |  30 +-
 docs/README.md                                |   3 +-
 docs/adr/004-report-and-hold.md               |  86 +++++
 package.json                                  |   1 +
 scripts/ops-run.mjs                           |  65 ++++
 scripts/report-ops.ts                         | 179 ++++++++++
 .../[slug]/jobs/[jobId]/tap-add/route.ts      |   4 +
 src/app/api/boards/[slug]/photos/route.ts     |   5 +
 .../api/boards/[slug]/report/route.test.ts    | 188 ++++++++++
 src/app/api/boards/[slug]/report/route.ts     |  52 +++
 src/app/api/boards/[slug]/scenes/route.ts     |   4 +
 src/app/api/boards/shared.ts                  |  27 ++
 src/app/g/[slug]/BoardClient.tsx              |  26 +-
 src/app/g/[slug]/ReportBoard.tsx              | 323 +++++++++++++++--
 src/app/g/[slug]/board-report-render.test.ts  | 118 +++++--
 src/app/g/[slug]/board.module.css             |  56 ++-
 src/app/g/[slug]/page.tsx                     |   2 +-
 src/domain/board-report.test.ts               | 176 +++++++++-
 src/domain/board-report.ts                    | 265 +++++++++++++-
 src/domain/board-repository.contract.ts       | 132 +++++++
 src/domain/board-repository.ts                | 134 ++++++-
 src/domain/board.ts                           |  29 ++
 src/domain/report-store.contract.ts           |  96 +++++
 src/domain/report-store.test.ts               |   4 +
 src/domain/report-store.ts                    | 121 +++++++
 src/i18n/messages/de.json                     |  33 +-
 src/i18n/messages/de.lock.json                |  33 +-
 src/i18n/messages/en.json                     |  33 +-
 src/i18n/messages/es.json                     |  33 +-
 src/i18n/messages/es.lock.json                |  33 +-
 src/i18n/messages/fr.json                     |  33 +-
 src/i18n/messages/fr.lock.json                |  33 +-
 src/i18n/messages/id.json                     |  33 +-
 src/i18n/messages/id.lock.json                |  33 +-
 src/i18n/messages/it.json                     |  33 +-
 src/i18n/messages/it.lock.json                |  33 +-
 src/i18n/messages/pt-BR.json                  |  33 +-
 src/i18n/messages/pt-BR.lock.json             |  33 +-
 src/policy/policy.test.ts                     |  36 ++
 src/policy/policy.ts                          |  44 +++
 src/server/board-api.ts                       |   2 +
 src/server/board-card.test.ts                 |   1 +
 src/server/board-report.test.ts               | 267 ++++++++++++++
 src/server/board-report.ts                    | 276 +++++++++++++++
 src/server/board-storage.test.ts              |  35 ++
 src/server/board-storage.ts                   |  22 +-
 src/server/delete-my-element.test.ts          |   2 +
 src/server/derivative-store.test.ts           |  59 +++-
 src/server/derivative-store.ts                |  37 +-
 src/server/firestore-board-repository.ts      | 186 +++++++++-
 src/server/firestore-report-store.test.ts     | 171 +++++++++
 src/server/firestore-report-store.ts          | 148 ++++++++
 src/server/report-decide.test.ts              | 329 ++++++++++++++++++
 src/server/report-decide.ts                   | 317 +++++++++++++++++
 src/server/report-store.ts                    |  29 ++
 src/server/safe-log.ts                        |  17 +
 src/ui/pinneds.css                            |  11 +
 62 files changed, 4725 insertions(+), 268 deletions(-)
 create mode 100644 .github/workflows/report-sweep.yml
 create mode 100644 docs/adr/004-report-and-hold.md
 create mode 100644 scripts/ops-run.mjs
 create mode 100644 scripts/report-ops.ts
 create mode 100644 src/app/api/boards/[slug]/report/route.test.ts
 create mode 100644 src/app/api/boards/[slug]/report/route.ts
 create mode 100644 src/domain/report-store.contract.ts
 create mode 100644 src/domain/report-store.test.ts
 create mode 100644 src/domain/report-store.ts
 create mode 100644 src/server/board-report.test.ts
 create mode 100644 src/server/board-report.ts
 create mode 100644 src/server/firestore-report-store.test.ts
 create mode 100644 src/server/firestore-report-store.ts
 create mode 100644 src/server/report-decide.test.ts
 create mode 100644 src/server/report-decide.ts
 create mode 100644 src/server/report-store.ts

diff --git a/.github/workflows/report-sweep.yml b/.github/workflows/report-sweep.yml
new file mode 100644
index 00000000..1a603336
--- /dev/null
+++ b/.github/workflows/report-sweep.yml
@@ -0,0 +1,119 @@
+# PIN-272 report backstop: the timed takedown of ADR-004.
+#
+# A face-flagged pin reported as someone's likeness is hidden at once
+# and tombstoned by itself once Policy.takedownHours have passed with
+# no operator decision (docs/20, docs/adr/004-report-and-hold.md).
+# The app has no scheduler, so this job runs `report:ops sweep`
+# daily; a report filed through the day waits at most one run past
+# its deadline. Content reported as illegal is never touched here.
+#
+# PUBLIC REPO: anyone can read this job's log. The sweep prints counts
+# only (due / takenDown / skipped), never a report id, reference, slug
+# or link.
+#
+# Environments: the job reuses reconcile-dev / reconcile-prod (same
+# selection rule as billing-reconciliation.yml: dispatch input, else the
+# repository variable PINNED_RECONCILE_ENV). It needs its OWN identity
+# because the reconciliation service account is read-only; until the
+# variables below exist the run skips with a warning.
+#
+# WHAT THE OPERATOR MUST ADD (never invent values; never paste them
+# into issues, PRs or logs). In EACH environment:
+#   Variable PINNED_REPORT_SWEEP_WIF_PROVIDER
+#     the same provider resource name as PINNED_RECONCILE_WIF_PROVIDER
+#   Variable PINNED_REPORT_SWEEP_SERVICE_ACCOUNT
+#     <SA_NAME>@<PROJECT_ID>.iam.gserviceaccount.com
+# Google Cloud, once per project, from an operator machine (placeholders in <>):
+#   P=<PROJECT_ID> N=<PROJECT_NUMBER> POOL=<POOL_ID> SA=pinned-report-sweep BUCKET=<P>.firebasestorage.app
+#   gcloud iam service-accounts create "$SA" --project "$P" --display-name "Report sweep (timed takedown)"
+#   gcloud projects add-iam-policy-binding "$P" --member "serviceAccount:$SA@$P.iam.gserviceaccount.com" --role roles/datastore.user --condition=None
+#   gcloud storage buckets add-iam-policy-binding "gs://$BUCKET" --member "serviceAccount:$SA@$P.iam.gserviceaccount.com" --role roles/storage.objectAdmin
+#   gcloud iam service-accounts add-iam-policy-binding "$SA@$P.iam.gserviceaccount.com" --project "$P" --role roles/iam.workloadIdentityUser \
+#     --member "principalSet://iam.googleapis.com/projects/$N/locations/global/workloadIdentityPools/$POOL/attribute.repository/MoriaCrew/Pinned"
+# The existing pool and provider (billing-reconciliation.yml step 3) are
+# reused: their attribute condition already binds the environment name.
+
+name: Report sweep
+
+on:
+  schedule:
+    - cron: "47 6 * * *" # daily 06:47 UTC, from the default branch (main)
+  workflow_dispatch:
+    inputs:
+      environment:
+        description: "Target environment (runs in reconcile-dev or reconcile-prod)"
+        type: choice
+        options: [dev, prod]
+        default: dev
+
+permissions:
+  contents: read
+
+jobs:
+  sweep:
+    runs-on: ubuntu-latest
+    environment: ${{ (inputs.environment || vars.PINNED_RECONCILE_ENV) == 'prod' && 'reconcile-prod' || 'reconcile-dev' }}
+    permissions:
+      contents: read
+      id-token: write # Workload Identity Federation token; no key in a secret
+    env:
+      SWEEP_ENV: ${{ (inputs.environment || vars.PINNED_RECONCILE_ENV) == 'prod' && 'prod' || 'dev' }}
+    steps:
+      - name: Guard — skip until the environment is configured
+        id: guard
+        env:
+          HAS_WIF_PROVIDER: ${{ vars.PINNED_REPORT_SWEEP_WIF_PROVIDER != '' }}
+          HAS_SERVICE_ACCOUNT: ${{ vars.PINNED_REPORT_SWEEP_SERVICE_ACCOUNT != '' }}
+        run: |
+          if [ "$HAS_WIF_PROVIDER" = "true" ] && [ "$HAS_SERVICE_ACCOUNT" = "true" ]; then
+            echo "enabled=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "enabled=false" >> "$GITHUB_OUTPUT"
+            echo "::warning title=Report sweep skipped::Environment reconcile-$SWEEP_ENV needs variables PINNED_REPORT_SWEEP_WIF_PROVIDER and PINNED_REPORT_SWEEP_SERVICE_ACCOUNT (see the header of this workflow) to enable."
+            {
+              echo "## Report sweep ($SWEEP_ENV) — skipped (PIN-272)"
+              echo "Environment \`reconcile-$SWEEP_ENV\` has no sweep identity yet. See the header of \`.github/workflows/report-sweep.yml\`."
+            } >> "$GITHUB_STEP_SUMMARY"
+          fi
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        if: steps.guard.outputs.enabled == 'true'
+        with:
+          persist-credentials: false
+
+      - uses: actions/setup-node@949feb2413d6458794dcd2491c4babbbce0c15c1 # v7.1.0
+        if: steps.guard.outputs.enabled == 'true'
+        with:
+          node-version: "22"
+          package-manager-cache: false
+
+      # Before the auth step and without lifecycle scripts, so no
+      # dependency install code runs while a Google credential exists.
+      - name: Install (no lifecycle scripts)
+        if: steps.guard.outputs.enabled == 'true'
+        run: npm ci --ignore-scripts --no-audit --no-fund
+
+      - name: Authenticate to Google Cloud (Workload Identity Federation)
+        if: steps.guard.outputs.enabled == 'true'
+        uses: google-github-actions/auth@7c6bc770dae815cd3e89ee6cdf493a5fab2cc093 # v3.0.0
+        with:
+          workload_identity_provider: ${{ vars.PINNED_REPORT_SWEEP_WIF_PROVIDER }}
+          service_account: ${{ vars.PINNED_REPORT_SWEEP_SERVICE_ACCOUNT }}
+
+      - name: Sweep due reports
+        if: steps.guard.outputs.enabled == 'true'
+        run: |
+          set +e
+          if [ "$SWEEP_ENV" = "prod" ]; then
+            npm run -s report:ops -- --project moriacrew-pinned-prod sweep > sweep.out
+          else
+            npm run -s report:ops -- --project moriacrew-pinned-dev sweep > sweep.out
+          fi
+          code=$?
+          {
+            echo "## Report sweep ($SWEEP_ENV) — exit $code"
+            echo '```'
+            grep '^REPORT_SWEEP ' sweep.out || echo "No summary line: see the job log."
+            echo '```'
+          } >> "$GITHUB_STEP_SUMMARY"
+          exit "$code"
diff --git a/.gitignore b/.gitignore
index b9d9e092..70e2a4b4 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,3 +38,4 @@ coverage/
 
 .spike-work/
 .showcase-work/
+.ops-build/
diff --git a/docs/11-studio.md b/docs/11-studio.md
index 5ca21834..757a685c 100644
--- a/docs/11-studio.md
+++ b/docs/11-studio.md
@@ -163,6 +163,7 @@ object. The defaults below are proposals; tune them from evidence.
 | Prompt versions | `elements.v1`, `scene.v1`, `tap-name.v1`, `chips.v2` |
 | `credits.enabled` / `credits.starterMakes` | `false` / 5 (PIN-151: the makes pool, docs/15; 25 before PIN-181; off = pre-credit behaviour exactly, on = 1 make per successful photo or AI scene, collage stays free) |
 | `demo.ttlHours` / `demo.starterMakes` / `demo.freePhotos` / `demo.maxPerIp` / `demo.maxTotal` / `demo.windowMs` / `demo.sweepBatch` | 24 / 2 / 3 / 3 / 200 / 86,400,000 / 5 (PIN-251: per-visitor demo boards cloned from the landing template, `docs/DEPLOY.md` §6.3; the caps bound a creation path outside the per-maker rule, worst case about `maxTotal` x `starterMakes` scenes per window) |
+| `report.perIp` / `report.maxBytes` / `report.messageMaxChars` / `report.sweepBatch` | 5 per 600,000 ms / 4,096 / 1,000 / 5 (PIN-266: the in-app report route and its backstop, `docs/20-abuse-runbook.md`, ADR-004; the takedown deadline is `takedownHours`) |
 
 > **A2 (budget), as of Oct 31:** the original hosted $2 / 200 calls
 > was too small for family play, so it was raised. Today the code
diff --git a/docs/14-design-system.md b/docs/14-design-system.md
index 66ffa7e9..bad5cedb 100644
--- a/docs/14-design-system.md
+++ b/docs/14-design-system.md
@@ -297,3 +297,4 @@ No pins yet: three dashed ghost outlines.
 | Oct 31 | The Make sheet rides above the phone keyboard; measured, not configured: a `visualViewport` hook sets `--pn-keyboard-inset` on the sheet (0 with the keyboard closed or while pinch-zoomed), which lifts it and takes the same height off its scrolling middle; no glide under reduced motion; the root viewport keeps the default `interactive-widget` (PIN-226) | iOS Safari and Chrome on Android lay the keyboard over the page, so it covered the field and Make it while typing; changing the viewport would move every page on Android |
 | Oct 31 | Name tags never auto-hyphenate (`hyphens: manual`); a pin's owner name ends with "…" when it does not fit, full name in `title`; the picking dock's tray slots shrink (44px down to about 34px) so a long Next label never leaves the dock (PIN-225) | Spark names things in English and owners can rename in any language, but the browser hyphenates by the page language ("Pot-ted Succulent" in fr and de); es "Siguiente" and de "Weiter" pushed the Next button past the dock edge at 390px |
 | Oct 31 | A board's free photos (PIN-230) show only in the Add sheet and only when close: nothing above `lowFreePhotosWarning` (3), one quiet line under the picker at or under it, and at 0 the Get Plus invitation in the picker's place (library pins stay); the Plus sheet lists "Unlimited photos" after the creations perk (PIN-231) | The limit should be a cap people rarely feel, not a meter; hitting it is an offer, never an error |
+| Nov 4 | "Report this board" opens a sheet instead of a mail (PIN-271, ADR-004): what (this board, a pin by label, a scene by number) and why as pressed chips, a message, an optional email, Cancel and Send; the receipt shows the opaque reference and the legal address stays as plain text; a board under a report hold shows the one-line `pn-lib-notice` and its write actions answer with a friendly line | One tap on a mailto sent an empty report by mistake on Nov 4; a reason and a confirm step are what stop that, and an in-app record is what lets the app hide the reported thing at once |
diff --git a/docs/20-abuse-runbook.md b/docs/20-abuse-runbook.md
index 56acb3cb..feb9965b 100644
--- a/docs/20-abuse-runbook.md
+++ b/docs/20-abuse-runbook.md
@@ -1,146 +1,191 @@
-# 20 — Abuse reports and illegal content (PIN-239)
-
-One page for the human on duty. Scope: a report that a board holds
-illegal or abusive content — above all CSAM (child sexual abuse
-material). These are operational controls, not legal advice; when
-in doubt, quarantine first and ask qualified counsel after.
-
-**Order:** find → note → hold storage → tombstone → copies →
-report → close. Never open the board, never view, download or
-forward the images. Use your own logins (Firebase console, `gcloud
-auth login`, ADC); no service-account keys. Nothing below reads image
-bytes. `<project>` is the project the lookup found the board in;
-`<bucket>` is that project's bucket (`docs/DEPLOY.md` §6.2).
+# 20 — Abuse reports and illegal content (PIN-239, PIN-266)
+
+One page for the human on duty. Scope: a report that a board, a pin
+or a scene holds illegal or abusive content, above all CSAM (child
+sexual abuse material), and the ordinary reports (someone's likeness,
+something not theirs to share) that arrive far more often. These are
+operational controls, not legal advice; when in doubt, hold first and
+ask qualified counsel after. Decision record: `docs/adr/004-report-and-hold.md`.
+
+**Order:** read the report → decide (dismiss or takedown) → report
+and preserve when illegal → close. Never open the board, never view,
+download or forward the images: the scripts below work on records
+and references and print no board link. Use your own logins (`gcloud
+auth application-default login`); no service-account keys.
+`<project>` is `moriacrew-pinned-prod` or `moriacrew-pinned-dev`.
 
 ## 0. Who and when (fill in before launch)
 
 | | |
 | --- | --- |
 | On duty | `<name>` (backup `<name>`) |
-| Inbox `LEGAL_CONTACT_EMAIL` checked | every `<N>` h during launch and judging week, `<cadence>` after |
-| Quarantine target | within `<N>` h of **receipt** (the mail's arrival time) |
-| "Confirmed" means | `<e.g. reference matched to a board, and the report text plus metadata plausibly show a Terms or legal breach>` |
+| Report alert (email) and `pending` checked | twice a day during judging week (`docs/DEPLOY.md` §8), `<cadence>` after |
+| Decision target | within `<N>` h of **receipt** (the report's `created` time) |
+| "Confirmed" means | `<e.g. the report text plus the record's metadata plausibly show a Terms or legal breach>` |
 
 The Terms promise removal within `Policy.takedownHours` (24 h by
 default) of **confirming** a report (`/terms#report`). That clock
 starts at confirmation, so the row above must bound receipt →
-confirmation, or the promise is open-ended. Anything that may be CSAM
-is quarantined on receipt, before confirmation. Note all three times.
-
-## Where reports land
-
-- "Report this board" at the foot of every board page mails
-  `LEGAL_CONTACT_EMAIL` (`docs/DEPLOY.md` §2); the address and the
-  reference also show as plain text for in-app browsers with no mail
-  app. Keep `LEGAL_CONTACT_EMAIL` set on every backend: without it the
-  link falls back to the Terms contact, a **public** GitHub issue.
-- A report carries only a **board reference**: the first 16 hex of
-  `sha256("pinned-report-v1:" + slug)` (`boardReportRef`,
-  `src/domain/tokens.ts`). Never the board link.
-
-## 1. Find the board
+decision, or the promise is open-ended. Anything that may be CSAM is
+held on receipt (the app does it), before any confirmation.
+
+## What the app already did (PIN-266)
+
+"Report" at the foot of every board page opens a sheet: what (this
+board, a pin, a scene), why (`likeness`: that is me or someone who did
+not agree; `inappropriate`; `illegal`, minors included; `ownership`:
+not theirs to share; `other` with a message), an optional message and
+email. `POST /api/boards/<slug>/report` records it at `reports/{id}`
+and acts at once, reversibly, per this table:
+
+| Scope | Reporter | Reason | Automatic action |
+| --- | --- | --- | --- |
+| pin / scene | anyone | any | the pin's refs get `held:` (image 404, never composed), the scenes using it are hidden; a scene is hidden |
+| pin with a face | anyone | `likeness` | as above, plus a deadline: tombstoned by the daily sweep if nobody decided within `takedownHours` |
+| whole board | participant | any | every pin held and scene hidden; board under review (uploads, scenes, tap-adds answer 423; banner on the page) |
+| whole board | anyone | `illegal` | as above, plus Storage temporary holds on every object (evidence), severity high |
+| whole board | visitor | not `illegal` | nothing hidden (anyone with a link can join and report); the report is queued |
+
+Nothing is deleted automatically except the one deadline case, and an
+`illegal` report is never deleted by the app. The reporter sees a
+receipt with the board's **reference** (first 16 hex of
+`sha256("pinned-report-v1:" + slug)`, `boardReportRef`), never the
+slug. The same reference is the only board identifier in the alert
+line `report.received` (Cloud Logging → the email channel,
+`docs/DEPLOY.md` §6) and in every command below.
+
+A report that still arrives by **mail** to `LEGAL_CONTACT_EMAIL`
+(someone copied the address from the sheet) carries that reference
+too: treat it as a visitor's whole-board report, that is, decide from
+the text; if it names a pin or scene, hold by hand (section 5).
+
+## 1. Read the report
 
 ```sh
-node scripts/find-report-ref.mjs --project moriacrew-pinned-prod --ref <reference>
+npm run report:ops -- --project <project> pending                    # the queue, oldest first
+npm run report:ops -- --project <project> list --ref <reference>     # every report on that board
+npm run report:ops -- --project <project> show --id <reportId>       # one report, message included
 ```
 
-Read-only. Prints `<slug> live|deleted` to your terminal only; exit 1
-= not in that project (try `moriacrew-pinned-dev`). From here the slug
-goes only into the console paths and commands below: never into
-mail, chat, tickets, Linear or git, and never paste those commands
-anywhere.
+Read-only. `show` prints the reporter's words: run it in a private
+terminal, never in CI. The lines carry report ids, references, enums,
+times and hold counts, never the slug. (`npm run report:find-ref --
+--project <project> --ref <reference>` still maps a reference to the
+slug for the manual path; the slug then goes only into console paths
+and commands, never into mail, chat, tickets, Linear or git.)
 
-## 2. Note what is there (read only)
+Write the operator note now (private, never git or Linear): the
+reference, report id, the report's text and times (receipt, your
+decision), what the app held (`held:` line of `show`).
 
-Firestore console → `boards/<slug>/elements`: for each doc note `id`,
-`cutoutRef`, `label`; `boards/<slug>/scenes`: note each `id`. Write
-them in a private operator note (never git, never Linear). A
-`cutoutRef` that does **not** start with `elements/boards/<slug>/` is a
-library copy whose bytes live in another board's folder: note that
-folder (the ref without `cutout.png`). Do not open Storage in the
-console on these folders: it previews images.
+## 2. Decide
+
+**False alarm, or not actionable** (an accidental tap, a report that
+describes nothing, a pin the reporter changed their mind about):
+
+```sh
+npm run report:ops -- --project <project> dismiss --id <reportId> --note "<why>"
+```
 
-## 3. Hold storage — before the tombstone
+Restores exactly what that report hid: refs unprefixed, scenes back
+(a scene returns only when every pin it uses is back), board review
+cleared, Storage holds released, unless another **open** report on
+the same board still holds them. The record stays as `dismissed`.
 
-A tombstone alone does not preserve anything: `sweepDeletedBoardStorage`
-(`src/server/board-storage.ts`) deletes a deleted board's objects
-whenever a decompose or scene job on it finishes (`decompose-job.ts`,
-`scene-job.ts`), and deleting another board can free shared cut-out
-bytes. So hold first:
+**Confirmed** (a Terms breach, or someone's likeness they did not
+agree to):
 
 ```sh
-gcloud storage objects update "gs://<bucket>/elements/boards/<slug>/**" --temporary-hold --project <project>
-gcloud storage objects update "gs://<bucket>/scenes/boards/<slug>/**" --temporary-hold --project <project>
+npm run report:ops -- --project <project> takedown --id <reportId> --note "<what and why>"
 ```
 
-Same command for each foreign folder from step 2
-(`"gs://<bucket>/<folder>/**"`). "Matched no objects" is fine (no
-scenes yet). Check one: `gcloud storage objects describe
-"gs://<bucket>/<cutoutRef>" --project <project>` shows
-`temporary_hold: true`. Storage refuses to delete a held object, so the
-sweep's delete fails harmlessly (counted as `failed`, logged by error
-name only). **Never hold or list `tmp/`**: working copies are not
-evidence we keep; the 1-day lifecycle rule deletes them.
-
-## 4. Tombstone the board
-
-Firestore console → `boards/<slug>` → add field `deletedAt`, type
-number, value = now in epoch ms (PowerShell:
-`[DateTimeOffset]::UtcNow.ToUnixTimeMilliseconds()`). Same tombstone as
-the host delete (`BoardRepository.deleteBoard`): the board, its
-images, scenes and link-preview card read as missing everywhere. Then
-run the step 3 commands once more, to catch anything a job wrote in
-between.
-
-## 5. Library copies on other boards
-
-A signed-in uploader can pin a cut-out onto other boards they joined
-(`pinFromLibrary`, `src/server/my-pins.ts`). The copy shares the same
-stored bytes and its board is live, so step 4 does not stop it. For
-each distinct `cutoutRef` from step 2: Firestore → Query builder →
-scope **Collection group**, `elements` → `cutoutRef` `==` `<cutoutRef>`
-→ Run (the index exists). Every result outside `boards/<slug>/` is a
-copy (or the source, if the reported element was itself a copy): give
-each one the step 6 hold.
-
-## 6. Hold one element (copies, or a board that stays live)
-
-For element `<id>` on board `<b>`, in this order:
-
-1. Collection group `scenes` → `elementIds` `array-contains` `<id>`.
-   For each: hold `"gs://<bucket>/scenes/boards/<b>/<sceneId>/**"`
-   (command as step 3), then set field `hidden` = `true` (boolean).
-   Hidden scenes are never listed or served.
-2. Hold the element's folder (`cutoutRef` without `cutout.png`), unless
-   section 3 already covered it. Always before the prefix below: once
-   prefixed, the shared-bytes check no longer sees this element, so
-   another delete could free the bytes.
-3. In the element doc, put `held:` in front of `cutoutRef` and
-   `flattenedRef` (`held:elements/boards/…`). Checked in code: the board
-   image route, the library thumbnail and the link-preview card serve
-   only refs starting `elements/` (`resolveElementImage`,
-   `resolveOwnedElementImage`, `loadBoardCard`); owner delete and job
-   clean-up never delete such a ref; a new scene using it fails (the
-   store refuses a ref with `:`), so no bytes reach a model or a
-   collage; pinning it from the library copies the `held:` refs. The pin
-   stays with a blank picture; if its name is the problem, change
-   `label` too (old one in the note).
-
-False alarm: remove the prefixes, set `hidden` back to `false`,
-release with `--no-temporary-hold`.
-
-**The judges' demo board:** never tombstone it; hold the reported
-elements with step 6. If the whole board is spoiled, point the landing
-demo link at the backup board (`docs/DEPLOY.md` §6.3):
-`firebase apphosting:secrets:set DEMO_BOARD_SLUG --project
-moriacrew-pinned-prod`, backup slug typed at the prompt; it applies on
-the next rollout (`docs/launch-ops-runbook.md` §5). The submission
-form may still carry the original link, so the step 6 holds stay.
-
-## 7. Report and preserve
-
-1. The operator note also gets: the reference, the report's date and
-   text, the receipt / confirmation / quarantine times, the copies
+Removes the reported thing the way the product deletes: a pin
+(element cascade: pins gone, its scenes hidden, objects deleted
+unless a live library copy still needs them), a scene (tombstone,
+picture deleted) or the board (tombstone, My boards rows unlinked,
+storage swept). Storage temporary holds are **never** released by a
+takedown: a held object refuses deletion, the sweep logs it as
+failed, the bytes stay. That is the point for section 6; for an
+ordinary takedown that reports `storage hold true`, run
+`release-holds` afterwards (section 7, step 3).
+
+**Timed takedown.** A `likeness` report on a face-flagged pin carries
+`deleteAt`; `.github/workflows/report-sweep.yml` runs
+`report:ops sweep` daily and tombstones what passed its deadline
+with no decision (never an `illegal` report). Deciding before the
+deadline, either way, cancels it. The step summary shows counts only.
+
+**Reply to the reporter** when they left an email (the record's
+`email` line): the decision and the date, nothing else; never the
+board link. The app sends no mail itself.
+
+## 3. Reports of illegal content
+
+The app has already held every pin, hidden every scene, put the board
+under review and set Storage temporary holds (`show` says
+`storage hold true`). Do not dismiss. Decide `takedown` once the
+record's metadata and text plausibly describe illegal material (your
+"confirmed" rule in section 0); the holds keep the objects as
+evidence. Then section 6 (report and preserve). Never run
+`release-holds` before section 7 says so.
+
+If `storage hold false` on an `illegal` report, a Storage call
+failed when the report was filed: set the holds by hand (section 5,
+step 1) before anything else.
+
+## 4. The judges' demo board
+
+Never take down the demo template board or the judges' board as a
+whole; decide per pin or scene (the automatic hold already did the
+hiding). If the whole board is spoiled, point the landing demo at the
+backup board (`docs/DEPLOY.md` §6.3 and §6.5) and leave the holds in
+place: the submission form may still carry the original link.
+
+## 5. Manual path (fallback: a mailed report, a failed hold, the app down)
+
+Find the board: `npm run report:find-ref -- --project <project> --ref <reference>`
+prints `<slug> live|deleted` to your terminal only.
+
+1. **Hold storage before any tombstone.** `sweepDeletedBoardStorage`
+   deletes a deleted board's objects whenever a job on it finishes,
+   and deleting another board can free shared cut-out bytes:
+   ```sh
+   gcloud storage objects update "gs://<bucket>/elements/boards/<slug>/**" --temporary-hold --project <project>
+   gcloud storage objects update "gs://<bucket>/scenes/boards/<slug>/**" --temporary-hold --project <project>
+   ```
+   `<bucket>` is `<project>.firebasestorage.app`. "Matched no objects"
+   is fine. **Never hold or list `tmp/`**: working copies are not
+   evidence we keep; the 1-day lifecycle rule deletes them.
+2. **Note what is there (read only).** Firestore console →
+   `boards/<slug>/elements`: note each `id`, `cutoutRef`, `label`;
+   `boards/<slug>/scenes`: each `id`. A `cutoutRef` outside
+   `elements/boards/<slug>/` is a library copy whose bytes live in
+   another board's folder: hold that folder too (step 1 command on
+   it). Do not open Storage in the console on these folders: it
+   previews images.
+3. **Tombstone the board.** Firestore console → `boards/<slug>` → add
+   field `deletedAt` (number, now in epoch ms). Same tombstone as the
+   host delete: the board, its images, scenes and link card read as
+   missing everywhere. Run step 1 again to catch anything a job wrote
+   in between.
+4. **Library copies on other boards.** For each distinct `cutoutRef`
+   from step 2: Firestore → Query builder → Collection group
+   `elements` → `cutoutRef == <cutoutRef>`. Every result outside
+   `boards/<slug>/` is a copy (or the source): hold it with step 5.
+5. **Hold one element** (`<id>` on board `<b>`), in this order:
+   collection group `scenes` → `elementIds array-contains <id>` →
+   hold each `"gs://<bucket>/scenes/boards/<b>/<sceneId>/**"` and set
+   `hidden = true`; hold the element's folder; then put `held:` in
+   front of `cutoutRef` and `flattenedRef` in the element doc. Readers
+   serve only refs starting `elements/`, job clean-up never deletes
+   such a ref, a new scene using it fails, pinning it from the library
+   copies the prefix. False alarm: remove the prefixes, `hidden` back
+   to `false`, `--no-temporary-hold`.
+
+## 6. Report and preserve
+
+1. The operator note also gets: the reference, report id, the
+   report's date and text, the receipt / decision times, the copies
    held. No image bytes, no board link.
 2. **CSAM or anything that may be:** report to the NCMEC CyberTipline
    (report.cybertip.org) the same day with the note's metadata;
@@ -152,23 +197,33 @@ form may still carry the original link, so the step 6 holds stay.
    before it), longer if law enforcement asks. Confirm which law
    applies with counsel.
 4. **Never redistribute** suspected CSAM: no download to any device,
-   no attachment, no "evidence" copy. If a reporter sent an image
-   anyway, do not forward it; tell NCMEC it exists and delete the mail
-   copy once they have what they need.
+   no attachment, no "evidence" copy. If a reporter sent an image by
+   mail anyway, do not forward it; tell NCMEC it exists and delete
+   the mail copy once they have what they need.
 5. Other illegal content: same holds and note, follow counsel on
    reporting. Ordinary Terms breaches (spam, harassment): the
-   tombstone or step 6 is the removal.
+   takedown is the removal.
 
-## 8. Close out
+## 7. Close out
 
-1. Reply to the reporter: removal confirmed, the date, nothing else.
-2. Quarantine other boards only if they are reported too; never browse
+1. Reply to the reporter if they left an address: removal confirmed
+   (or not), the date, nothing else.
+2. Hold other boards only if they are reported too; never browse
    unreported boards.
-3. When preservation ends (CSAM: NCMEC / law-enforcement clearance and
-   the legal period): `--no-temporary-hold` on every path you held,
-   then `gcloud storage rm` on the same paths. Nothing in the app
-   sweeps a hand-tombstoned board by itself. False alarm instead:
-   delete the `deletedAt` field (the board returns as it was), undo
-   step 6, release the holds.
-4. Log the outcome (reference, dates, CyberTipline report number)
-   where the operator keeps such records.
+3. When preservation ends (CSAM: NCMEC / law-enforcement clearance
+   and the legal period), or after an ordinary takedown that left
+   holds:
+   ```sh
+   npm run report:ops -- --project <project> release-holds --id <reportId>
+   ```
+   releases exactly the objects that report held, minus any object
+   another report still holds (an open one, or a takedown not yet
+   closed out), and marks the report's hold as released, so the next
+   close-out can free what this one kept. Then the objects of a tombstoned board go with the next
+   storage sweep, or by hand: `gcloud storage rm "gs://<bucket>/elements/boards/<slug>/**"`
+   and the `scenes/` folder. Nothing in the app sweeps a
+   hand-tombstoned board by itself. False alarm instead: `dismiss`
+   (or, on the manual path, delete the `deletedAt` field, undo step
+   5, release the holds).
+4. Log the outcome (reference, report id, dates, CyberTipline report
+   number) where the operator keeps such records.
diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md
index deabf3f0..945e09a1 100644
--- a/docs/DEPLOY.md
+++ b/docs/DEPLOY.md
@@ -180,6 +180,10 @@ curl -s -o /dev/null -w "%{http_code} %{redirect_url}\n" -X POST -H "sec-fetch-s
 curl -s -H "Accept-Language: fr-FR" https://pinneds.com/ | grep -o '<html lang="fr"\|Nos trucs, épinglés ensemble'
 curl -s -H "Accept-Language: fr-FR" -H "Cookie: pinneds_locale=en" https://pinneds.com/ | grep -o '<html lang="en"'
 curl -s -H "Accept-Language: ja" https://pinneds.com/ | grep -o '<html lang="en"'
+# Report & hold (PIN-266, docs/20): the route exists and refuses a cross-site post; GET records nothing.
+# Never file a real report from here: on prod it hides content and alerts the operator.
+curl -s -o /dev/null -w "%{http_code}\n" -X POST -H "content-type: application/json" -H "sec-fetch-site: cross-site" https://pinneds.com/api/boards/AAAAAAAAAAAAAAAAAAAAAA/report  # 403
+curl -s -o /dev/null -w "%{http_code}\n" https://pinneds.com/api/boards/AAAAAAAAAAAAAAAAAAAAAA/report  # 405
 ```
 
 On a phone: create and join a board; upload a fixture photo from
@@ -262,6 +266,25 @@ element; delete the throwaway board.
      **(console: Monitoring → Uptime checks)**; the check also keeps
      the instance warm.
    - Alert on Cloud Run 5xx > 5 in 5 min for `pinned-web`.
+   - **Report alert (PIN-272, docs/20):** every report the app receives
+     is one structured line `report.received` on stdout (reference,
+     reason, scope, hold counts; never the board link). Turn it into
+     an email on the same channel: a log-based metric, then an alert
+     policy on it (console: Monitoring → Alerting → Create policy →
+     metric `logging/user/pinned_report_received`, condition "any
+     time series violates: count > 0 over 5 min", notification = the
+     email channel, documentation = "run
+     `npm run report:ops -- --project <p> pending`, then docs/20").
+     ```sh
+     gcloud logging metrics create pinned_report_received --project "$P" \
+       --description "Report & hold: a report was filed (docs/20)" \
+       --log-filter 'resource.type="cloud_run_revision" AND resource.labels.service_name="pinned-web" AND jsonPayload.event="report.received"'
+     ```
+     Test-fire once per project with a report on a throwaway board
+     (`docs/launch-ops-runbook.md` §3 rule: an alert nobody saw
+     arrive is not an alert). The daily backstop
+     (`.github/workflows/report-sweep.yml`) needs its own identity:
+     its header lists the operator steps.
    - GCP billing budget (e.g. $25) with 50/90/100 % emails. Meta
      spend is not on GCP billing: run
      `GCLOUD_PROJECT=moriacrew-pinned-prod npm run usage:costs -- --days 1`
@@ -292,7 +315,12 @@ the judges' board and kept (§6.4). Steps, smoke and rollback:
   pins, scenes since the last check; nobody but the recorded
   participants and the judges should appear), the demo template
   board (unchanged counts: 2 participants, its pins and 1 scene) and
-  a "See a board" click (lands on a fresh board), `usage:costs`.
+  a "See a board" click (lands on a fresh board), `usage:costs`, and
+  the reports queue: `npm run report:ops -- --project moriacrew-pinned-prod pending`
+  (an alert email means one just landed; decide each with `show`,
+  then `dismiss` or `takedown`, docs/20). The app already hid what
+  the report named, so the queue is never an emergency for the
+  content, only for the reporter waiting on an answer.
 - **Demo boards piling up or abused:** lower `demo.maxTotal` /
   `demo.maxPerIp` in `POLICY_OVERRIDES_JSON` (0 closes the demo; the
   landing then still shows the button, which answers "busy"), or
diff --git a/docs/README.md b/docs/README.md
index 444751d0..6506d9d0 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -24,7 +24,7 @@ for how each Meta model is used. Numbers 01, 02 and 05 are archived with the dro
 | [`17-showcase-sets.md`](17-showcase-sets.md) | Recipe for making a landing showcase set with the app's own pipeline |
 | [`18-i18n.md`](18-i18n.md) | UI languages: how a request picks one, `UI_LOCALES`, adding strings, translation runs |
 | [`19-meta-models.md`](19-meta-models.md) | Each Meta model: prompt and version, Policy keys, inputs, fallbacks, cost, evidence |
-| [`20-abuse-runbook.md`](20-abuse-runbook.md) | Abuse reports and illegal content: storage hold, quarantine, library copies, single-element hold, NCMEC CyberTipline, takedown clock |
+| [`20-abuse-runbook.md`](20-abuse-runbook.md) | Abuse reports and illegal content: the in-app report and its automatic hold, the operator's decide script, the manual hold path, NCMEC CyberTipline, takedown clock |
 | [`DEPLOY.md`](DEPLOY.md) | Prod runbook and env matrix (lands with PIN-209) |
 | [`launch-ops-runbook.md`](launch-ops-runbook.md) | Launch ops: hourly AI sub-cap, GCP budget alerts, soft-kill drill, demo-board protection (PIN-240) |
 | [`build-log.md`](build-log.md) | Who built what: each coding agent's PRs with dates, the evidence for each claim, and what the record does not show (PIN-248) |
@@ -34,6 +34,7 @@ for how each Meta model is used. Numbers 01, 02 and 05 are archived with the dro
 | Doc | What it covers |
 | --- | --- |
 | [`adr/003-studio-architecture.md`](adr/003-studio-architecture.md) | ADR-003: Policy as data, capability ports and decorators, jobs, Element/Pin split, stateless remix |
+| [`adr/004-report-and-hold.md`](adr/004-report-and-hold.md) | ADR-004: reports hold first (reversibly), the operator decides, timed takedown only for face-flagged likeness reports, no model as judge, alert through Monitoring |
 
 ADR-001 (hosting) and ADR-002 (no friction) still stand; they live in the archived
 `archive/02-architecture.md`.
diff --git a/docs/adr/004-report-and-hold.md b/docs/adr/004-report-and-hold.md
new file mode 100644
index 00000000..2a48bcd6
--- /dev/null
+++ b/docs/adr/004-report-and-hold.md
@@ -0,0 +1,86 @@
+# ADR-004: Reports hold first, decide second, delete on a timer only for faces (PIN-266, Nov 4 2026)
+
+_Status: Accepted (Robin, Nov 4 2026). Extends ADR-003. Runbook:
+`docs/20-abuse-runbook.md`. Policy row: `docs/11-studio.md` §5.1
+(`report.*`, `takedownHours`)._
+
+## Context
+
+"Report this board" (PIN-239) is a one-tap `mailto:` to the legal
+contact whose body carries only an opaque board reference. On
+Nov 4 2026 a visitor sent one by mistake: the mail held the template
+and nothing else. There is no reason to pick, no confirmation, no
+in-app record, and everything after receipt is manual (find the
+board, hold Storage, tombstone, find library copies). The pieces the
+runbook uses by hand already exist in code: scene `hidden`, element
+refs prefixed `held:` (never served, never deleted, never reach a
+model), the board tombstone, `Element.faceFlag` set by Muse Spark at
+upload, and Storage temporary holds.
+
+Three automations were on the table: take a board offline or delete
+its assets whenever a reported picture contains faces; let a model
+judge the reported content; delete as soon as anyone on the board
+reports. Hosting-service notice-and-action duties (DSA Art. 16 and
+17) apply regardless of company size; Art. 19 exempts small
+providers only from the online-platform duties. Legal wording stays
+with counsel.
+
+## Decision
+
+1. **Reports are in-app records.** `POST /api/boards/<slug>/report`
+   writes a `reports/{id}` document with a scope (element, scene,
+   board), one reason (`likeness`, `inappropriate`, `illegal`,
+   `ownership`, `other` with a message), the reporter kind
+   (participant when the board cookie is valid, else visitor) and
+   what was held. The reporter sees a receipt with the reference. The
+   `mailto:` goes; the contact address stays as plain text.
+2. **Hold at report time, reversibly.** The request applies the hold
+   itself (no queue, like the demo sweep): the element's refs get
+   `held:` and the scenes using it `hidden`; a whole-board hold does
+   that for every element and scene and sets `Board.reviewAt`, which
+   blocks uploads, scenes and tap-adds (423). A report records
+   exactly what it held so `dismiss` can restore it.
+3. **Decision table.** Element or scene: held for any reporter and
+   reason. Whole board: held when the reporter is a participant or
+   the reason is `illegal`; an anonymous visitor's whole-board report
+   with another reason is queued and alerted, nothing hidden (anyone
+   with a link can join and report, so one click must not blank a
+   friend group's board). `illegal` adds Storage temporary holds on
+   the board's folders.
+4. **Delete on a timer only for faces.** A `likeness` report on an
+   element Spark flagged as a face sets `deleteAt = now +
+   takedownHours`; the backstop tombstones it if nobody decided by
+   then. Nothing else is deleted automatically, and content reported
+   as `illegal` is never deleted by the app: it is preserved for the
+   runbook's §7.
+5. **No model as judge.** Suspected illegal content never leaves the
+   project (the runbook's "nothing reads image bytes" holds for the
+   automation too), a model verdict is not a defensible takedown
+   ground, and the signal we rely on is already computed at upload
+   (`faceFlag`, screen and document flags) or at generation (provider
+   refusals).
+6. **Alert through Monitoring, not mail.** The route logs one
+   structured line `report.received` with the reference, reason,
+   scope, severity and hold counts, never the slug or the message. A
+   log-based alert policy on the existing email channel delivers it.
+   The operator decides with `scripts/report-decide.mjs` (`--dismiss`
+   restores, `--takedown` follows the runbook); a signed-in operator
+   page can come later.
+7. **Limits are Policy.** `report.perIp`, `report.maxBytes`,
+   `report.messageMaxChars`, `report.sweepBatch`; the deadline is the
+   existing `takedownHours` promised on `/terms`.
+
+## Consequences
+
+- A mistaken report hides at most the thing it names, and `dismiss`
+  puts it back; today's accidental mail would have produced a queued
+  record and an alert, nothing hidden.
+- The reporter's message is stored for the operator but never logged
+  or mailed; the alert carries the reference only, so the board link
+  never spreads.
+- Prod gets this with promotion #4 after judging week; it lands on
+  `dev` first.
+- Not done here: email acknowledgment to the reporter (needs an SMTP
+  provider and a new secret), an operator UI, and any automated
+  detection of illegal material (partner-gated hash matching; the
+  human path in `docs/20` remains).
diff --git a/package.json b/package.json
index aff117e2..c867fc39 100644
--- a/package.json
+++ b/package.json
@@ -27,6 +27,7 @@
     "i18n:check": "node scripts/i18n-check.mjs",
     "billing:reconcile": "node scripts/billing-reconciliation.mjs",
     "report:find-ref": "node scripts/find-report-ref.mjs",
+    "report:ops": "node scripts/ops-run.mjs scripts/report-ops.ts --",
     "billing:webhook-endpoint": "node scripts/ensure-stripe-webhook-endpoint.mjs"
   },
   "dependencies": {
diff --git a/scripts/ops-run.mjs b/scripts/ops-run.mjs
new file mode 100644
index 00000000..0b33d43d
--- /dev/null
+++ b/scripts/ops-run.mjs
@@ -0,0 +1,65 @@
+#!/usr/bin/env node
+/**
+ * Run a TypeScript operator script against the app's real server code
+ * (PIN-272). The server modules are `server-only` and import each other
+ * without extensions, so plain Node cannot load them; this bundles the
+ * entry with esbuild (already in node_modules through vitest/vite)
+ * under the `react-server` condition, which turns `server-only` into
+ * its empty module, keeps node_modules external, and runs the result.
+ *
+ *   node scripts/ops-run.mjs scripts/report-ops.ts -- <script args>
+ *
+ * Nothing here reads env or credentials: the script itself decides
+ * what it needs (ADC for Firestore and Storage, an explicit --project).
+ * Build output lands in .ops-build/ (gitignored).
+ */
+import { createRequire } from "node:module";
+import { mkdir } from "node:fs/promises";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+
+const require = createRequire(import.meta.url);
+const [entry, ...rest] = process.argv.slice(2);
+const dash = rest.indexOf("--");
+const scriptArgs = dash >= 0 ? rest.slice(dash + 1) : rest;
+
+if (!entry || !entry.endsWith(".ts")) {
+  console.error("usage: node scripts/ops-run.mjs <script.ts> -- <args>");
+  process.exit(2);
+}
+
+let esbuild;
+try {
+  esbuild = require("esbuild");
+} catch {
+  console.error("esbuild is not installed; run `npm ci` first.");
+  process.exit(2);
+}
+
+const root = path.resolve(path.dirname(new URL(import.meta.url).pathname.replace(/^\/([A-Za-z]:)/, "$1")), "..");
+const outDir = path.join(root, ".ops-build");
+await mkdir(outDir, { recursive: true });
+const outfile = path.join(outDir, `${path.basename(entry, ".ts")}.mjs`);
+
+await esbuild.build({
+  entryPoints: [path.resolve(root, entry)],
+  outfile,
+  bundle: true,
+  platform: "node",
+  format: "esm",
+  target: "node22",
+  // node_modules stay external (Firestore, Storage, sharp load from disk);
+  // `server-only` is the one exception: aliased to its own empty module,
+  // the file Next itself serves under the react-server condition, so the
+  // marker never throws in a plain Node process.
+  packages: "external",
+  // The package exports only "." so resolve its entry and take the sibling file.
+  alias: { "server-only": path.join(path.dirname(require.resolve("server-only")), "empty.js") },
+  logLevel: "warning",
+  // JSON catalogs and config are bundled in; secrets never are (they come from env at run time).
+  loader: { ".json": "json" },
+});
+
+// The bundled script owns argv from here on.
+process.argv = [process.argv[0], outfile, ...scriptArgs];
+await import(pathToFileURL(outfile).href);
diff --git a/scripts/report-ops.ts b/scripts/report-ops.ts
new file mode 100644
index 00000000..e702bc69
--- /dev/null
+++ b/scripts/report-ops.ts
@@ -0,0 +1,179 @@
+/**
+ * Report & hold operator CLI (PIN-272, docs/20). Runs the app's own
+ * server code against a named project through scripts/ops-run.mjs:
+ *
+ *   npm run report:ops -- --project <firebase-project-id> [--bucket <name>] <command>
+ *
+ *   pending [--limit <n>]           open reports of every board, oldest first (the twice-a-day check)
+ *   list --ref <reference>          every report carrying the reference, newest first
+ *   show --id <reportId>            one report in full (message included: operator terminal only)
+ *   dismiss --id <reportId> [--note "..."]   false alarm: restore what the report hid
+ *   takedown --id <reportId> [--note "..."]  confirmed: remove the reported thing for everyone
+ *   release-holds --id <reportId>   close-out: release the Storage holds this report set (minus what another report still holds)
+ *   sweep [--batch <n>]             timed takedown of due reports (the daily backstop)
+ *
+ * --project is required and never read from ADC, gcloud or the env
+ * (PIN-233). Auth is Application Default Credentials; the bucket
+ * defaults to <project>.firebasestorage.app (docs/DEPLOY.md §6.2).
+ * Output names reports by id and reference, never a board slug or link;
+ * `show` prints the reporter's words, so run it in a private terminal.
+ * Exit 0 done, 1 error, 2 usage.
+ */
+import { Firestore } from "@google-cloud/firestore";
+import type { ReportRecord } from "../src/domain/board-report";
+import { resolvePolicy } from "../src/policy/policy";
+import { GcsDerivativeStore } from "../src/server/derivative-store";
+import { FirestoreBoardRepository } from "../src/server/firestore-board-repository";
+import { FirestoreReportStore } from "../src/server/firestore-report-store";
+import { FirestoreUserRepository } from "../src/server/firestore-user-repository";
+import {
+  dismissReport,
+  releaseReportHolds,
+  sweepDueReports,
+  takedownReport,
+  type ReportDecideDeps,
+} from "../src/server/report-decide";
+
+const USAGE =
+  "usage: npm run report:ops -- --project <id> [--bucket <name>] (pending [--limit <n>] | list --ref <reference> | show --id <id> | dismiss --id <id> [--note <text>] | takedown --id <id> [--note <text>] | release-holds --id <id> | sweep [--batch <n>])";
+const COMMANDS = ["pending", "list", "show", "dismiss", "takedown", "release-holds", "sweep"] as const;
+const PENDING_DEFAULT_LIMIT = 50;
+type Command = (typeof COMMANDS)[number];
+
+function usage(message?: string): never {
+  if (message) console.error(message);
+  console.error(USAGE);
+  process.exit(2);
+}
+
+const argv = process.argv.slice(2);
+function option(name: string): string | undefined {
+  const i = argv.indexOf(name);
+  const value = i >= 0 ? argv[i + 1] : undefined;
+  return value && !value.startsWith("--") ? value : undefined;
+}
+const command = argv.find((a) => (COMMANDS as readonly string[]).includes(a)) as Command | undefined;
+const project = option("--project");
+if (!command) usage("A command is required.");
+if (!project || !/^[a-z][a-z0-9-]{4,28}[a-z0-9]$/.test(project)) usage("--project must name the Firebase project (never a default).");
+const bucket = option("--bucket") ?? `${project}.firebasestorage.app`;
+
+/** Terminal line for one report: ids, reference, enums, times and counts; never the board. */
+function describe(record: ReportRecord, withMessage = false): string {
+  const at = (ms?: number) => (ms === undefined ? "-" : new Date(ms).toISOString());
+  const lines = [
+    `report ${record.id}  ref ${record.reference}  ${record.status}`,
+    `  ${record.scope}${record.targetId ? ` ${record.targetId}` : ""}  reason ${record.reason}  severity ${record.severity}  by ${record.reporterKind}`,
+    `  created ${at(record.createdAt)}  deleteAt ${at(record.deleteAt)}  decided ${at(record.decidedAt)}${record.note ? `  note: ${record.note}` : ""}`,
+    `  held: ${record.held.elementIds.length} element(s), ${record.held.sceneIds.length} scene(s), review ${record.held.boardReview}, storage hold ${record.held.storageHold}`,
+  ];
+  if (withMessage) {
+    lines.push(`  email: ${record.reporterEmail ?? "-"}`);
+    lines.push(`  message: ${record.message ?? "-"}`);
+  }
+  return lines.join("\n");
+}
+
+async function main(): Promise<number> {
+  const db = new Firestore({ projectId: project });
+  const deps: ReportDecideDeps = {
+    boards: new FirestoreBoardRepository(db),
+    users: new FirestoreUserRepository(db),
+    store: new GcsDerivativeStore(bucket, project),
+    reports: new FirestoreReportStore(db),
+  };
+  try {
+    switch (command) {
+      case "pending": {
+        const limitOption = option("--limit");
+        const limit = limitOption === undefined ? PENDING_DEFAULT_LIMIT : Number(limitOption);
+        if (!Number.isInteger(limit) || limit < 0) usage("--limit must be a whole number.");
+        const records = await deps.reports.listOpen(limit);
+        console.log(`${records.length} open report(s) in ${project}${records.length === limit ? " (capped)" : ""}.`);
+        for (const record of records) console.log(describe(record));
+        return 0;
+      }
+      case "list": {
+        const ref = option("--ref")?.toLowerCase();
+        if (!ref || !/^[0-9a-f]{16}$/.test(ref)) usage("--ref must be the 16-character reference from the alert or receipt.");
+        const records = await deps.reports.listByReference(ref);
+        if (records.length === 0) console.log(`No report carries reference ${ref} in ${project}.`);
+        for (const record of records) console.log(describe(record));
+        return 0;
+      }
+      case "show": {
+        const id = option("--id");
+        if (!id) usage("--id is required.");
+        const record = await deps.reports.get(id);
+        if (!record) {
+          console.error(`No report ${id} in ${project}.`);
+          return 1;
+        }
+        console.log(describe(record, true));
+        return 0;
+      }
+      case "dismiss": {
+        const id = option("--id");
+        if (!id) usage("--id is required.");
+        const outcome = await dismissReport(id, deps, option("--note"));
+        if (!outcome) {
+          console.error(`Report ${id} is missing or already decided.`);
+          return 1;
+        }
+        console.log(describe(outcome.record));
+        console.log(`released: ${JSON.stringify(outcome.released)}`);
+        return 0;
+      }
+      case "takedown": {
+        const id = option("--id");
+        if (!id) usage("--id is required.");
+        const result = await takedownReport(id, deps, option("--note"));
+        if (!result) {
+          console.error(`Report ${id} is missing or already decided.`);
+          return 1;
+        }
+        console.log(describe(result.record));
+        console.log(`outcome: ${result.outcome}`);
+        if (result.record.reason === "illegal") {
+          console.log("Storage holds stay (evidence). docs/20 §7: report to the hotline, keep the operator note; release with `release-holds` only at close-out.");
+        }
+        return 0;
+      }
+      case "release-holds": {
+        const id = option("--id");
+        if (!id) usage("--id is required.");
+        const record = await deps.reports.get(id);
+        if (!record) {
+          console.error(`No report ${id} in ${project}.`);
+          return 1;
+        }
+        const released = await releaseReportHolds(record, deps);
+        console.log(
+          `released ${released.released} object hold(s) of this report, kept ${released.kept} (another report still holds them), ${released.failed} failed (ref ${record.reference}).`,
+        );
+        return released.failed === 0 ? 0 : 1;
+      }
+      case "sweep": {
+        const batchOption = option("--batch");
+        const batch = batchOption === undefined ? resolvePolicy(null).report.sweepBatch : Number(batchOption);
+        if (!Number.isInteger(batch) || batch < 0) usage("--batch must be a whole number.");
+        const summary = await sweepDueReports(deps, Date.now(), batch);
+        console.log(`REPORT_SWEEP ${JSON.stringify({ project, ...summary })}`);
+        return 0;
+      }
+    }
+    return 2;
+  } finally {
+    await db.terminate();
+  }
+}
+
+main().then(
+  (code) => process.exit(code),
+  (error: unknown) => {
+    // Name and message only: never a slug list (safe-log's rule, by hand here).
+    const text = error instanceof Error ? `${error.name}: ${error.message}` : "Operation failed.";
+    console.error(text.replace(/(?<![A-Za-z0-9_-])[A-Za-z0-9_-]{22}(?![A-Za-z0-9_-])/g, "<slug>"));
+    process.exit(1);
+  },
+);
diff --git a/src/app/api/boards/[slug]/jobs/[jobId]/tap-add/route.ts b/src/app/api/boards/[slug]/jobs/[jobId]/tap-add/route.ts
index aec86968..23692a6c 100644
--- a/src/app/api/boards/[slug]/jobs/[jobId]/tap-add/route.ts
+++ b/src/app/api/boards/[slug]/jobs/[jobId]/tap-add/route.ts
@@ -14,6 +14,7 @@ import {
   errorResponse,
   notFound,
   policyForBoard,
+  rejectUnderReview,
   slugGate,
   viewerFor,
 } from "../../../../shared";
@@ -60,6 +61,9 @@ export async function POST(
     );
   }
   const body: unknown = capped.value;
+  // PIN-270: a board under a report hold makes nothing new until the operator decides.
+  const paused = await rejectUnderReview(slug, locale);
+  if (paused) return paused;
   try {
     const policy = await policyForBoard(slug);
     const viewer = await viewerFor(request, slug, policy);
diff --git a/src/app/api/boards/[slug]/photos/route.ts b/src/app/api/boards/[slug]/photos/route.ts
index b0b8efc8..7b4339df 100644
--- a/src/app/api/boards/[slug]/photos/route.ts
+++ b/src/app/api/boards/[slug]/photos/route.ts
@@ -9,6 +9,7 @@ import {
   boardApiDeps,
   errorResponse,
   policyForBoard,
+  rejectUnderReview,
   slugGate,
   viewerFor,
 } from "../../shared";
@@ -51,6 +52,10 @@ export async function POST(
       { status: 429, headers: JSON_HEADERS },
     );
   }
+  // PIN-270: a board under a report hold takes no new photo until the
+  // operator decides; checked before the body is read.
+  const paused = await rejectUnderReview(slug, locale);
+  if (paused) return paused;
 
   const lengthHeader = request.headers.get("content-length");
   const contentLength = Number(lengthHeader ?? NaN);
diff --git a/src/app/api/boards/[slug]/report/route.test.ts b/src/app/api/boards/[slug]/report/route.test.ts
new file mode 100644
index 00000000..0ae4fa75
--- /dev/null
+++ b/src/app/api/boards/[slug]/report/route.test.ts
@@ -0,0 +1,188 @@
+import { afterEach, beforeAll, describe, expect, it, vi } from "vitest";
+
+/**
+ * POST /api/boards/[slug]/report (PIN-270) through the real handlers,
+ * memory backends, AI_MOCK=1: guards in order (slug, cross-site, JSON,
+ * per-IP brake, body cap), typed 400s, the uniform 404, 201 with the
+ * reference and `held`, and the 423 the write routes answer while a
+ * board is under review. getLocale() is stubbed (it reads
+ * next/headers). Env is set BEFORE the route modules first read config.
+ */
+process.env.SESSION_SECRET = "test-secret-test-secret-test-secret-32";
+process.env.AI_MOCK = "1";
+process.env.DATA_BACKEND = "memory";
+
+vi.mock("../../../../../i18n/server", () => ({ getLocale: async (): Promise<string> => "en" }));
+
+type Handler = (request: Request) => Promise<Response>;
+type SlugHandler = (request: Request, context: { params: Promise<{ slug: string }> }) => Promise<Response>;
+type TapHandler = (request: Request, context: { params: Promise<{ slug: string; jobId: string }> }) => Promise<Response>;
+
+let route: Record<string, unknown>;
+let reportRoute: SlugHandler;
+let createBoardRoute: Handler;
+let joinRoute: SlugHandler;
+let boardViewRoute: SlugHandler;
+let scenesRoute: SlugHandler;
+let photosRoute: SlugHandler;
+let tapAddRoute: TapHandler;
+let getBoardRepository: typeof import("../../../../../server/board-repository").getBoardRepository;
+let boardReportRef: typeof import("../../../../../domain/tokens").boardReportRef;
+
+beforeAll(async () => {
+  route = (await import("./route")) as unknown as Record<string, unknown>;
+  reportRoute = route.POST as SlugHandler;
+  ({ POST: createBoardRoute } = await import("../../route"));
+  ({ POST: joinRoute } = await import("../participants/route"));
+  ({ GET: boardViewRoute } = await import("../route"));
+  ({ POST: scenesRoute } = await import("../scenes/route"));
+  ({ POST: photosRoute } = await import("../photos/route"));
+  ({ POST: tapAddRoute } = await import("../jobs/[jobId]/tap-add/route"));
+  ({ getBoardRepository } = await import("../../../../../server/board-repository"));
+  ({ boardReportRef } = await import("../../../../../domain/tokens"));
+});
+
+let ipSeq = 0;
+const ip = () => `10.242.${Math.floor(++ipSeq / 250)}.${ipSeq % 250}`;
+const params = (slug: string) => ({ params: Promise.resolve({ slug }) });
+
+async function newBoard(): Promise<string> {
+  const res = await createBoardRoute(
+    new Request("http://t/api/boards", {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-forwarded-for": ip() },
+      body: JSON.stringify({ title: "Report board" }),
+    }),
+  );
+  expect(res.status).toBe(201);
+  return ((await res.json()) as { board: { slug: string } }).board.slug;
+}
+
+async function join(slug: string): Promise<string> {
+  const res = await joinRoute(
+    new Request(`http://t/api/boards/${slug}/participants`, {
+      method: "POST",
+      headers: { "content-type": "application/json", "x-forwarded-for": ip(), "sec-fetch-site": "same-origin" },
+      body: JSON.stringify({ displayName: "Mia" }),
+    }),
+    params(slug),
+  );
+  expect(res.status).toBe(201);
+  const cookie = res.headers.get("set-cookie");
+  expect(cookie).not.toBeNull();
+  return (cookie as string).split(";")[0];
+}
+
+async function seedElement(slug: string, id: string): Promise<void> {
+  const boards = getBoardRepository();
+  await boards.createElement({
+    id, boardId: slug, ownerId: "p-seed", label: "teal mug", description: "", maskBox: { x1: 0, y1: 0, x2: 1, y2: 1 },
+    cutoutRef: `elements/boards/${slug}/${id}/cutout.png`, flattenedRef: `elements/boards/${slug}/${id}/flattened.jpg`,
+    sourcePhotoId: "job", faceFlag: false, createdAt: 1_200,
+  });
+  await boards.putScene({
+    id: `${id}-scene`, boardId: slug, createdBy: "p-seed", elementIds: [id], prompt: "x", status: "ready",
+    imageRef: `scenes/boards/${slug}/${id}-scene/scene.webp`, promptVersion: "scene.v1", createdAt: 1_400,
+  });
+}
+
+function report(slug: string, body: unknown, headers: Record<string, string> = {}, fromIp = ip()): Promise<Response> {
+  return reportRoute(
+    new Request(`http://t/api/boards/${slug}/report`, {
+      method: "POST",
+      headers: { "content-type": "application/json", "sec-fetch-site": "same-origin", "x-forwarded-for": fromIp, ...headers },
+      body: typeof body === "string" ? body : JSON.stringify(body),
+    }),
+    params(slug),
+  );
+}
+
+describe("POST /api/boards/[slug]/report (PIN-270)", () => {
+  afterEach(() => vi.restoreAllMocks());
+
+  it("serves no GET", () => {
+    expect(route.GET).toBeUndefined();
+  });
+
+  it("guards in order: bad slug 404, cross-site 403, non-JSON 415, body over the cap 413, bad body 400, unknown board 404", async () => {
+    const slug = await newBoard();
+    expect((await report("../etc", { scope: "board", reason: "likeness" })).status).toBe(404);
+    const cross = await report(slug, { scope: "board", reason: "likeness" }, { "sec-fetch-site": "cross-site" });
+    expect(cross.status).toBe(403);
+    expect(await cross.json()).toMatchObject({ code: "cross_site" });
+    expect((await report(slug, { scope: "board", reason: "likeness" }, { "content-type": "text/plain" })).status).toBe(415);
+    const big = await report(slug, JSON.stringify({ scope: "board", reason: "likeness", message: "x".repeat(5000) }));
+    expect(big.status).toBe(413);
+    expect(await big.json()).toMatchObject({ code: "body_too_large" });
+    const bad = await report(slug, {});
+    expect(bad.status).toBe(400);
+    expect(await bad.json()).toEqual({ error: "Pick what to report and why.", code: "report_invalid" });
+    const noMessage = await report(slug, { scope: "board", reason: "other" });
+    expect(await noMessage.json()).toMatchObject({ code: "report_message_required" });
+    expect((await report(slug, "{nope")).status).toBe(400);
+    expect((await report("ZyXwVuTsRqPoNmLkJiHgFe", { scope: "board", reason: "likeness" })).status).toBe(404);
+  });
+
+  it("brakes per address after Policy.report.perIp reports", async () => {
+    const slug = await newBoard();
+    const from = ip();
+    for (let i = 0; i < 5; i++) {
+      expect((await report(slug, { scope: "board", reason: "inappropriate" }, {}, from)).status).toBe(201);
+    }
+    const sixth = await report(slug, { scope: "board", reason: "inappropriate" }, {}, from);
+    expect(sixth.status).toBe(429);
+    expect(await sixth.json()).toMatchObject({ code: "rate_limited" });
+  });
+
+  it("a visitor's whole-board report is received, not held; the view stays open", async () => {
+    const slug = await newBoard();
+    const log = vi.spyOn(console, "log").mockImplementation(() => {});
+    const res = await report(slug, { scope: "board", reason: "inappropriate", reporterEmail: "a@b.co" });
+    expect(res.status).toBe(201);
+    expect(await res.json()).toEqual({ reference: boardReportRef(slug), held: false });
+    const view = await boardViewRoute(new Request(`http://t/api/boards/${slug}`), params(slug));
+    expect(((await view.json()) as { board: { underReview: boolean } }).board.underReview).toBe(false);
+    for (const call of log.mock.calls) expect(String(call[0])).not.toContain(slug);
+  });
+
+  it("an element report hides the pin's image and scene for everyone", async () => {
+    const slug = await newBoard();
+    await seedElement(slug, "el-1");
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    const res = await report(slug, { scope: "element", targetId: "el-1", reason: "likeness" });
+    expect(res.status).toBe(201);
+    expect(await res.json()).toEqual({ reference: boardReportRef(slug), held: true });
+    const boards = getBoardRepository();
+    expect((await boards.getElement("el-1"))?.cutoutRef).toBe(`held:elements/boards/${slug}/el-1/cutout.png`);
+    expect(await boards.listScenes(slug)).toEqual([]);
+    expect((await report(slug, { scope: "element", targetId: "ghost", reason: "likeness" })).status).toBe(404);
+  });
+
+  it("a participant's whole-board report pauses the board: 423 on photos, scenes and tap-add", async () => {
+    const slug = await newBoard();
+    const cookie = await join(slug);
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    const res = await report(slug, { scope: "board", reason: "ownership" }, { cookie });
+    expect(res.status).toBe(201);
+    expect(await res.json()).toEqual({ reference: boardReportRef(slug), held: true });
+    const view = await boardViewRoute(new Request(`http://t/api/boards/${slug}`, { headers: { cookie } }), params(slug));
+    expect(((await view.json()) as { board: { underReview: boolean } }).board.underReview).toBe(true);
+
+    const jsonPost = (path: string, body: unknown) =>
+      new Request(`http://t/api/boards/${slug}/${path}`, {
+        method: "POST",
+        headers: { "content-type": "application/json", "x-forwarded-for": ip(), cookie },
+        body: JSON.stringify(body),
+      });
+    const scene = await scenesRoute(jsonPost("scenes", { elementIds: ["el-1"], prompt: "hi" }), params(slug));
+    expect(scene.status).toBe(423);
+    expect(await scene.json()).toEqual({ error: "This board is paused while we check a report.", code: "board_under_review" });
+    const tap = await tapAddRoute(jsonPost("jobs/job-1/tap-add", { x: 0.5, y: 0.5 }), { params: Promise.resolve({ slug, jobId: "job-1" }) });
+    expect(tap.status).toBe(423);
+    const photo = await photosRoute(
+      new Request(`http://t/api/boards/${slug}/photos`, { method: "POST", headers: { "x-forwarded-for": ip(), cookie } }),
+      params(slug),
+    );
+    expect(photo.status).toBe(423);
+  });
+});
diff --git a/src/app/api/boards/[slug]/report/route.ts b/src/app/api/boards/[slug]/report/route.ts
new file mode 100644
index 00000000..01dd3402
--- /dev/null
+++ b/src/app/api/boards/[slug]/report/route.ts
@@ -0,0 +1,52 @@
+import { NextResponse } from "next/server";
+import { t } from "../../../../../i18n";
+import { getLocale } from "../../../../../i18n/server";
+import { getPolicy } from "../../../../../policy/server";
+import { createReport } from "../../../../../server/board-report";
+import { rateLimit, readJsonCapped, rejectCrossSite, requireJson } from "../../request-guards";
+import {
+  JSON_HEADERS,
+  errorResponse,
+  policyForBoard,
+  reportDeps,
+  slugGate,
+  viewerFor,
+} from "../../shared";
+
+export const runtime = "nodejs";
+export const dynamic = "force-dynamic";
+
+/**
+ * Report this board, a pin or a scene (PIN-270, ADR-004). Same-origin
+ * JSON only, capped and rate-limited from the env-level Policy before
+ * any board read. The request applies the hold itself and answers 201
+ * with the opaque reference and whether anything was hidden; a bad
+ * body is a typed 400, an unknown board or target the uniform 404.
+ * Only POST exists: a GET never records anything (405).
+ */
+export async function POST(
+  request: Request,
+  context: { params: Promise<{ slug: string }> },
+): Promise<NextResponse> {
+  const locale = await getLocale();
+  const { slug } = await context.params;
+  const gated = slugGate(slug);
+  if (gated) return gated;
+  const crossSite = rejectCrossSite(request, locale);
+  if (crossSite) return crossSite;
+  const notJson = requireJson(request, locale);
+  if (notJson) return notJson;
+  const envPolicy = getPolicy();
+  const limited = rateLimit(request, "report", envPolicy.report.perIp, locale);
+  if (limited) return limited;
+  const capped = await readJsonCapped(request, envPolicy.report.maxBytes, locale);
+  if (!capped.ok) return capped.response;
+  try {
+    const policy = await policyForBoard(slug);
+    const viewer = await viewerFor(request, slug, policy);
+    const { record, held } = await createReport(slug, capped.value, viewer, reportDeps(policy));
+    return NextResponse.json({ reference: record.reference, held }, { status: 201, headers: JSON_HEADERS });
+  } catch (error) {
+    return errorResponse(error, t(locale, "request.reportFailed"));
+  }
+}
diff --git a/src/app/api/boards/[slug]/scenes/route.ts b/src/app/api/boards/[slug]/scenes/route.ts
index 29eb8739..06c35b84 100644
--- a/src/app/api/boards/[slug]/scenes/route.ts
+++ b/src/app/api/boards/[slug]/scenes/route.ts
@@ -19,6 +19,7 @@ import {
   errorResponse,
   notFound,
   policyForBoard,
+  rejectUnderReview,
   slugGate,
   viewerFor,
 } from "../../shared";
@@ -83,6 +84,9 @@ export async function POST(
     );
   }
   const body: unknown = capped.value;
+  // PIN-270: a board under a report hold makes nothing new until the operator decides.
+  const paused = await rejectUnderReview(slug, locale);
+  if (paused) return paused;
 
   try {
     const policy = await policyForBoard(slug);
diff --git a/src/app/api/boards/shared.ts b/src/app/api/boards/shared.ts
index a8ad0320..11c4bff4 100644
--- a/src/app/api/boards/shared.ts
+++ b/src/app/api/boards/shared.ts
@@ -24,7 +24,10 @@ import { getDerivativeStore } from "../../../server/derivative-store";
 import { getCreditLedgerStore } from "../../../server/credit-ledger-store";
 import { getStarterAllowanceStore } from "../../../server/starter-allowance-store";
 import { PhotoIntakeError } from "../../../server/photo-intake";
+import { getReportStore } from "../../../server/report-store";
+import type { ReportDeps } from "../../../server/board-report";
 import { logServerError } from "../../../server/safe-log";
+import { t, type Locale } from "../../../i18n";
 
 export const JSON_HEADERS = { "Cache-Control": "no-store" };
 
@@ -82,6 +85,30 @@ export function boardApiDeps(policy: Policy): BoardApiDeps {
   };
 }
 
+/** Report & hold deps (PIN-270): the board repository, Storage and the reports collection. */
+export function reportDeps(policy: Policy): ReportDeps {
+  return {
+    boards: getBoardRepository(),
+    store: getDerivativeStore(),
+    reports: getReportStore(),
+    policy,
+  };
+}
+
+/**
+ * 423 while a board-wide report hold is on (PIN-270, `Board.reviewAt`):
+ * uploads, scenes and tap-adds wait for the operator's decision. A
+ * missing board is left to the route's own uniform 404.
+ */
+export async function rejectUnderReview(slug: string, locale: Locale): Promise<NextResponse | null> {
+  const board = await getBoardRepository().getBoard(slug);
+  if (board?.reviewAt === undefined) return null;
+  return NextResponse.json(
+    { error: t(locale, "request.boardUnderReview"), code: "board_under_review" },
+    { status: 423, headers: JSON_HEADERS },
+  );
+}
+
 export function sessionDeps(policy: Policy): BoardSessionDeps {
   return {
     boards: getBoardRepository(),
diff --git a/src/app/g/[slug]/BoardClient.tsx b/src/app/g/[slug]/BoardClient.tsx
index 2181963c..b408187e 100644
--- a/src/app/g/[slug]/BoardClient.tsx
+++ b/src/app/g/[slug]/BoardClient.tsx
@@ -81,12 +81,13 @@ import { PlusFlow, useLookFlow } from "./PlusFlow";
 import { DeleteBoardSheet } from "./DeleteBoardSheet";
 import { isPoolEmptyCode, parseBillingFlag, poolEmptyCopy, type MakesPack } from "../../../domain/makes-ui";
 import { BillingBanner, MakesIndicator, useMakesFlow } from "./MakesFlow";
-import { ReportBoardLink } from "./ReportBoard";
+import { ReportBoard } from "./ReportBoard";
 import { SceneViewer } from "./SceneViewer";
 import styles from "./board.module.css";
 
 export interface BoardClientView extends BoardViewLike {
-  board: { slug: string; title: string; themeId?: string | null };
+  /** PIN-266 `underReview`: a board-wide report hold; the page shows a banner. */
+  board: { slug: string; title: string; themeId?: string | null; underReview?: boolean };
   me: { id: string; displayName: string } | null;
   scenes: BoardViewScene[];
   activity: ActivityLine[];
@@ -105,6 +106,8 @@ export interface BoardClientView extends BoardViewLike {
 export interface BoardClientPolicy {
   pollIntervalMs: number;
   jobPollIntervalMs: number;
+  /** Policy report.messageMaxChars: the report sheet's message cap (PIN-271). */
+  reportMessageMaxChars: number;
   uploadMaxPx: number;
   uploadJpegQuality: number;
   pinsPerScene: { min: number; max: number };
@@ -1243,6 +1246,11 @@ function BoardBody({
   return (
     <div className="pn-skin-root" data-theme={look.shownSkin} style={{ minHeight: "100dvh" }}>
       <main className={cx(styles.board, !showDock && styles.boardRest, look.tryOn && styles.boardTryOn)} inert={viewerOpen}>
+        {view.board.underReview ? (
+          <p className="pn-lib-notice" role="status">
+            {t(locale, "board.underReviewNotice")}
+          </p>
+        ) : null}
         <BoardHeader
           title={view.board.title}
           people={people}
@@ -1572,7 +1580,19 @@ function BoardBody({
           aboveDock={showDock}
           picking={pickingNow}
         />
-        <ReportBoardLink email={legalContactEmail} reportRef={reportRef} />
+        <ReportBoard
+          slug={slug}
+          email={legalContactEmail}
+          reportRef={reportRef}
+          messageMaxChars={policy.reportMessageMaxChars}
+          targets={{
+            // The pins on the grid only: leftover candidates are never on the board for others.
+            pins: cards.filter((card) => card.status === "pinned").map((card) => ({ id: card.element.id, label: card.element.label })),
+            // The same catalogue numbers the prints show ("Nº 03": ready scenes, oldest first).
+            scenes: [...numbers.entries()].map(([id, index]) => ({ id, index })),
+          }}
+          onReported={() => void queryClient.invalidateQueries({ queryKey: boardQueryKey(slug) })}
+        />
       </main>
       {viewerSlot ? (
         <SceneViewer
diff --git a/src/app/g/[slug]/ReportBoard.tsx b/src/app/g/[slug]/ReportBoard.tsx
index cff9e296..d586cc03 100644
--- a/src/app/g/[slug]/ReportBoard.tsx
+++ b/src/app/g/[slug]/ReportBoard.tsx
@@ -1,55 +1,308 @@
 "use client";
 
-import { reportBoardHref } from "../../../domain/board-report";
-import { t, tf } from "../../../i18n";
+import { useId, useRef, useState, type FormEvent } from "react";
+import { REPORT_REASONS, type ReportReason } from "../../../domain/board-report";
+import { t, tf, type MessageKey } from "../../../i18n";
 import { useLocale } from "../../../i18n/client";
+import { Button, Chip, Sheet, TextField, cx } from "../../../ui";
 import styles from "./board.module.css";
 
 /**
- * "Report this board" (PIN-239): a quiet link at the foot of every
- * board page, for visitors too (no join needed). It opens a mail to
- * the legal contact carrying only the board's opaque report
- * reference — never the slug — so reporting illegal or abusive
- * content never spreads the board link. Without a configured
- * address it points at the Terms contact section instead, and
- * without a reference (renders that predate PIN-239) it is absent.
- *
- * In-app browsers often have no mail handler, so the address and the
- * reference also show as plain, selectable text under the link: a
- * reporter can copy them into any mail app. Still never the slug.
+ * Report (PIN-271, ADR-004): the quiet link at the foot of every board
+ * page, for visitors too, now opens a sheet instead of a mail. What
+ * (this board, a pin, a scene), why (one reason), a message, an optional
+ * email, then Confirm; `POST /api/boards/<slug>/report` hides the
+ * reported thing at once and answers with the board's opaque reference,
+ * which the receipt shows. The legal address stays as plain text with
+ * the reference for follow-up. The capability slug never appears in the
+ * sheet, the request body or the receipt (the URL carries it already).
  */
-export function ReportBoardLink({
+
+export interface ReportTargets {
+  /** Visible pins, by element id and label. */
+  pins: { id: string; label: string }[];
+  /** Ready scenes, newest first, numbered for people (no scene has a name). */
+  scenes: { id: string; index: number }[];
+}
+
+export type ReportScopeKey = "board" | `element:${string}` | `scene:${string}`;
+
+export interface ReportResult {
+  reference: string;
+  held: boolean;
+}
+
+const REASON_KEYS: Record<ReportReason, MessageKey> = {
+  likeness: "board.reportReason.likeness",
+  inappropriate: "board.reportReason.inappropriate",
+  illegal: "board.reportReason.illegal",
+  ownership: "board.reportReason.ownership",
+  other: "board.reportReason.other",
+};
+
+export function canSendReport(reason: ReportReason | null, message: string): boolean {
+  if (!reason) return false;
+  return reason !== "other" || message.trim().length > 0;
+}
+
+/** Scope key → request fields. */
+export function scopeFields(key: ReportScopeKey): { scope: "board" } | { scope: "element" | "scene"; targetId: string } {
+  if (key === "board") return { scope: "board" };
+  const [kind, id] = key.split(":", 2) as ["element" | "scene", string];
+  return { scope: kind, targetId: id };
+}
+
+/** The form, stateless: the sheet owns the state, tests render states. */
+export function ReportForm({
+  targets,
+  scopeKey,
+  reason,
+  message,
+  email,
+  messageMaxChars,
+  sending,
+  error,
+  onScope,
+  onReason,
+  onMessage,
+  onEmail,
+  messageId,
+}: {
+  targets: ReportTargets;
+  scopeKey: ReportScopeKey;
+  reason: ReportReason | null;
+  message: string;
+  email: string;
+  messageMaxChars: number;
+  sending: boolean;
+  error: string | null;
+  onScope: (key: ReportScopeKey) => void;
+  onReason: (reason: ReportReason) => void;
+  onMessage: (value: string) => void;
+  onEmail: (value: string) => void;
+  messageId: string;
+}) {
+  const locale = useLocale();
+  const scopeLabelId = `${messageId}-scope`;
+  const reasonLabelId = `${messageId}-reason`;
+  return (
+    <div className={styles.reportForm}>
+      <p className={styles.reportGroupLabel} id={scopeLabelId}>
+        {t(locale, "board.reportScopeLabel")}
+      </p>
+      <div className={cx("pn-chip-row", styles.reportChips)} role="group" aria-labelledby={scopeLabelId}>
+        <Chip selected={scopeKey === "board"} onClick={() => onScope("board")} disabled={sending}>
+          {t(locale, "board.reportScopeBoard")}
+        </Chip>
+        {targets.pins.map((pin) => (
+          <Chip key={pin.id} selected={scopeKey === `element:${pin.id}`} onClick={() => onScope(`element:${pin.id}`)} disabled={sending}>
+            {pin.label}
+          </Chip>
+        ))}
+        {targets.scenes.map((scene) => (
+          <Chip key={scene.id} selected={scopeKey === `scene:${scene.id}`} onClick={() => onScope(`scene:${scene.id}`)} disabled={sending}>
+            {tf(locale, "board.reportScopeScene", { n: scene.index })}
+          </Chip>
+        ))}
+      </div>
+      <p className={styles.reportGroupLabel} id={reasonLabelId}>
+        {t(locale, "board.reportReasonLabel")}
+      </p>
+      <div className={cx("pn-chip-row", styles.reportChips)} role="group" aria-labelledby={reasonLabelId}>
+        {REPORT_REASONS.map((value) => (
+          <Chip key={value} selected={reason === value} onClick={() => onReason(value)} disabled={sending}>
+            {t(locale, REASON_KEYS[value])}
+          </Chip>
+        ))}
+      </div>
+      <TextField
+        id={messageId}
+        label={t(locale, "board.reportMessage")}
+        value={message}
+        onChange={onMessage}
+        multiline
+        rows={3}
+        softMaxLength={messageMaxChars}
+        required={reason === "other"}
+        help={t(locale, "board.reportMessageHelp")}
+      />
+      <TextField
+        id={`${messageId}-email`}
+        label={t(locale, "board.reportEmail")}
+        value={email}
+        onChange={onEmail}
+        autoComplete="email"
+        help={t(locale, "board.reportEmailHelp")}
+      />
+      {error ? (
+        <p className={styles.reportError} role="alert">
+          {error}
+        </p>
+      ) : null}
+    </div>
+  );
+}
+
+/** The receipt: what happened and the reference to quote. */
+export function ReportReceipt({ result, email }: { result: ReportResult; email?: string | null }) {
+  const locale = useLocale();
+  return (
+    <div className={styles.reportReceipt} role="status">
+      <p>{tf(locale, result.held ? "board.reportHeld" : "board.reportReceived", { ref: result.reference })}</p>
+      {email ? (
+        <p className={styles.reportManual}>
+          {t(locale, "board.reportFollowUp")} <span className={styles.reportMono}>{email}</span>
+        </p>
+      ) : null}
+    </div>
+  );
+}
+
+export function ReportBoard({
+  slug,
   email,
   reportRef,
+  targets,
+  messageMaxChars,
+  onReported,
 }: {
+  slug: string;
   email?: string | null;
   reportRef?: string | null;
+  targets: ReportTargets;
+  messageMaxChars: number;
+  onReported?: (result: ReportResult) => void;
 }) {
   const locale = useLocale();
+  const messageId = useId();
+  const [open, setOpen] = useState(false);
+  const [scopeKey, setScopeKey] = useState<ReportScopeKey>("board");
+  const [reason, setReason] = useState<ReportReason | null>(null);
+  const [message, setMessage] = useState("");
+  const [emailValue, setEmailValue] = useState("");
+  const [sending, setSending] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+  const [result, setResult] = useState<ReportResult | null>(null);
+  // One request at a time, whatever the render state says in between.
+  const inFlight = useRef(false);
   if (!reportRef) return null;
-  const href =
-    reportBoardHref(
-      email,
-      reportRef,
-      tf(locale, "board.reportSubject", { ref: reportRef }),
-      tf(locale, "board.reportBody", { ref: reportRef }),
-    ) ?? "/terms#contact";
+
+  const close = () => {
+    // Escape, the scrim and the X all land here: while the answer is
+    // on its way the sheet stays, so the receipt is seen and the form
+    // cannot be sent twice.
+    if (inFlight.current) return;
+    setOpen(false);
+    setError(null);
+    if (result) {
+      setResult(null);
+      setScopeKey("board");
+      setReason(null);
+      setMessage("");
+      setEmailValue("");
+    }
+  };
+
+  const send = async (event?: FormEvent) => {
+    event?.preventDefault();
+    if (!canSendReport(reason, message) || inFlight.current || !reason) return;
+    inFlight.current = true;
+    setSending(true);
+    setError(null);
+    try {
+      const body = {
+        ...scopeFields(scopeKey),
+        reason,
+        ...(message.trim() ? { message: message.trim() } : {}),
+        ...(emailValue.trim() ? { reporterEmail: emailValue.trim() } : {}),
+      };
+      const response = await fetch(`/api/boards/${encodeURIComponent(slug)}/report`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify(body),
+      });
+      const data = (await response.json().catch(() => null)) as { reference?: string; held?: boolean; error?: string } | null;
+      if (!response.ok || !data?.reference) {
+        setError(data?.error || t(locale, "request.reportFailed"));
+        return;
+      }
+      const outcome = { reference: data.reference, held: data.held === true };
+      setResult(outcome);
+      onReported?.(outcome);
+    } catch {
+      setError(t(locale, "request.reportFailed"));
+    } finally {
+      inFlight.current = false;
+      setSending(false);
+    }
+  };
+
+  const footer = result ? (
+    <Button variant="primary" size="lg" onClick={close}>
+      {t(locale, "board.reportDone")}
+    </Button>
+  ) : (
+    <>
+      <Button variant="quiet" onClick={close} disabled={sending}>
+        {t(locale, "board.reportCancel")}
+      </Button>
+      <Button variant="primary" size="lg" onClick={() => void send()} disabled={!canSendReport(reason, message) || sending}>
+        {t(locale, sending ? "board.reportSending" : "board.reportSend")}
+      </Button>
+    </>
+  );
+
   return (
-    <footer className={styles.reportFoot}>
-      <a href={href}>{t(locale, "board.report")}</a>
-      {email ? <p className={styles.reportManual}>{t(locale, "board.reportManual")}</p> : null}
-      <dl className={styles.reportFacts}>
-        {email ? (
+    <>
+      <footer className={styles.reportFoot}>
+        <button type="button" className={styles.reportLink} onClick={() => setOpen(true)} aria-haspopup="dialog">
+          {t(locale, "board.report")}
+        </button>
+        <dl className={styles.reportFacts}>
+          {email ? (
+            <div>
+              <dt>{t(locale, "board.reportAddress")}</dt>
+              <dd>{email}</dd>
+            </div>
+          ) : null}
           <div>
-            <dt>{t(locale, "board.reportAddress")}</dt>
-            <dd>{email}</dd>
+            <dt>{t(locale, "board.reportRef")}</dt>
+            <dd>{reportRef}</dd>
           </div>
-        ) : null}
-        <div>
-          <dt>{t(locale, "board.reportRef")}</dt>
-          <dd>{reportRef}</dd>
-        </div>
-      </dl>
-    </footer>
+        </dl>
+      </footer>
+      {open ? (
+        <Sheet
+          title={t(locale, "board.reportTitle")}
+          onClose={close}
+          closeLabel={t(locale, "board.reportClose")}
+          footer={footer}
+          className="pn-report-sheet"
+          keyboardAware
+        >
+          {result ? (
+            <ReportReceipt result={result} email={email} />
+          ) : (
+            <form onSubmit={(event) => void send(event)}>
+              <ReportForm
+                targets={targets}
+                scopeKey={scopeKey}
+                reason={reason}
+                message={message}
+                email={emailValue}
+                messageMaxChars={messageMaxChars}
+                sending={sending}
+                error={error}
+                onScope={setScopeKey}
+                onReason={setReason}
+                onMessage={setMessage}
+                onEmail={setEmailValue}
+                messageId={messageId}
+              />
+            </form>
+          )}
+        </Sheet>
+      ) : null}
+    </>
   );
 }
diff --git a/src/app/g/[slug]/board-report-render.test.ts b/src/app/g/[slug]/board-report-render.test.ts
index 18bbf25a..be01015a 100644
--- a/src/app/g/[slug]/board-report-render.test.ts
+++ b/src/app/g/[slug]/board-report-render.test.ts
@@ -2,48 +2,110 @@ import { createElement as h } from "react";
 import { renderToStaticMarkup } from "react-dom/server";
 import { describe, expect, it, vi } from "vitest";
 import { boardReportRef } from "../../../domain/tokens";
-import { ReportBoardLink } from "./ReportBoard";
+import { ReportBoard, ReportForm, ReportReceipt, canSendReport, scopeFields, type ReportTargets } from "./ReportBoard";
 
-// ReportBoardLink reads the language with a hook; mock it like add-pick.test.ts.
+// The components read the language with a hook; mock it like add-pick.test.ts.
 vi.mock("../../../i18n/client", () => ({ useLocale: () => "en" }));
 
 const SLUG = "AbCdEfGhIjKlMnOpQrStUv";
+const targets: ReportTargets = {
+  pins: [{ id: "el-1", label: "teal mug" }, { id: "el-2", label: "a friend" }],
+  scenes: [{ id: "sc-9", index: 1 }],
+};
+const noop = () => {};
+const formProps = {
+  targets,
+  scopeKey: "board" as const,
+  reason: null,
+  message: "",
+  email: "",
+  messageMaxChars: 1000,
+  sending: false,
+  error: null,
+  onScope: noop,
+  onReason: noop,
+  onMessage: noop,
+  onEmail: noop,
+  messageId: "m",
+};
 
-describe("report this board (PIN-239)", () => {
-  it("mails the legal contact with the reference, never the slug", () => {
+describe("report foot (PIN-271)", () => {
+  it("opens a sheet instead of a mail: a button, the address and the reference as text, never the slug", () => {
     const ref = boardReportRef(SLUG);
-    const out = renderToStaticMarkup(h(ReportBoardLink, { email: "contact@example.com", reportRef: ref }));
+    const out = renderToStaticMarkup(
+      h(ReportBoard, { slug: SLUG, email: "contact@example.com", reportRef: ref, targets, messageMaxChars: 1000 }),
+    );
     expect(out).toContain("Report this board");
-    expect(out).toContain("mailto:contact@example.com");
-    expect(out).toContain(ref);
+    expect(out).toContain('aria-haspopup="dialog"');
+    expect(out).not.toContain("mailto:");
+    expect(out).toContain("<dt>Email</dt><dd>contact@example.com</dd>");
+    expect(out).toContain(`<dt>Board reference</dt><dd>${ref}</dd>`);
     expect(out).not.toContain(SLUG);
-    expect(decodeURIComponent(out)).toContain("do not attach or send illegal images");
+    // Closed: no sheet in the markup.
+    expect(out).not.toContain("pn-report-sheet");
   });
 
-  it("shows the address and the reference as plain text for browsers without a mail app", () => {
-    const ref = boardReportRef(SLUG);
-    const out = renderToStaticMarkup(h(ReportBoardLink, { email: "contact@example.com", reportRef: ref }));
-    const text = out.replace(/<a [^>]*>/g, "<a>"); // drop the mailto href: what is left is visible text
-    expect(text).toContain("No mail app? Write to this address and include the board reference.");
-    expect(text).toContain("<dt>Email</dt><dd>contact@example.com</dd>");
-    expect(text).toContain(`<dt>Board reference</dt><dd>${ref}</dd>`);
-    expect(out).not.toContain(SLUG);
+  it("renders nothing without a reference, and no address line without an address", () => {
+    expect(renderToStaticMarkup(h(ReportBoard, { slug: SLUG, email: "c@e.co", reportRef: null, targets, messageMaxChars: 1000 }))).toBe("");
+    const out = renderToStaticMarkup(h(ReportBoard, { slug: SLUG, email: null, reportRef: boardReportRef(SLUG), targets, messageMaxChars: 1000 }));
+    expect(out).not.toContain("<dt>Email</dt>");
+    expect(out).toContain("<dt>Board reference</dt>");
   });
+});
 
-  it("falls back to the Terms contact section when no address is configured", () => {
-    const ref = boardReportRef(SLUG);
-    const out = renderToStaticMarkup(h(ReportBoardLink, { email: null, reportRef: ref }));
-    expect(out).toContain('href="/terms#contact"');
-    expect(out).toContain("Report this board");
-    // The reference still shows, to quote in whatever contact the Terms give; no address line.
-    expect(out).toContain(`<dt>Board reference</dt><dd>${ref}</dd>`);
-    expect(out).not.toContain("<dt>Email</dt>");
-    expect(out).not.toContain("No mail app?");
+describe("report form (PIN-271)", () => {
+  it("offers the board, every pin by label and every scene by number, and the five reasons", () => {
+    const out = renderToStaticMarkup(h(ReportForm, formProps));
+    for (const label of ["This board", "teal mug", "a friend", "Scene 1"]) expect(out).toContain(label);
+    for (const reason of [
+      "That&#x27;s me, or someone who didn&#x27;t agree",
+      "Inappropriate",
+      "Illegal, or involves a minor",
+      "Not theirs to share",
+      "Something else",
+    ]) {
+      expect(out).toContain(reason);
+    }
+    expect(out).toContain("What should we look at?");
+    expect(out).toContain("Your email (optional)");
+    expect(out).toContain('aria-pressed="true"'); // "This board" starts selected
     expect(out).not.toContain(SLUG);
   });
 
-  it("renders nothing without a reference", () => {
-    expect(renderToStaticMarkup(h(ReportBoardLink, { email: "contact@example.com", reportRef: null }))).toBe("");
-    expect(renderToStaticMarkup(h(ReportBoardLink, {}))).toBe("");
+  it("marks the chosen scope and reason, shows a server line, and caps the message from Policy", () => {
+    const out = renderToStaticMarkup(
+      h(ReportForm, { ...formProps, scopeKey: "element:el-2", reason: "likeness", error: "Keep your message under 40 characters.", messageMaxChars: 40 }),
+    );
+    expect((out.match(/aria-pressed="true"/g) ?? []).length).toBe(2);
+    expect(out).toContain('role="alert"');
+    expect(out).toContain("Keep your message under 40 characters.");
+    // The count follows Policy (code points); the server enforces the cap.
+    expect(out).toContain("0/40");
+  });
+
+  it("canSendReport needs a reason, and a message for 'other'", () => {
+    expect(canSendReport(null, "x")).toBe(false);
+    expect(canSendReport("likeness", "")).toBe(true);
+    expect(canSendReport("other", "   ")).toBe(false);
+    expect(canSendReport("other", "the host is a bot")).toBe(true);
+  });
+
+  it("scopeFields maps a chip to the request body", () => {
+    expect(scopeFields("board")).toEqual({ scope: "board" });
+    expect(scopeFields("element:el-1")).toEqual({ scope: "element", targetId: "el-1" });
+    expect(scopeFields("scene:sc-9")).toEqual({ scope: "scene", targetId: "sc-9" });
+  });
+});
+
+describe("report receipt (PIN-271)", () => {
+  it("says what happened and shows the reference and the follow-up address", () => {
+    const ref = boardReportRef(SLUG);
+    const held = renderToStaticMarkup(h(ReportReceipt, { result: { reference: ref, held: true }, email: "contact@example.com" }));
+    expect(held).toContain(`Hidden while we check. Your reference: ${ref}`);
+    expect(held).toContain("contact@example.com");
+    expect(held).not.toContain(SLUG);
+    const received = renderToStaticMarkup(h(ReportReceipt, { result: { reference: ref, held: false }, email: null }));
+    expect(received).toContain(`Received. We&#x27;ll take a look. Your reference: ${ref}`);
+    expect(received).not.toContain("Questions about a report?");
   });
 });
diff --git a/src/app/g/[slug]/board.module.css b/src/app/g/[slug]/board.module.css
index 721aadb6..2d1ee9e2 100644
--- a/src/app/g/[slug]/board.module.css
+++ b/src/app/g/[slug]/board.module.css
@@ -47,7 +47,8 @@
   text-align: center;
 }
 
-.reportFoot a {
+.reportFoot a,
+.reportLink {
   display: inline-flex;
   align-items: center;
   min-height: var(--tap);
@@ -55,13 +56,62 @@
   font: 500 14px/20px var(--font-ui);
 }
 
-.reportFoot a:focus-visible {
+.reportLink {
+  padding: 0 var(--space-3);
+  border: 0;
+  background: none;
+  cursor: pointer;
+  text-decoration: underline;
+  text-underline-offset: 3px;
+}
+
+.reportFoot a:focus-visible,
+.reportLink:focus-visible {
   outline: 2px solid var(--focus);
   outline-offset: 2px;
   border-radius: var(--radius-xs);
 }
 
-/* No mail app (in-app browsers): the address and reference as plain, selectable text. */
+/* The report sheet (PIN-271): two chip groups, a message, an email. */
+.reportForm {
+  display: grid;
+  gap: var(--space-3);
+}
+
+.reportGroupLabel {
+  margin: 0;
+  color: var(--ink-muted);
+  font: 500 13px/18px var(--font-ui);
+}
+
+.reportChips {
+  flex-wrap: wrap;
+}
+
+.reportError {
+  margin: 0;
+  color: var(--danger, var(--ink));
+  font: 400 14px/20px var(--font-ui);
+}
+
+.reportReceipt {
+  display: grid;
+  gap: var(--space-3);
+  font: 400 15px/22px var(--font-ui);
+}
+
+.reportReceipt p {
+  margin: 0;
+}
+
+.reportMono {
+  font-family: var(--font-mono);
+  overflow-wrap: anywhere;
+  -webkit-user-select: all;
+  user-select: all;
+}
+
+/* The address and reference as plain, selectable text for follow-up. */
 .reportManual,
 .reportFacts {
   margin: 0;
diff --git a/src/app/g/[slug]/page.tsx b/src/app/g/[slug]/page.tsx
index 64e0e08c..79eb63c1 100644
--- a/src/app/g/[slug]/page.tsx
+++ b/src/app/g/[slug]/page.tsx
@@ -154,7 +154,7 @@ export default async function BoardPage({
       initialBilling={query.billing ?? null}
       legalContactEmail={getConfig().legalContactEmail}
       reportRef={boardReportRef(slug)}
-      policy={{ pollIntervalMs: resolved.boardPollIntervalMs, jobPollIntervalMs: resolved.jobPollIntervalMs, uploadMaxPx: resolved.uploadMaxPx, uploadJpegQuality: resolved.uploadJpegQuality, pinsPerScene: resolved.pinsPerScene, sceneChips, scenePromptMaxChars: resolved.scenePromptMaxChars, elementLabelMaxChars: resolved.elementLabelMaxChars, sceneSize: resolved.sceneSize, elementsPerPhotoMax: resolved.elementsPerPhoto.max, photosPerBatch: resolved.photosPerBatch, batchUploadConcurrency: resolved.batchUploadConcurrency, uploadRetryMaxAttempts: resolved.uploadRetryMaxAttempts, uploadRetryBackoffMs: resolved.uploadRetryBackoffMs, signInNudge: resolved.signInNudge, libraryStripMax: resolved.libraryStripMax, dictationMaxSeconds: resolved.dictationMaxSeconds, dictationEnabled: resolved.dictationsPerParticipantPerDay > 0 && resolved.dailyBudgetUsd > 0 && resolved.dailyCallLimit > 0, makes: { packs: resolved.credits.packs, lowMakesWarning: resolved.credits.lowMakesWarning, lowFreePhotosWarning: resolved.credits.lowFreePhotosWarning } }}
+      policy={{ pollIntervalMs: resolved.boardPollIntervalMs, jobPollIntervalMs: resolved.jobPollIntervalMs, uploadMaxPx: resolved.uploadMaxPx, uploadJpegQuality: resolved.uploadJpegQuality, pinsPerScene: resolved.pinsPerScene, sceneChips, scenePromptMaxChars: resolved.scenePromptMaxChars, elementLabelMaxChars: resolved.elementLabelMaxChars, sceneSize: resolved.sceneSize, elementsPerPhotoMax: resolved.elementsPerPhoto.max, photosPerBatch: resolved.photosPerBatch, batchUploadConcurrency: resolved.batchUploadConcurrency, uploadRetryMaxAttempts: resolved.uploadRetryMaxAttempts, uploadRetryBackoffMs: resolved.uploadRetryBackoffMs, signInNudge: resolved.signInNudge, libraryStripMax: resolved.libraryStripMax, reportMessageMaxChars: resolved.report.messageMaxChars, dictationMaxSeconds: resolved.dictationMaxSeconds, dictationEnabled: resolved.dictationsPerParticipantPerDay > 0 && resolved.dailyBudgetUsd > 0 && resolved.dailyCallLimit > 0, makes: { packs: resolved.credits.packs, lowMakesWarning: resolved.credits.lowMakesWarning, lowFreePhotosWarning: resolved.credits.lowFreePhotosWarning } }}
     />
   );
 }
diff --git a/src/domain/board-report.test.ts b/src/domain/board-report.test.ts
index 15b860e2..e7565f70 100644
--- a/src/domain/board-report.test.ts
+++ b/src/domain/board-report.test.ts
@@ -7,10 +7,184 @@ import {
   matchReportRef,
   parseFindArgs,
 } from "../../scripts/find-report-ref.mjs";
-import { reportBoardHref } from "./board-report";
+import {
+  NOTHING_HELD,
+  parseReportInput,
+  planHoldsSomething,
+  planReportHold,
+  reportBoardHref,
+  type ReportPlanInput,
+} from "./board-report";
 import { boardReportRef, generateSlug } from "./tokens";
 
 const SLUG = "AbCdEfGhIjKlMnOpQrStUv";
+const LIMITS = { messageMaxChars: 20 };
+const HOUR = 3_600_000;
+
+describe("parseReportInput (PIN-268)", () => {
+  it("accepts a narrow scope with a target and a board scope without one", () => {
+    expect(parseReportInput({ scope: "element", targetId: "el-1", reason: "likeness" }, LIMITS)).toEqual({
+      ok: true,
+      input: { scope: "element", targetId: "el-1", reason: "likeness" },
+    });
+    expect(parseReportInput({ scope: "board", reason: "inappropriate", message: "  ", reporterEmail: "" }, LIMITS)).toEqual({
+      ok: true,
+      input: { scope: "board", reason: "inappropriate" },
+    });
+  });
+
+  it("keeps a trimmed message and a valid email", () => {
+    expect(
+      parseReportInput(
+        { scope: "scene", targetId: "sc-1", reason: "other", message: "  not ours  ", reporterEmail: " a@b.co " },
+        LIMITS,
+      ),
+    ).toEqual({
+      ok: true,
+      input: { scope: "scene", targetId: "sc-1", reason: "other", message: "not ours", reporterEmail: "a@b.co" },
+    });
+  });
+
+  it("rejects bad shapes, unknown values and a target on a board scope", () => {
+    for (const bad of [
+      null,
+      "x",
+      [],
+      { scope: "board" },
+      { reason: "likeness" },
+      { scope: "pin", reason: "likeness" },
+      { scope: "board", reason: "mistake" },
+      { scope: "element", reason: "likeness" },
+      { scope: "element", targetId: "../x", reason: "likeness" },
+      { scope: "element", targetId: 7, reason: "likeness" },
+      { scope: "board", targetId: "el-1", reason: "likeness" },
+      { scope: "board", reason: "likeness", message: 3 },
+      { scope: "board", reason: "likeness", reporterEmail: ["a@b.co"] },
+    ]) {
+      expect(parseReportInput(bad, LIMITS)).toEqual({ ok: false, error: "invalid" });
+    }
+  });
+
+  it("requires a message for 'other', caps it in code points, and checks the email", () => {
+    expect(parseReportInput({ scope: "board", reason: "other" }, LIMITS)).toEqual({ ok: false, error: "message_required" });
+    expect(parseReportInput({ scope: "board", reason: "other", message: "   " }, LIMITS)).toEqual({ ok: false, error: "message_required" });
+    const twentyOne = "é".repeat(21);
+    expect(parseReportInput({ scope: "board", reason: "likeness", message: twentyOne }, LIMITS)).toEqual({ ok: false, error: "message_too_long" });
+    expect(parseReportInput({ scope: "board", reason: "likeness", message: "é".repeat(20) }, LIMITS).ok).toBe(true);
+    expect(parseReportInput({ scope: "board", reason: "likeness", reporterEmail: "nope" }, LIMITS)).toEqual({ ok: false, error: "email_invalid" });
+    expect(parseReportInput({ scope: "board", reason: "likeness", reporterEmail: `${"a".repeat(250)}@b.co` }, LIMITS)).toEqual({ ok: false, error: "email_invalid" });
+  });
+});
+
+describe("planReportHold (PIN-268, ADR-004 decision table)", () => {
+  const scenes = [
+    { id: "sc-a", hidden: false, elementIds: ["el-1", "el-2"] },
+    { id: "sc-b", hidden: false, elementIds: ["el-2"] },
+    { id: "sc-hidden", hidden: true, elementIds: ["el-1"] },
+  ];
+  const elements = [{ id: "el-1" }, { id: "el-2" }];
+  const base: ReportPlanInput = {
+    scope: "board",
+    reason: "inappropriate",
+    reporterKind: "visitor",
+    now: 1_000,
+    takedownHours: 24,
+    boardElements: elements,
+    boardScenes: scenes,
+  };
+
+  it("element: holds the element and the visible scenes using it, for anyone", () => {
+    const result = planReportHold({ ...base, scope: "element", element: { id: "el-1", faceFlag: false } });
+    expect(result).toEqual({
+      ok: true,
+      plan: {
+        held: { elementIds: ["el-1"], sceneIds: ["sc-a"], boardReview: false, storageHold: false },
+        severity: "normal",
+        queuedOnly: false,
+      },
+    });
+  });
+
+  it("element + likeness + faceFlag: the one timed takedown, takedownHours from now", () => {
+    const result = planReportHold({
+      ...base,
+      scope: "element",
+      reason: "likeness",
+      element: { id: "el-2", faceFlag: true },
+    });
+    expect(result.ok && result.plan.deleteAt).toBe(1_000 + 24 * HOUR);
+    expect(result.ok && result.plan.held.sceneIds).toEqual(["sc-a", "sc-b"]);
+  });
+
+  it("no deadline without a face flag, with another reason, or ever for illegal", () => {
+    for (const input of [
+      { ...base, scope: "element" as const, reason: "likeness" as const, element: { id: "el-2", faceFlag: false } },
+      { ...base, scope: "element" as const, reason: "inappropriate" as const, element: { id: "el-2", faceFlag: true } },
+      { ...base, scope: "element" as const, reason: "illegal" as const, element: { id: "el-2", faceFlag: true } },
+      { ...base, scope: "board" as const, reason: "illegal" as const },
+    ]) {
+      const result = planReportHold(input);
+      expect(result.ok && "deleteAt" in result.plan).toBe(false);
+    }
+  });
+
+  it("scene: hides that scene; an already hidden scene is queued only", () => {
+    expect(planReportHold({ ...base, scope: "scene", scene: { id: "sc-b", hidden: false } })).toEqual({
+      ok: true,
+      plan: { held: { elementIds: [], sceneIds: ["sc-b"], boardReview: false, storageHold: false }, severity: "normal", queuedOnly: false },
+    });
+    const hidden = planReportHold({ ...base, scope: "scene", scene: { id: "sc-hidden", hidden: true } });
+    expect(hidden.ok && hidden.plan.queuedOnly).toBe(true);
+    expect(hidden.ok && planHoldsSomething(hidden.plan.held)).toBe(false);
+  });
+
+  it("a missing target is an error, never a board-wide hold", () => {
+    expect(planReportHold({ ...base, scope: "element", element: null })).toEqual({ ok: false, error: "target_missing" });
+    expect(planReportHold({ ...base, scope: "element" })).toEqual({ ok: false, error: "target_missing" });
+    expect(planReportHold({ ...base, scope: "scene", scene: null })).toEqual({ ok: false, error: "target_missing" });
+  });
+
+  it("board + participant: every element and visible scene, board under review, no storage hold", () => {
+    const result = planReportHold({ ...base, reporterKind: "participant" });
+    expect(result).toEqual({
+      ok: true,
+      plan: {
+        held: { elementIds: ["el-1", "el-2"], sceneIds: ["sc-a", "sc-b"], boardReview: true, storageHold: false },
+        severity: "normal",
+        queuedOnly: false,
+      },
+    });
+  });
+
+  it("board + illegal from anyone: the same plus a storage hold, severity high", () => {
+    const result = planReportHold({ ...base, reason: "illegal" });
+    expect(result.ok && result.plan).toEqual({
+      held: { elementIds: ["el-1", "el-2"], sceneIds: ["sc-a", "sc-b"], boardReview: true, storageHold: true },
+      severity: "high",
+      queuedOnly: false,
+    });
+  });
+
+  it("board + visitor + another reason: nothing hidden, queued only", () => {
+    const result = planReportHold(base);
+    expect(result).toEqual({ ok: true, plan: { held: { ...NOTHING_HELD }, severity: "normal", queuedOnly: true } });
+    expect(result.ok && planHoldsSomething(result.plan.held)).toBe(false);
+  });
+
+  it("severity follows the reason alone, and illegal on a pin or a scene adds the Storage hold", () => {
+    const high = planReportHold({ ...base, scope: "element", reason: "illegal", element: { id: "el-1", faceFlag: false } });
+    expect(high.ok && high.plan.severity).toBe("high");
+    expect(high.ok && high.plan.held).toEqual({ elementIds: ["el-1"], sceneIds: ["sc-a"], boardReview: false, storageHold: true });
+    const normal = planReportHold({ ...base, scope: "element", reason: "ownership", element: { id: "el-1", faceFlag: false } });
+    expect(normal.ok && normal.plan.severity).toBe("normal");
+    expect(normal.ok && normal.plan.held.storageHold).toBe(false);
+    const scene = planReportHold({ ...base, scope: "scene", reason: "illegal", scene: { id: "sc-b", hidden: false } });
+    expect(scene.ok && scene.plan.held).toEqual({ elementIds: [], sceneIds: ["sc-b"], boardReview: false, storageHold: true });
+    // An already hidden scene reported as illegal is still listed, so its folder gets the hold (never queued only).
+    const hiddenIllegal = planReportHold({ ...base, scope: "scene", reason: "illegal", scene: { id: "sc-hidden", hidden: true } });
+    expect(hiddenIllegal.ok && hiddenIllegal.plan).toEqual({ held: { elementIds: [], sceneIds: ["sc-hidden"], boardReview: false, storageHold: true }, severity: "high", queuedOnly: false });
+  });
+});
 
 describe("boardReportRef (PIN-239)", () => {
   it("is the first 16 hex of the domain-separated sha256, so standard tools recompute it", () => {
diff --git a/src/domain/board-report.ts b/src/domain/board-report.ts
index 849e53d4..ea7904b0 100644
--- a/src/domain/board-report.ts
+++ b/src/domain/board-report.ts
@@ -1,11 +1,262 @@
 /**
- * Report-this-board link (PIN-239). Pure and client-safe: the board
- * page builds a `mailto:` to the legal contact whose subject/body
- * carry only the opaque report reference (`boardReportRef` in
- * tokens.ts, server-computed) — never the capability slug, so a
- * report never puts the board link in mail or logs. The operator
- * maps a reference back to a board with scripts/find-report-ref.mjs
- * (docs/20-abuse-runbook.md).
+ * Report & hold, the pure part (PIN-239 link, PIN-266 / PIN-268
+ * automation; `docs/adr/004-report-and-hold.md`, docs/20).
+ *
+ * A report names a scope (one element, one scene or the whole
+ * board), one reason and an optional message. `planReportHold`
+ * turns it into a HoldPlan, the decision table of ADR-004: what to
+ * hide right away (reversibly, never a delete), whether the board
+ * goes under review, whether Storage gets a temporary hold, and
+ * the one case that gets a deletion deadline (a face-flagged pin
+ * reported as someone's likeness). The server applies the plan and
+ * records what it actually held, so a dismiss can put it back.
+ *
+ * Client-safe: no I/O, no Policy import (the caller passes the two
+ * numbers it needs). The report reference (`boardReportRef` in
+ * tokens.ts) is the only board identifier that ever leaves the
+ * server: alerts, receipts and operator tooling use it, never the
+ * capability slug.
+ */
+import type { Element, Scene } from "./board";
+
+export const REPORT_REASONS = ["likeness", "inappropriate", "illegal", "ownership", "other"] as const;
+export type ReportReason = (typeof REPORT_REASONS)[number];
+
+export const REPORT_SCOPES = ["element", "scene", "board"] as const;
+export type ReportScope = (typeof REPORT_SCOPES)[number];
+
+export type ReporterKind = "participant" | "visitor";
+export type ReportStatus = "open" | "dismissed" | "takedown";
+export type ReportSeverity = "normal" | "high";
+
+/** What a report hid or locked; exactly what `dismiss` restores. */
+export interface ReportHeld {
+  elementIds: string[];
+  sceneIds: string[];
+  boardReview: boolean;
+  storageHold: boolean;
+  /**
+   * The stored objects this report put a Storage temporary hold on
+   * (unprefixed refs), recorded at hold time so a release covers
+   * exactly these, whatever happened to the records since (a taken-down
+   * pin has no record left to compute them from). Absent without a hold.
+   */
+  storageRefs?: string[];
+}
+
+export const NOTHING_HELD: Readonly<ReportHeld> = Object.freeze({
+  elementIds: [],
+  sceneIds: [],
+  boardReview: false,
+  storageHold: false,
+});
+
+/** One stored report (`reports/{id}`; the slug lives only here, server-side). */
+export interface ReportRecord {
+  id: string;
+  boardId: string;
+  /** `boardReportRef(boardId)`: the opaque id shown to people and in alerts. */
+  reference: string;
+  scope: ReportScope;
+  /** Element or scene id for a narrow scope; absent for the board. */
+  targetId?: string;
+  reason: ReportReason;
+  /** The reporter's free text (Policy `report.messageMaxChars`); stored, never logged. */
+  message?: string;
+  reporterEmail?: string;
+  reporterKind: ReporterKind;
+  severity: ReportSeverity;
+  createdAt: number;
+  status: ReportStatus;
+  /** Timed takedown deadline (face-flagged likeness only); absent otherwise. */
+  deleteAt?: number;
+  held: ReportHeld;
+  decidedAt?: number;
+  /** Operator note on the decision; never a slug. */
+  note?: string;
+  /** When this report's Storage holds were released (dismiss, or the close-out); `held.storageHold` is false from then on. */
+  holdsReleasedAt?: number;
+}
+
+export type ReportInputError = "invalid" | "message_required" | "message_too_long" | "email_invalid";
+
+/** The validated body of `POST /api/boards/<slug>/report`. */
+export interface ReportInput {
+  scope: ReportScope;
+  targetId?: string;
+  reason: ReportReason;
+  message?: string;
+  reporterEmail?: string;
+}
+
+const EMAIL_PATTERN = /^[^\s@]+@[^\s@]+\.[^\s@]+$/;
+const EMAIL_MAX_CHARS = 254;
+const TARGET_ID_PATTERN = /^[A-Za-z0-9_-]{1,64}$/;
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+
+/**
+ * Shape and size checks for the report body. A narrow scope needs a
+ * target id; `other` needs a message; the message is capped in code
+ * points by `messageMaxChars` (Policy); the email, when given, must
+ * look like one. Blank strings count as absent.
+ */
+export function parseReportInput(
+  value: unknown,
+  limits: { messageMaxChars: number },
+): { ok: true; input: ReportInput } | { ok: false; error: ReportInputError } {
+  if (!isRecord(value)) return { ok: false, error: "invalid" };
+  const scope = value.scope;
+  const reason = value.reason;
+  if (!REPORT_SCOPES.includes(scope as ReportScope)) return { ok: false, error: "invalid" };
+  if (!REPORT_REASONS.includes(reason as ReportReason)) return { ok: false, error: "invalid" };
+  const targetRaw = value.targetId;
+  let targetId: string | undefined;
+  if (scope !== "board") {
+    if (typeof targetRaw !== "string" || !TARGET_ID_PATTERN.test(targetRaw)) {
+      return { ok: false, error: "invalid" };
+    }
+    targetId = targetRaw;
+  } else if (targetRaw !== undefined && targetRaw !== null) {
+    return { ok: false, error: "invalid" };
+  }
+  const messageRaw = value.message;
+  if (messageRaw !== undefined && messageRaw !== null && typeof messageRaw !== "string") {
+    return { ok: false, error: "invalid" };
+  }
+  const message = typeof messageRaw === "string" ? messageRaw.trim() : "";
+  if (reason === "other" && message.length === 0) return { ok: false, error: "message_required" };
+  if ([...message].length > limits.messageMaxChars) return { ok: false, error: "message_too_long" };
+  const emailRaw = value.reporterEmail;
+  if (emailRaw !== undefined && emailRaw !== null && typeof emailRaw !== "string") {
+    return { ok: false, error: "invalid" };
+  }
+  const email = typeof emailRaw === "string" ? emailRaw.trim() : "";
+  if (email.length > 0 && (email.length > EMAIL_MAX_CHARS || !EMAIL_PATTERN.test(email))) {
+    return { ok: false, error: "email_invalid" };
+  }
+  return {
+    ok: true,
+    input: {
+      scope: scope as ReportScope,
+      ...(targetId ? { targetId } : {}),
+      reason: reason as ReportReason,
+      ...(message ? { message } : {}),
+      ...(email ? { reporterEmail: email } : {}),
+    },
+  };
+}
+
+export interface ReportPlanInput {
+  scope: ReportScope;
+  reason: ReportReason;
+  reporterKind: ReporterKind;
+  now: number;
+  /** Policy `takedownHours`: the deadline of the one timed takedown. */
+  takedownHours: number;
+  /** The element an element-scope report names; null when the id matched nothing. */
+  element?: Pick<Element, "id" | "faceFlag"> | null;
+  /** The scene a scene-scope report names; null when the id matched nothing. */
+  scene?: Pick<Scene, "id" | "hidden"> | null;
+  /** The board's elements and scenes (hidden ones included), for a board-scope hold and for the scenes an element hold will hide. */
+  boardElements?: Pick<Element, "id">[];
+  boardScenes?: Pick<Scene, "id" | "hidden" | "elementIds">[];
+}
+
+export interface HoldPlan {
+  held: ReportHeld;
+  severity: ReportSeverity;
+  /** Set only for a face-flagged pin reported as a likeness. */
+  deleteAt?: number;
+  /** True when nothing is hidden: the report is queued and alerted only. */
+  queuedOnly: boolean;
+}
+
+export type PlanResult = { ok: true; plan: HoldPlan } | { ok: false; error: "target_missing" };
+
+const HOUR_MS = 3_600_000;
+
+/**
+ * The ADR-004 decision table. Pure: hides and locks only, never
+ * deletes; the one deadline it sets is acted on later by the
+ * backstop, and never for `illegal`.
+ */
+export function planReportHold(input: ReportPlanInput): PlanResult {
+  const severity: ReportSeverity = input.reason === "illegal" ? "high" : "normal";
+  const scenes = input.boardScenes ?? [];
+  const visibleScenes = scenes.filter((scene) => !scene.hidden);
+
+  if (input.scope === "element") {
+    const element = input.element;
+    if (!element) return { ok: false, error: "target_missing" };
+    const sceneIds = visibleScenes
+      .filter((scene) => scene.elementIds.includes(element.id))
+      .map((scene) => scene.id);
+    const timed = input.reason === "likeness" && element.faceFlag === true;
+    // `illegal` on a pin: its objects (and its scenes') get the Storage
+    // hold too, so no later delete can free the evidence.
+    return {
+      ok: true,
+      plan: {
+        held: { elementIds: [element.id], sceneIds, boardReview: false, storageHold: severity === "high" },
+        severity,
+        ...(timed ? { deleteAt: input.now + input.takedownHours * HOUR_MS } : {}),
+        queuedOnly: false,
+      },
+    };
+  }
+
+  if (input.scope === "scene") {
+    const scene = input.scene;
+    if (!scene) return { ok: false, error: "target_missing" };
+    // An already hidden scene is queued only, unless the report says
+    // `illegal`: then it is listed all the same, so its folder gets the
+    // Storage hold and the operator's decision covers it.
+    const sceneIds = scene.hidden && severity !== "high" ? [] : [scene.id];
+    return {
+      ok: true,
+      plan: {
+        held: { elementIds: [], sceneIds, boardReview: false, storageHold: severity === "high" },
+        severity,
+        queuedOnly: sceneIds.length === 0,
+      },
+    };
+  }
+
+  // Whole board: a participant's word, or an illegal-content report
+  // from anyone, holds the board. An anonymous visitor's other
+  // reports are queued: anyone with the link can join and report,
+  // so one click must not blank a friend group's board.
+  const holds = input.reporterKind === "participant" || input.reason === "illegal";
+  if (!holds) {
+    return { ok: true, plan: { held: { ...NOTHING_HELD }, severity, queuedOnly: true } };
+  }
+  return {
+    ok: true,
+    plan: {
+      held: {
+        elementIds: (input.boardElements ?? []).map((element) => element.id),
+        sceneIds: visibleScenes.map((scene) => scene.id),
+        boardReview: true,
+        storageHold: input.reason === "illegal",
+      },
+      severity,
+      queuedOnly: false,
+    },
+  };
+}
+
+/** True when a plan hid or locked anything. */
+export function planHoldsSomething(held: ReportHeld): boolean {
+  return held.elementIds.length > 0 || held.sceneIds.length > 0 || held.boardReview || held.storageHold;
+}
+
+/**
+ * Report-this-board link (PIN-239), kept until the sheet of PIN-271
+ * replaces it: a `mailto:` to the legal contact whose subject/body
+ * carry only the opaque report reference, never the slug.
  */
 export function reportBoardHref(
   email: string | null | undefined,
diff --git a/src/domain/board-repository.contract.ts b/src/domain/board-repository.contract.ts
index 751b1eee..2cb841c1 100644
--- a/src/domain/board-repository.contract.ts
+++ b/src/domain/board-repository.contract.ts
@@ -764,6 +764,138 @@ export function describeBoardRepositoryContract(
       expect((await repo.deleteElement("ghost")).deleted).toBe(false);
     });
 
+    it("holdElement blanks the refs and hides the scenes using it; releaseElement brings both back (PIN-269)", async () => {
+      const repo = makeRepo();
+      await repo.createBoard(makeBoard());
+      await repo.createElement(makeElement());
+      await repo.createElement(makeElement({ id: "el-2", createdAt: 1_210, cutoutRef: "elements/el-2/cutout.png", flattenedRef: "elements/el-2/flat.png" }));
+      await repo.createPin(makePin({ status: "pinned" }));
+      await repo.putScene(makeScene());
+      await repo.putScene(makeScene({ id: "scene-2", elementIds: ["el-2"], createdAt: 1_410 }));
+      await repo.putScene(makeScene({ id: "scene-3", elementIds: ["el-1", "el-2"], createdAt: 1_420 }));
+      // Tombstoned by its maker before the report (PIN-142): final, whatever happens to el-1.
+      await repo.putScene(makeScene({ id: "scene-4", createdAt: 1_430, hidden: true, deletedAt: 1_500, deletedBy: "maker" }));
+
+      expect(await repo.holdElement("el-1")).toEqual({ held: true, hiddenSceneIds: ["scene-1", "scene-3"] });
+      const held = await repo.getElement("el-1");
+      expect(held?.cutoutRef).toBe("held:elements/el-1/cutout.png");
+      expect(held?.flattenedRef).toBe("held:elements/el-1/flat.png");
+      expect(held?.label).toBe("teal mug");
+      // The pin stays; only scenes leave the board.
+      expect((await repo.getPin("pin-1"))?.status).toBe("pinned");
+      expect((await repo.listScenes(SLUG)).map((s) => s.id)).toEqual(["scene-2"]);
+      expect((await repo.getBoard(SLUG))?.counters).toEqual({ participantCount: 0, elementCount: 2, pinCount: 1, sceneCount: 1 });
+      // Idempotent, and a ghost is a no-op result.
+      expect(await repo.holdElement("el-1")).toEqual({ held: true, hiddenSceneIds: [] });
+      expect(await repo.holdElement("ghost")).toEqual({ held: false, hiddenSceneIds: [] });
+
+      expect(await repo.releaseElement("el-1")).toBe(true);
+      const released = await repo.getElement("el-1");
+      expect(released?.cutoutRef).toBe("elements/el-1/cutout.png");
+      expect(released?.flattenedRef).toBe("elements/el-1/flat.png");
+      expect((await repo.listScenes(SLUG)).map((s) => s.id)).toEqual(["scene-1", "scene-2", "scene-3"]);
+      expect((await repo.getScene("scene-1"))?.hidden).toBeUndefined();
+      // The tombstone stays hidden.
+      expect((await repo.getScene("scene-4"))?.hidden).toBe(true);
+      expect((await repo.getBoard(SLUG))?.counters.sceneCount).toBe(3);
+      expect(await repo.releaseElement("ghost")).toBe(false);
+    });
+
+    it("releaseElement never resurrects a scene over a deleted, still-held or tombstoned pin (PIN-269)", async () => {
+      const repo = makeRepo();
+      await repo.createBoard(makeBoard());
+      await repo.createElement(makeElement());
+      await repo.createElement(makeElement({ id: "el-2", createdAt: 1_210, cutoutRef: "elements/el-2/cutout.png", flattenedRef: "elements/el-2/flat.png" }));
+      await repo.createElement(makeElement({ id: "el-3", createdAt: 1_220, cutoutRef: "elements/el-3/cutout.png", flattenedRef: "elements/el-3/flat.png" }));
+      await repo.putScene(makeScene({ id: "both", elementIds: ["el-1", "el-2"] }));
+      await repo.putScene(makeScene({ id: "with-deleted", elementIds: ["el-1", "el-3"], createdAt: 1_410 }));
+      await repo.putScene(makeScene({ id: "gone", elementIds: ["el-1"], createdAt: 1_420 }));
+
+      expect((await repo.holdElement("el-1")).hiddenSceneIds).toEqual(["both", "with-deleted", "gone"]);
+      // A second hold on el-2 finds "both" already hidden: nothing new.
+      expect(await repo.holdElement("el-2")).toEqual({ held: true, hiddenSceneIds: [] });
+      // el-3 is deleted for good; "gone" is tombstoned by its maker.
+      await repo.deleteElement("el-3");
+      await repo.putScene(makeScene({ id: "gone", elementIds: ["el-1"], createdAt: 1_420, hidden: true, deletedAt: 1_500, deletedBy: "maker" }));
+
+      expect(await repo.releaseElement("el-1")).toBe(true);
+      // "both" waits for el-2, "with-deleted" has lost el-3, "gone" is final.
+      expect((await repo.listScenes(SLUG)).map((s) => s.id)).toEqual([]);
+      expect((await repo.getBoard(SLUG))?.counters.sceneCount).toBe(0);
+      // Releasing el-2 restores "both" (its elements are all back), nothing else.
+      expect(await repo.releaseElement("el-2")).toBe(true);
+      expect((await repo.listScenes(SLUG)).map((s) => s.id)).toEqual(["both"]);
+      expect((await repo.getBoard(SLUG))?.counters.sceneCount).toBe(1);
+      expect((await repo.getScene("gone"))?.hidden).toBe(true);
+      expect((await repo.getScene("with-deleted"))?.hidden).toBe(true);
+    });
+
+    it("hideScene / unhideScene move one scene and its count; tombstones and held pins block the return (PIN-269)", async () => {
+      const repo = makeRepo();
+      await repo.createBoard(makeBoard());
+      await repo.createElement(makeElement());
+      await repo.putScene(makeScene());
+      await repo.putScene(makeScene({ id: "scene-2", createdAt: 1_410 }));
+
+      expect(await repo.hideScene("scene-1")).toBe(true);
+      expect(await repo.hideScene("scene-1")).toBe(false);
+      expect(await repo.hideScene("ghost")).toBe(false);
+      expect((await repo.listScenes(SLUG)).map((s) => s.id)).toEqual(["scene-2"]);
+      expect((await repo.getBoard(SLUG))?.counters.sceneCount).toBe(1);
+
+      // Held pin: the scene stays hidden until the hold is released.
+      await repo.holdElement("el-1");
+      expect(await repo.unhideScene("scene-1")).toBe(false);
+      await repo.releaseElement("el-1");
+      // releaseElement already brought scene-1 and scene-2 back.
+      expect((await repo.listScenes(SLUG)).map((s) => s.id)).toEqual(["scene-1", "scene-2"]);
+      expect(await repo.unhideScene("scene-1")).toBe(false);
+      expect(await repo.hideScene("scene-2")).toBe(true);
+      expect(await repo.unhideScene("scene-2")).toBe(true);
+      expect((await repo.getBoard(SLUG))?.counters.sceneCount).toBe(2);
+
+      // A tombstone is final (PIN-142): never unhidden.
+      await repo.putScene(makeScene({ id: "scene-3", createdAt: 1_420, hidden: true, deletedAt: 1_500, deletedBy: "host" }));
+      expect(await repo.unhideScene("scene-3")).toBe(false);
+      expect(await repo.unhideScene("ghost")).toBe(false);
+    });
+
+    it("releaseElement keeps the scenes it is told to keep hidden (a scene held by its own report, PIN-272)", async () => {
+      const repo = makeRepo();
+      await repo.createBoard(makeBoard());
+      await repo.createElement(makeElement());
+      await repo.putScene(makeScene());
+      await repo.putScene(makeScene({ id: "scene-2", createdAt: 1_410 }));
+      expect((await repo.holdElement("el-1")).hiddenSceneIds).toEqual(["scene-1", "scene-2"]);
+      expect(await repo.releaseElement("el-1", ["scene-2"])).toBe(true);
+      expect((await repo.listScenes(SLUG)).map((s) => s.id)).toEqual(["scene-1"]);
+      expect((await repo.getBoard(SLUG))?.counters.sceneCount).toBe(1);
+      // The kept scene comes back only through its own release.
+      expect(await repo.unhideScene("scene-2")).toBe(true);
+      expect((await repo.getBoard(SLUG))?.counters.sceneCount).toBe(2);
+    });
+
+    it("setBoardReview sets and clears reviewAt on a live board only; counters and version untouched (PIN-269)", async () => {
+      const repo = makeRepo();
+      await repo.createBoard(makeBoard({ version: 3 }));
+      await repo.createElement(makeElement());
+      expect(await repo.setBoardReview(SLUG, 2_000)).toBe(true);
+      const under = await repo.getBoard(SLUG);
+      expect(under?.reviewAt).toBe(2_000);
+      expect(under?.version).toBe(3);
+      expect(under?.counters.elementCount).toBe(1);
+      // The flag survives an ordinary counter write.
+      await repo.createElement(makeElement({ id: "el-2", createdAt: 1_210 }));
+      expect((await repo.getBoard(SLUG))?.reviewAt).toBe(2_000);
+      expect(await repo.setBoardReview(SLUG, null)).toBe(true);
+      const cleared = await repo.getBoard(SLUG);
+      expect(cleared?.reviewAt).toBeUndefined();
+      expect(cleared?.counters.elementCount).toBe(2);
+      expect(await repo.setBoardReview("missing", 2_000)).toBe(false);
+      await repo.deleteBoard(SLUG, 3_000);
+      expect(await repo.setBoardReview(SLUG, 2_000)).toBe(false);
+    });
+
     it("stored writes are isolated from later caller mutation", async () => {
       const repo = makeRepo();
       await repo.createBoard(makeBoard());
diff --git a/src/domain/board-repository.ts b/src/domain/board-repository.ts
index 0687c390..3a039548 100644
--- a/src/domain/board-repository.ts
+++ b/src/domain/board-repository.ts
@@ -51,15 +51,18 @@
  *   RangeError like a missing board. Its records stay readable by
  *   id and by board list (storage cleanup enumerates them).
  */
-import type {
-  Board,
-  BoardCounters,
-  BoardEvent,
-  Element,
-  Participant,
-  Pin,
-  PinStatus,
-  Scene,
+import {
+  holdRef,
+  isHeldRef,
+  releaseRef,
+  type Board,
+  type BoardCounters,
+  type BoardEvent,
+  type Element,
+  type Participant,
+  type Pin,
+  type PinStatus,
+  type Scene,
 } from "./board";
 import type { BoardThemeTokens } from "./board-themes";
 import { decideJoin, type JoinAttemptState, type JoinRateParams } from "./join-rate";
@@ -72,6 +75,13 @@ export interface DeleteElementResult {
   hiddenSceneIds: string[];
 }
 
+/** holdElement (PIN-269): `held` is false only for a missing element. */
+export interface HoldElementResult {
+  held: boolean;
+  /** Scenes this call hid (already hidden ones are not listed). */
+  hiddenSceneIds: string[];
+}
+
 /**
  * Host-editable board fields (PIN-103). Narrow on purpose: title,
  * counters and Policy overrides are not settable through it.
@@ -208,6 +218,34 @@ export interface BoardRepository {
   renameElement(elementId: string, label: string): Promise<Element | null>;
   /** Cascade delete; see the contract notes above. */
   deleteElement(elementId: string): Promise<DeleteElementResult>;
+  /**
+   * Report & hold (PIN-269, ADR-004). Keeps the element and its pins
+   * but blanks it: `held:` goes in front of both storage refs (readers
+   * serve, delete and compose only refs starting `elements/`) and every
+   * visible scene using it is hidden, counters following, in one
+   * atomic step. Idempotent: an already held element answers
+   * `held: true` with no new scenes. Missing element → `held: false`.
+   */
+  holdElement(elementId: string): Promise<HoldElementResult>;
+  /**
+   * Undo of holdElement: the refs lose the prefix, and every hidden,
+   * non-tombstoned scene using the element comes back when all of its
+   * elements exist unheld (a scene never resurrects over a deleted or
+   * still-held pin; a scene another report hid returns once that hold
+   * is released too). Scenes listed in `keepHiddenSceneIds` stay hidden
+   * whatever their pins (a scene another open report holds on its own,
+   * PIN-272). False when the element is missing.
+   */
+  releaseElement(elementId: string, keepHiddenSceneIds?: readonly string[]): Promise<boolean>;
+  /** Hide one visible scene (sceneCount follows). True only when it was visible. */
+  hideScene(sceneId: string): Promise<boolean>;
+  /** Bring back a hidden, non-tombstoned scene whose elements all exist unheld. True only when it changed. */
+  unhideScene(sceneId: string): Promise<boolean>;
+  /**
+   * Board under review (PIN-266): set or clear `Board.reviewAt`.
+   * Counters and version untouched. False for a missing or deleted board.
+   */
+  setBoardReview(slug: string, at: number | null): Promise<boolean>;
 
   /** Stores the pin; appends `pin_added` when created already pinned. */
   createPin(pin: Pin): Promise<void>;
@@ -508,6 +546,84 @@ export class InMemoryBoardRepository implements BoardRepository {
     return { deleted: true, removedPinIds, hiddenSceneIds };
   }
 
+  async holdElement(elementId: string): Promise<HoldElementResult> {
+    const element = this.elements.get(elementId);
+    if (!element) return { held: false, hiddenSceneIds: [] };
+    this.requireBoard(element.boardId);
+    this.elements.set(elementId, {
+      ...clone(element),
+      cutoutRef: holdRef(element.cutoutRef),
+      flattenedRef: holdRef(element.flattenedRef),
+    });
+    const hiddenSceneIds: string[] = [];
+    for (const scene of [...this.scenes.values()]) {
+      if (scene.hidden || !scene.elementIds.includes(elementId)) continue;
+      this.scenes.set(scene.id, { ...clone(scene), hidden: true });
+      hiddenSceneIds.push(scene.id);
+      this.adjustCounters(scene.boardId, { sceneCount: -1 });
+    }
+    return { held: true, hiddenSceneIds };
+  }
+
+  async releaseElement(elementId: string, keepHiddenSceneIds: readonly string[] = []): Promise<boolean> {
+    const element = this.elements.get(elementId);
+    if (!element) return false;
+    this.requireBoard(element.boardId);
+    this.elements.set(elementId, {
+      ...clone(element),
+      cutoutRef: releaseRef(element.cutoutRef),
+      flattenedRef: releaseRef(element.flattenedRef),
+    });
+    const keep = new Set(keepHiddenSceneIds);
+    for (const scene of [...this.scenes.values()]) {
+      if (!scene.hidden || scene.deletedAt !== undefined || !scene.elementIds.includes(elementId)) continue;
+      if (keep.has(scene.id)) continue;
+      if (this.sceneElementsAllPresent(scene)) this.unhideStored(scene);
+    }
+    return true;
+  }
+
+  async hideScene(sceneId: string): Promise<boolean> {
+    const scene = this.scenes.get(sceneId);
+    if (!scene) return false;
+    this.requireBoard(scene.boardId);
+    if (scene.hidden) return false;
+    this.scenes.set(sceneId, { ...clone(scene), hidden: true });
+    this.adjustCounters(scene.boardId, { sceneCount: -1 });
+    return true;
+  }
+
+  async unhideScene(sceneId: string): Promise<boolean> {
+    const scene = this.scenes.get(sceneId);
+    if (!scene) return false;
+    this.requireBoard(scene.boardId);
+    if (!scene.hidden || scene.deletedAt !== undefined || !this.sceneElementsAllPresent(scene)) return false;
+    this.unhideStored(scene);
+    return true;
+  }
+
+  async setBoardReview(slug: string, at: number | null): Promise<boolean> {
+    const board = this.boards.get(slug);
+    if (!board || board.deletedAt !== undefined) return false;
+    const { reviewAt: _review, ...rest } = board;
+    this.boards.set(slug, at === null ? rest : { ...rest, reviewAt: at });
+    return true;
+  }
+
+  /** Every element a scene uses exists and none is held (the unhide rule). */
+  private sceneElementsAllPresent(scene: Scene): boolean {
+    return scene.elementIds.every((id) => {
+      const element = this.elements.get(id);
+      return element !== undefined && !isHeldRef(element.cutoutRef) && !isHeldRef(element.flattenedRef);
+    });
+  }
+
+  private unhideStored(scene: Scene): void {
+    const { hidden: _hidden, ...rest } = clone(scene);
+    this.scenes.set(scene.id, rest);
+    this.adjustCounters(scene.boardId, { sceneCount: 1 });
+  }
+
   async createPin(pin: Pin): Promise<void> {
     this.requireBoard(pin.boardId);
     if (this.pins.has(pin.id)) throw new RangeError(`Pin ${pin.id} already exists`);
diff --git a/src/domain/board.ts b/src/domain/board.ts
index c0dd363b..01337c70 100644
--- a/src/domain/board.ts
+++ b/src/domain/board.ts
@@ -102,6 +102,13 @@ export interface Board {
    * every ordinary board, which the sweep therefore never sees.
    */
   demoSweepAt?: number;
+  /**
+   * Under review (PIN-266, ADR-004): set by a board-wide report hold.
+   * While present, uploads, scenes and tap-adds answer 423 and the
+   * board view says `underReview`; the operator's dismiss clears it.
+   * Counters and version are untouched by the flag.
+   */
+  reviewAt?: number;
   counters: BoardCounters;
   createdAt: number;
   version: number; // optimistic-concurrency counter
@@ -157,6 +164,28 @@ export interface Element {
   createdAt: number;
 }
 
+/**
+ * Held storage refs (docs/20 §6, automated by PIN-269): a `held:`
+ * prefix on an element's `cutoutRef` / `flattenedRef` blanks the pin
+ * without deleting anything. Every reader serves, deletes or composes
+ * a ref only when it starts with `elements/`, and the derivative store
+ * refuses a ref containing `:`, so no held bytes reach a response, a
+ * model or a collage. The prefix is reversible by design.
+ */
+export const HELD_REF_PREFIX = "held:";
+
+export function isHeldRef(ref: string): boolean {
+  return ref.startsWith(HELD_REF_PREFIX);
+}
+
+export function holdRef(ref: string): string {
+  return isHeldRef(ref) ? ref : `${HELD_REF_PREFIX}${ref}`;
+}
+
+export function releaseRef(ref: string): string {
+  return isHeldRef(ref) ? ref.slice(HELD_REF_PREFIX.length) : ref;
+}
+
 export type PinStatus = "candidate" | "pinned";
 
 export interface Pin {
diff --git a/src/domain/report-store.contract.ts b/src/domain/report-store.contract.ts
new file mode 100644
index 00000000..4440b7e8
--- /dev/null
+++ b/src/domain/report-store.contract.ts
@@ -0,0 +1,96 @@
+/**
+ * Shared ReportStore contract suite (PIN-269): run by the in-memory
+ * store and by the Firestore store against its fake.
+ */
+import { describe, expect, it } from "vitest";
+import type { ReportRecord } from "./board-report";
+import type { ReportStore } from "./report-store";
+
+function makeReport(overrides: Partial<ReportRecord> = {}): ReportRecord {
+  return {
+    id: "rep-1",
+    boardId: "board-slug-00000000001",
+    reference: "0123456789abcdef",
+    scope: "element",
+    targetId: "el-1",
+    reason: "likeness",
+    reporterKind: "visitor",
+    severity: "normal",
+    createdAt: 1_000,
+    status: "open",
+    held: { elementIds: ["el-1"], sceneIds: [], boardReview: false, storageHold: false },
+    ...overrides,
+  };
+}
+
+export function describeReportStoreContract(name: string, makeStore: () => ReportStore): void {
+  describe(`ReportStore contract: ${name}`, () => {
+    it("creates and reads back an isolated copy; a duplicate id throws", async () => {
+      const store = makeStore();
+      const record = makeReport({ message: "that is me", reporterEmail: "a@b.co", deleteAt: 5_000 });
+      await store.create(record);
+      record.message = "mutated";
+      record.held.elementIds.push("el-9");
+      const read = await store.get("rep-1");
+      expect(read).toEqual(makeReport({ message: "that is me", reporterEmail: "a@b.co", deleteAt: 5_000 }));
+      expect(await store.get("missing")).toBeNull();
+      await expect(store.create(makeReport())).rejects.toThrow(RangeError);
+    });
+
+    it("lists by reference newest first, and open reports per board oldest first", async () => {
+      const store = makeStore();
+      await store.create(makeReport({ id: "a", createdAt: 1_000 }));
+      await store.create(makeReport({ id: "b", createdAt: 3_000 }));
+      await store.create(makeReport({ id: "c", createdAt: 2_000, status: "dismissed", decidedAt: 2_500 }));
+      await store.create(makeReport({ id: "other", reference: "fedcba9876543210", boardId: "board-b", createdAt: 1_500 }));
+      expect((await store.listByReference("0123456789abcdef")).map((r) => r.id)).toEqual(["b", "c", "a"]);
+      expect((await store.listOpenForBoard("board-slug-00000000001")).map((r) => r.id)).toEqual(["a", "b"]);
+      expect((await store.listOpenForBoard("board-b")).map((r) => r.id)).toEqual(["other"]);
+      expect(await store.listOpenForBoard("nobody")).toEqual([]);
+      // Every status, oldest first: what a hold release must respect.
+      expect((await store.listForBoard("board-slug-00000000001")).map((r) => r.id)).toEqual(["a", "c", "b"]);
+      expect(await store.listForBoard("nobody")).toEqual([]);
+      // The operator's queue: open reports of every board, oldest first, capped.
+      expect((await store.listOpen(10)).map((r) => r.id)).toEqual(["a", "other", "b"]);
+      expect((await store.listOpen(2)).map((r) => r.id)).toEqual(["a", "other"]);
+      expect(await store.listOpen(0)).toEqual([]);
+    });
+
+    it("listOpenDue: open reports with a deadline before `before`, oldest deadline first, capped", async () => {
+      const store = makeStore();
+      await store.create(makeReport({ id: "late", createdAt: 1_000, deleteAt: 9_000 }));
+      await store.create(makeReport({ id: "due-2", createdAt: 1_100, deleteAt: 4_000 }));
+      await store.create(makeReport({ id: "due-1", createdAt: 1_200, deleteAt: 3_000 }));
+      await store.create(makeReport({ id: "no-deadline", createdAt: 1_300 }));
+      await store.create(makeReport({ id: "decided", createdAt: 1_400, deleteAt: 2_000, status: "takedown", decidedAt: 2_100 }));
+      expect((await store.listOpenDue(5_000, 10)).map((r) => r.id)).toEqual(["due-1", "due-2"]);
+      expect((await store.listOpenDue(5_000, 1)).map((r) => r.id)).toEqual(["due-1"]);
+      expect(await store.listOpenDue(5_000, 0)).toEqual([]);
+      expect(await store.listOpenDue(2_500, 10)).toEqual([]);
+      // A decision takes the report out of the due list for good.
+      await store.decide("due-1", { status: "dismissed", decidedAt: 3_500 });
+      expect((await store.listOpenDue(5_000, 10)).map((r) => r.id)).toEqual(["due-2"]);
+    });
+
+    it("decide closes an open report once and keeps the deadline for the record", async () => {
+      const store = makeStore();
+      await store.create(makeReport({ deleteAt: 5_000 }));
+      const decided = await store.decide("rep-1", { status: "takedown", decidedAt: 4_000, note: "confirmed" });
+      expect(decided).toEqual(makeReport({ deleteAt: 5_000, status: "takedown", decidedAt: 4_000, note: "confirmed" }));
+      expect(await store.get("rep-1")).toEqual(decided);
+      expect(await store.decide("rep-1", { status: "dismissed", decidedAt: 4_500 })).toBeNull();
+      expect((await store.get("rep-1"))?.status).toBe("takedown");
+      expect(await store.decide("missing", { status: "dismissed", decidedAt: 4_500 })).toBeNull();
+    });
+
+    it("markHoldsReleased turns the Storage hold off and stamps the time, whatever the status", async () => {
+      const store = makeStore();
+      await store.create(makeReport({ held: { elementIds: ["el-1"], sceneIds: [], boardReview: false, storageHold: true, storageRefs: ["elements/el-1/cutout.png"] } }));
+      await store.decide("rep-1", { status: "takedown", decidedAt: 4_000 });
+      const released = await store.markHoldsReleased("rep-1", 6_000);
+      expect(released).toMatchObject({ status: "takedown", holdsReleasedAt: 6_000, held: { storageHold: false, storageRefs: ["elements/el-1/cutout.png"] } });
+      expect(await store.get("rep-1")).toEqual(released);
+      expect(await store.markHoldsReleased("missing", 6_000)).toBeNull();
+    });
+  });
+}
diff --git a/src/domain/report-store.test.ts b/src/domain/report-store.test.ts
new file mode 100644
index 00000000..3f9ea8fc
--- /dev/null
+++ b/src/domain/report-store.test.ts
@@ -0,0 +1,4 @@
+import { describeReportStoreContract } from "./report-store.contract";
+import { InMemoryReportStore } from "./report-store";
+
+describeReportStoreContract("in-memory", () => new InMemoryReportStore());
diff --git a/src/domain/report-store.ts b/src/domain/report-store.ts
new file mode 100644
index 00000000..af20383f
--- /dev/null
+++ b/src/domain/report-store.ts
@@ -0,0 +1,121 @@
+/**
+ * ReportStore port (PIN-269, ADR-004): the `reports/{id}` records
+ * behind the in-app report route, the operator's decide script and
+ * the timed-takedown backstop. The in-memory implementation is the
+ * test double and the contract (`report-store.contract.ts`); the
+ * Firestore one (`src/server/firestore-report-store.ts`) passes the
+ * same suite.
+ *
+ * Contract: reads return isolated copies and writes store copies; a
+ * duplicate id throws RangeError; `listOpenDue` sees only open reports
+ * that carry a deadline, oldest deadline first; `decide` closes an open
+ * report exactly once (a second decision, or a missing id, is null).
+ */
+import type { ReportRecord, ReportStatus } from "./board-report";
+
+export interface ReportDecision {
+  status: Exclude<ReportStatus, "open">;
+  decidedAt: number;
+  /** Operator note; never a slug. */
+  note?: string;
+}
+
+export interface ReportStore {
+  create(record: ReportRecord): Promise<void>;
+  get(id: string): Promise<ReportRecord | null>;
+  /** Every report carrying this reference (one board), newest first. */
+  listByReference(reference: string): Promise<ReportRecord[]>;
+  /** Open reports on one board, oldest first. */
+  listOpenForBoard(boardId: string): Promise<ReportRecord[]>;
+  /** Every report on one board, any status, oldest first (the holds a release must respect). */
+  listForBoard(boardId: string): Promise<ReportRecord[]>;
+  /** Open reports across boards for the operator's queue, oldest first, at most `limit`. */
+  listOpen(limit: number): Promise<ReportRecord[]>;
+  /** Open reports whose `deleteAt` is before `before`, oldest deadline first, at most `limit`. */
+  listOpenDue(before: number, limit: number): Promise<ReportRecord[]>;
+  /** Close an open report; null when missing or already decided. */
+  decide(id: string, decision: ReportDecision): Promise<ReportRecord | null>;
+  /** Record that the report's Storage holds were released: `held.storageHold` false, `holdsReleasedAt` set. Null when missing. */
+  markHoldsReleased(id: string, at: number): Promise<ReportRecord | null>;
+}
+
+function clone<T>(value: T): T {
+  return structuredClone(value);
+}
+
+export class InMemoryReportStore implements ReportStore {
+  private readonly records = new Map<string, ReportRecord>();
+
+  async create(record: ReportRecord): Promise<void> {
+    if (this.records.has(record.id)) throw new RangeError(`Report ${record.id} already exists`);
+    this.records.set(record.id, clone(record));
+  }
+
+  async get(id: string): Promise<ReportRecord | null> {
+    const hit = this.records.get(id);
+    return hit ? clone(hit) : null;
+  }
+
+  async listByReference(reference: string): Promise<ReportRecord[]> {
+    return [...this.records.values()]
+      .filter((record) => record.reference === reference)
+      .sort((a, b) => b.createdAt - a.createdAt)
+      .map(clone);
+  }
+
+  async listOpenForBoard(boardId: string): Promise<ReportRecord[]> {
+    return [...this.records.values()]
+      .filter((record) => record.boardId === boardId && record.status === "open")
+      .sort((a, b) => a.createdAt - b.createdAt)
+      .map(clone);
+  }
+
+  async listForBoard(boardId: string): Promise<ReportRecord[]> {
+    return [...this.records.values()]
+      .filter((record) => record.boardId === boardId)
+      .sort((a, b) => a.createdAt - b.createdAt)
+      .map(clone);
+  }
+
+  async listOpen(limit: number): Promise<ReportRecord[]> {
+    if (limit <= 0) return [];
+    return [...this.records.values()]
+      .filter((record) => record.status === "open")
+      .sort((a, b) => a.createdAt - b.createdAt)
+      .slice(0, limit)
+      .map(clone);
+  }
+
+  async listOpenDue(before: number, limit: number): Promise<ReportRecord[]> {
+    if (limit <= 0) return [];
+    return [...this.records.values()]
+      .filter(
+        (record): record is ReportRecord & { deleteAt: number } =>
+          record.status === "open" && record.deleteAt !== undefined && record.deleteAt < before,
+      )
+      .sort((a, b) => a.deleteAt - b.deleteAt)
+      .slice(0, limit)
+      .map(clone);
+  }
+
+  async decide(id: string, decision: ReportDecision): Promise<ReportRecord | null> {
+    const current = this.records.get(id);
+    if (!current || current.status !== "open") return null;
+    const decided: ReportRecord = {
+      ...clone(current),
+      status: decision.status,
+      decidedAt: decision.decidedAt,
+      ...(decision.note !== undefined ? { note: decision.note } : {}),
+    };
+    this.records.set(id, decided);
+    return clone(decided);
+  }
+
+  async markHoldsReleased(id: string, at: number): Promise<ReportRecord | null> {
+    const current = this.records.get(id);
+    if (!current) return null;
+    const released: ReportRecord = { ...clone(current), held: { ...clone(current.held), storageHold: false }, holdsReleasedAt: at };
+    this.records.set(id, released);
+    return clone(released);
+  }
+}
diff --git a/src/i18n/messages/de.json b/src/i18n/messages/de.json
index b9d8d454..227b82b5 100644
--- a/src/i18n/messages/de.json
+++ b/src/i18n/messages/de.json
@@ -232,6 +232,12 @@
   "request.joinBeforePhoto": "Tritt dieser Pinnwand bei, bevor du ein Foto hinzufügst.",
   "request.addPhotoFailed": "Dieses Foto konnte nicht hinzugefügt werden. Bitte versuch es nochmal.",
   "request.photoTooLarge": "Dieses Foto ist zu groß. Bleib unter {max} MB.",
+  "request.reportInvalid": "Wähle aus, was du melden willst und warum.",
+  "request.reportMessageRequired": "Sag uns in wenigen Worten, was nicht stimmt.",
+  "request.reportMessageTooLong": "Halte deine Nachricht unter {max} Zeichen.",
+  "request.reportEmailInvalid": "Diese E-Mail-Adresse sieht nicht richtig aus.",
+  "request.reportFailed": "Diese Meldung konnte nicht gesendet werden. Bitte versuche es erneut.",
+  "request.boardUnderReview": "Diese Pinnwand ist pausiert, während wir eine Meldung prüfen.",
   "add.title": "Foto hinzufügen",
   "add.pick": "Foto aufnehmen oder auswählen",
   "add.takePhoto": "Foto aufnehmen",
@@ -264,11 +270,34 @@
   "board.joinFirst": "Füg deinen Namen hinzu, damit alle wissen, was deins ist.",
   "board.loadError": "Pinnwand konnte nicht geladen werden. Prüfe deine Verbindung.",
   "board.report": "Diese Pinnwand melden",
+  "board.reportAddress": "E-Mail",
+  "board.reportRef": "Pinnwand-Referenz",
   "board.reportSubject": "Pinnwand melden ({ref})",
   "board.reportBody": "Pinnwand-Referenz: {ref}\n\nWorauf sollen wir achten? Beschreibe das Foto, den Pin oder die Szene. Bitte keine illegalen Bilder anhängen oder senden.",
   "board.reportManual": "Keine Mail-App? Schreib an diese Adresse und gib die Pinnwand-Referenz an.",
-  "board.reportAddress": "E-Mail",
-  "board.reportRef": "Pinnwand-Referenz",
+  "board.reportTitle": "Meldung",
+  "board.reportScopeLabel": "Was",
+  "board.reportScopeBoard": "Diese Pinnwand",
+  "board.reportScopeScene": "Szene {n}",
+  "board.reportReasonLabel": "Warum",
+  "board.reportReason.likeness": "Das bin ich oder jemand ohne Zustimmung",
+  "board.reportReason.inappropriate": "Unangemessen",
+  "board.reportReason.illegal": "Illegal oder mit Minderjährigen",
+  "board.reportReason.ownership": "Nicht zum Teilen freigegeben",
+  "board.reportReason.other": "Etwas anderes",
+  "board.reportMessage": "Worauf sollen wir achten?",
+  "board.reportMessageHelp": "Ein paar Worte helfen uns bei der Entscheidung. Sende niemals Bilder.",
+  "board.reportEmail": "Deine E-Mail (optional)",
+  "board.reportEmailHelp": "Nur um dir mitzuteilen, was wir entschieden haben.",
+  "board.reportSend": "Meldung senden",
+  "board.reportSending": "Wird gesendet…",
+  "board.reportCancel": "Abbrechen",
+  "board.reportClose": "Schließen",
+  "board.reportDone": "Fertig",
+  "board.reportHeld": "Ausgeblendet, während wir prüfen. Deine Referenz: {ref}",
+  "board.reportReceived": "Meldung erhalten. Wir schauen es uns an. Deine Referenz: {ref}",
+  "board.reportFollowUp": "Fragen zu einer Meldung? Schreib an diese Adresse und gib die Referenz an:",
+  "board.underReviewNotice": "Diese Pinnwand ist pausiert, während wir eine Meldung prüfen.",
   "make.title": "Szene erstellen",
   "make.pickHint": "Wähl Pins auf der Pinnwand",
   "make.idea": "Deine Idee",
diff --git a/src/i18n/messages/de.lock.json b/src/i18n/messages/de.lock.json
index 89c774d8..ce488387 100644
--- a/src/i18n/messages/de.lock.json
+++ b/src/i18n/messages/de.lock.json
@@ -236,6 +236,12 @@
     "request.joinBeforePhoto": "aab76d9df48d0e99",
     "request.addPhotoFailed": "bcd9158b344dc05b",
     "request.photoTooLarge": "5cd5535bedfbe644",
+    "request.reportInvalid": "75ced24b276cd25c",
+    "request.reportMessageRequired": "601ee70a3c206478",
+    "request.reportMessageTooLong": "ad00cd34acee6aaf",
+    "request.reportEmailInvalid": "518710625cda91c8",
+    "request.reportFailed": "bb4c2dfb0b3c402a",
+    "request.boardUnderReview": "f96f3142f35ca0b1",
     "add.title": "787d8913e7221b88",
     "add.pick": "e516b916371de9c5",
     "add.takePhoto": "f3ff70e1103d5024",
@@ -268,11 +274,34 @@
     "board.joinFirst": "c090c7e86973f7e5",
     "board.loadError": "abafbe13160bf559",
     "board.report": "46331d9a56fac01b",
+    "board.reportAddress": "9c155f23a73dd738",
+    "board.reportRef": "75bc527240db7afc",
     "board.reportSubject": "006f71019af5f968",
     "board.reportBody": "43b0b87ccd2400d0",
     "board.reportManual": "7b8b7727953020e9",
-    "board.reportAddress": "9c155f23a73dd738",
-    "board.reportRef": "75bc527240db7afc",
+    "board.reportTitle": "18bfc4b505b2ed6f",
+    "board.reportScopeLabel": "6ff71379727be61c",
+    "board.reportScopeBoard": "950bad600ad8705c",
+    "board.reportScopeScene": "0ddfb2b6ad4dc883",
+    "board.reportReasonLabel": "f71e8e464b7c8f18",
+    "board.reportReason.likeness": "597ed5829d3a4fbf",
+    "board.reportReason.inappropriate": "6a69fa6bb360a7f3",
+    "board.reportReason.illegal": "46d2a9656152ab1a",
+    "board.reportReason.ownership": "5bf4df49175410ac",
+    "board.reportReason.other": "13677f691505b3c9",
+    "board.reportMessage": "025ec218811b8b9e",
+    "board.reportMessageHelp": "8d0f7f657c413a8b",
+    "board.reportEmail": "3a9d86c7125733ed",
+    "board.reportEmailHelp": "d228459651482723",
+    "board.reportSend": "c2b4a98ece281d51",
+    "board.reportSending": "6403b88b9c432d60",
+    "board.reportCancel": "80d4e90ec5dfc046",
+    "board.reportClose": "4bf7f68d2c68166f",
+    "board.reportDone": "67f787692773bd8e",
+    "board.reportHeld": "da8ea2d2313c8bcc",
+    "board.reportReceived": "40fc7ed20d3c9be8",
+    "board.reportFollowUp": "d927818d772d2f3f",
+    "board.underReviewNotice": "f96f3142f35ca0b1",
     "make.title": "8fcaf2e503b3bfc2",
     "make.pickHint": "34ae06f27d25982f",
     "make.idea": "1196ca8162e0b6b2",
diff --git a/src/i18n/messages/en.json b/src/i18n/messages/en.json
index 5c9c9449..fc57fa94 100644
--- a/src/i18n/messages/en.json
+++ b/src/i18n/messages/en.json
@@ -232,6 +232,12 @@
   "request.joinBeforePhoto": "Join this board before adding a photo.",
   "request.addPhotoFailed": "That photo could not be added. Please try again.",
   "request.photoTooLarge": "That photo is too large. Keep it under {max} MB.",
+  "request.reportInvalid": "Pick what to report and why.",
+  "request.reportMessageRequired": "Tell us what is wrong in a few words.",
+  "request.reportMessageTooLong": "Keep your message under {max} characters.",
+  "request.reportEmailInvalid": "That email address does not look right.",
+  "request.reportFailed": "That report could not be sent. Please try again.",
+  "request.boardUnderReview": "This board is paused while we check a report.",
   "add.title": "Add a photo",
   "add.pick": "Take or pick a photo",
   "add.takePhoto": "Take photo",
@@ -264,11 +270,34 @@
   "board.joinFirst": "Add your name so people know what's yours.",
   "board.loadError": "Couldn't load the board. Check your connection.",
   "board.report": "Report this board",
+  "board.reportAddress": "Email",
+  "board.reportRef": "Board reference",
   "board.reportSubject": "Report a board ({ref})",
   "board.reportBody": "Board reference: {ref}\n\nWhat should we look at? Describe the photo, pin or scene. Please do not attach or send illegal images.",
   "board.reportManual": "No mail app? Write to this address and include the board reference.",
-  "board.reportAddress": "Email",
-  "board.reportRef": "Board reference",
+  "board.reportTitle": "Report",
+  "board.reportScopeLabel": "What",
+  "board.reportScopeBoard": "This board",
+  "board.reportScopeScene": "Scene {n}",
+  "board.reportReasonLabel": "Why",
+  "board.reportReason.likeness": "That's me, or someone who didn't agree",
+  "board.reportReason.inappropriate": "Inappropriate",
+  "board.reportReason.illegal": "Illegal, or involves a minor",
+  "board.reportReason.ownership": "Not theirs to share",
+  "board.reportReason.other": "Something else",
+  "board.reportMessage": "What should we look at?",
+  "board.reportMessageHelp": "A few words help us decide. Never send images.",
+  "board.reportEmail": "Your email (optional)",
+  "board.reportEmailHelp": "Only to tell you what we decided.",
+  "board.reportSend": "Send report",
+  "board.reportSending": "Sending…",
+  "board.reportCancel": "Cancel",
+  "board.reportClose": "Close",
+  "board.reportDone": "Done",
+  "board.reportHeld": "Hidden while we check. Your reference: {ref}",
+  "board.reportReceived": "Received. We'll take a look. Your reference: {ref}",
+  "board.reportFollowUp": "Questions about a report? Write to this address and quote the reference:",
+  "board.underReviewNotice": "This board is paused while we check a report.",
   "make.title": "Make a scene",
   "make.pickHint": "Pick pins on the board",
   "make.idea": "Your idea",
diff --git a/src/i18n/messages/es.json b/src/i18n/messages/es.json
index 2b10a075..ac720337 100644
--- a/src/i18n/messages/es.json
+++ b/src/i18n/messages/es.json
@@ -232,6 +232,12 @@
   "request.joinBeforePhoto": "Únete a este tablero antes de agregar una foto.",
   "request.addPhotoFailed": "No se pudo agregar esa foto. Intenta de nuevo.",
   "request.photoTooLarge": "Esa foto es demasiado grande. Mantenla por debajo de {max} MB.",
+  "request.reportInvalid": "Elige qué reportar y por qué.",
+  "request.reportMessageRequired": "Cuéntanos en pocas palabras qué está mal.",
+  "request.reportMessageTooLong": "Tu mensaje debe tener menos de {max} caracteres.",
+  "request.reportEmailInvalid": "Esa dirección de correo no parece válida.",
+  "request.reportFailed": "No se pudo enviar el reporte. Intenta de nuevo.",
+  "request.boardUnderReview": "Este tablero está en pausa mientras revisamos un reporte.",
   "add.title": "Agrega una foto",
   "add.pick": "Toma o elige una foto",
   "add.takePhoto": "Tomar foto",
@@ -264,11 +270,34 @@
   "board.joinFirst": "Agrega tu nombre para que sepan qué es tuyo.",
   "board.loadError": "No se pudo cargar el tablero. Revisa tu conexión.",
   "board.report": "Reportar este tablero",
+  "board.reportAddress": "Correo electrónico",
+  "board.reportRef": "Referencia del tablero",
   "board.reportSubject": "Reportar un tablero ({ref})",
   "board.reportBody": "Referencia del tablero: {ref}\n\n¿Qué debemos revisar? Describe la foto, pin o escena. Por favor no adjuntes ni envíes imágenes ilegales.",
   "board.reportManual": "¿No tienes app de correo? Escribe a esta dirección e incluye la referencia del tablero.",
-  "board.reportAddress": "Correo electrónico",
-  "board.reportRef": "Referencia del tablero",
+  "board.reportTitle": "Reporte",
+  "board.reportScopeLabel": "Qué",
+  "board.reportScopeBoard": "Este tablero",
+  "board.reportScopeScene": "Escena {n}",
+  "board.reportReasonLabel": "Por qué",
+  "board.reportReason.likeness": "Soy yo, o alguien que no dio permiso",
+  "board.reportReason.inappropriate": "Inapropiado",
+  "board.reportReason.illegal": "Ilegal o involucra a un menor",
+  "board.reportReason.ownership": "No es suyo para compartir",
+  "board.reportReason.other": "Otra cosa",
+  "board.reportMessage": "¿Qué debemos revisar?",
+  "board.reportMessageHelp": "Unas palabras nos ayudan a decidir. Nunca envíes imágenes.",
+  "board.reportEmail": "Tu correo (opcional)",
+  "board.reportEmailHelp": "Solo para contarte qué decidimos.",
+  "board.reportSend": "Enviar reporte",
+  "board.reportSending": "Enviando…",
+  "board.reportCancel": "Cancelar",
+  "board.reportClose": "Cerrar",
+  "board.reportDone": "Listo",
+  "board.reportHeld": "Oculto mientras revisamos. Tu referencia: {ref}",
+  "board.reportReceived": "Recibido. Lo revisaremos. Tu referencia: {ref}",
+  "board.reportFollowUp": "¿Dudas sobre un reporte? Escríbenos a esta dirección y menciona la referencia:",
+  "board.underReviewNotice": "Este tablero está en pausa mientras revisamos un reporte.",
   "make.title": "Crea una escena",
   "make.pickHint": "Elige pins del tablero",
   "make.idea": "Tu idea",
diff --git a/src/i18n/messages/es.lock.json b/src/i18n/messages/es.lock.json
index 89c774d8..ce488387 100644
--- a/src/i18n/messages/es.lock.json
+++ b/src/i18n/messages/es.lock.json
@@ -236,6 +236,12 @@
     "request.joinBeforePhoto": "aab76d9df48d0e99",
     "request.addPhotoFailed": "bcd9158b344dc05b",
     "request.photoTooLarge": "5cd5535bedfbe644",
+    "request.reportInvalid": "75ced24b276cd25c",
+    "request.reportMessageRequired": "601ee70a3c206478",
+    "request.reportMessageTooLong": "ad00cd34acee6aaf",
+    "request.reportEmailInvalid": "518710625cda91c8",
+    "request.reportFailed": "bb4c2dfb0b3c402a",
+    "request.boardUnderReview": "f96f3142f35ca0b1",
     "add.title": "787d8913e7221b88",
     "add.pick": "e516b916371de9c5",
     "add.takePhoto": "f3ff70e1103d5024",
@@ -268,11 +274,34 @@
     "board.joinFirst": "c090c7e86973f7e5",
     "board.loadError": "abafbe13160bf559",
     "board.report": "46331d9a56fac01b",
+    "board.reportAddress": "9c155f23a73dd738",
+    "board.reportRef": "75bc527240db7afc",
     "board.reportSubject": "006f71019af5f968",
     "board.reportBody": "43b0b87ccd2400d0",
     "board.reportManual": "7b8b7727953020e9",
-    "board.reportAddress": "9c155f23a73dd738",
-    "board.reportRef": "75bc527240db7afc",
+    "board.reportTitle": "18bfc4b505b2ed6f",
+    "board.reportScopeLabel": "6ff71379727be61c",
+    "board.reportScopeBoard": "950bad600ad8705c",
+    "board.reportScopeScene": "0ddfb2b6ad4dc883",
+    "board.reportReasonLabel": "f71e8e464b7c8f18",
+    "board.reportReason.likeness": "597ed5829d3a4fbf",
+    "board.reportReason.inappropriate": "6a69fa6bb360a7f3",
+    "board.reportReason.illegal": "46d2a9656152ab1a",
+    "board.reportReason.ownership": "5bf4df49175410ac",
+    "board.reportReason.other": "13677f691505b3c9",
+    "board.reportMessage": "025ec218811b8b9e",
+    "board.reportMessageHelp": "8d0f7f657c413a8b",
+    "board.reportEmail": "3a9d86c7125733ed",
+    "board.reportEmailHelp": "d228459651482723",
+    "board.reportSend": "c2b4a98ece281d51",
+    "board.reportSending": "6403b88b9c432d60",
+    "board.reportCancel": "80d4e90ec5dfc046",
+    "board.reportClose": "4bf7f68d2c68166f",
+    "board.reportDone": "67f787692773bd8e",
+    "board.reportHeld": "da8ea2d2313c8bcc",
+    "board.reportReceived": "40fc7ed20d3c9be8",
+    "board.reportFollowUp": "d927818d772d2f3f",
+    "board.underReviewNotice": "f96f3142f35ca0b1",
     "make.title": "8fcaf2e503b3bfc2",
     "make.pickHint": "34ae06f27d25982f",
     "make.idea": "1196ca8162e0b6b2",
diff --git a/src/i18n/messages/fr.json b/src/i18n/messages/fr.json
index 03dbf92b..95b3d965 100644
--- a/src/i18n/messages/fr.json
+++ b/src/i18n/messages/fr.json
@@ -232,6 +232,12 @@
   "request.joinBeforePhoto": "Rejoins ce tableau avant d'ajouter une photo.",
   "request.addPhotoFailed": "Impossible d'ajouter cette photo. Réessaie.",
   "request.photoTooLarge": "Cette photo est trop grande. Garde-la sous {max} Mo.",
+  "request.reportInvalid": "Choisis quoi signaler et pourquoi.",
+  "request.reportMessageRequired": "Dis-nous ce qui ne va pas en quelques mots.",
+  "request.reportMessageTooLong": "Garde ton message sous {max} caractères.",
+  "request.reportEmailInvalid": "Cette adresse e-mail n'a pas l'air correcte.",
+  "request.reportFailed": "Ce signalement n'a pas pu être envoyé. Réessaie.",
+  "request.boardUnderReview": "Ce tableau est en pause le temps qu'on vérifie un signalement.",
   "add.title": "Ajouter une photo",
   "add.pick": "Prends ou choisis une photo",
   "add.takePhoto": "Prendre une photo",
@@ -264,11 +270,34 @@
   "board.joinFirst": "Ajoute ton nom pour qu'on sache ce qui est à toi.",
   "board.loadError": "Impossible de charger le tableau. Vérifie ta connexion.",
   "board.report": "Signaler ce tableau",
+  "board.reportAddress": "E-mail",
+  "board.reportRef": "Référence du tableau",
   "board.reportSubject": "Signaler un tableau ({ref})",
   "board.reportBody": "Référence du tableau : {ref}\n\nQue devons-nous vérifier ? Décris la photo, l'épingle ou la scène. Merci de ne pas joindre ni envoyer d'images illégales.",
   "board.reportManual": "Pas d'appli mail ? Écris à cette adresse en indiquant la référence du tableau.",
-  "board.reportAddress": "E-mail",
-  "board.reportRef": "Référence du tableau",
+  "board.reportTitle": "Signaler",
+  "board.reportScopeLabel": "Quoi",
+  "board.reportScopeBoard": "Ce tableau",
+  "board.reportScopeScene": "Scène {n}",
+  "board.reportReasonLabel": "Pourquoi",
+  "board.reportReason.likeness": "C'est moi, ou quelqu'un qui n'a pas donné son accord",
+  "board.reportReason.inappropriate": "Inapproprié",
+  "board.reportReason.illegal": "Illégal, ou implique un mineur",
+  "board.reportReason.ownership": "Ce n'est pas à eux de partager",
+  "board.reportReason.other": "Autre chose",
+  "board.reportMessage": "Que doit-on regarder ?",
+  "board.reportMessageHelp": "Quelques mots nous aident à décider. N'envoie jamais d'images.",
+  "board.reportEmail": "Ton e-mail (facultatif)",
+  "board.reportEmailHelp": "Juste pour te dire ce qu'on a décidé.",
+  "board.reportSend": "Envoyer le signalement",
+  "board.reportSending": "Envoi en cours…",
+  "board.reportCancel": "Annuler",
+  "board.reportClose": "Fermer",
+  "board.reportDone": "Terminé",
+  "board.reportHeld": "Masqué le temps qu'on vérifie. Ta référence : {ref}",
+  "board.reportReceived": "Reçu. On va regarder. Ta référence : {ref}",
+  "board.reportFollowUp": "Des questions sur un signalement ? Écris à cette adresse en indiquant la référence :",
+  "board.underReviewNotice": "Ce tableau est en pause le temps qu'on vérifie un signalement.",
   "make.title": "Créer une scène",
   "make.pickHint": "Choisis des épingles sur le tableau",
   "make.idea": "Ton idée",
diff --git a/src/i18n/messages/fr.lock.json b/src/i18n/messages/fr.lock.json
index 89c774d8..ce488387 100644
--- a/src/i18n/messages/fr.lock.json
+++ b/src/i18n/messages/fr.lock.json
@@ -236,6 +236,12 @@
     "request.joinBeforePhoto": "aab76d9df48d0e99",
     "request.addPhotoFailed": "bcd9158b344dc05b",
     "request.photoTooLarge": "5cd5535bedfbe644",
+    "request.reportInvalid": "75ced24b276cd25c",
+    "request.reportMessageRequired": "601ee70a3c206478",
+    "request.reportMessageTooLong": "ad00cd34acee6aaf",
+    "request.reportEmailInvalid": "518710625cda91c8",
+    "request.reportFailed": "bb4c2dfb0b3c402a",
+    "request.boardUnderReview": "f96f3142f35ca0b1",
     "add.title": "787d8913e7221b88",
     "add.pick": "e516b916371de9c5",
     "add.takePhoto": "f3ff70e1103d5024",
@@ -268,11 +274,34 @@
     "board.joinFirst": "c090c7e86973f7e5",
     "board.loadError": "abafbe13160bf559",
     "board.report": "46331d9a56fac01b",
+    "board.reportAddress": "9c155f23a73dd738",
+    "board.reportRef": "75bc527240db7afc",
     "board.reportSubject": "006f71019af5f968",
     "board.reportBody": "43b0b87ccd2400d0",
     "board.reportManual": "7b8b7727953020e9",
-    "board.reportAddress": "9c155f23a73dd738",
-    "board.reportRef": "75bc527240db7afc",
+    "board.reportTitle": "18bfc4b505b2ed6f",
+    "board.reportScopeLabel": "6ff71379727be61c",
+    "board.reportScopeBoard": "950bad600ad8705c",
+    "board.reportScopeScene": "0ddfb2b6ad4dc883",
+    "board.reportReasonLabel": "f71e8e464b7c8f18",
+    "board.reportReason.likeness": "597ed5829d3a4fbf",
+    "board.reportReason.inappropriate": "6a69fa6bb360a7f3",
+    "board.reportReason.illegal": "46d2a9656152ab1a",
+    "board.reportReason.ownership": "5bf4df49175410ac",
+    "board.reportReason.other": "13677f691505b3c9",
+    "board.reportMessage": "025ec218811b8b9e",
+    "board.reportMessageHelp": "8d0f7f657c413a8b",
+    "board.reportEmail": "3a9d86c7125733ed",
+    "board.reportEmailHelp": "d228459651482723",
+    "board.reportSend": "c2b4a98ece281d51",
+    "board.reportSending": "6403b88b9c432d60",
+    "board.reportCancel": "80d4e90ec5dfc046",
+    "board.reportClose": "4bf7f68d2c68166f",
+    "board.reportDone": "67f787692773bd8e",
+    "board.reportHeld": "da8ea2d2313c8bcc",
+    "board.reportReceived": "40fc7ed20d3c9be8",
+    "board.reportFollowUp": "d927818d772d2f3f",
+    "board.underReviewNotice": "f96f3142f35ca0b1",
     "make.title": "8fcaf2e503b3bfc2",
     "make.pickHint": "34ae06f27d25982f",
     "make.idea": "1196ca8162e0b6b2",
diff --git a/src/i18n/messages/id.json b/src/i18n/messages/id.json
index 387186f0..2506c09e 100644
--- a/src/i18n/messages/id.json
+++ b/src/i18n/messages/id.json
@@ -232,6 +232,12 @@
   "request.joinBeforePhoto": "Gabung papan ini dulu sebelum menambah foto.",
   "request.addPhotoFailed": "Foto itu tidak bisa ditambahkan. Coba lagi ya.",
   "request.photoTooLarge": "Foto itu terlalu besar. Pastikan di bawah {max} MB.",
+  "request.reportInvalid": "Pilih apa yang mau kamu laporkan dan kenapa.",
+  "request.reportMessageRequired": "Ceritakan apa yang salah dengan beberapa kata.",
+  "request.reportMessageTooLong": "Buat pesanmu di bawah {max} karakter ya.",
+  "request.reportEmailInvalid": "Alamat email itu sepertinya salah.",
+  "request.reportFailed": "Laporan tidak bisa dikirim. Coba lagi ya.",
+  "request.boardUnderReview": "Papan ini dijeda sementara kami cek laporan.",
   "add.title": "Tambah foto",
   "add.pick": "Ambil atau pilih foto",
   "add.takePhoto": "Ambil foto",
@@ -264,11 +270,34 @@
   "board.joinFirst": "Tambahkan namamu biar orang tahu mana punyamu.",
   "board.loadError": "Papan tidak bisa dimuat. Cek koneksimu.",
   "board.report": "Laporkan papan ini",
+  "board.reportAddress": "Email",
+  "board.reportRef": "Referensi papan",
   "board.reportSubject": "Laporkan papan ({ref})",
   "board.reportBody": "Referensi papan: {ref}\n\nApa yang perlu kami cek? Jelaskan foto, pin, atau adegannya. Jangan lampirkan atau kirim gambar ilegal ya.",
   "board.reportManual": "Nggak ada aplikasi email? Tulis ke alamat ini dan sertakan referensi papannya.",
-  "board.reportAddress": "Email",
-  "board.reportRef": "Referensi papan",
+  "board.reportTitle": "Laporan",
+  "board.reportScopeLabel": "Apa",
+  "board.reportScopeBoard": "Papan ini",
+  "board.reportScopeScene": "Adegan {n}",
+  "board.reportReasonLabel": "Kenapa",
+  "board.reportReason.likeness": "Itu aku, atau seseorang yang tidak setuju",
+  "board.reportReason.inappropriate": "Tidak pantas",
+  "board.reportReason.illegal": "Ilegal, atau melibatkan anak di bawah umur",
+  "board.reportReason.ownership": "Bukan miliknya untuk dibagikan",
+  "board.reportReason.other": "Lainnya",
+  "board.reportMessage": "Apa yang perlu kami cek?",
+  "board.reportMessageHelp": "Beberapa kata bantu kami memutuskan. Jangan kirim gambar ya.",
+  "board.reportEmail": "Email kamu (opsional)",
+  "board.reportEmailHelp": "Hanya untuk mengabari keputusan kami.",
+  "board.reportSend": "Kirim laporan",
+  "board.reportSending": "Mengirim…",
+  "board.reportCancel": "Batal",
+  "board.reportClose": "Tutup",
+  "board.reportDone": "Selesai",
+  "board.reportHeld": "Disembunyikan sementara kami cek. Referensimu: {ref}",
+  "board.reportReceived": "Diterima. Akan kami cek. Referensimu: {ref}",
+  "board.reportFollowUp": "Ada pertanyaan soal laporan? Tulis ke alamat ini dan cantumkan referensi:",
+  "board.underReviewNotice": "Papan ini dijeda sementara kami cek laporan.",
   "make.title": "Buat adegan",
   "make.pickHint": "Pilih pin di papan",
   "make.idea": "Idemu",
diff --git a/src/i18n/messages/id.lock.json b/src/i18n/messages/id.lock.json
index 89c774d8..ce488387 100644
--- a/src/i18n/messages/id.lock.json
+++ b/src/i18n/messages/id.lock.json
@@ -236,6 +236,12 @@
     "request.joinBeforePhoto": "aab76d9df48d0e99",
     "request.addPhotoFailed": "bcd9158b344dc05b",
     "request.photoTooLarge": "5cd5535bedfbe644",
+    "request.reportInvalid": "75ced24b276cd25c",
+    "request.reportMessageRequired": "601ee70a3c206478",
+    "request.reportMessageTooLong": "ad00cd34acee6aaf",
+    "request.reportEmailInvalid": "518710625cda91c8",
+    "request.reportFailed": "bb4c2dfb0b3c402a",
+    "request.boardUnderReview": "f96f3142f35ca0b1",
     "add.title": "787d8913e7221b88",
     "add.pick": "e516b916371de9c5",
     "add.takePhoto": "f3ff70e1103d5024",
@@ -268,11 +274,34 @@
     "board.joinFirst": "c090c7e86973f7e5",
     "board.loadError": "abafbe13160bf559",
     "board.report": "46331d9a56fac01b",
+    "board.reportAddress": "9c155f23a73dd738",
+    "board.reportRef": "75bc527240db7afc",
     "board.reportSubject": "006f71019af5f968",
     "board.reportBody": "43b0b87ccd2400d0",
     "board.reportManual": "7b8b7727953020e9",
-    "board.reportAddress": "9c155f23a73dd738",
-    "board.reportRef": "75bc527240db7afc",
+    "board.reportTitle": "18bfc4b505b2ed6f",
+    "board.reportScopeLabel": "6ff71379727be61c",
+    "board.reportScopeBoard": "950bad600ad8705c",
+    "board.reportScopeScene": "0ddfb2b6ad4dc883",
+    "board.reportReasonLabel": "f71e8e464b7c8f18",
+    "board.reportReason.likeness": "597ed5829d3a4fbf",
+    "board.reportReason.inappropriate": "6a69fa6bb360a7f3",
+    "board.reportReason.illegal": "46d2a9656152ab1a",
+    "board.reportReason.ownership": "5bf4df49175410ac",
+    "board.reportReason.other": "13677f691505b3c9",
+    "board.reportMessage": "025ec218811b8b9e",
+    "board.reportMessageHelp": "8d0f7f657c413a8b",
+    "board.reportEmail": "3a9d86c7125733ed",
+    "board.reportEmailHelp": "d228459651482723",
+    "board.reportSend": "c2b4a98ece281d51",
+    "board.reportSending": "6403b88b9c432d60",
+    "board.reportCancel": "80d4e90ec5dfc046",
+    "board.reportClose": "4bf7f68d2c68166f",
+    "board.reportDone": "67f787692773bd8e",
+    "board.reportHeld": "da8ea2d2313c8bcc",
+    "board.reportReceived": "40fc7ed20d3c9be8",
+    "board.reportFollowUp": "d927818d772d2f3f",
+    "board.underReviewNotice": "f96f3142f35ca0b1",
     "make.title": "8fcaf2e503b3bfc2",
     "make.pickHint": "34ae06f27d25982f",
     "make.idea": "1196ca8162e0b6b2",
diff --git a/src/i18n/messages/it.json b/src/i18n/messages/it.json
index 67b5cf08..928e31c2 100644
--- a/src/i18n/messages/it.json
+++ b/src/i18n/messages/it.json
@@ -232,6 +232,12 @@
   "request.joinBeforePhoto": "Unisciti a questa bacheca prima di aggiungere una foto.",
   "request.addPhotoFailed": "Impossibile aggiungere quella foto. Riprova.",
   "request.photoTooLarge": "Quella foto è troppo grande. Tienila sotto {max} MB.",
+  "request.reportInvalid": "Scegli cosa segnalare e perché.",
+  "request.reportMessageRequired": "Dicci in poche parole cosa non va.",
+  "request.reportMessageTooLong": "Mantieni il messaggio sotto i {max} caratteri.",
+  "request.reportEmailInvalid": "Quell'indirizzo email non sembra corretto.",
+  "request.reportFailed": "Segnalazione non inviata. Riprova.",
+  "request.boardUnderReview": "Questa bacheca è in pausa mentre controlliamo una segnalazione.",
   "add.title": "Aggiungi una foto",
   "add.pick": "Scatta o scegli una foto",
   "add.takePhoto": "Scatta una foto",
@@ -264,11 +270,34 @@
   "board.joinFirst": "Aggiungi il tuo nome così sanno cos'è tuo.",
   "board.loadError": "Impossibile caricare la bacheca. Controlla la connessione.",
   "board.report": "Segnala questa bacheca",
+  "board.reportAddress": "Email",
+  "board.reportRef": "Riferimento bacheca",
   "board.reportSubject": "Segnala una bacheca ({ref})",
   "board.reportBody": "Riferimento bacheca: {ref}\n\nCosa dobbiamo controllare? Descrivi la foto, il pin o la scena. Non allegare o inviare immagini illegali.",
   "board.reportManual": "Niente app di posta? Scrivi a questo indirizzo e includi il riferimento della bacheca.",
-  "board.reportAddress": "Email",
-  "board.reportRef": "Riferimento bacheca",
+  "board.reportTitle": "Segnala",
+  "board.reportScopeLabel": "Cosa",
+  "board.reportScopeBoard": "Questa bacheca",
+  "board.reportScopeScene": "Scena {n}",
+  "board.reportReasonLabel": "Perché",
+  "board.reportReason.likeness": "Sono io, o qualcuno che non ha dato il consenso",
+  "board.reportReason.inappropriate": "Inappropriato",
+  "board.reportReason.illegal": "Illegale o coinvolge un minore",
+  "board.reportReason.ownership": "Non è loro da condividere",
+  "board.reportReason.other": "Altro",
+  "board.reportMessage": "Cosa dovremmo controllare?",
+  "board.reportMessageHelp": "Bastano poche parole per aiutarci a decidere. Non inviare mai immagini.",
+  "board.reportEmail": "La tua email (facoltativa)",
+  "board.reportEmailHelp": "Solo per dirti cosa abbiamo deciso.",
+  "board.reportSend": "Invia segnalazione",
+  "board.reportSending": "Invio in corso…",
+  "board.reportCancel": "Annulla",
+  "board.reportClose": "Chiudi",
+  "board.reportDone": "Fatto",
+  "board.reportHeld": "Nascosto mentre controlliamo. Il tuo riferimento: {ref}",
+  "board.reportReceived": "Ricevuto. Diamo un'occhiata. Il tuo riferimento: {ref}",
+  "board.reportFollowUp": "Domande su una segnalazione? Scrivi a questo indirizzo citando il riferimento:",
+  "board.underReviewNotice": "Questa bacheca è in pausa mentre controlliamo una segnalazione.",
   "make.title": "Crea una scena",
   "make.pickHint": "Scegli i pin sulla bacheca",
   "make.idea": "La tua idea",
diff --git a/src/i18n/messages/it.lock.json b/src/i18n/messages/it.lock.json
index 89c774d8..ce488387 100644
--- a/src/i18n/messages/it.lock.json
+++ b/src/i18n/messages/it.lock.json
@@ -236,6 +236,12 @@
     "request.joinBeforePhoto": "aab76d9df48d0e99",
     "request.addPhotoFailed": "bcd9158b344dc05b",
     "request.photoTooLarge": "5cd5535bedfbe644",
+    "request.reportInvalid": "75ced24b276cd25c",
+    "request.reportMessageRequired": "601ee70a3c206478",
+    "request.reportMessageTooLong": "ad00cd34acee6aaf",
+    "request.reportEmailInvalid": "518710625cda91c8",
+    "request.reportFailed": "bb4c2dfb0b3c402a",
+    "request.boardUnderReview": "f96f3142f35ca0b1",
     "add.title": "787d8913e7221b88",
     "add.pick": "e516b916371de9c5",
     "add.takePhoto": "f3ff70e1103d5024",
@@ -268,11 +274,34 @@
     "board.joinFirst": "c090c7e86973f7e5",
     "board.loadError": "abafbe13160bf559",
     "board.report": "46331d9a56fac01b",
+    "board.reportAddress": "9c155f23a73dd738",
+    "board.reportRef": "75bc527240db7afc",
     "board.reportSubject": "006f71019af5f968",
     "board.reportBody": "43b0b87ccd2400d0",
     "board.reportManual": "7b8b7727953020e9",
-    "board.reportAddress": "9c155f23a73dd738",
-    "board.reportRef": "75bc527240db7afc",
+    "board.reportTitle": "18bfc4b505b2ed6f",
+    "board.reportScopeLabel": "6ff71379727be61c",
+    "board.reportScopeBoard": "950bad600ad8705c",
+    "board.reportScopeScene": "0ddfb2b6ad4dc883",
+    "board.reportReasonLabel": "f71e8e464b7c8f18",
+    "board.reportReason.likeness": "597ed5829d3a4fbf",
+    "board.reportReason.inappropriate": "6a69fa6bb360a7f3",
+    "board.reportReason.illegal": "46d2a9656152ab1a",
+    "board.reportReason.ownership": "5bf4df49175410ac",
+    "board.reportReason.other": "13677f691505b3c9",
+    "board.reportMessage": "025ec218811b8b9e",
+    "board.reportMessageHelp": "8d0f7f657c413a8b",
+    "board.reportEmail": "3a9d86c7125733ed",
+    "board.reportEmailHelp": "d228459651482723",
+    "board.reportSend": "c2b4a98ece281d51",
+    "board.reportSending": "6403b88b9c432d60",
+    "board.reportCancel": "80d4e90ec5dfc046",
+    "board.reportClose": "4bf7f68d2c68166f",
+    "board.reportDone": "67f787692773bd8e",
+    "board.reportHeld": "da8ea2d2313c8bcc",
+    "board.reportReceived": "40fc7ed20d3c9be8",
+    "board.reportFollowUp": "d927818d772d2f3f",
+    "board.underReviewNotice": "f96f3142f35ca0b1",
     "make.title": "8fcaf2e503b3bfc2",
     "make.pickHint": "34ae06f27d25982f",
     "make.idea": "1196ca8162e0b6b2",
diff --git a/src/i18n/messages/pt-BR.json b/src/i18n/messages/pt-BR.json
index 7eb17b44..b8736bc7 100644
--- a/src/i18n/messages/pt-BR.json
+++ b/src/i18n/messages/pt-BR.json
@@ -232,6 +232,12 @@
   "request.joinBeforePhoto": "Entre neste quadro antes de adicionar uma foto.",
   "request.addPhotoFailed": "Não deu para adicionar essa foto. Tente de novo.",
   "request.photoTooLarge": "Essa foto é grande demais. Mantenha abaixo de {max} MB.",
+  "request.reportInvalid": "Escolha o que denunciar e por quê.",
+  "request.reportMessageRequired": "Conte em poucas palavras o que está errado.",
+  "request.reportMessageTooLong": "Deixe sua mensagem com menos de {max} caracteres.",
+  "request.reportEmailInvalid": "Esse e-mail não parece certo.",
+  "request.reportFailed": "Não deu para enviar a denúncia. Tente de novo.",
+  "request.boardUnderReview": "Este quadro está pausado enquanto verificamos uma denúncia.",
   "add.title": "Adicionar foto",
   "add.pick": "Tire ou escolha uma foto",
   "add.takePhoto": "Tirar foto",
@@ -264,11 +270,34 @@
   "board.joinFirst": "Adicione seu nome para saberem o que é seu.",
   "board.loadError": "Não deu para carregar o quadro. Verifique sua conexão.",
   "board.report": "Denunciar este quadro",
+  "board.reportAddress": "E-mail",
+  "board.reportRef": "Referência do quadro",
   "board.reportSubject": "Denunciar um quadro ({ref})",
   "board.reportBody": "Referência do quadro: {ref}\n\nO que devemos verificar? Descreva a foto, pin ou cena. Por favor, não anexe nem envie imagens ilegais.",
   "board.reportManual": "Sem app de e-mail? Escreva para este endereço e inclua a referência do quadro.",
-  "board.reportAddress": "E-mail",
-  "board.reportRef": "Referência do quadro",
+  "board.reportTitle": "Denunciar",
+  "board.reportScopeLabel": "O quê",
+  "board.reportScopeBoard": "Este quadro",
+  "board.reportScopeScene": "Cena {n}",
+  "board.reportReasonLabel": "Por quê",
+  "board.reportReason.likeness": "Sou eu, ou alguém que não autorizou",
+  "board.reportReason.inappropriate": "Inapropriado",
+  "board.reportReason.illegal": "Ilegal ou envolve menor de idade",
+  "board.reportReason.ownership": "Não é deles para compartilhar",
+  "board.reportReason.other": "Outra coisa",
+  "board.reportMessage": "O que devemos verificar?",
+  "board.reportMessageHelp": "Algumas palavras ajudam a gente a decidir. Nunca envie imagens.",
+  "board.reportEmail": "Seu e-mail (opcional)",
+  "board.reportEmailHelp": "Só para te avisar o que decidimos.",
+  "board.reportSend": "Enviar denúncia",
+  "board.reportSending": "Enviando…",
+  "board.reportCancel": "Cancelar",
+  "board.reportClose": "Fechar",
+  "board.reportDone": "Pronto",
+  "board.reportHeld": "Oculto enquanto verificamos. Seu protocolo: {ref}",
+  "board.reportReceived": "Recebido. Vamos dar uma olhada. Seu protocolo: {ref}",
+  "board.reportFollowUp": "Dúvidas sobre a denúncia? Escreva para este endereço e informe o protocolo:",
+  "board.underReviewNotice": "Este quadro está pausado enquanto verificamos uma denúncia.",
   "make.title": "Criação de cena",
   "make.pickHint": "Escolha pins no quadro",
   "make.idea": "Sua ideia",
diff --git a/src/i18n/messages/pt-BR.lock.json b/src/i18n/messages/pt-BR.lock.json
index 89c774d8..ce488387 100644
--- a/src/i18n/messages/pt-BR.lock.json
+++ b/src/i18n/messages/pt-BR.lock.json
@@ -236,6 +236,12 @@
     "request.joinBeforePhoto": "aab76d9df48d0e99",
     "request.addPhotoFailed": "bcd9158b344dc05b",
     "request.photoTooLarge": "5cd5535bedfbe644",
+    "request.reportInvalid": "75ced24b276cd25c",
+    "request.reportMessageRequired": "601ee70a3c206478",
+    "request.reportMessageTooLong": "ad00cd34acee6aaf",
+    "request.reportEmailInvalid": "518710625cda91c8",
+    "request.reportFailed": "bb4c2dfb0b3c402a",
+    "request.boardUnderReview": "f96f3142f35ca0b1",
     "add.title": "787d8913e7221b88",
     "add.pick": "e516b916371de9c5",
     "add.takePhoto": "f3ff70e1103d5024",
@@ -268,11 +274,34 @@
     "board.joinFirst": "c090c7e86973f7e5",
     "board.loadError": "abafbe13160bf559",
     "board.report": "46331d9a56fac01b",
+    "board.reportAddress": "9c155f23a73dd738",
+    "board.reportRef": "75bc527240db7afc",
     "board.reportSubject": "006f71019af5f968",
     "board.reportBody": "43b0b87ccd2400d0",
     "board.reportManual": "7b8b7727953020e9",
-    "board.reportAddress": "9c155f23a73dd738",
-    "board.reportRef": "75bc527240db7afc",
+    "board.reportTitle": "18bfc4b505b2ed6f",
+    "board.reportScopeLabel": "6ff71379727be61c",
+    "board.reportScopeBoard": "950bad600ad8705c",
+    "board.reportScopeScene": "0ddfb2b6ad4dc883",
+    "board.reportReasonLabel": "f71e8e464b7c8f18",
+    "board.reportReason.likeness": "597ed5829d3a4fbf",
+    "board.reportReason.inappropriate": "6a69fa6bb360a7f3",
+    "board.reportReason.illegal": "46d2a9656152ab1a",
+    "board.reportReason.ownership": "5bf4df49175410ac",
+    "board.reportReason.other": "13677f691505b3c9",
+    "board.reportMessage": "025ec218811b8b9e",
+    "board.reportMessageHelp": "8d0f7f657c413a8b",
+    "board.reportEmail": "3a9d86c7125733ed",
+    "board.reportEmailHelp": "d228459651482723",
+    "board.reportSend": "c2b4a98ece281d51",
+    "board.reportSending": "6403b88b9c432d60",
+    "board.reportCancel": "80d4e90ec5dfc046",
+    "board.reportClose": "4bf7f68d2c68166f",
+    "board.reportDone": "67f787692773bd8e",
+    "board.reportHeld": "da8ea2d2313c8bcc",
+    "board.reportReceived": "40fc7ed20d3c9be8",
+    "board.reportFollowUp": "d927818d772d2f3f",
+    "board.underReviewNotice": "f96f3142f35ca0b1",
     "make.title": "8fcaf2e503b3bfc2",
     "make.pickHint": "34ae06f27d25982f",
     "make.idea": "1196ca8162e0b6b2",
diff --git a/src/policy/policy.test.ts b/src/policy/policy.test.ts
index 204ff320..fba82260 100644
--- a/src/policy/policy.test.ts
+++ b/src/policy/policy.test.ts
@@ -414,6 +414,42 @@ describe("Policy (PIN-59, docs/11 §5.1)", () => {
     }
   });
 
+  it("report: in-app report route caps, deep-overridable, invalid values fail closed (PIN-267)", () => {
+    expect(DEFAULT_POLICY.report).toEqual({
+      perIp: { limit: 5, windowMs: 600_000 },
+      maxBytes: 4096,
+      messageMaxChars: 1000,
+      sweepBatch: 5,
+    });
+    const p = resolvePolicy(
+      { report: { messageMaxChars: 500 } },
+      { report: { perIp: { limit: 2 }, sweepBatch: 0 } },
+    );
+    expect(p.report).toEqual({
+      perIp: { limit: 2, windowMs: 600_000 },
+      maxBytes: 4096,
+      messageMaxChars: 500,
+      sweepBatch: 0,
+    });
+    // The deadline stays the one takedown promise on /terms.
+    expect(p.takedownHours).toBe(DEFAULT_POLICY.takedownHours);
+    expect(parsePolicyOverridesJson('{"report":{"maxBytes":8192}}')).toEqual({
+      report: { maxBytes: 8192 },
+    });
+    for (const bad of [
+      { report: { perIp: { limit: 0 } } },
+      { report: { perIp: { windowMs: 0 } } },
+      { report: { maxBytes: 0 } },
+      { report: { messageMaxChars: 0 } },
+      { report: { messageMaxChars: 10.5 } },
+      { report: { sweepBatch: -1 } },
+      { report: { maxBytes: "4096" } },
+    ]) {
+      expect(() => resolvePolicy(bad as never)).toThrow();
+      expect(() => resolvePolicy(null, bad as never)).toThrow();
+    }
+  });
+
   it("dailyBudgetUsd 0 means off and survives resolution", () => {
     expect(resolvePolicy({ dailyBudgetUsd: 0 }).dailyBudgetUsd).toBe(0);
   });
diff --git a/src/policy/policy.ts b/src/policy/policy.ts
index 26fa00a4..c7e201fe 100644
--- a/src/policy/policy.ts
+++ b/src/policy/policy.ts
@@ -295,6 +295,37 @@ export const PolicySchema = z
         sweepBatch: 5,
         createPerIp: { limit: 5, windowMs: 600_000 },
       }),
+    /**
+     * Report & hold (PIN-266, docs/20-abuse-runbook.md): the caps of
+     * the in-app report route, `POST /api/boards/<slug>/report`. A
+     * report is one Firestore write plus reversible holds, never a
+     * model call, so a flood is the risk, not spend: `perIp` is the
+     * in-process brake per client address; `maxBytes` caps the JSON
+     * body and is read from the env-level Policy before any board
+     * read (like sceneRequestMaxBytes); `messageMaxChars` caps the
+     * reporter's free text (stored with the report, never logged).
+     * `sweepBatch` is how many due reports one backstop run takes
+     * down (0 turns the timed takedown off); the deadline itself is
+     * the existing `takedownHours`.
+     */
+    report: z
+      .object({
+        perIp: z
+          .object({
+            limit: z.number().int().min(1).default(5),
+            windowMs: z.number().int().min(1).default(600_000),
+          })
+          .default({ limit: 5, windowMs: 600_000 }),
+        maxBytes: z.number().int().min(1).default(4096),
+        messageMaxChars: z.number().int().min(1).default(1000),
+        sweepBatch: z.number().int().min(0).default(5),
+      })
+      .default({
+        perIp: { limit: 5, windowMs: 600_000 },
+        maxBytes: 4096,
+        messageMaxChars: 1000,
+        sweepBatch: 5,
+      }),
     /** One-time "sign in to keep your pins" nudge after the first
      * pinned pin (PIN-84). Only ever renders when sign-in is on. */
     signInNudge: z.boolean().default(true),
@@ -567,6 +598,19 @@ export const PolicyOverridesSchema = z.object({
         .optional(),
     })
     .optional(),
+  report: z
+    .object({
+      perIp: z
+        .object({
+          limit: z.number().int().min(1).optional(),
+          windowMs: z.number().int().min(1).optional(),
+        })
+        .optional(),
+      maxBytes: z.number().int().min(1).optional(),
+      messageMaxChars: z.number().int().min(1).optional(),
+      sweepBatch: z.number().int().min(0).optional(),
+    })
+    .optional(),
   libraryPageSize: z.number().int().min(1).optional(),
   libraryStripMax: z.number().int().min(0).optional(),
   boardPollIntervalMs: z.number().int().min(250).optional(),
diff --git a/src/server/board-api.ts b/src/server/board-api.ts
index 81362ebf..a7f9ec1b 100644
--- a/src/server/board-api.ts
+++ b/src/server/board-api.ts
@@ -170,6 +170,8 @@ export function publicBoard(board: Board) {
       : board.theme ?? null,
     counters: board.counters,
     createdAt: board.createdAt,
+    // PIN-266: a board-wide report hold; the page shows a banner and the write routes answer 423.
+    underReview: board.reviewAt !== undefined,
   };
 }
 
diff --git a/src/server/board-card.test.ts b/src/server/board-card.test.ts
index 26e7daca..7b3bb1ae 100644
--- a/src/server/board-card.test.ts
+++ b/src/server/board-card.test.ts
@@ -123,6 +123,7 @@ describe("loadBoardCard", () => {
       delete: h.store.delete.bind(h.store),
       listPrefix: h.store.listPrefix.bind(h.store),
       copy: h.store.copy.bind(h.store),
+      setHold: h.store.setHold.bind(h.store),
       async get(ref) {
         if (calls++ === 0) throw new Error("storage hiccup");
         return h.store.get(ref);
diff --git a/src/server/board-report.test.ts b/src/server/board-report.test.ts
new file mode 100644
index 00000000..5d83f16b
--- /dev/null
+++ b/src/server/board-report.test.ts
@@ -0,0 +1,267 @@
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { emptyBoardCounters, type Element, type Participant, type Scene } from "../domain/board";
+import { InMemoryBoardRepository } from "../domain/board-repository";
+import { InMemoryReportStore } from "../domain/report-store";
+import { boardReportRef } from "../domain/tokens";
+import { resolvePolicy } from "../policy/policy";
+import { publicBoard } from "./board-api";
+import { REPORT_RECEIVED_EVENT, createReport, listBoardObjectRefs, type ReportDeps } from "./board-report";
+import { BoardApiError } from "./board-session";
+import { InMemoryDerivativeStore } from "./derivative-store";
+
+/**
+ * createReport (PIN-270): validate, plan (ADR-004 table), hold, record,
+ * announce. Memory ports, a fixed clock, ids from a counter.
+ */
+const SLUG = "AbCdEfGhIjKlMnOpQrStUv";
+const NOW = 1_700_000_000_000;
+const HOUR = 3_600_000;
+
+const participant: Participant = { id: "p1", boardId: SLUG, displayName: "Mia", cookieSecretHash: "h", createdAt: 1_100 };
+const refsOf = (id: string) => [`elements/boards/${SLUG}/${id}/cutout.png`, `elements/boards/${SLUG}/${id}/flattened.jpg`];
+
+async function harness() {
+  const boards = new InMemoryBoardRepository();
+  const store = new InMemoryDerivativeStore();
+  const reports = new InMemoryReportStore();
+  const policy = resolvePolicy({ report: { messageMaxChars: 40 } });
+  await boards.createBoard({ slug: SLUG, title: "Party", counters: emptyBoardCounters(), createdAt: 1_000, version: 0 });
+  await boards.putParticipant(participant);
+  const element = (id: string, faceFlag: boolean): Element => ({
+    id, boardId: SLUG, ownerId: "p1", label: id, description: "", maskBox: { x1: 0, y1: 0, x2: 1, y2: 1 },
+    cutoutRef: refsOf(id)[0], flattenedRef: refsOf(id)[1], sourcePhotoId: "job", faceFlag, createdAt: 1_200,
+  });
+  await boards.createElement(element("mug", false));
+  await boards.createElement(element("friend", true));
+  for (const id of ["mug", "friend"]) {
+    await store.put(refsOf(id)[0], Buffer.from("c"), "image/png");
+    await store.put(refsOf(id)[1], Buffer.from("f"), "image/jpeg");
+  }
+  const scene = (id: string, elementIds: string[]): Scene => ({
+    id, boardId: SLUG, createdBy: "p1", elementIds, prompt: "x", status: "ready",
+    imageRef: `scenes/boards/${SLUG}/${id}/scene.webp`, promptVersion: "scene.v1", createdAt: 1_400,
+  });
+  await boards.putScene(scene("s-mug", ["mug"]));
+  await boards.putScene(scene("s-both", ["mug", "friend"]));
+  for (const id of ["s-mug", "s-both"]) await store.put(`scenes/boards/${SLUG}/${id}/scene.webp`, Buffer.from("w"), "image/webp");
+  // A sibling no record points at (the strip preview, PIN-133).
+  await store.put(`scenes/boards/${SLUG}/s-mug/preview.webp`, Buffer.from("p"), "image/webp");
+  let ids = 0;
+  const deps: ReportDeps = { boards, store, reports, policy, now: () => NOW, newId: () => `rep-${++ids}` };
+  return { boards, store, reports, policy, deps };
+}
+
+function loggedEvents(spy: ReturnType<typeof vi.spyOn>): Record<string, unknown>[] {
+  return spy.mock.calls.map((call) => JSON.parse(String(call[0])) as Record<string, unknown>);
+}
+
+describe("createReport (PIN-270)", () => {
+  afterEach(() => vi.restoreAllMocks());
+
+  it("element by a visitor: holds the pin and its scenes, records exactly that, announces without the slug", async () => {
+    const h = await harness();
+    const log = vi.spyOn(console, "log").mockImplementation(() => {});
+    const result = await createReport(SLUG, { scope: "element", targetId: "mug", reason: "inappropriate", message: "not nice" }, null, h.deps);
+    expect(result.held).toBe(true);
+    expect(result.record).toEqual({
+      id: "rep-1",
+      boardId: SLUG,
+      reference: boardReportRef(SLUG),
+      scope: "element",
+      targetId: "mug",
+      reason: "inappropriate",
+      message: "not nice",
+      reporterKind: "visitor",
+      severity: "normal",
+      createdAt: NOW,
+      status: "open",
+      held: { elementIds: ["mug"], sceneIds: ["s-mug", "s-both"], boardReview: false, storageHold: false },
+    });
+    expect(await h.reports.get("rep-1")).toEqual(result.record);
+    expect((await h.boards.getElement("mug"))?.cutoutRef).toBe(`held:${refsOf("mug")[0]}`);
+    expect((await h.boards.getElement("friend"))?.cutoutRef).toBe(refsOf("friend")[0]);
+    expect(await h.boards.listScenes(SLUG)).toEqual([]);
+    expect((await h.boards.getBoard(SLUG))?.reviewAt).toBeUndefined();
+    const [event] = loggedEvents(log);
+    expect(event).toEqual({
+      severity: "WARNING",
+      event: REPORT_RECEIVED_EVENT,
+      reference: boardReportRef(SLUG),
+      reason: "inappropriate",
+      scope: "element",
+      reportSeverity: "normal",
+      reporterKind: "visitor",
+      held: { elements: 1, scenes: 2, board: false, storage: false },
+    });
+  });
+
+  it("a likeness report on a face-flagged pin gets the one deadline; without the flag it does not", async () => {
+    const h = await harness();
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    const timed = await createReport(SLUG, { scope: "element", targetId: "friend", reason: "likeness" }, null, h.deps);
+    expect(timed.record.deleteAt).toBe(NOW + h.policy.takedownHours * HOUR);
+    expect((await h.reports.listOpenDue(NOW + 25 * HOUR, 10)).map((r) => r.id)).toEqual(["rep-1"]);
+    const plain = await createReport(SLUG, { scope: "element", targetId: "mug", reason: "likeness" }, null, h.deps);
+    expect(plain.record).not.toHaveProperty("deleteAt");
+  });
+
+  it("scene: hides that scene only", async () => {
+    const h = await harness();
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    const result = await createReport(SLUG, { scope: "scene", targetId: "s-both", reason: "ownership" }, null, h.deps);
+    expect(result.held).toBe(true);
+    expect(result.record.held).toEqual({ elementIds: [], sceneIds: ["s-both"], boardReview: false, storageHold: false });
+    expect((await h.boards.listScenes(SLUG)).map((s) => s.id)).toEqual(["s-mug"]);
+    expect((await h.boards.getElement("mug"))?.cutoutRef).toBe(refsOf("mug")[0]);
+  });
+
+  it("whole board by a visitor (not illegal): queued, alerted, nothing hidden", async () => {
+    const h = await harness();
+    const log = vi.spyOn(console, "log").mockImplementation(() => {});
+    const result = await createReport(SLUG, { scope: "board", reason: "inappropriate" }, null, h.deps);
+    expect(result.held).toBe(false);
+    expect(result.record.held).toEqual({ elementIds: [], sceneIds: [], boardReview: false, storageHold: false });
+    expect((await h.boards.listScenes(SLUG)).length).toBe(2);
+    const board = await h.boards.getBoard(SLUG);
+    expect(board?.reviewAt).toBeUndefined();
+    expect(publicBoard(board!).underReview).toBe(false);
+    expect(loggedEvents(log)[0]).toMatchObject({ held: { elements: 0, scenes: 0, board: false, storage: false } });
+  });
+
+  it("whole board by a participant: everything held, board under review, no storage hold", async () => {
+    const h = await harness();
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    const result = await createReport(SLUG, { scope: "board", reason: "inappropriate" }, participant, h.deps);
+    expect(result.held).toBe(true);
+    expect(result.record.reporterKind).toBe("participant");
+    expect(result.record.held).toEqual({ elementIds: ["mug", "friend"], sceneIds: ["s-mug", "s-both"], boardReview: true, storageHold: false });
+    const board = await h.boards.getBoard(SLUG);
+    expect(board?.reviewAt).toBe(NOW);
+    expect(publicBoard(board!).underReview).toBe(true);
+    expect(await h.boards.listScenes(SLUG)).toEqual([]);
+    expect(h.store.isHeld(refsOf("mug")[0])).toBe(false);
+  });
+
+  it("whole board as illegal from anyone: the same plus Storage holds on whole folders, severity high, CRITICAL line", async () => {
+    const h = await harness();
+    // A library copy whose bytes live under another board's folder (PIN-85).
+    const OTHER = "ZyXwVuTsRqPoNmLkJiHgFe";
+    const foreign = [`elements/boards/${OTHER}/src/cutout.png`, `elements/boards/${OTHER}/src/flattened.jpg`, `elements/boards/${OTHER}/src/extra.bin`];
+    for (const ref of foreign) await h.store.put(ref, Buffer.from("x"), "image/png");
+    await h.boards.createElement({
+      id: "copy", boardId: SLUG, ownerId: "p1", label: "copy", description: "", maskBox: { x1: 0, y1: 0, x2: 1, y2: 1 },
+      cutoutRef: foreign[0], flattenedRef: foreign[1], sourcePhotoId: "job", faceFlag: false, sourceElementId: "src", createdAt: 1_250,
+    });
+    // A working copy must never be held.
+    await h.store.put(`tmp/boards/${SLUG}/jobs/j/working.webp`, Buffer.from("t"), "image/webp");
+    const log = vi.spyOn(console, "log").mockImplementation(() => {});
+    const result = await createReport(SLUG, { scope: "board", reason: "illegal" }, null, h.deps);
+    expect(result.record.severity).toBe("high");
+    expect(result.record.held).toMatchObject({ elementIds: ["mug", "friend", "copy"], sceneIds: ["s-mug", "s-both"], boardReview: true, storageHold: true });
+    expect(result.record).not.toHaveProperty("deleteAt");
+    const expectedHeld = [
+      ...refsOf("mug"),
+      ...refsOf("friend"),
+      `scenes/boards/${SLUG}/s-mug/scene.webp`,
+      `scenes/boards/${SLUG}/s-both/scene.webp`,
+      `scenes/boards/${SLUG}/s-mug/preview.webp`,
+      ...foreign,
+    ];
+    for (const ref of expectedHeld) expect(h.store.isHeld(ref)).toBe(true);
+    // The record lists exactly what it held, so a release never has to guess.
+    expect(new Set(result.record.held.storageRefs)).toEqual(new Set(expectedHeld));
+    expect(h.store.isHeld(`tmp/boards/${SLUG}/jobs/j/working.webp`)).toBe(false);
+    expect(loggedEvents(log)[0]).toMatchObject({ severity: "CRITICAL", reason: "illegal", held: { storage: true } });
+  });
+
+  it("illegal on one pin or one scene holds that pin's objects and its scenes' folders, nothing else", async () => {
+    const h = await harness();
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    const pin = await createReport(SLUG, { scope: "element", targetId: "friend", reason: "illegal" }, null, h.deps);
+    expect(pin.record.held).toMatchObject({ elementIds: ["friend"], sceneIds: ["s-both"], boardReview: false, storageHold: true });
+    for (const ref of [...refsOf("friend"), `scenes/boards/${SLUG}/s-both/scene.webp`]) expect(h.store.isHeld(ref)).toBe(true);
+    expect(new Set(pin.record.held.storageRefs)).toEqual(new Set([...refsOf("friend"), `scenes/boards/${SLUG}/s-both/scene.webp`]));
+    for (const ref of [...refsOf("mug"), `scenes/boards/${SLUG}/s-mug/scene.webp`, `scenes/boards/${SLUG}/s-mug/preview.webp`]) expect(h.store.isHeld(ref)).toBe(false);
+    expect((await h.boards.getBoard(SLUG))?.reviewAt).toBeUndefined();
+
+    const scene = await createReport(SLUG, { scope: "scene", targetId: "s-mug", reason: "illegal" }, null, h.deps);
+    expect(scene.record.held).toMatchObject({ elementIds: [], sceneIds: ["s-mug"], boardReview: false, storageHold: true });
+    expect(new Set(scene.record.held.storageRefs)).toEqual(new Set([`scenes/boards/${SLUG}/s-mug/scene.webp`, `scenes/boards/${SLUG}/s-mug/preview.webp`]));
+    // An illegal report on a scene another hold hid first still lists it (the decision covers it).
+    const again = await createReport(SLUG, { scope: "scene", targetId: "s-both", reason: "illegal" }, null, h.deps);
+    expect(again.record.held).toMatchObject({ sceneIds: ["s-both"], storageHold: true });
+    // The scene's whole folder, preview included; the pin it uses stays unheld in Storage.
+    expect(h.store.isHeld(`scenes/boards/${SLUG}/s-mug/scene.webp`)).toBe(true);
+    expect(h.store.isHeld(`scenes/boards/${SLUG}/s-mug/preview.webp`)).toBe(true);
+    expect(h.store.isHeld(refsOf("mug")[0])).toBe(false);
+  });
+
+  it("listBoardObjectRefs falls back to the records' refs when a listing fails", async () => {
+    const h = await harness();
+    vi.spyOn(console, "error").mockImplementation(() => {});
+    const elements = await h.boards.listElements(SLUG);
+    const scenes = await h.boards.listScenes(SLUG, { includeHidden: true });
+    const refs = await listBoardObjectRefs(SLUG, elements, scenes, { listPrefix: async () => { throw new Error("gcs down"); } });
+    expect(refs.sort()).toEqual([...refsOf("friend"), ...refsOf("mug"), `scenes/boards/${SLUG}/s-both/scene.webp`, `scenes/boards/${SLUG}/s-mug/scene.webp`].sort());
+  });
+
+  it("a Storage hold that fails is logged by name and recorded as not held; the report still lands", async () => {
+    const h = await harness();
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    const errors = vi.spyOn(console, "error").mockImplementation(() => {});
+    const original = h.store.setHold.bind(h.store);
+    h.store.setHold = async (ref, held) => {
+      if (ref.endsWith("s-both/scene.webp")) throw new Error(`gcs down for ${SLUG}`);
+      return original(ref, held);
+    };
+    const result = await createReport(SLUG, { scope: "board", reason: "illegal" }, null, h.deps);
+    expect(result.record.held.storageHold).toBe(false);
+    expect(await h.reports.get("rep-1")).not.toBeNull();
+    expect(errors).toHaveBeenCalledTimes(1);
+    expect(JSON.stringify(errors.mock.calls[0])).not.toContain(SLUG);
+  });
+
+  it("never logs the slug or the message; the message stays on the record", async () => {
+    const h = await harness();
+    const log = vi.spyOn(console, "log").mockImplementation(() => {});
+    await createReport(SLUG, { scope: "board", reason: "other", message: "the host is my ex" }, participant, h.deps);
+    const line = String(log.mock.calls[0][0]);
+    expect(line).not.toContain(SLUG);
+    expect(line).not.toContain("my ex");
+    expect((await h.reports.get("rep-1"))?.message).toBe("the host is my ex");
+  });
+
+  it("a bad body is a typed 400 before any read", async () => {
+    const h = await harness();
+    const cases: [unknown, string][] = [
+      [{ scope: "board" }, "report_invalid"],
+      [{ scope: "board", reason: "other" }, "report_message_required"],
+      [{ scope: "board", reason: "likeness", message: "x".repeat(41) }, "report_message_too_long"],
+      [{ scope: "board", reason: "likeness", reporterEmail: "nope" }, "report_email_invalid"],
+    ];
+    for (const [body, code] of cases) {
+      const error = await createReport("ZyXwVuTsRqPoNmLkJiHgFe", body, null, h.deps).catch((e: unknown) => e);
+      expect(error).toBeInstanceOf(BoardApiError);
+      expect((error as BoardApiError).status).toBe(400);
+      expect((error as BoardApiError).code).toBe(code);
+    }
+    const tooLong = await createReport(SLUG, { scope: "board", reason: "likeness", message: "x".repeat(41) }, null, h.deps).catch((e: unknown) => e);
+    expect((tooLong as BoardApiError).userMessage).toEqual({ key: "request.reportMessageTooLong", values: { max: 40 } });
+    expect(await h.reports.listOpenForBoard(SLUG)).toEqual([]);
+  });
+
+  it("an unknown board or target is the uniform 404, and records nothing", async () => {
+    const h = await harness();
+    for (const [slug, body] of [
+      ["ZyXwVuTsRqPoNmLkJiHgFe", { scope: "board", reason: "likeness" }],
+      [SLUG, { scope: "element", targetId: "ghost", reason: "likeness" }],
+      [SLUG, { scope: "scene", targetId: "ghost", reason: "likeness" }],
+    ] as const) {
+      const error = await createReport(slug, body, null, h.deps).catch((e: unknown) => e);
+      expect(error).toBeInstanceOf(BoardApiError);
+      expect((error as BoardApiError).status).toBe(404);
+    }
+    expect(await h.reports.listOpenForBoard(SLUG)).toEqual([]);
+    expect((await h.boards.listScenes(SLUG)).length).toBe(2);
+  });
+});
diff --git a/src/server/board-report.ts b/src/server/board-report.ts
new file mode 100644
index 00000000..afeb8773
--- /dev/null
+++ b/src/server/board-report.ts
@@ -0,0 +1,276 @@
+import "server-only";
+/**
+ * Report & hold service (PIN-270, ADR-004, docs/20): the request does
+ * the work, like the demo sweep. A report body is validated, planned
+ * by the pure decision table (`planReportHold`), applied to the
+ * repository (reversible holds, never a delete) and to Storage
+ * (temporary holds for `illegal`), recorded as a `reports/{id}` doc
+ * with exactly what was held, and announced with one structured log
+ * line carrying the opaque reference, never the slug or the message.
+ */
+import { randomUUID } from "node:crypto";
+import { releaseRef, type Element, type Participant, type Scene } from "../domain/board";
+import type { BoardRepository } from "../domain/board-repository";
+import {
+  parseReportInput,
+  planHoldsSomething,
+  planReportHold,
+  type ReportHeld,
+  type ReportInputError,
+  type ReportRecord,
+  type ReportScope,
+  type ReporterKind,
+} from "../domain/board-report";
+import type { ReportStore } from "../domain/report-store";
+import { boardReportRef } from "../domain/tokens";
+import { userMessage } from "../i18n/user-message";
+import type { MessageKey } from "../i18n";
+import type { Policy } from "../policy/policy";
+import { BoardApiError } from "./board-session";
+import { boardStoragePrefixes } from "./board-storage";
+import type { DerivativeStore } from "./derivative-store";
+import { logEvent, logServerError } from "./safe-log";
+
+export interface ReportDeps {
+  boards: BoardRepository;
+  store: DerivativeStore;
+  reports: ReportStore;
+  policy: Policy;
+  now?: () => number;
+  newId?: () => string;
+}
+
+/** The 400 codes of `POST /api/boards/<slug>/report`. */
+export const REPORT_CODES: Readonly<Record<ReportInputError, string>> = {
+  invalid: "report_invalid",
+  message_required: "report_message_required",
+  message_too_long: "report_message_too_long",
+  email_invalid: "report_email_invalid",
+};
+
+const REPORT_MESSAGE_KEYS: Readonly<Record<ReportInputError, MessageKey>> = {
+  invalid: "request.reportInvalid",
+  message_required: "request.reportMessageRequired",
+  message_too_long: "request.reportMessageTooLong",
+  email_invalid: "request.reportEmailInvalid",
+};
+
+export const REPORT_RECEIVED_EVENT = "report.received";
+
+export interface CreateReportResult {
+  record: ReportRecord;
+  /** True when the report hid or locked anything (the receipt's wording). */
+  held: boolean;
+}
+
+/**
+ * Validate, plan, hold, record, announce. Throws BoardApiError 400
+ * (typed code) on a bad body and the uniform 404 for an unknown board
+ * or target (no existence leak for either).
+ */
+export async function createReport(
+  slug: string,
+  body: unknown,
+  viewer: Participant | null,
+  deps: ReportDeps,
+): Promise<CreateReportResult> {
+  const parsed = parseReportInput(body, { messageMaxChars: deps.policy.report.messageMaxChars });
+  if (!parsed.ok) {
+    const values = parsed.error === "message_too_long" ? { max: deps.policy.report.messageMaxChars } : undefined;
+    throw new BoardApiError(userMessage(REPORT_MESSAGE_KEYS[parsed.error], values), 400, REPORT_CODES[parsed.error]);
+  }
+  const board = await deps.boards.getBoard(slug);
+  if (!board) throw new BoardApiError("Board not found.", 404);
+  const input = parsed.input;
+  const [elements, scenes] = await Promise.all([
+    deps.boards.listElements(slug),
+    deps.boards.listScenes(slug, { includeHidden: true }),
+  ]);
+  const now = deps.now?.() ?? Date.now();
+  const reporterKind: ReporterKind = viewer && viewer.boardId === slug ? "participant" : "visitor";
+  const planned = planReportHold({
+    scope: input.scope,
+    reason: input.reason,
+    reporterKind,
+    now,
+    takedownHours: deps.policy.takedownHours,
+    element: input.scope === "element" ? (elements.find((e) => e.id === input.targetId) ?? null) : undefined,
+    scene: input.scope === "scene" ? (scenes.find((s) => s.id === input.targetId) ?? null) : undefined,
+    boardElements: elements,
+    boardScenes: scenes,
+  });
+  if (!planned.ok) throw new BoardApiError("Board not found.", 404);
+  const plan = planned.plan;
+  const held = await applyHold(slug, input.scope, plan.held, elements, scenes, now, deps);
+  const record: ReportRecord = {
+    id: deps.newId?.() ?? randomUUID(),
+    boardId: slug,
+    reference: boardReportRef(slug),
+    scope: input.scope,
+    ...(input.targetId ? { targetId: input.targetId } : {}),
+    reason: input.reason,
+    ...(input.message ? { message: input.message } : {}),
+    ...(input.reporterEmail ? { reporterEmail: input.reporterEmail } : {}),
+    reporterKind,
+    severity: plan.severity,
+    createdAt: now,
+    status: "open",
+    ...(plan.deleteAt !== undefined ? { deleteAt: plan.deleteAt } : {}),
+    held,
+  };
+  await deps.reports.create(record);
+  logEvent(
+    REPORT_RECEIVED_EVENT,
+    {
+      reference: record.reference,
+      reason: record.reason,
+      scope: record.scope,
+      reportSeverity: record.severity,
+      reporterKind,
+      held: {
+        elements: held.elementIds.length,
+        scenes: held.sceneIds.length,
+        board: held.boardReview,
+        storage: held.storageHold,
+      },
+      ...(record.deleteAt !== undefined ? { deleteAt: record.deleteAt } : {}),
+    },
+    plan.severity === "high" ? "CRITICAL" : "WARNING",
+  );
+  return { record, held: planHoldsSomething(held) };
+}
+
+/**
+ * Apply a plan and return what actually happened, so `dismiss` can
+ * restore exactly that. Repository holds are atomic each; a Storage
+ * hold that fails is logged by error name and recorded as not held
+ * (the report still lands, the operator sees `storage: false`).
+ */
+async function applyHold(
+  slug: string,
+  scope: ReportScope,
+  planned: ReportHeld,
+  elements: readonly Element[],
+  scenes: readonly Scene[],
+  now: number,
+  deps: ReportDeps,
+): Promise<ReportHeld> {
+  const elementIds: string[] = [];
+  const sceneIds = new Set<string>();
+  for (const id of planned.elementIds) {
+    const result = await deps.boards.holdElement(id);
+    if (!result.held) continue;
+    elementIds.push(id);
+    for (const sceneId of result.hiddenSceneIds) sceneIds.add(sceneId);
+  }
+  for (const id of planned.sceneIds) {
+    if (sceneIds.has(id)) continue;
+    // A scene report lists its scene even when another hold hid it
+    // first: the decision covers it, and a dismiss of that other hold
+    // must not bring it back while this report is open.
+    if ((await deps.boards.hideScene(id)) || scope === "scene") sceneIds.add(id);
+  }
+  const boardReview = planned.boardReview ? await deps.boards.setBoardReview(slug, now) : false;
+  let storageHold = false;
+  const storageRefs: string[] = [];
+  if (planned.storageHold) {
+    storageHold = true;
+    // A board-wide hold covers the board's folders; a pin or scene hold
+    // covers that pin's objects and the folders of the scenes it hid.
+    const refs = planned.boardReview
+      ? await listBoardObjectRefs(slug, elements, scenes, deps.store)
+      : await listTargetObjectRefs(
+          slug,
+          elements.filter((e) => planned.elementIds.includes(e.id)),
+          scenes.filter((s) => planned.sceneIds.includes(s.id)),
+          deps.store,
+        );
+    for (const ref of refs) {
+      try {
+        await deps.store.setHold(ref, true);
+        storageRefs.push(ref);
+      } catch (error) {
+        storageHold = false;
+        logServerError("report storage hold failed", error);
+      }
+    }
+  }
+  return {
+    elementIds,
+    sceneIds: [...sceneIds],
+    boardReview,
+    storageHold,
+    ...(planned.storageHold ? { storageRefs } : {}),
+  };
+}
+
+/**
+ * The stored objects of a few records (an `illegal` report on one pin
+ * or one scene): each element's two refs and the folder of each scene
+ * as Storage lists it (preview included), with the records' refs as the
+ * floor when a listing fails.
+ */
+export async function listTargetObjectRefs(
+  slug: string,
+  elements: readonly Pick<Element, "cutoutRef" | "flattenedRef">[],
+  scenes: readonly Pick<Scene, "id" | "imageRef">[],
+  store: Pick<DerivativeStore, "listPrefix">,
+): Promise<string[]> {
+  const refs = new Set<string>();
+  for (const element of elements) {
+    refs.add(releaseRef(element.cutoutRef));
+    refs.add(releaseRef(element.flattenedRef));
+  }
+  for (const scene of scenes) {
+    if (scene.imageRef) refs.add(scene.imageRef);
+    try {
+      for (const ref of await store.listPrefix(`scenes/boards/${slug}/${scene.id}/`)) refs.add(ref);
+    } catch (error) {
+      logServerError("storage listing failed; holding the records' refs only", error);
+    }
+  }
+  return [...refs];
+}
+
+/**
+ * Every stored object a board's records can reach (ADR-004: holds go
+ * on the board's folders): the board's own `elements/` and `scenes/`
+ * folders as Storage lists them (a scene's preview and any other
+ * sibling included), the folder of every library copy whose bytes live
+ * under another board, and the records' own refs as the floor when a
+ * listing fails. Never `tmp/`: working copies are not evidence we keep.
+ * Shared with the operator's close-out (`releaseStorageHolds`).
+ */
+export async function listBoardObjectRefs(
+  slug: string,
+  elements: readonly Pick<Element, "cutoutRef" | "flattenedRef">[],
+  scenes: readonly Pick<Scene, "imageRef">[],
+  store: Pick<DerivativeStore, "listPrefix">,
+): Promise<string[]> {
+  const refs = new Set<string>();
+  const folders = new Set<string>();
+  const prefixes = boardStoragePrefixes(slug);
+  const ownElements = prefixes?.[1];
+  if (prefixes) {
+    folders.add(prefixes[1]);
+    folders.add(prefixes[2]);
+  }
+  for (const element of elements) {
+    for (const ref of [releaseRef(element.cutoutRef), releaseRef(element.flattenedRef)]) {
+      refs.add(ref);
+      const folder = ref.slice(0, ref.lastIndexOf("/") + 1);
+      if (ref.startsWith("elements/") && folder.length > "elements/".length && !(ownElements && ref.startsWith(ownElements))) {
+        folders.add(folder);
+      }
+    }
+  }
+  for (const scene of scenes) if (scene.imageRef) refs.add(scene.imageRef);
+  for (const folder of folders) {
+    try {
+      for (const ref of await store.listPrefix(folder)) refs.add(ref);
+    } catch (error) {
+      logServerError("storage listing failed; holding the records' refs only", error);
+    }
+  }
+  return [...refs];
+}
diff --git a/src/server/board-storage.test.ts b/src/server/board-storage.test.ts
index 199b9916..df25fe78 100644
--- a/src/server/board-storage.test.ts
+++ b/src/server/board-storage.test.ts
@@ -79,6 +79,40 @@ describe("sweepDeletedBoardStorage (PIN-169)", () => {
     expect(await sweep()).toEqual({ deleted: 0, kept: kept.length, failed: 0 }); // idempotent
   });
 
+  it("a held library copy on a live board still keeps the shared bytes (PIN-269)", async () => {
+    const h = await harness();
+    await h.boards.createElement(element("shared", DEAD));
+    await h.boards.createElement(element("own", DEAD));
+    await h.boards.createElement(element("copy-shared", COPIES, DEAD, "shared"));
+    // The copy is under a report hold: its refs carry the `held:` prefix.
+    expect((await h.boards.holdElement("copy-shared")).held).toBe(true);
+    await h.put(...files(DEAD, "shared"), ...files(DEAD, "own"));
+    await h.boards.deleteBoard(DEAD, 2);
+    expect(await sweepDeletedBoardStorage(DEAD, h.deps)).toEqual({ deleted: 2, kept: 2, failed: 0 });
+    expect(await h.store.listPrefix(folderOf(DEAD, "shared"))).toHaveLength(2);
+    expect(await h.store.listPrefix(folderOf(DEAD, "own"))).toEqual([]);
+    // The hold released, the copy still counts; the copy deleted, the bytes go with the next sweep.
+    await h.boards.releaseElement("copy-shared");
+    expect(await sweepDeletedBoardStorage(DEAD, h.deps)).toEqual({ deleted: 0, kept: 2, failed: 0 });
+    await h.boards.deleteElement("copy-shared");
+    expect(await sweepDeletedBoardStorage(DEAD, h.deps)).toEqual({ deleted: 2, kept: 0, failed: 0 });
+  });
+
+  it("deleting a board whose held copy was the last live pointer frees the source bytes (PIN-269)", async () => {
+    const h = await harness();
+    await h.boards.createElement(element("shared", DEAD));
+    await h.boards.createElement(element("copy-shared", COPIES, DEAD, "shared"));
+    expect((await h.boards.holdElement("copy-shared")).held).toBe(true);
+    await h.put(...files(DEAD, "shared"));
+    await h.boards.deleteBoard(DEAD, 2);
+    // The held live copy keeps the source's bytes.
+    expect(await sweepDeletedBoardStorage(DEAD, h.deps)).toEqual({ deleted: 0, kept: 2, failed: 0 });
+    // The copy's board goes while the copy is still held: nothing live points at the bytes any more.
+    await h.boards.deleteBoard(COPIES, 3);
+    expect(await sweepDeletedBoardStorage(COPIES, h.deps)).toEqual({ deleted: 2, kept: 0, failed: 0 });
+    expect(await h.store.listPrefix(folderOf(DEAD, "shared"))).toEqual([]);
+  });
+
   it("deleting the board that held the last live copy frees the kept bytes; a live source keeps its own", async () => {
     const h = await harness();
     await h.boards.createElement(element("shared", DEAD));
@@ -104,6 +138,7 @@ describe("sweepDeletedBoardStorage (PIN-169)", () => {
       get: (ref) => h.store.get(ref),
       listPrefix: (prefix) => h.store.listPrefix(prefix),
       copy: (from, to) => h.store.copy(from, to),
+      setHold: (ref, held) => h.store.setHold(ref, held),
       delete: async (ref) => {
         if (ref === refs[0]) throw new TypeError(`gcs down for ${ref}`);
         return h.store.delete(ref);
diff --git a/src/server/board-storage.ts b/src/server/board-storage.ts
index 641c2c0d..2c09bca4 100644
--- a/src/server/board-storage.ts
+++ b/src/server/board-storage.ts
@@ -16,6 +16,7 @@ import "server-only";
  * for everyone), logs by error name only (never a slug or ref), and a
  * later run removes what an earlier one missed or a late job wrote.
  */
+import { holdRef, releaseRef } from "../domain/board";
 import { isLiveBoard, type BoardRepository } from "../domain/board-repository";
 import { isValidSlug } from "../domain/tokens";
 import type { DerivativeStore } from "./derivative-store";
@@ -48,7 +49,14 @@ export async function elementBytesStillNeeded(
   boards: NeedsBoards,
   exceptElementId?: string,
 ): Promise<boolean> {
-  for (const other of await boards.listElementsByCutoutRef(cutoutRef)) {
+  // A held element (PIN-269) keeps the same bytes behind a `held:`
+  // prefix, so both spellings of the ref count as still pointing at them.
+  const raw = releaseRef(cutoutRef);
+  const pointing = [
+    ...(await boards.listElementsByCutoutRef(raw)),
+    ...(await boards.listElementsByCutoutRef(holdRef(raw))),
+  ];
+  for (const other of pointing) {
     if (other.id === exceptElementId) continue;
     if (await isLiveBoard(boards, other.boardId)) return true;
   }
@@ -101,11 +109,15 @@ export async function sweepDeletedBoardStorage(
     // element folder. Once nothing live needs those bytes, this board
     // held the last live copy: free them as deleteMyElement would.
     for (const element of await deps.boards.listElements(slug)) {
-      const folder = elementFolder(element.cutoutRef);
+      // A held copy (PIN-269) keeps the same refs behind `held:`; the
+      // bytes are the same bytes, and this board is gone either way.
+      const cutoutRef = releaseRef(element.cutoutRef);
+      const flattenedRef = releaseRef(element.flattenedRef);
+      const folder = elementFolder(cutoutRef);
       if (!folder || folder.startsWith(prefixes[1])) continue;
-      if (elementFolder(element.flattenedRef) !== folder) continue;
-      if (await elementBytesStillNeeded(element.cutoutRef, deps.boards)) continue;
-      for (const ref of [element.cutoutRef, element.flattenedRef]) await remove(ref);
+      if (elementFolder(flattenedRef) !== folder) continue;
+      if (await elementBytesStillNeeded(cutoutRef, deps.boards)) continue;
+      for (const ref of [cutoutRef, flattenedRef]) await remove(ref);
     }
     // The three folders. An element folder is kept whole while a copy
     // on a live board points at its cut-out, decided from storage (not
diff --git a/src/server/delete-my-element.test.ts b/src/server/delete-my-element.test.ts
index 6bc041f9..1c3479b3 100644
--- a/src/server/delete-my-element.test.ts
+++ b/src/server/delete-my-element.test.ts
@@ -240,6 +240,7 @@ describe("deleteMyElement (PIN-77)", () => {
       get: (ref) => h.store.get(ref),
       listPrefix: (prefix) => h.store.listPrefix(prefix),
       copy: (from, to) => h.store.copy(from, to),
+      setHold: (ref, held) => h.store.setHold(ref, held),
       delete: async (ref) => {
         if (ref === "elements/el-f/flattened.jpg") throw new Error("gcs down");
         return h.store.delete(ref);
@@ -262,6 +263,7 @@ describe("deleteMyElement (PIN-77)", () => {
       get: (ref) => h.store.get(ref),
       listPrefix: (prefix) => h.store.listPrefix(prefix),
       copy: (from, to) => h.store.copy(from, to),
+      setHold: (ref, held) => h.store.setHold(ref, held),
       delete: async (ref) => {
         if (ref === full1) throw new Error("gcs down");
         return h.store.delete(ref);
diff --git a/src/server/derivative-store.test.ts b/src/server/derivative-store.test.ts
index 832d65c9..da42cf49 100644
--- a/src/server/derivative-store.test.ts
+++ b/src/server/derivative-store.test.ts
@@ -2,10 +2,16 @@ import { describe, expect, it } from "vitest";
 import { GcsDerivativeStore, InMemoryDerivativeStore, type DerivativeStore } from "./derivative-store";
 
 /** A bucket double with just what GcsDerivativeStore calls; it records each listing query. */
-function gcsWithFakeBucket(): { store: GcsDerivativeStore; queries: unknown[]; extraNames: string[] } {
+function gcsWithFakeBucket(): {
+  store: GcsDerivativeStore;
+  queries: unknown[];
+  extraNames: string[];
+  holds: Map<string, boolean>;
+} {
   const objects = new Map<string, Buffer>();
   const queries: unknown[] = [];
   const extraNames: string[] = [];
+  const holds = new Map<string, boolean>();
   const gone = () => Object.assign(new Error("No such object"), { code: 404 });
   const bucket = {
     file: (name: string) => ({
@@ -16,8 +22,13 @@ function gcsWithFakeBucket(): { store: GcsDerivativeStore; queries: unknown[]; e
         return [bytes];
       },
       delete: async () => {
+        if (holds.get(name)) throw Object.assign(new Error("Object is under active Temporary hold"), { code: 403 });
         if (!objects.delete(name)) throw gone();
       },
+      setMetadata: async (meta: { temporaryHold?: boolean }) => {
+        if (!objects.has(name)) throw gone();
+        holds.set(name, meta.temporaryHold === true);
+      },
     }),
     getFiles: async (query: { prefix: string }) => {
       queries.push(query);
@@ -27,9 +38,53 @@ function gcsWithFakeBucket(): { store: GcsDerivativeStore; queries: unknown[]; e
   };
   const store = new GcsDerivativeStore("synthetic-bucket", null);
   Object.assign(store, { storage: { bucket: () => bucket } });
-  return { store, queries, extraNames };
+  return { store, queries, extraNames, holds };
 }
 
+describe.each([
+  ["in-memory", (): DerivativeStore => new InMemoryDerivativeStore()],
+  ["GCS (fake bucket)", (): DerivativeStore => gcsWithFakeBucket().store],
+])("DerivativeStore.setHold (PIN-269): %s", (_name, make) => {
+  it("a held object refuses deletion until released; a missing object is a no-op", async () => {
+    const store = make();
+    const ref = "elements/boards/b1/e1/cutout.png";
+    await store.put(ref, Buffer.from("png"), "image/png");
+    await store.setHold(ref, true);
+    await expect(store.delete(ref)).rejects.toThrow();
+    expect(await store.get(ref)).toEqual(Buffer.from("png"));
+    await store.setHold(ref, false);
+    await store.delete(ref);
+    expect(await store.get(ref)).toBeNull();
+    await expect(store.setHold("elements/boards/b1/none/cutout.png", true)).resolves.toBeUndefined();
+  });
+
+  it("never accepts a held: ref (the hold goes on the real object)", async () => {
+    const store = make();
+    await expect(store.setHold("held:elements/boards/b1/e1/cutout.png", true)).rejects.toThrow("Invalid derivative");
+  });
+});
+
+describe("GcsDerivativeStore.setHold (PIN-269)", () => {
+  it("writes the temporaryHold flag through setMetadata", async () => {
+    const { store, holds } = gcsWithFakeBucket();
+    await store.put("elements/boards/b1/e1/cutout.png", Buffer.from("a"), "image/png");
+    await store.setHold("elements/boards/b1/e1/cutout.png", true);
+    expect(holds.get("elements/boards/b1/e1/cutout.png")).toBe(true);
+    await store.setHold("elements/boards/b1/e1/cutout.png", false);
+    expect(holds.get("elements/boards/b1/e1/cutout.png")).toBe(false);
+  });
+});
+
+describe("InMemoryDerivativeStore.isHeld (PIN-269 test helper)", () => {
+  it("reports the hold state", async () => {
+    const store = new InMemoryDerivativeStore();
+    await store.put("scenes/boards/b1/s1/scene.webp", Buffer.from("w"), "image/webp");
+    expect(store.isHeld("scenes/boards/b1/s1/scene.webp")).toBe(false);
+    await store.setHold("scenes/boards/b1/s1/scene.webp", true);
+    expect(store.isHeld("scenes/boards/b1/s1/scene.webp")).toBe(true);
+  });
+});
+
 describe.each([
   ["in-memory", (): DerivativeStore => new InMemoryDerivativeStore()],
   ["GCS (fake bucket)", (): DerivativeStore => gcsWithFakeBucket().store],
diff --git a/src/server/derivative-store.ts b/src/server/derivative-store.ts
index eac2469a..5bc8ecf0 100644
--- a/src/server/derivative-store.ts
+++ b/src/server/derivative-store.ts
@@ -28,6 +28,13 @@ export interface DerivativeStore {
    * source is missing (an Error, not a silent no-op).
    */
   copy(from: string, to: string): Promise<void>;
+  /**
+   * Temporary hold on one stored object (PIN-269, docs/20 §3): while
+   * held, Storage refuses to delete it, so a tombstone's sweep fails
+   * harmlessly and the bytes stay as evidence. `false` releases.
+   * A missing object is a no-op (nothing to preserve).
+   */
+  setHold(ref: string, held: boolean): Promise<void>;
 }
 
 const REF_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
@@ -53,6 +60,7 @@ function assertDerivativePrefix(prefix: string): string {
 
 export class InMemoryDerivativeStore implements DerivativeStore {
   private readonly objects = new Map<string, { bytes: Buffer; contentType: string }>();
+  private readonly holds = new Set<string>();
 
   async put(ref: string, bytes: Uint8Array, contentType: string): Promise<void> {
     this.objects.set(assertDerivativeRef(ref), {
@@ -66,8 +74,25 @@ export class InMemoryDerivativeStore implements DerivativeStore {
     return hit ? Buffer.from(hit.bytes) : null;
   }
 
+  /** Like GCS, a held object refuses deletion (the sweep counts it as failed). */
   async delete(ref: string): Promise<void> {
-    this.objects.delete(assertDerivativeRef(ref));
+    const checked = assertDerivativeRef(ref);
+    if (this.holds.has(checked)) {
+      throw Object.assign(new Error("Object is under a temporary hold."), { code: 403 });
+    }
+    this.objects.delete(checked);
+  }
+
+  async setHold(ref: string, held: boolean): Promise<void> {
+    const checked = assertDerivativeRef(ref);
+    if (!this.objects.has(checked)) return;
+    if (held) this.holds.add(checked);
+    else this.holds.delete(checked);
+  }
+
+  /** Test helper: whether `ref` is under a hold. */
+  isHeld(ref: string): boolean {
+    return this.holds.has(assertDerivativeRef(ref));
   }
 
   async listPrefix(prefix: string): Promise<string[]> {
@@ -135,6 +160,16 @@ export class GcsDerivativeStore implements DerivativeStore {
   async copy(from: string, to: string): Promise<void> {
     await this.file(from).copy(this.file(to));
   }
+
+  /** The object's `temporaryHold` flag (the runbook's `gcloud storage objects update --temporary-hold`). */
+  async setHold(ref: string, held: boolean): Promise<void> {
+    try {
+      await this.file(ref).setMetadata({ temporaryHold: held });
+    } catch (error) {
+      if ((error as { code?: number }).code === 404) return;
+      throw error;
+    }
+  }
 }
 
 const globalStore = globalThis as typeof globalThis & {
diff --git a/src/server/firestore-board-repository.ts b/src/server/firestore-board-repository.ts
index 6e254734..6e7183f1 100644
--- a/src/server/firestore-board-repository.ts
+++ b/src/server/firestore-board-repository.ts
@@ -42,21 +42,25 @@ import {
   type QuerySnapshot,
   type Transaction,
 } from "@google-cloud/firestore";
-import type {
-  Board,
-  BoardCounters,
-  BoardEvent,
-  Element,
-  Participant,
-  Pin,
-  PinStatus,
-  Scene,
+import {
+  holdRef,
+  isHeldRef,
+  releaseRef,
+  type Board,
+  type BoardCounters,
+  type BoardEvent,
+  type Element,
+  type Participant,
+  type Pin,
+  type PinStatus,
+  type Scene,
 } from "../domain/board";
 import {
   applyBoardSettings,
   type BoardRepository,
   type BoardSettingsMutator,
   type DeleteElementResult,
+  type HoldElementResult,
 } from "../domain/board-repository";
 import {
   decideJoin,
@@ -507,6 +511,170 @@ export class FirestoreBoardRepository implements BoardRepository {
     });
   }
 
+  /**
+   * Report & hold (PIN-269): the deleteElement cascade's shape (reads,
+   * then writes, one transaction) with the element kept and its refs
+   * prefixed instead of deleted. Pins are untouched.
+   */
+  async holdElement(elementId: string): Promise<HoldElementResult> {
+    const found = await this.findOneById<Element>(ELEMENTS, elementId);
+    if (!found) return { held: false, hiddenSceneIds: [] };
+    const boardId = found.value.boardId;
+    return this.db.runTransaction(async (tx) => {
+      const elementSnap = await tx.get(found.ref);
+      if (!elementSnap.exists) return { held: false, hiddenSceneIds: [] };
+      const element = rowFrom<Element>(found.ref, elementSnap.data() as DocumentData);
+      const board = await this.requireBoardTx(tx, boardId);
+      const sceneQuery: Query = this.db
+        .collectionGroup(SCENES)
+        .where("elementIds", "array-contains", elementId);
+      const sceneRows = rowsFrom<Scene>(await tx.get(sceneQuery)).filter((row) => !row.value.hidden);
+      const otherBoards = new Map<string, Board>();
+      for (const sceneBoardId of new Set(sceneRows.map((row) => row.value.boardId))) {
+        if (sceneBoardId !== boardId) otherBoards.set(sceneBoardId, await this.requireBoardTx(tx, sceneBoardId));
+      }
+      const ordered = [...sceneRows].sort(
+        (a, b) => a.value.createdAt - b.value.createdAt || a.seq - b.seq,
+      );
+      tx.set(
+        found.ref,
+        toStored(
+          {
+            ...element.value,
+            cutoutRef: holdRef(element.value.cutoutRef),
+            flattenedRef: holdRef(element.value.flattenedRef),
+          },
+          element.seq,
+        ),
+      );
+      const deltas = new Map<string, number>();
+      for (const row of ordered) {
+        tx.set(row.ref, toStored({ ...row.value, hidden: true }, row.seq));
+        deltas.set(row.value.boardId, (deltas.get(row.value.boardId) ?? 0) - 1);
+      }
+      for (const [slug, delta] of deltas) {
+        const base = slug === boardId ? board : (otherBoards.get(slug) as Board);
+        tx.set(this.boardRef(slug), toFirestoreData(withCounters(base, { sceneCount: delta })));
+      }
+      return { held: true, hiddenSceneIds: ordered.map((row) => row.value.id) };
+    });
+  }
+
+  /** True when every element the scene uses exists unheld; `released` counts as present. */
+  private async sceneElementsPresentTx(
+    tx: Transaction,
+    scene: Scene,
+    released: string | null,
+    cache: Map<string, boolean>,
+  ): Promise<boolean> {
+    for (const id of scene.elementIds) {
+      if (id === released) continue;
+      if (!cache.has(id)) {
+        const other = await this.txFindOneById<Element>(tx, ELEMENTS, id);
+        cache.set(
+          id,
+          other !== null && !isHeldRef(other.value.cutoutRef) && !isHeldRef(other.value.flattenedRef),
+        );
+      }
+      if (!cache.get(id)) return false;
+    }
+    return true;
+  }
+
+  async releaseElement(elementId: string, keepHiddenSceneIds: readonly string[] = []): Promise<boolean> {
+    const found = await this.findOneById<Element>(ELEMENTS, elementId);
+    if (!found) return false;
+    const boardId = found.value.boardId;
+    const keep = new Set(keepHiddenSceneIds);
+    return this.db.runTransaction(async (tx) => {
+      const elementSnap = await tx.get(found.ref);
+      if (!elementSnap.exists) return false;
+      const element = rowFrom<Element>(found.ref, elementSnap.data() as DocumentData);
+      const board = await this.requireBoardTx(tx, boardId);
+      const sceneQuery: Query = this.db
+        .collectionGroup(SCENES)
+        .where("elementIds", "array-contains", elementId);
+      const candidates = rowsFrom<Scene>(await tx.get(sceneQuery)).filter(
+        (row) => row.value.hidden === true && row.value.deletedAt === undefined && !keep.has(row.value.id),
+      );
+      const cache = new Map<string, boolean>();
+      const restorable: StoredRow<Scene>[] = [];
+      for (const row of candidates) {
+        if (await this.sceneElementsPresentTx(tx, row.value, elementId, cache)) restorable.push(row);
+      }
+      const otherBoards = new Map<string, Board>();
+      for (const sceneBoardId of new Set(restorable.map((row) => row.value.boardId))) {
+        if (sceneBoardId !== boardId) otherBoards.set(sceneBoardId, await this.requireBoardTx(tx, sceneBoardId));
+      }
+      tx.set(
+        found.ref,
+        toStored(
+          {
+            ...element.value,
+            cutoutRef: releaseRef(element.value.cutoutRef),
+            flattenedRef: releaseRef(element.value.flattenedRef),
+          },
+          element.seq,
+        ),
+      );
+      const deltas = new Map<string, number>();
+      for (const row of restorable) {
+        const { hidden: _hidden, ...rest } = row.value;
+        tx.set(row.ref, toStored(rest, row.seq));
+        deltas.set(row.value.boardId, (deltas.get(row.value.boardId) ?? 0) + 1);
+      }
+      for (const [slug, delta] of deltas) {
+        const base = slug === boardId ? board : (otherBoards.get(slug) as Board);
+        tx.set(this.boardRef(slug), toFirestoreData(withCounters(base, { sceneCount: delta })));
+      }
+      return true;
+    });
+  }
+
+  async hideScene(sceneId: string): Promise<boolean> {
+    const found = await this.findOneById<Scene>(SCENES, sceneId);
+    if (!found) return false;
+    return this.db.runTransaction(async (tx) => {
+      const snap = await tx.get(found.ref);
+      if (!snap.exists) return false;
+      const row = rowFrom<Scene>(found.ref, snap.data() as DocumentData);
+      const board = await this.requireBoardTx(tx, row.value.boardId);
+      if (row.value.hidden) return false;
+      tx.set(found.ref, toStored({ ...row.value, hidden: true }, row.seq));
+      tx.set(this.boardRef(row.value.boardId), toFirestoreData(withCounters(board, { sceneCount: -1 })));
+      return true;
+    });
+  }
+
+  async unhideScene(sceneId: string): Promise<boolean> {
+    const found = await this.findOneById<Scene>(SCENES, sceneId);
+    if (!found) return false;
+    return this.db.runTransaction(async (tx) => {
+      const snap = await tx.get(found.ref);
+      if (!snap.exists) return false;
+      const row = rowFrom<Scene>(found.ref, snap.data() as DocumentData);
+      const board = await this.requireBoardTx(tx, row.value.boardId);
+      if (!row.value.hidden || row.value.deletedAt !== undefined) return false;
+      if (!(await this.sceneElementsPresentTx(tx, row.value, null, new Map()))) return false;
+      const { hidden: _hidden, ...rest } = row.value;
+      tx.set(found.ref, toStored(rest, row.seq));
+      tx.set(this.boardRef(row.value.boardId), toFirestoreData(withCounters(board, { sceneCount: 1 })));
+      return true;
+    });
+  }
+
+  /** Whole-doc set inside a transaction, like the counter writes, so a racing bump never drops the flag. */
+  async setBoardReview(slug: string, at: number | null): Promise<boolean> {
+    const ref = this.boardRef(slug);
+    return this.db.runTransaction(async (tx) => {
+      const board = liveBoardFrom(await tx.get(ref));
+      if (!board) return false;
+      const { reviewAt: _review, ...rest } = board;
+      tx.set(ref, toFirestoreData(at === null ? rest : { ...rest, reviewAt: at }));
+      return true;
+    });
+  }
+
   async createPin(pin: Pin): Promise<void> {
     await this.db.runTransaction(async (tx) => {
       const board = await this.requireBoardTx(tx, pin.boardId);
diff --git a/src/server/firestore-report-store.test.ts b/src/server/firestore-report-store.test.ts
new file mode 100644
index 00000000..5c0896a8
--- /dev/null
+++ b/src/server/firestore-report-store.test.ts
@@ -0,0 +1,171 @@
+import type { Firestore } from "@google-cloud/firestore";
+import { describe, expect, it } from "vitest";
+import { describeReportStoreContract } from "../domain/report-store.contract";
+import { FirestoreReportStore } from "./firestore-report-store";
+
+/**
+ * Minimal fake Firestore for one flat collection, same approach as
+ * firestore-starter-allowance-store.test.ts: a path-keyed store,
+ * buffered transaction writes applied on commit, transactions
+ * serialized through a lock, plus the one-where query with orderBy and
+ * limit that `listOpenDue` needs (`==` and `<` only).
+ */
+type Data = Record<string, unknown>;
+
+class FakeSnapshot {
+  constructor(private readonly value?: Data) {}
+  get exists(): boolean {
+    return this.value !== undefined;
+  }
+  data(): Data | undefined {
+    return this.value ? structuredClone(this.value) : undefined;
+  }
+}
+
+class FakeDocRef {
+  constructor(
+    readonly db: FakeFirestore,
+    readonly path: string,
+  ) {}
+  async get(): Promise<FakeSnapshot> {
+    return new FakeSnapshot(this.db.store.get(this.path));
+  }
+  async create(data: Data): Promise<void> {
+    if (this.db.store.has(this.path)) throw Object.assign(new Error("already exists"), { code: 6 });
+    this.db.store.set(this.path, structuredClone(data));
+  }
+  async set(data: Data): Promise<void> {
+    this.db.store.set(this.path, structuredClone(data));
+  }
+}
+
+interface Filter {
+  field: string;
+  op: string;
+  value: unknown;
+}
+
+class FakeQuery {
+  constructor(
+    private readonly db: FakeFirestore,
+    private readonly prefix: string,
+    private readonly filter: Filter | null = null,
+    private readonly order: string | null = null,
+    private readonly max: number | null = null,
+  ) {}
+  where(field: string, op: string, value: unknown): FakeQuery {
+    if (this.filter) throw new Error("fake supports one where clause");
+    return new FakeQuery(this.db, this.prefix, { field, op, value }, this.order, this.max);
+  }
+  orderBy(field: string): FakeQuery {
+    return new FakeQuery(this.db, this.prefix, this.filter, field, this.max);
+  }
+  limit(n: number): FakeQuery {
+    return new FakeQuery(this.db, this.prefix, this.filter, this.order, n);
+  }
+  async get(): Promise<{ docs: FakeSnapshot[] }> {
+    let rows = [...this.db.store.entries()]
+      .filter(([path]) => path.startsWith(`${this.prefix}/`))
+      .map(([, data]) => data);
+    const filter = this.filter;
+    if (filter) {
+      rows = rows.filter((data) => {
+        const actual = data[filter.field];
+        if (filter.op === "==") return actual === filter.value;
+        if (filter.op === "<") return typeof actual === "number" && actual < (filter.value as number);
+        throw new Error(`fake only supports == and <, got ${filter.op}`);
+      });
+    }
+    if (this.order) {
+      const key = this.order;
+      rows = rows
+        .filter((data) => data[key] !== undefined)
+        .sort((a, b) => (a[key] as number) - (b[key] as number));
+    }
+    if (this.max !== null) rows = rows.slice(0, this.max);
+    return { docs: rows.map((data) => new FakeSnapshot(data)) };
+  }
+  doc(id: string): FakeDocRef {
+    return new FakeDocRef(this.db, `${this.prefix}/${id}`);
+  }
+}
+
+class FakeTransaction {
+  constructor(private readonly writes: (() => void)[]) {}
+  get(ref: FakeDocRef) {
+    return ref.get();
+  }
+  set(ref: FakeDocRef, data: Data): void {
+    this.writes.push(() => ref.db.store.set(ref.path, structuredClone(data)));
+  }
+}
+
+class FakeFirestore {
+  readonly store = new Map<string, Data>();
+  private lock: Promise<unknown> = Promise.resolve();
+
+  collection(name: string): FakeQuery {
+    return new FakeQuery(this, name);
+  }
+  async runTransaction<T>(fn: (tx: FakeTransaction) => Promise<T>): Promise<T> {
+    const run = async () => {
+      const writes: (() => void)[] = [];
+      const result = await fn(new FakeTransaction(writes));
+      for (const write of writes) write();
+      return result;
+    };
+    const chained = this.lock.then(run, run);
+    this.lock = chained.catch(() => undefined);
+    return chained;
+  }
+}
+
+function makeStore() {
+  const fake = new FakeFirestore();
+  return { fake, store: new FirestoreReportStore(fake as unknown as Firestore) };
+}
+
+describeReportStoreContract("Firestore (fake)", () => makeStore().store);
+
+describe("FirestoreReportStore (PIN-269)", () => {
+  it("mirrors deleteAt as the dueAt query key while open, and drops it on a decision", async () => {
+    const { fake, store } = makeStore();
+    await store.create({
+      id: "rep-1",
+      boardId: "board-slug-00000000001",
+      reference: "0123456789abcdef",
+      scope: "element",
+      targetId: "el-1",
+      reason: "likeness",
+      reporterKind: "visitor",
+      severity: "normal",
+      createdAt: 1_000,
+      status: "open",
+      deleteAt: 5_000,
+      held: { elementIds: ["el-1"], sceneIds: [], boardReview: false, storageHold: false },
+    });
+    expect(fake.store.get("reports/rep-1")).toMatchObject({ deleteAt: 5_000, dueAt: 5_000 });
+    expect(await store.get("rep-1")).not.toHaveProperty("dueAt");
+    await store.decide("rep-1", { status: "dismissed", decidedAt: 2_000 });
+    const decided = fake.store.get("reports/rep-1");
+    expect(decided).toMatchObject({ deleteAt: 5_000, status: "dismissed" });
+    expect(decided).not.toHaveProperty("dueAt");
+  });
+
+  it("a report without a deadline carries no query key", async () => {
+    const { fake, store } = makeStore();
+    await store.create({
+      id: "rep-2",
+      boardId: "board-slug-00000000001",
+      reference: "0123456789abcdef",
+      scope: "board",
+      reason: "inappropriate",
+      reporterKind: "participant",
+      severity: "normal",
+      createdAt: 1_000,
+      status: "open",
+      held: { elementIds: [], sceneIds: [], boardReview: true, storageHold: false },
+    });
+    expect(fake.store.get("reports/rep-2")).not.toHaveProperty("dueAt");
+  });
+});
diff --git a/src/server/firestore-report-store.ts b/src/server/firestore-report-store.ts
new file mode 100644
index 00000000..e5a216ba
--- /dev/null
+++ b/src/server/firestore-report-store.ts
@@ -0,0 +1,148 @@
+import "server-only";
+/**
+ * Firestore ReportStore (PIN-269): one doc per report at
+ * `reports/{id}`. Server-only; client rules stay deny-all. The board
+ * slug (`boardId`) lives in the doc and nowhere else: alerts, receipts
+ * and the operator scripts carry the opaque `reference`.
+ *
+ * `dueAt` is the backstop's query key: a mirror of `deleteAt` present
+ * only while the report is open (`decide` drops it), so
+ * `listOpenDue` is one single-field range query with no composite
+ * index, and a decided report never comes back as due (the
+ * demoSweepAt pattern of PIN-251). It is stripped on every read.
+ */
+import { Firestore, type DocumentData } from "@google-cloud/firestore";
+import type { ReportRecord } from "../domain/board-report";
+import type { ReportDecision, ReportStore } from "../domain/report-store";
+import { toFirestoreData } from "./firestore-util";
+
+const REPORTS = "reports";
+
+function fromData(data: DocumentData | undefined): ReportRecord | null {
+  if (!data) return null;
+  const { dueAt: _due, ...rest } = structuredClone(data);
+  return rest as unknown as ReportRecord;
+}
+
+function toData(record: ReportRecord): DocumentData {
+  const data = toFirestoreData(record);
+  return record.status === "open" && record.deleteAt !== undefined ? { ...data, dueAt: record.deleteAt } : data;
+}
+
+function isAlreadyExists(error: unknown): boolean {
+  if (typeof error !== "object" || error === null) return false;
+  const candidate = error as { code?: unknown; message?: unknown };
+  return (
+    candidate.code === 6 ||
+    candidate.code === "already-exists" ||
+    (typeof candidate.message === "string" && /already exists/i.test(candidate.message))
+  );
+}
+
+export class FirestoreReportStore implements ReportStore {
+  constructor(private readonly db: Firestore) {}
+
+  private ref(id: string) {
+    return this.db.collection(REPORTS).doc(id);
+  }
+
+  async create(record: ReportRecord): Promise<void> {
+    try {
+      await this.ref(record.id).create(toData(record));
+    } catch (error) {
+      if (isAlreadyExists(error)) throw new RangeError(`Report ${record.id} already exists`);
+      throw error;
+    }
+  }
+
+  async get(id: string): Promise<ReportRecord | null> {
+    return fromData((await this.ref(id).get()).data());
+  }
+
+  async listByReference(reference: string): Promise<ReportRecord[]> {
+    const snap = await this.db.collection(REPORTS).where("reference", "==", reference).get();
+    return snap.docs
+      .map((doc) => fromData(doc.data()))
+      .filter((record): record is ReportRecord => record !== null)
+      .sort((a, b) => b.createdAt - a.createdAt);
+  }
+
+  async listOpenForBoard(boardId: string): Promise<ReportRecord[]> {
+    return (await this.listForBoard(boardId)).filter((record) => record.status === "open");
+  }
+
+  async listForBoard(boardId: string): Promise<ReportRecord[]> {
+    const snap = await this.db.collection(REPORTS).where("boardId", "==", boardId).get();
+    return snap.docs
+      .map((doc) => fromData(doc.data()))
+      .filter((record): record is ReportRecord => record !== null)
+      .sort((a, b) => a.createdAt - b.createdAt);
+  }
+
+  /** One equality query (no index entry); the oldest `limit` of what it returns, sorted here. */
+  async listOpen(limit: number): Promise<ReportRecord[]> {
+    if (limit <= 0) return [];
+    const snap = await this.db.collection(REPORTS).where("status", "==", "open").get();
+    return snap.docs
+      .map((doc) => fromData(doc.data()))
+      .filter((record): record is ReportRecord => record !== null)
+      .sort((a, b) => a.createdAt - b.createdAt)
+      .slice(0, limit);
+  }
+
+  async listOpenDue(before: number, limit: number): Promise<ReportRecord[]> {
+    if (limit <= 0) return [];
+    const snap = await this.db
+      .collection(REPORTS)
+      .where("dueAt", "<", before)
+      .orderBy("dueAt")
+      .limit(limit)
+      .get();
+    return snap.docs
+      .map((doc) => fromData(doc.data()))
+      .filter((record): record is ReportRecord => record !== null && record.status === "open");
+  }
+
+  async decide(id: string, decision: ReportDecision): Promise<ReportRecord | null> {
+    const ref = this.ref(id);
+    return this.db.runTransaction(async (tx) => {
+      const current = fromData((await tx.get(ref)).data());
+      if (!current || current.status !== "open") return null;
+      const decided: ReportRecord = {
+        ...current,
+        status: decision.status,
+        decidedAt: decision.decidedAt,
+        ...(decision.note !== undefined ? { note: decision.note } : {}),
+      };
+      tx.set(ref, toData(decided));
+      return structuredClone(decided);
+    });
+  }
+
+  async markHoldsReleased(id: string, at: number): Promise<ReportRecord | null> {
+    const ref = this.ref(id);
+    return this.db.runTransaction(async (tx) => {
+      const current = fromData((await tx.get(ref)).data());
+      if (!current) return null;
+      const released: ReportRecord = { ...current, held: { ...current.held, storageHold: false }, holdsReleasedAt: at };
+      tx.set(ref, toData(released));
+      return structuredClone(released);
+    });
+  }
+}
+
+export interface FirestoreReportStoreOptions {
+  projectId?: string | null;
+  emulatorHost?: string | null;
+}
+
+export function createFirestoreReportStore(options: FirestoreReportStoreOptions = {}): FirestoreReportStore {
+  const db = options.emulatorHost
+    ? new Firestore({
+        projectId: options.projectId ?? undefined,
+        host: options.emulatorHost,
+        ssl: false,
+      })
+    : new Firestore({ projectId: options.projectId ?? undefined });
+  return new FirestoreReportStore(db);
+}
diff --git a/src/server/report-decide.test.ts b/src/server/report-decide.test.ts
new file mode 100644
index 00000000..855d0f48
--- /dev/null
+++ b/src/server/report-decide.test.ts
@@ -0,0 +1,329 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { emptyBoardCounters, type Element, type Participant, type Scene } from "../domain/board";
+import { InMemoryBoardRepository } from "../domain/board-repository";
+import { InMemoryReportStore } from "../domain/report-store";
+import { boardReportRef } from "../domain/tokens";
+import { InMemoryUserRepository } from "../domain/user-repository";
+import { resolvePolicy } from "../policy/policy";
+import { createReport, type ReportDeps } from "./board-report";
+import { InMemoryDerivativeStore } from "./derivative-store";
+import { dismissReport, releaseReportHolds, sweepDueReports, takedownReport, type ReportDecideDeps } from "./report-decide";
+
+/**
+ * The operator side (PIN-272): holds set by real reports (createReport),
+ * then dismissed, taken down or swept. Memory ports, fixed clock.
+ */
+const SLUG = "AbCdEfGhIjKlMnOpQrStUv";
+const NOW = 1_700_000_000_000;
+const HOUR = 3_600_000;
+const UID = "uid-mia";
+
+const participant: Participant = { id: "p1", boardId: SLUG, displayName: "Mia", cookieSecretHash: "h", userId: UID, createdAt: 1_100 };
+const refsOf = (id: string) => [`elements/boards/${SLUG}/${id}/cutout.png`, `elements/boards/${SLUG}/${id}/flattened.jpg`];
+const sceneRef = (id: string) => `scenes/boards/${SLUG}/${id}/scene.webp`;
+
+async function harness() {
+  const boards = new InMemoryBoardRepository();
+  const store = new InMemoryDerivativeStore();
+  const reports = new InMemoryReportStore();
+  const users = new InMemoryUserRepository();
+  const policy = resolvePolicy(null);
+  await boards.createBoard({ slug: SLUG, title: "Party", counters: emptyBoardCounters(), createdAt: 1_000, version: 0 });
+  await boards.putParticipant(participant);
+  await users.putUserBoard(UID, { boardId: SLUG, participantId: "p1", claimedAt: 1_100, updatedAt: 1_100 });
+  const element = (id: string, faceFlag: boolean): Element => ({
+    id, boardId: SLUG, ownerId: "p1", label: id, description: "", maskBox: { x1: 0, y1: 0, x2: 1, y2: 1 },
+    cutoutRef: refsOf(id)[0], flattenedRef: refsOf(id)[1], sourcePhotoId: "job", faceFlag, createdAt: 1_200,
+  });
+  await boards.createElement(element("mug", false));
+  await boards.createElement(element("friend", true));
+  for (const id of ["mug", "friend"]) {
+    await store.put(refsOf(id)[0], Buffer.from("c"), "image/png");
+    await store.put(refsOf(id)[1], Buffer.from("f"), "image/jpeg");
+  }
+  const scene = (id: string, elementIds: string[]): Scene => ({
+    id, boardId: SLUG, createdBy: "p1", elementIds, prompt: "x", status: "ready",
+    imageRef: sceneRef(id), promptVersion: "scene.v1", createdAt: 1_400,
+  });
+  await boards.putScene(scene("s-mug", ["mug"]));
+  await boards.putScene(scene("s-both", ["mug", "friend"]));
+  for (const id of ["s-mug", "s-both"]) await store.put(sceneRef(id), Buffer.from("w"), "image/webp");
+  let ids = 0;
+  const reportDeps: ReportDeps = { boards, store, reports, policy, now: () => NOW, newId: () => `rep-${++ids}` };
+  const deps: ReportDecideDeps = { boards, users, store, reports, now: () => NOW + HOUR };
+  const file = async (slug: string, body: unknown, viewer: Participant | null = null) =>
+    (await createReport(slug, body, viewer, reportDeps)).record;
+  return { boards, store, reports, users, deps, file };
+}
+
+describe("report decisions (PIN-272)", () => {
+  beforeEach(() => {
+    vi.spyOn(console, "log").mockImplementation(() => {});
+    vi.spyOn(console, "error").mockImplementation(() => {});
+  });
+  afterEach(() => vi.restoreAllMocks());
+
+  it("dismiss puts back exactly what an element report hid, once", async () => {
+    const h = await harness();
+    const report = await h.file(SLUG, { scope: "element", targetId: "mug", reason: "inappropriate" });
+    expect(await h.boards.listScenes(SLUG)).toEqual([]);
+    const outcome = await dismissReport(report.id, h.deps, "false alarm");
+    expect(outcome?.released).toEqual({ elements: 1, scenes: 0, boardReview: false, storage: false });
+    expect(outcome?.record).toMatchObject({ status: "dismissed", decidedAt: NOW + HOUR, note: "false alarm" });
+    expect((await h.boards.getElement("mug"))?.cutoutRef).toBe(refsOf("mug")[0]);
+    expect((await h.boards.listScenes(SLUG)).map((s) => s.id)).toEqual(["s-mug", "s-both"]);
+    expect(await dismissReport(report.id, h.deps)).toBeNull();
+    expect(await dismissReport("missing", h.deps)).toBeNull();
+  });
+
+  it("dismiss keeps what another open report on the board still holds", async () => {
+    const h = await harness();
+    const first = await h.file(SLUG, { scope: "element", targetId: "mug", reason: "inappropriate" });
+    const second = await h.file(SLUG, { scope: "board", reason: "illegal" });
+    // Dismissing the first report: mug stays held (the board report lists it), review and storage stay.
+    const one = await dismissReport(first.id, h.deps);
+    expect(one?.released).toEqual({ elements: 0, scenes: 0, boardReview: false, storage: false });
+    expect((await h.boards.getElement("mug"))?.cutoutRef).toBe(`held:${refsOf("mug")[0]}`);
+    expect((await h.boards.getBoard(SLUG))?.reviewAt).toBe(NOW);
+    expect(h.store.isHeld(refsOf("mug")[0])).toBe(true);
+    // Dismissing the board report releases everything.
+    const two = await dismissReport(second.id, h.deps);
+    expect(two?.released).toEqual({ elements: 2, scenes: 0, boardReview: true, storage: true });
+    expect((await h.boards.getBoard(SLUG))?.reviewAt).toBeUndefined();
+    expect((await h.boards.listScenes(SLUG)).map((s) => s.id)).toEqual(["s-mug", "s-both"]);
+    for (const ref of [...refsOf("mug"), ...refsOf("friend"), sceneRef("s-mug"), sceneRef("s-both")]) {
+      expect(h.store.isHeld(ref)).toBe(false);
+    }
+  });
+
+  it("dismiss of a scene report brings the scene back", async () => {
+    const h = await harness();
+    const report = await h.file(SLUG, { scope: "scene", targetId: "s-both", reason: "ownership" });
+    const outcome = await dismissReport(report.id, h.deps);
+    expect(outcome?.released).toEqual({ elements: 0, scenes: 1, boardReview: false, storage: false });
+    expect((await h.boards.listScenes(SLUG)).map((s) => s.id)).toEqual(["s-mug", "s-both"]);
+  });
+
+  it("takedown of an element deletes the record and its objects, and the scenes' pictures", async () => {
+    const h = await harness();
+    const report = await h.file(SLUG, { scope: "element", targetId: "friend", reason: "likeness" });
+    const result = await takedownReport(report.id, h.deps, "confirmed");
+    expect(result).toMatchObject({ outcome: "element_deleted", record: { status: "takedown", note: "confirmed" } });
+    expect(await h.boards.getElement("friend")).toBeNull();
+    expect(await h.store.get(refsOf("friend")[0])).toBeNull();
+    expect(await h.store.get(refsOf("friend")[1])).toBeNull();
+    // s-both used friend: hidden by the hold, its picture gone with the takedown; s-mug untouched.
+    expect(await h.store.get(sceneRef("s-both"))).toBeNull();
+    expect(await h.store.get(sceneRef("s-mug"))).not.toBeNull();
+    expect((await h.boards.getElement("mug"))?.cutoutRef).toBe(refsOf("mug")[0]);
+    expect(await takedownReport(report.id, h.deps)).toBeNull();
+  });
+
+  it("takedown under an illegal-content hold keeps the held objects (evidence) and still closes the report", async () => {
+    const h = await harness();
+    const illegal = await h.file(SLUG, { scope: "board", reason: "illegal" });
+    const result = await takedownReport(illegal.id, h.deps);
+    expect(result?.outcome).toBe("board_deleted");
+    expect(await h.boards.getBoard(SLUG)).toBeNull();
+    for (const ref of [...refsOf("mug"), ...refsOf("friend"), sceneRef("s-mug"), sceneRef("s-both")]) {
+      expect(await h.store.get(ref)).not.toBeNull();
+      expect(h.store.isHeld(ref)).toBe(true);
+    }
+    expect(await h.users.getUserBoard(UID, SLUG)).toBeNull();
+    // Close-out: release this report's holds, then the objects can go.
+    expect(await releaseReportHolds(result!.record, h.deps)).toEqual({ released: 6, kept: 0, failed: 0 });
+    expect(h.store.isHeld(refsOf("mug")[0])).toBe(false);
+  });
+
+  it("takedown of a scene tombstones it and deletes its picture", async () => {
+    const h = await harness();
+    const report = await h.file(SLUG, { scope: "scene", targetId: "s-mug", reason: "inappropriate" });
+    const result = await takedownReport(report.id, h.deps);
+    expect(result?.outcome).toBe("scene_deleted");
+    const scene = await h.boards.getScene("s-mug");
+    expect(scene).toMatchObject({ hidden: true, deletedAt: NOW + HOUR, deletedBy: "host" });
+    expect(await h.store.get(sceneRef("s-mug"))).toBeNull();
+    expect(await h.store.get(sceneRef("s-both"))).not.toBeNull();
+  });
+
+  it("takedown of a participant's board report tombstones the board, unlinks My boards and sweeps storage", async () => {
+    const h = await harness();
+    const report = await h.file(SLUG, { scope: "board", reason: "inappropriate" }, participant);
+    const result = await takedownReport(report.id, h.deps);
+    expect(result?.outcome).toBe("board_deleted");
+    expect(await h.boards.getBoard(SLUG)).toBeNull();
+    expect(await h.users.getUserBoard(UID, SLUG)).toBeNull();
+    for (const ref of [...refsOf("mug"), ...refsOf("friend"), sceneRef("s-mug"), sceneRef("s-both")]) {
+      expect(await h.store.get(ref)).toBeNull();
+    }
+    // A second decision on the same report, or on a board that is gone, is not an error.
+    expect(await takedownReport(report.id, h.deps)).toBeNull();
+    const late = await h.reports.create({ ...report, id: "late", status: "open" }).then(() => takedownReport("late", h.deps));
+    expect(late?.outcome).toBe("already_gone");
+  });
+
+  it("the sweep takes down due likeness reports in deadline order, batch-capped, and never an illegal one", async () => {
+    const h = await harness();
+    const timed = await h.file(SLUG, { scope: "element", targetId: "friend", reason: "likeness" });
+    expect(timed.deleteAt).toBe(NOW + 24 * HOUR);
+    // An illegal record with a deadline must not exist by construction; the sweep refuses it anyway.
+    await h.reports.create({ ...timed, id: "forged", reason: "illegal", deleteAt: NOW + 1, targetId: "mug" });
+    // A due report on a thing that no longer exists closes as already_gone.
+    await h.reports.create({ ...timed, id: "ghost", targetId: "ghost", deleteAt: NOW + 2 });
+
+    expect(await sweepDueReports(h.deps, NOW + 23 * HOUR, 10)).toEqual({ due: 2, takenDown: 1, skipped: 1 });
+    expect((await h.reports.get("forged"))?.status).toBe("open");
+    expect((await h.reports.get("ghost"))?.status).toBe("takedown");
+    expect(await h.boards.getElement("friend")).not.toBeNull();
+
+    expect(await sweepDueReports(h.deps, NOW + 25 * HOUR, 0)).toEqual({ due: 0, takenDown: 0, skipped: 0 });
+    expect(await sweepDueReports(h.deps, NOW + 25 * HOUR, 10)).toEqual({ due: 2, takenDown: 1, skipped: 1 });
+    expect(await h.boards.getElement("friend")).toBeNull();
+    expect((await h.reports.get(timed.id))).toMatchObject({ status: "takedown", note: "timed takedown (takedownHours)" });
+    expect(await sweepDueReports(h.deps, NOW + 25 * HOUR, 10)).toEqual({ due: 1, takenDown: 0, skipped: 1 });
+  });
+
+  it("dismiss never brings back a scene another open report holds on its own", async () => {
+    const h = await harness();
+    const sceneReport = await h.file(SLUG, { scope: "scene", targetId: "s-both", reason: "illegal" });
+    // The pin report finds s-both already hidden and hides s-mug.
+    const pinReport = await h.file(SLUG, { scope: "element", targetId: "mug", reason: "inappropriate" });
+    expect(pinReport.held).toEqual({ elementIds: ["mug"], sceneIds: ["s-mug"], boardReview: false, storageHold: false });
+    const outcome = await dismissReport(pinReport.id, h.deps);
+    expect(outcome?.released).toEqual({ elements: 1, scenes: 0, boardReview: false, storage: false });
+    expect((await h.boards.listScenes(SLUG)).map((s) => s.id)).toEqual(["s-mug"]);
+    expect((await h.boards.getScene("s-both"))?.hidden).toBe(true);
+    // The scene report's own dismiss brings it back.
+    const second = await dismissReport(sceneReport.id, h.deps);
+    expect(second?.released.scenes).toBe(1);
+    expect((await h.boards.listScenes(SLUG)).map((s) => s.id)).toEqual(["s-mug", "s-both"]);
+  });
+
+  it("a pin takedown keeps the picture of a scene another open report is about", async () => {
+    const h = await harness();
+    const sceneReport = await h.file(SLUG, { scope: "scene", targetId: "s-both", reason: "illegal" });
+    const pinReport = await h.file(SLUG, { scope: "element", targetId: "friend", reason: "likeness" });
+    expect(pinReport.held.sceneIds).toEqual([]); // s-both was already hidden by the scene report
+    const result = await takedownReport(pinReport.id, h.deps);
+    expect(result?.outcome).toBe("element_deleted");
+    expect(await h.boards.getElement("friend")).toBeNull();
+    // The scene report's evidence stays (hold and picture); s-mug, used by mug only, is untouched.
+    expect(await h.store.get(sceneRef("s-both"))).not.toBeNull();
+    expect(h.store.isHeld(sceneRef("s-both"))).toBe(true);
+    expect((await h.reports.get(sceneReport.id))?.status).toBe("open");
+    expect(await h.store.get(sceneRef("s-mug"))).not.toBeNull();
+  });
+
+  it("a report someone else decided first is left alone: the decision is claimed before anything is touched", async () => {
+    const h = await harness();
+    const report = await h.file(SLUG, { scope: "element", targetId: "friend", reason: "likeness" });
+    // The sweep (or another operator terminal) got there first.
+    expect(await h.reports.decide(report.id, { status: "takedown", decidedAt: NOW })).not.toBeNull();
+    expect(await dismissReport(report.id, h.deps)).toBeNull();
+    expect((await h.boards.getElement("friend"))?.cutoutRef).toBe(`held:${refsOf("friend")[0]}`);
+    expect(await takedownReport(report.id, h.deps)).toBeNull();
+    expect(await h.boards.getElement("friend")).not.toBeNull();
+    expect((await h.reports.get(report.id))?.status).toBe("takedown");
+  });
+
+  it("releasing holds keeps the objects another board's open illegal report still holds as evidence", async () => {
+    const h = await harness();
+    const OTHER = "ZyXwVuTsRqPoNmLkJiHgFe";
+    await h.boards.createBoard({ slug: OTHER, title: "Other", counters: emptyBoardCounters(), createdAt: 1_000, version: 0 });
+    await h.boards.putParticipant({ ...participant, id: "p2", boardId: OTHER, userId: undefined });
+    const srcRefs = [`elements/boards/${OTHER}/src/cutout.png`, `elements/boards/${OTHER}/src/flattened.jpg`];
+    for (const ref of srcRefs) await h.store.put(ref, Buffer.from("s"), "image/png");
+    const base = { description: "", maskBox: { x1: 0, y1: 0, x2: 1, y2: 1 }, sourcePhotoId: "job", faceFlag: false };
+    await h.boards.createElement({ ...base, id: "src", boardId: OTHER, ownerId: "p2", label: "src", cutoutRef: srcRefs[0], flattenedRef: srcRefs[1], createdAt: 1_200 });
+    // A library copy on this board shares the other board's bytes (PIN-85).
+    await h.boards.createElement({ ...base, id: "copy", boardId: SLUG, ownerId: "p1", label: "copy", cutoutRef: srcRefs[0], flattenedRef: srcRefs[1], sourceElementId: "src", createdAt: 1_250 });
+    const theirs = await h.file(OTHER, { scope: "board", reason: "illegal" });
+    const mine = await h.file(SLUG, { scope: "board", reason: "illegal" });
+    expect(srcRefs.every((ref) => h.store.isHeld(ref))).toBe(true);
+
+    const outcome = await dismissReport(mine.id, h.deps);
+    expect(outcome?.released.storage).toBe(true);
+    expect(h.store.isHeld(refsOf("mug")[0])).toBe(false);
+    // The other board's evidence is not this report's to release.
+    expect(srcRefs.every((ref) => h.store.isHeld(ref))).toBe(true);
+    expect(await releaseReportHolds(outcome!.record, h.deps)).toMatchObject({ kept: 2, failed: 0 });
+
+    await dismissReport(theirs.id, h.deps);
+    expect(srcRefs.some((ref) => h.store.isHeld(ref))).toBe(false);
+  });
+
+  it("an illegal scene report on a scene another hold hid keeps it hidden through that hold's dismiss", async () => {
+    const h = await harness();
+    const pinReport = await h.file(SLUG, { scope: "element", targetId: "friend", reason: "inappropriate" }); // hides s-both
+    const sceneReport = await h.file(SLUG, { scope: "scene", targetId: "s-both", reason: "illegal" });
+    expect(sceneReport.held).toMatchObject({ sceneIds: ["s-both"], storageHold: true });
+    await dismissReport(pinReport.id, h.deps);
+    expect((await h.boards.getElement("friend"))?.cutoutRef).toBe(refsOf("friend")[0]);
+    expect((await h.boards.listScenes(SLUG)).map((s) => s.id)).toEqual(["s-mug"]);
+    expect(h.store.isHeld(sceneRef("s-both"))).toBe(true);
+    await dismissReport(sceneReport.id, h.deps);
+    expect((await h.boards.listScenes(SLUG)).map((s) => s.id)).toEqual(["s-mug", "s-both"]);
+    expect(h.store.isHeld(sceneRef("s-both"))).toBe(false);
+  });
+
+  it("a dismiss never clears the evidence holds of a confirmed takedown on the same board", async () => {
+    const h = await harness();
+    const confirmed = await h.file(SLUG, { scope: "element", targetId: "friend", reason: "illegal" });
+    const taken = await takedownReport(confirmed.id, h.deps, "confirmed");
+    expect(taken?.outcome).toBe("element_deleted");
+    // The record is gone, the objects are held and still there.
+    expect(await h.boards.getElement("friend")).toBeNull();
+    for (const ref of refsOf("friend")) {
+      expect(await h.store.get(ref)).not.toBeNull();
+      expect(h.store.isHeld(ref)).toBe(true);
+    }
+    // A later illegal pin report on the same board, dismissed as a false alarm.
+    const later = await h.file(SLUG, { scope: "element", targetId: "mug", reason: "illegal" });
+    const outcome = await dismissReport(later.id, h.deps);
+    expect(outcome?.released.storage).toBe(true);
+    expect(h.store.isHeld(refsOf("mug")[0])).toBe(false);
+    for (const ref of refsOf("friend")) expect(h.store.isHeld(ref)).toBe(true);
+    // The close-out of the takedown releases exactly its own objects.
+    expect(await releaseReportHolds(taken!.record, h.deps)).toMatchObject({ kept: 0, failed: 0 });
+    for (const ref of refsOf("friend")) expect(h.store.isHeld(ref)).toBe(false);
+  });
+
+  it("two takedowns sharing objects release in turn: a closed-out report protects nothing any more", async () => {
+    const h = await harness();
+    // A board-wide illegal report and a pin illegal report overlap on friend's objects and s-both.
+    const wide = await h.file(SLUG, { scope: "board", reason: "illegal" });
+    const narrow = await h.file(SLUG, { scope: "element", targetId: "friend", reason: "illegal" });
+    const narrowDone = await takedownReport(narrow.id, h.deps);
+    const wideDone = await takedownReport(wide.id, h.deps);
+    expect(narrowDone?.outcome).toBe("element_deleted");
+    expect(wideDone?.outcome).toBe("board_deleted");
+    for (const ref of [...refsOf("mug"), ...refsOf("friend")]) expect(h.store.isHeld(ref)).toBe(true);
+    // Closing out the wide one keeps what the narrow one still holds.
+    const first = await releaseReportHolds(wideDone!.record, h.deps);
+    expect(first.kept).toBeGreaterThan(0);
+    expect(h.store.isHeld(refsOf("mug")[0])).toBe(false);
+    expect(h.store.isHeld(refsOf("friend")[0])).toBe(true);
+    expect((await h.reports.get(wide.id))).toMatchObject({ held: { storageHold: false }, holdsReleasedAt: NOW + HOUR });
+    // Closing out the narrow one frees the rest: the wide one no longer counts as holding.
+    const second = await releaseReportHolds((await h.reports.get(narrow.id))!, h.deps);
+    expect(second).toMatchObject({ kept: 0, failed: 0 });
+    for (const ref of [...refsOf("mug"), ...refsOf("friend"), sceneRef("s-mug"), sceneRef("s-both")]) expect(h.store.isHeld(ref)).toBe(false);
+  });
+
+  it("a queued-only scene report keeps nothing hidden: the report that hid the scene restores it", async () => {
+    const h = await harness();
+    const pinReport = await h.file(SLUG, { scope: "element", targetId: "friend", reason: "inappropriate" }); // hides s-both
+    const queued = await h.file(SLUG, { scope: "scene", targetId: "s-both", reason: "ownership" });
+    expect(queued.held).toEqual({ elementIds: [], sceneIds: [], boardReview: false, storageHold: false });
+    await dismissReport(pinReport.id, h.deps);
+    expect((await h.boards.listScenes(SLUG)).map((s) => s.id)).toEqual(["s-mug", "s-both"]);
+    expect((await h.reports.get(queued.id))?.status).toBe("open");
+  });
+
+  it("references stay the only board id in a decision's record", async () => {
+    const h = await harness();
+    const report = await h.file(SLUG, { scope: "board", reason: "inappropriate" });
+    const outcome = await dismissReport(report.id, h.deps);
+    expect(outcome?.record.reference).toBe(boardReportRef(SLUG));
+  });
+});
diff --git a/src/server/report-decide.ts b/src/server/report-decide.ts
new file mode 100644
index 00000000..8384b683
--- /dev/null
+++ b/src/server/report-decide.ts
@@ -0,0 +1,317 @@
+import "server-only";
+/**
+ * The operator's side of Report & hold (PIN-272, ADR-004 decision 6,
+ * docs/20): dismiss restores exactly what a report held, unless another
+ * open report on the same board still needs it; takedown removes the
+ * reported thing the way the product deletes (element cascade, scene
+ * tombstone, board tombstone + unlink + storage sweep); the backstop
+ * takes down the reports whose deadline passed, never an `illegal`
+ * one. Storage temporary holds are released only by `releaseReportHolds`
+ * (a dismiss, or the close-out of docs/20 §7), never by a takedown: a held object
+ * refuses deletion, which is the point. Run through
+ * `scripts/report-ops.ts`; never from a request.
+ */
+import { releaseRef, type Scene } from "../domain/board";
+import type { BoardRepository } from "../domain/board-repository";
+import type { ReportRecord } from "../domain/board-report";
+import type { ReportStore } from "../domain/report-store";
+import type { UserRepository } from "../domain/user-repository";
+import { deleteSceneObjects } from "./board-api";
+import { unlinkMyBoards } from "./board-delete";
+import { listBoardObjectRefs, listTargetObjectRefs } from "./board-report";
+import { elementBytesStillNeeded, sweepDeletedBoardStorage } from "./board-storage";
+import type { DerivativeStore } from "./derivative-store";
+import { logServerError } from "./safe-log";
+
+export interface ReportDecideDeps {
+  boards: BoardRepository;
+  users: UserRepository;
+  store: DerivativeStore;
+  reports: ReportStore;
+  now?: () => number;
+}
+
+export interface ReleasedCounts {
+  elements: number;
+  scenes: number;
+  boardReview: boolean;
+  storage: boolean;
+}
+
+export interface DismissOutcome {
+  record: ReportRecord;
+  released: ReleasedCounts;
+}
+
+/** A missing board (deleted meanwhile) reads as RangeError from the repository: the hold is moot. */
+function isGoneBoard(error: unknown): boolean {
+  return error instanceof RangeError;
+}
+
+export interface HoldReleaseResult {
+  released: number;
+  /** Objects left held: another report (open, or a confirmed takedown awaiting its close-out) still holds them as evidence. */
+  kept: number;
+  failed: number;
+}
+
+/** The board a stored object belongs to, from its folder; null for any other path. */
+const OBJECT_OWNER = /^(?:elements|scenes)\/boards\/([A-Za-z0-9_-]{22})\//;
+
+/**
+ * A report whose Storage hold still stands: `held.storageHold` is
+ * turned off by `releaseReportHolds` (a dismiss, or the close-out), so
+ * two takedowns sharing objects release in turn instead of protecting
+ * each other for good.
+ */
+function stillHoldsStorage(report: ReportRecord): boolean {
+  return report.held.storageHold;
+}
+
+/**
+ * The objects a report's Storage hold covers: what it recorded at hold
+ * time, or, for a record written before `storageRefs` existed, the
+ * board's folders (board-wide hold) or its targets' objects as the
+ * records stand now.
+ */
+async function coveredRefs(report: ReportRecord, deps: Pick<ReportDecideDeps, "boards" | "store">): Promise<string[]> {
+  if (report.held.storageRefs) return report.held.storageRefs;
+  const [elements, scenes] = await Promise.all([
+    deps.boards.listElements(report.boardId),
+    deps.boards.listScenes(report.boardId, { includeHidden: true }),
+  ]);
+  if (report.held.boardReview) return listBoardObjectRefs(report.boardId, elements, scenes, deps.store);
+  const sceneIds = new Set(report.held.sceneIds.concat(report.scope === "scene" && report.targetId ? [report.targetId] : []));
+  return listTargetObjectRefs(
+    report.boardId,
+    elements.filter((e) => report.held.elementIds.includes(e.id)),
+    scenes.filter((s) => sceneIds.has(s.id)),
+    deps.store,
+  );
+}
+
+/**
+ * Release the Storage temporary holds one report set (a false alarm, or
+ * the docs/20 §7 close-out of a confirmed takedown): exactly its own
+ * objects, minus any object another report still holds, on this board
+ * (open, or a takedown awaiting its own close-out) or on the board a
+ * library copy's bytes belong to. Best-effort per object; returns how
+ * many were released, kept and failed.
+ */
+export async function releaseReportHolds(
+  report: ReportRecord,
+  deps: Pick<ReportDecideDeps, "boards" | "store" | "reports" | "now">,
+): Promise<HoldReleaseResult> {
+  const result: HoldReleaseResult = { released: 0, kept: 0, failed: 0 };
+  const own = await coveredRefs(report, deps);
+  if (own.length === 0) return result;
+  const owners = new Set<string>([report.boardId]);
+  for (const ref of own) {
+    const owner = OBJECT_OWNER.exec(ref)?.[1];
+    if (owner) owners.add(owner);
+  }
+  const protectedRefs = new Set<string>();
+  for (const owner of owners) {
+    for (const other of await deps.reports.listForBoard(owner)) {
+      if (other.id === report.id || !stillHoldsStorage(other)) continue;
+      for (const ref of await coveredRefs(other, deps)) protectedRefs.add(ref);
+    }
+  }
+  for (const ref of own) {
+    if (protectedRefs.has(ref)) {
+      result.kept += 1;
+      continue;
+    }
+    try {
+      await deps.store.setHold(ref, false);
+      result.released += 1;
+    } catch (error) {
+      result.failed += 1;
+      logServerError("storage hold release failed", error);
+    }
+  }
+  // This report no longer holds anything: what it kept for another
+  // report is that report's to release.
+  await deps.reports.markHoldsReleased(report.id, deps.now?.() ?? Date.now());
+  return result;
+}
+
+/**
+ * False alarm, or not actionable: put back what this report hid. Holds
+ * another open report on the same board still lists stay, and a scene
+ * such a report holds on its own is never brought back by a pin's
+ * release. The decision is recorded first (claim-before-act, like the
+ * jobs): the daily sweep and an operator can both see the same open
+ * report, and only the one that claims it acts. Null when the report is
+ * missing or already decided.
+ */
+export async function dismissReport(
+  id: string,
+  deps: ReportDecideDeps,
+  note?: string,
+): Promise<DismissOutcome | null> {
+  const now = deps.now?.() ?? Date.now();
+  const record = await deps.reports.decide(id, { status: "dismissed", decidedAt: now, ...(note ? { note } : {}) });
+  if (!record) return null;
+  const others = (await deps.reports.listOpenForBoard(record.boardId)).filter((r) => r.id !== id);
+  const stillElements = new Set(others.flatMap((r) => r.held.elementIds));
+  // A scene another open report holds stays hidden. A scene report
+  // lists its scene when it hid it or found it hidden under an
+  // `illegal` reason; a queued-only report lists nothing and keeps
+  // nothing hidden.
+  const stillScenes = new Set(others.flatMap((r) => r.held.sceneIds));
+  const stillReview = others.some((r) => r.held.boardReview);
+  const released: ReleasedCounts = { elements: 0, scenes: 0, boardReview: false, storage: false };
+
+  for (const elementId of record.held.elementIds) {
+    if (stillElements.has(elementId)) continue;
+    try {
+      if (await deps.boards.releaseElement(elementId, [...stillScenes])) released.elements += 1;
+    } catch (error) {
+      if (!isGoneBoard(error)) throw error;
+    }
+  }
+  for (const sceneId of record.held.sceneIds) {
+    if (stillScenes.has(sceneId)) continue;
+    try {
+      if (await deps.boards.unhideScene(sceneId)) released.scenes += 1;
+    } catch (error) {
+      if (!isGoneBoard(error)) throw error;
+    }
+  }
+  if (record.held.boardReview && !stillReview) {
+    released.boardReview = await deps.boards.setBoardReview(record.boardId, null);
+  }
+  if (record.held.storageHold) {
+    // Only this report's own objects, minus what any other holding
+    // report (open, or a takedown awaiting its close-out) still needs.
+    const holds = await releaseReportHolds(record, deps);
+    released.storage = holds.failed === 0;
+  }
+  return { record, released };
+}
+
+export type TakedownOutcome = "element_deleted" | "scene_deleted" | "board_deleted" | "already_gone";
+
+export interface TakedownResult {
+  record: ReportRecord;
+  outcome: TakedownOutcome;
+}
+
+/**
+ * Confirmed: remove the reported thing for everyone. Storage holds are
+ * left in place (a held object refuses deletion; the sweep counts it as
+ * failed and the bytes stay as evidence until `releaseStorageHolds`).
+ * The decision is recorded first (claim-before-act), so two actors never
+ * both delete or one restores what the other removed. Null when the
+ * report is missing or already decided.
+ */
+export async function takedownReport(
+  id: string,
+  deps: ReportDecideDeps,
+  note?: string,
+): Promise<TakedownResult | null> {
+  const now = deps.now?.() ?? Date.now();
+  const record = await deps.reports.decide(id, { status: "takedown", decidedAt: now, ...(note ? { note } : {}) });
+  if (!record) return null;
+  // Scenes another open report on the board holds keep their pictures:
+  // that report (an `illegal` scene report included) decides them, not
+  // this one.
+  const others = await deps.reports.listOpenForBoard(record.boardId);
+  const keepScenePictures = new Set(others.flatMap((r) => r.held.sceneIds));
+  let outcome: TakedownOutcome = "already_gone";
+  try {
+    if (record.scope === "element" && record.targetId) {
+      outcome = await takedownElement(record.boardId, record.targetId, record.held.sceneIds, keepScenePictures, deps);
+    } else if (record.scope === "scene" && record.targetId) {
+      outcome = await takedownScene(record.targetId, now, deps);
+    } else if (record.scope === "board") {
+      outcome = await takedownBoard(record.boardId, now, deps);
+    }
+  } catch (error) {
+    if (!isGoneBoard(error)) throw error;
+  }
+  return { record, outcome };
+}
+
+async function takedownElement(
+  boardId: string,
+  elementId: string,
+  heldSceneIds: readonly string[],
+  keepScenePictures: ReadonlySet<string>,
+  deps: ReportDecideDeps,
+): Promise<TakedownOutcome> {
+  const element = await deps.boards.getElement(elementId);
+  if (!element || element.boardId !== boardId) return "already_gone";
+  const result = await deps.boards.deleteElement(elementId);
+  if (!result.deleted) return "already_gone";
+  // The shared-asset rule of deleteMyElement: bytes go only when no
+  // live element elsewhere still points at them. A held object refuses
+  // the delete; that is logged and the record is gone all the same.
+  const cutoutRef = releaseRef(element.cutoutRef);
+  if (!(await elementBytesStillNeeded(cutoutRef, deps.boards, elementId))) {
+    for (const ref of [cutoutRef, releaseRef(element.flattenedRef)]) {
+      if (!ref.startsWith("elements/")) continue;
+      try {
+        await deps.store.delete(ref);
+      } catch (error) {
+        logServerError("takedown left an element object behind", error);
+      }
+    }
+  }
+  // The scenes the cascade hid now, and the ones the report's hold hid
+  // earlier (the cascade does not list those): their pictures go too.
+  for (const sceneId of new Set([...result.hiddenSceneIds, ...heldSceneIds])) {
+    if (keepScenePictures.has(sceneId)) continue;
+    const scene = await deps.boards.getScene(sceneId);
+    if (scene?.boardId === boardId && scene.hidden && scene.elementIds.includes(elementId)) {
+      await deleteSceneObjects(scene, deps.store);
+    }
+  }
+  return "element_deleted";
+}
+
+async function takedownScene(sceneId: string, now: number, deps: ReportDecideDeps): Promise<TakedownOutcome> {
+  const scene = await deps.boards.getScene(sceneId);
+  if (!scene || scene.deletedAt !== undefined) return "already_gone";
+  const tombstone: Scene = { ...scene, hidden: true, deletedAt: now, deletedBy: "host" };
+  await deps.boards.putScene(tombstone);
+  await deleteSceneObjects(tombstone, deps.store);
+  return "scene_deleted";
+}
+
+async function takedownBoard(boardId: string, now: number, deps: ReportDecideDeps): Promise<TakedownOutcome> {
+  if (!(await deps.boards.deleteBoard(boardId, now))) return "already_gone";
+  await unlinkMyBoards(boardId, deps);
+  await sweepDeletedBoardStorage(boardId, deps);
+  return "board_deleted";
+}
+
+export interface SweepSummary {
+  due: number;
+  takenDown: number;
+  skipped: number;
+}
+
+/**
+ * The timed takedown (ADR-004 decision 4): open reports whose
+ * `deleteAt` passed, `batch` at a time, oldest deadline first. Only a
+ * face-flagged likeness report ever carries a deadline; an `illegal`
+ * report is skipped here whatever its record says.
+ */
+export async function sweepDueReports(deps: ReportDecideDeps, now: number, batch: number): Promise<SweepSummary> {
+  const summary: SweepSummary = { due: 0, takenDown: 0, skipped: 0 };
+  if (batch <= 0) return summary;
+  const due = await deps.reports.listOpenDue(now, batch);
+  summary.due = due.length;
+  for (const record of due) {
+    if (record.reason === "illegal") {
+      summary.skipped += 1;
+      continue;
+    }
+    const result = await takedownReport(record.id, { ...deps, now: () => now }, "timed takedown (takedownHours)");
+    if (result) summary.takenDown += 1;
+    else summary.skipped += 1;
+  }
+  return summary;
+}
diff --git a/src/server/report-store.ts b/src/server/report-store.ts
new file mode 100644
index 00000000..e0abaedf
--- /dev/null
+++ b/src/server/report-store.ts
@@ -0,0 +1,29 @@
+import "server-only";
+/**
+ * ReportStore selection (PIN-269), mirroring ./starter-allowance-store.ts:
+ * Firestore in hosted environments, the in-memory contract store for
+ * the memory backend.
+ */
+import { getConfig, type AppConfig } from "../config";
+import { InMemoryReportStore, type ReportStore } from "../domain/report-store";
+import { createFirestoreReportStore } from "./firestore-report-store";
+
+export function createReportStore(config: AppConfig = getConfig()): ReportStore {
+  if (config.dataBackend === "firestore") {
+    return createFirestoreReportStore({
+      projectId: config.firebaseProjectId,
+      emulatorHost: config.firestoreEmulatorHost,
+    });
+  }
+  return new InMemoryReportStore();
+}
+
+const globalReports = globalThis as typeof globalThis & {
+  __pinnedReportStore?: ReportStore;
+};
+
+/** Process-wide store so the memory fallback stays coherent in dev. */
+export function getReportStore(): ReportStore {
+  globalReports.__pinnedReportStore ??= createReportStore();
+  return globalReports.__pinnedReportStore;
+}
diff --git a/src/server/safe-log.ts b/src/server/safe-log.ts
index d10fb07a..f576886e 100644
--- a/src/server/safe-log.ts
+++ b/src/server/safe-log.ts
@@ -13,6 +13,23 @@ export function redactSlugs(text: string): string {
   return text.replace(SLUG_TOKEN, "<slug>");
 }
 
+export type EventSeverity = "INFO" | "WARNING" | "CRITICAL";
+
+/**
+ * One structured line on stdout (PIN-270): Cloud Logging turns a JSON
+ * line into `jsonPayload` and reads `severity`, so a log-based alert
+ * can match `jsonPayload.event`. Callers pass opaque values only
+ * (references, counts, enums); slug-shaped tokens are blanked anyway.
+ */
+export function logEvent(
+  event: string,
+  fields: Readonly<Record<string, unknown>>,
+  severity: EventSeverity = "INFO",
+): void {
+  // `event` and `severity` last: a field can never overwrite the alert keys.
+  console.log(redactSlugs(JSON.stringify({ ...fields, event, severity })));
+}
+
 export function logServerError(label: string, error: unknown): void {
   if (error instanceof Error) {
     console.error(label, {
diff --git a/src/ui/pinneds.css b/src/ui/pinneds.css
index 2ce1eb0a..1fda4a3e 100644
--- a/src/ui/pinneds.css
+++ b/src/ui/pinneds.css
@@ -768,6 +768,17 @@ a.pn-btn:not(.pn-btn-quiet) { text-decoration: none; }
 /* The sheet itself takes focus when it opens (so a screen reader starts at the title); it is not a control, so no ring around it. */
 .pn-make-sheet:focus { outline: none; }
 .pn-make-sheet > .pn-sheet-body { min-height: 0; overflow-y: auto; overscroll-behavior: contain; margin-inline: calc(-1 * var(--space-5)); padding: 4px var(--space-5); }
+
+/* ---------- Report sheet (PIN-271) ---------- */
+/* Two chip groups, a message and an email: long on a small phone, and typed into, so it takes the Make sheet's shape: the body scrolls, the title and the foot stay put, and the sheet rides above the keyboard by the measured --pn-keyboard-inset. */
+.pn-sheet.pn-report-sheet { display: flex; flex-direction: column; overflow: visible; margin-bottom: var(--pn-keyboard-inset, 0px); max-height: calc(92vh - var(--pn-keyboard-inset, 0px)); max-height: calc(92dvh - var(--pn-keyboard-inset, 0px)); transition: margin-bottom .2s ease, max-height .2s ease; }
+@media (prefers-reduced-motion: reduce) {
+  .pn-sheet.pn-report-sheet { transition: none; }
+}
+.pn-report-sheet > .pn-sheet-grab, .pn-report-sheet > .pn-sheet-head, .pn-report-sheet > .pn-sheet-foot { flex: none; }
+.pn-report-sheet > .pn-sheet-grab { align-self: center; }
+.pn-report-sheet:focus { outline: none; }
+.pn-report-sheet > .pn-sheet-body { min-height: 0; overflow-y: auto; overscroll-behavior: contain; margin-inline: calc(-1 * var(--space-5)); padding: 4px var(--space-5); }
 .pn-make-base { display: flex; align-items: center; gap: var(--space-3); min-width: 0; margin: 0; font: 650 15px/20px var(--font-ui); }
 .pn-make-base-thumb { flex: none; width: auto; height: 40px; border-radius: var(--radius-xs); object-fit: cover; box-shadow: 0 1px 3px var(--shade); }
 .pn-make-base-text { min-width: 0; overflow: hidden; text-overflow: ellipsis; white-space: nowrap; }

From a1a78776207c2f13dc9934b2417676b34a584b67 Mon Sep 17 00:00:00 2001
From: Robin ELM <64148042+Robin-ELM@users.noreply.github.com>
Date: Wed, 4 Nov 2026 19:55:02 +0300
Subject: [PATCH 3/5] Promote dev to prod (aea02fc)

---
 README.md                        | 15 +++++-----
 docs/12-submission.md            | 18 ++++++-----
 docs/20-abuse-runbook.md         |  5 +++-
 docs/build-log.md                | 51 +++++++++++++++++++-------------
 scripts/report-ops.ts            | 15 +++++++++-
 src/server/report-decide.test.ts | 26 ++++++++++++++++
 src/server/report-decide.ts      | 21 ++++++++-----
 7 files changed, 106 insertions(+), 45 deletions(-)

diff --git a/README.md b/README.md
index c50b408e..bee27d32 100644
--- a/README.md
+++ b/README.md
@@ -160,13 +160,14 @@ npm test
 npm run build
 ```
 
-On `dev` at `a90cd7b` (Nov 2, 2026), `npm test` reports **1,879 tests passed, 3
-skipped**, in 165 test files. CI (`.github/workflows/ci.yml`) runs all three with
-`AI_MOCK=1`, so it never makes a paid model call. Gitleaks scans the full history on every
-PR (`.github/workflows/secret-scan.yml`) and runs as a pre-commit hook, and Cursor Bugbot
-reviews every PR: as of Nov 2, each of the 215 merged PRs passed CI and gitleaks and got a
-Bugbot review ([`docs/build-log.md`](docs/build-log.md)). Domain and Policy logic have
-unit tests; the gateway has contract tests that replay recorded spike fixtures
+On `dev` at `d958f29` (Nov 4, 2026), `npm test` reports **2,091 tests passed, 3
+skipped**, in 181 test files (one of them skipped). CI (`.github/workflows/ci.yml`) runs
+all three with `AI_MOCK=1`, so it never makes a paid model call. Gitleaks scans the full
+history on every PR (`.github/workflows/secret-scan.yml`) and runs as a pre-commit hook,
+and Cursor Bugbot reviews every PR: as of Nov 4, each of the 240 merged PRs passed CI and
+gitleaks and got a Bugbot review ([`docs/build-log.md`](docs/build-log.md)). Domain and
+Policy logic have unit tests; the gateway has contract tests that replay recorded spike
+fixtures
 (`eval/fixtures/studio/`). Live-model runs happen by hand, with cost logged; results are in
 [`eval/studio-findings.md`](eval/studio-findings.md).
 
diff --git a/docs/12-submission.md b/docs/12-submission.md
index 50163796..fd59acb2 100644
--- a/docs/12-submission.md
+++ b/docs/12-submission.md
@@ -29,6 +29,10 @@ dates and marks what the record does not show. §3 counts re-run on
 page; §5 records the F6/F7 pass; §6 adds "Who built it?"; §8 holds
 answers drafted to paste. Re-run §3 at the freeze commit.
 
+Nov 4 refresh (PIN-274): §3 counts re-run on `dev` at `d958f29` (240
+merged PRs, 2,091 tests); [`build-log.md`](build-log.md) extended to
+Nov 4 with the same sources.
+
 ## 1. One-page pitch
 
 **Pinneds Studio — your stuff, pinned together.**
@@ -202,10 +206,10 @@ synthetic images.
 | Cost per photo (T5, **estimate**) | **≈ $0.020**/photo (bar ≤ $0.05). SAM bills one image per concept call (`usage.images_processed=1`); provider dashboard is authoritative | `eval/studio-findings.md` (T5); `docs/11` §8 |
 | Cost per scene (T5, **estimate**) | **≈ $0.01**/scene (bar ≤ $0.10). Meta's published Muse Image price is a flat $0.01 per generated image, whatever the tokens; the PIN-50 spike had priced tokens at Spark rates (≈ $0.022). Provider dashboard is authoritative | `src/gateway/costs.ts`; `docs/16-ai-usage.md`; `eval/studio-findings.md` (T5) |
 | Refusals (T6) | 0/10 harmless prompts refused (3 with synthetic people) | `eval/studio-findings.md` (T6) |
-| Automated tests | **1,879 passed / 3 skipped** (165 files, one of them skipped), `AI_MOCK=1`, as of Nov 2, 2026 on `dev` (tip `a90cd7b`). **Recount at freeze**; CI never makes paid calls | `npm test` (`package.json`); CI config `.github/workflows/ci.yml` |
-| Pull requests | **215 merged** (225 opened), including 3 promotions to `main`, as of Nov 2, 2026, 19:20 UTC — a moving number; **recount at freeze** (command below) | `gh pr list --state all --limit 500` |
-| Review gate | All 215 merged PRs have a Cursor Bugbot check run on their final commit (209 clean, 6 neutral); Bugbot opened 241 review threads on 85 of them; CI and gitleaks passed on all 215 (as of Nov 2) | GitHub check runs; [`build-log.md`](build-log.md) §7 |
-| Who built what | Muse Code: 98 merged PRs from its working copy only (setup, Meta model wiring, the 29-PR overnight core, the 9 Stripe PRs, sign-in, security fixes). Claude Code: 106. Both: 6. Promotions: 3. Not shown: 2 (as of Nov 2) | [`build-log.md`](build-log.md) |
+| Automated tests | **2,091 passed / 3 skipped** (181 files, one of them skipped), `AI_MOCK=1`, as of Nov 4, 2026 on `dev` (tip `d958f29`). CI never makes paid calls | `npm test` (`package.json`); CI config `.github/workflows/ci.yml` |
+| Pull requests | **240 merged** (252 opened), including 4 promotions to `main`, as of Nov 4, 2026, 16:00 UTC — a moving number (command below) | `gh pr list --state all --limit 500` |
+| Review gate | All 240 merged PRs have a Cursor Bugbot check run on their final commit (234 clean, 6 neutral); Bugbot opened 264 review threads on 94 of them; CI and gitleaks passed on all 240 (as of Nov 4) | GitHub check runs; [`build-log.md`](build-log.md) §7 |
+| Who built what | Muse Code: 98 merged PRs from its working copy only (setup, Meta model wiring, the 29-PR overnight core, the 9 Stripe PRs, sign-in, security fixes). Claude Code: 124. Both: 6. Promotions: 4. Not shown: 8, six of them Nov 3–4 PRs whose Linear close comments name Muse Code (as of Nov 4) | [`build-log.md`](build-log.md) |
 | Repo public | `MoriaCrew/Pinned`, visibility PUBLIC, AGPL-3.0 | `gh repo view` (Oct 29); `LICENSE`, `README.md` |
 | UI languages | Six translated by Muse Spark Open plus a reviewer pass; first pass **$0.98** in total. No native-speaker review yet | `docs/18-i18n.md` ("Costs", "Who reviewed what") |
 | Usage (people / pins / scenes) | Not a fixed number — captured fresh per §4 on record and submit days | `scripts/usage-report.mjs` (`npm run usage:report`) |
@@ -287,7 +291,7 @@ approves.
 | F3 | Prod promotion: `dev` → `main`/prod per the hosting setup, then a real end-to-end play on `<PROD_URL>` (create board → pin → scene → remix → share → delete) | Robin + Agent (Robin owns promotion/approval; agent must never push `main`/prod itself) | `<PROD_URL>` plays the full loop with live models; `/api/health` answers |
 | F4 | Two boards on prod (`docs/DEPLOY.md` §6.3): the judges' board (the video board; link private, judging overrides) and the demo template board (`npm run seed:demo`; its slug, never the judges', is what `DEMO_BOARD_SLUG` holds; "See a board" copies it into a fresh board per visitor, PIN-251) | Agent prepares, Robin approves host/env changes | `<DEMO_BOARD_URL from Linear>` opens a populated, non-empty board; two "See a board" clicks land on two different populated boards, neither the judges' nor the template |
 | F5 | Hosted budget sanity: confirm the deployed `AI_DAILY_BUDGET_USD` / call limit env values are sized for judge + family traffic (`docs/11` A2: code default $5 / 500 calls, dev the same; prod $50 / 10,000 during judging per Robin, Oct 31, see `docs/DEPLOY.md`; verify the live values, do not assume) | Robin | Live values checked in the hosting env and matching A2 |
-| F6 | This packet refreshed: §3 test count + PR count re-run at the freeze commit, §1 links block placeholders assigned owners. Nov 2 (PIN-248): re-run on `dev` `a90cd7b`; run again at the freeze commit | Agent | Packet matches freeze-commit reality |
+| F6 | This packet refreshed: §3 test count + PR count re-run at the freeze commit, §1 links block placeholders assigned owners. Nov 2 (PIN-248): re-run on `dev` `a90cd7b`; Nov 4 (PIN-274): re-run on `dev` `d958f29` | Agent | Packet matches freeze-commit reality |
 | F7 | Known-v1-limits honesty pass on `README.md` + this file (1-day `tmp/` lifecycle backstop applied vs the app-side delete, cost-estimate labelling, optional sign-in scope, non-Meta Higgsfield assets disclosed). Nov 2 (PIN-248): lifecycle, estimate labels and Higgsfield disclosure checked; §6 sign-in scope corrected (optional on prod too); build claims now cite `build-log.md`. Open: the `/models` "Built with Meta tools" line names only Muse Code (PIN-249, operator's call before freeze) | Agent | No claim in the packet or README that the code doesn't back |
 
 ### Video (Nov 3–4)
@@ -580,6 +584,6 @@ a reviewer pass for six languages, $0.98 for the first pass in
 total (`docs/18-i18n.md`). The opinion part is the submitter's.
 
 **Survey items** — the submitter's own answers. Facts for the Muse
-Code question: 98 of the 215 merged PRs came from its working copy
+Code question: 98 of the 240 merged PRs came from its working copy
 only, including the 29-PR overnight Studio core and the 9 Stripe
-PRs (as of Nov 2; `build-log.md`).
+PRs (as of Nov 4; `build-log.md`).
diff --git a/docs/20-abuse-runbook.md b/docs/20-abuse-runbook.md
index feb9965b..5a009a25 100644
--- a/docs/20-abuse-runbook.md
+++ b/docs/20-abuse-runbook.md
@@ -131,7 +131,10 @@ evidence. Then section 6 (report and preserve). Never run
 
 If `storage hold false` on an `illegal` report, a Storage call
 failed when the report was filed: set the holds by hand (section 5,
-step 1) before anything else.
+step 1) before anything else. With `(partial: N object(s) held)` after
+it, those N are held already (a dismiss or `release-holds` releases
+them), so set only the missing ones. `(released <time>)` means the
+holds were released on purpose.
 
 ## 4. The judges' demo board
 
diff --git a/docs/build-log.md b/docs/build-log.md
index 522e4ba6..8afd27ac 100644
--- a/docs/build-log.md
+++ b/docs/build-log.md
@@ -1,6 +1,7 @@
 # Build log: who built Pinneds, and how we know
 
-_As of Nov 2, 2026, 19:20 UTC (`dev` at `a90cd7b`; PIN-248). Times are
+_As of Nov 4, 2026, 16:00 UTC (`dev` at `d958f29`; PIN-248, counts
+refreshed by PIN-274). Times are
 US Eastern (ET) from GitHub's merge times. This log backs every "how it
 was built" line in the [`README`](../README.md), the submission packet
 ([`12-submission.md`](12-submission.md)), the in-app
@@ -32,7 +33,7 @@ request ([`03-ai-sdlc.md`](03-ai-sdlc.md)):
 | Muse Code built the Stripe billing (PIN-146–153) | Backed | W |
 | Claude Code refined parts of it | Backed | F, W, L |
 | Claude Code carried it to prod | Backed | F, W, L |
-| Cursor Bugbot reviewed every PR | Backed: 215 of 215 merged PRs | GitHub check runs |
+| Cursor Bugbot reviewed every PR | Backed: 240 of 240 merged PRs | GitHub check runs |
 
 ## Sources
 
@@ -44,7 +45,7 @@ Strongest first:
   names Muse Code as the executor of PIN-48–57.
 - **W** (operator-held): the two agents worked in separate local
   working copies of the repo, and each copy's git reflog records the
-  branches that got commits there (read Nov 2). The Muse Code copy was
+  branches that got commits there (read Nov 2 and Nov 4). The Muse Code copy was
   cloned Oct 26 at 10:43 ET and made the first commit after GitHub's
   initial one. The Claude Code copy was cloned Oct 30 at 06:44 ET;
   Claude Code sessions outside that copy are covered by F.
@@ -234,22 +235,23 @@ All F or W, and L where the issue is labelled:
 - Live Stripe path for the operator scripts and runbook: #182 (PIN-210).
   The prod billing switch: #203 (PIN-210, Oct 31 23:04 ET).
 - The prod landing's demo link: #224 (PIN-246).
-- Promotion #2 (#226, merged Nov 2 14:16 ET) was cut in the Claude Code
-  copy (W). Promotions #16 (Oct 26) and #31 (Oct 31) carry `dev` and
+- Promotions #2 (#226, merged Nov 2 14:16 ET) and #3 (#236, Nov 3
+  14:22 ET) were cut in the Claude Code copy (W). Promotions #16 (Oct
+  26) and #31 (Oct 31) carry `dev` and
   are not attributed to one agent; agents never merge to `main` without
   the operator ([`AGENTS.md`](../AGENTS.md)).
 
 ### 7. Cursor Bugbot reviewed every PR
 
 From GitHub's check runs on the final commit of each merged PR (read
-Nov 2, 19:30 UTC):
+Nov 2, 19:30 UTC, and again Nov 4, 16:20 UTC):
 
-- All 215 merged PRs have a "Cursor Bugbot" check run: 209 finished
+- All 240 merged PRs have a "Cursor Bugbot" check run: 234 finished
   clean and 6 finished neutral (findings posted on the final commit).
-- Bugbot opened 241 review threads across 85 of those PRs. It opened
+- Bugbot opened 264 review threads across 94 of those PRs. It opened
   every review thread on them.
 - CI (`check`) and `gitleaks (full history)` passed on the final commit
-  of all 215.
+  of all 240.
 - Cursor wrote no code: no PR came from a `cursor/` branch, and no
   Pinned issue carries the `executor/cursor` label.
 
@@ -264,24 +266,26 @@ Nov 2, 19:30 UTC):
 | Oct 30 | Tap naming, photo choice, dictation (#100, #103, #106); AI call log (#108, #110); Stripe billing (#117–#132) | Scene viewer, delete, rename, board delete (§5) |
 | Oct 31 | Upload pipeline: idempotent uploads, stale-job sweep, multi-photo queue, SAM confidence (#145–#149) | Billing refinements, languages, showcase sets, prod prep (#136–#208 without #145–#149) |
 | Nov 1 | Pre-launch security review and first fixes (PIN-238–243) | Submission brief (#214), `/models` page (#215) |
-| Nov 2 | Security fixes merged (#216, #218–#222) | Follow-up fixes on that stack; #223–#225; promotion #2 (#226) |
+| Nov 2 | Security fixes merged (#216, #218–#222) | Follow-up fixes on that stack; #223–#225; promotion #2 (#226); runbook updates (#228) |
+| Nov 3 | Phone-layout fixes (#240–#241, 23:07–23:15 ET): named in Linear only, see "What the record does not show" | Submission packet and build log (#227); demo-board docs (#229); per-visitor demo boards (#230–#235, #238); showcase script (#138); smoke runbook (#239); promotion #3 (#236) |
+| Nov 4 | Judging-week landing (#243–#246, 01:02–03:32 ET): named in Linear only, see "What the record does not show" | Report & hold (#247–#252) |
 
 The photo game Pinneds started as was dropped on Oct 28; #47 deleted its
 code ([`archive/`](archive/)).
 
 ## Counts
 
-Merged PRs as of Nov 2, 2026, 19:20 UTC. A PR count is a rough measure:
+Merged PRs as of Nov 4, 2026, 16:00 UTC. A PR count is a rough measure:
 PR sizes vary from a one-line fix to a full slice.
 
 | Source | Merged PRs |
 | --- | --- |
 | Muse Code copy only (W, with D or L where they exist) | 98 |
-| Claude Code (F, or W in the Claude Code copy) | 106 |
+| Claude Code (F, or W in the Claude Code copy) | 124 |
 | Both copies (the security fixes) | 6 |
-| Promotions to `main` (#16, #31, #226) | 3 |
-| No agent evidence (#11, #134) | 2 |
-| **Total** | **215** |
+| Promotions to `main` (#16, #31, #226, #236) | 4 |
+| No agent evidence (#11, #134, #240–#241, #243–#246) | 8 |
+| **Total** | **240** |
 
 ## What the record does not show
 
@@ -295,6 +299,11 @@ PR sizes vary from a one-line fix to a full slice.
 - **#134** (PIN-169, Oct 30 17:40 ET): storage clean-up when a board is
   deleted. Its commits are in neither copy. Its sibling issues PIN-167
   and PIN-168 (#133, #135) were done in the Claude Code copy.
+- **#240–#241, #243–#246** (PIN-261–265, Nov 3 23:07 – Nov 4 03:32 ET):
+  phone-layout fixes and the judging-week landing. Their branches are in
+  neither copy's reflog on the operator's machine. The Linear close
+  comments name Muse Code, which this log does not count as evidence
+  (see Sources).
 - **Gaps in W.** Reflogs live on the operator's machine, expire after a
   while and disappear with a removed worktree. "Not shown" means not
   shown, not "done by someone else".
@@ -303,7 +312,7 @@ PR sizes vary from a one-line fix to a full slice.
 ## Appendix: every merged PR by source
 
 Ranges list merged PRs only. Numbers closed without merging (#3, #4,
-#75, #217) or still open (#138, #209–#213) are skipped.
+#75, #209–#213, #217, #237) or still open (#242, #253) are skipped.
 
 - **Muse Code copy only (98):** #1–#10, #12–#15, #17–#30, #32–#80, #84,
   #88, #92–#93, #95, #100, #103, #106, #108, #110, #117, #119, #121,
@@ -311,13 +320,13 @@ Ranges list merged PRs only. Numbers closed without merging (#3, #4,
 - **Claude Code footer (78):** #81–#83, #85–#87, #89–#91, #94, #96–#99,
   #101–#102, #104–#105, #107, #143–#144, #150–#155, #157–#167,
   #169–#208, #223.
-- **Claude Code copy, no footer (28):** #109, #111–#116, #118, #120,
+- **Claude Code copy, no footer (46):** #109, #111–#116, #118, #120,
   #122, #124, #129–#131, #133, #135–#142, #156, #168, #214–#215,
-  #224–#225. Promotion #2 (#226) was also cut in this copy and is
-  counted under promotions.
+  #224–#225, #227–#235, #238–#239, #247–#252. Promotions #2 (#226) and
+  #3 (#236) were also cut in this copy and are counted under promotions.
 - **Both copies (6):** #216, #218–#222.
-- **Promotions (3):** #16, #31, #226.
-- **No agent evidence (2):** #11, #134.
+- **Promotions (4):** #16, #31, #226, #236.
+- **No agent evidence (8):** #11, #134, #240–#241, #243–#246.
 
 ## Re-running this log
 
diff --git a/scripts/report-ops.ts b/scripts/report-ops.ts
index e702bc69..31f8fb5f 100644
--- a/scripts/report-ops.ts
+++ b/scripts/report-ops.ts
@@ -58,6 +58,19 @@ if (!command) usage("A command is required.");
 if (!project || !/^[a-z][a-z0-9-]{4,28}[a-z0-9]$/.test(project)) usage("--project must name the Firebase project (never a default).");
 const bucket = option("--bucket") ?? `${project}.firebasestorage.app`;
 
+/**
+ * What the Storage hold line adds after true/false: `(released <time>)`
+ * once `markHoldsReleased` ran (it clears the flag but keeps the list),
+ * `(partial: N object(s) held)` while a hold that lost some `setHold`
+ * calls still stands, nothing otherwise.
+ */
+function storageNote(record: ReportRecord): string {
+  const refs = record.held.storageRefs?.length ?? 0;
+  if (record.holdsReleasedAt !== undefined) return ` (released ${new Date(record.holdsReleasedAt).toISOString()}${refs > 0 ? `, ${refs} object(s)` : ""})`;
+  if (!record.held.storageHold && refs > 0) return ` (partial: ${refs} object(s) held)`;
+  return "";
+}
+
 /** Terminal line for one report: ids, reference, enums, times and counts; never the board. */
 function describe(record: ReportRecord, withMessage = false): string {
   const at = (ms?: number) => (ms === undefined ? "-" : new Date(ms).toISOString());
@@ -65,7 +78,7 @@ function describe(record: ReportRecord, withMessage = false): string {
     `report ${record.id}  ref ${record.reference}  ${record.status}`,
     `  ${record.scope}${record.targetId ? ` ${record.targetId}` : ""}  reason ${record.reason}  severity ${record.severity}  by ${record.reporterKind}`,
     `  created ${at(record.createdAt)}  deleteAt ${at(record.deleteAt)}  decided ${at(record.decidedAt)}${record.note ? `  note: ${record.note}` : ""}`,
-    `  held: ${record.held.elementIds.length} element(s), ${record.held.sceneIds.length} scene(s), review ${record.held.boardReview}, storage hold ${record.held.storageHold}`,
+    `  held: ${record.held.elementIds.length} element(s), ${record.held.sceneIds.length} scene(s), review ${record.held.boardReview}, storage hold ${record.held.storageHold}${storageNote(record)}`,
   ];
   if (withMessage) {
     lines.push(`  email: ${record.reporterEmail ?? "-"}`);
diff --git a/src/server/report-decide.test.ts b/src/server/report-decide.test.ts
index 855d0f48..0ff41ad2 100644
--- a/src/server/report-decide.test.ts
+++ b/src/server/report-decide.test.ts
@@ -320,6 +320,32 @@ describe("report decisions (PIN-272)", () => {
     expect((await h.reports.get(queued.id))?.status).toBe("open");
   });
 
+  it("a partial Storage hold (one setHold failed) is still released by a dismiss and still protects until then", async () => {
+    const h = await harness();
+    vi.spyOn(console, "error").mockImplementation(() => {});
+    const original = h.store.setHold.bind(h.store);
+    h.store.setHold = async (ref, held) => {
+      if (held && ref.endsWith("s-both/scene.webp")) throw new Error("gcs down");
+      return original(ref, held);
+    };
+    const partial = await h.file(SLUG, { scope: "board", reason: "illegal" });
+    expect(partial.held.storageHold).toBe(false);
+    expect(partial.held.storageRefs?.length).toBe(5);
+    for (const ref of [...refsOf("mug"), ...refsOf("friend"), sceneRef("s-mug")]) expect(h.store.isHeld(ref)).toBe(true);
+    // Another board report's close-out keeps what the partial hold covers.
+    const other = await h.file(SLUG, { scope: "element", targetId: "mug", reason: "illegal" });
+    const otherDone = await takedownReport(other.id, h.deps);
+    expect((await releaseReportHolds(otherDone!.record, h.deps)).kept).toBeGreaterThan(0);
+    expect(h.store.isHeld(refsOf("mug")[0])).toBe(true);
+    // The partial hold's own dismiss releases exactly what it managed to hold.
+    const outcome = await dismissReport(partial.id, h.deps);
+    expect(outcome?.released.storage).toBe(true);
+    for (const ref of [...refsOf("mug"), ...refsOf("friend"), sceneRef("s-mug")]) expect(h.store.isHeld(ref)).toBe(false);
+    // The released record keeps the list of what it held, flag off: the operator line reads "released", not "partial".
+    expect(await h.reports.get(partial.id)).toMatchObject({ holdsReleasedAt: expect.any(Number), held: { storageHold: false } });
+    expect((await h.reports.get(partial.id))?.held.storageRefs?.length).toBe(5);
+  });
+
   it("references stay the only board id in a decision's record", async () => {
     const h = await harness();
     const report = await h.file(SLUG, { scope: "board", reason: "inappropriate" });
diff --git a/src/server/report-decide.ts b/src/server/report-decide.ts
index 8384b683..c626a5ba 100644
--- a/src/server/report-decide.ts
+++ b/src/server/report-decide.ts
@@ -59,13 +59,17 @@ export interface HoldReleaseResult {
 const OBJECT_OWNER = /^(?:elements|scenes)\/boards\/([A-Za-z0-9_-]{22})\//;
 
 /**
- * A report whose Storage hold still stands: `held.storageHold` is
- * turned off by `releaseReportHolds` (a dismiss, or the close-out), so
- * two takedowns sharing objects release in turn instead of protecting
- * each other for good.
+ * A report whose Storage hold still stands: the full set, or the part
+ * that succeeded before a `setHold` failure (`storageHold` false, but
+ * `storageRefs` listed). `releaseReportHolds` (a dismiss, or the
+ * close-out) stamps `holdsReleasedAt` and keeps the list as the record
+ * of what was held, so a released report no longer counts and two
+ * takedowns sharing objects release in turn instead of protecting each
+ * other for good.
  */
 function stillHoldsStorage(report: ReportRecord): boolean {
-  return report.held.storageHold;
+  if (report.holdsReleasedAt !== undefined) return false;
+  return report.held.storageHold || (report.held.storageRefs?.length ?? 0) > 0;
 }
 
 /**
@@ -182,9 +186,10 @@ export async function dismissReport(
   if (record.held.boardReview && !stillReview) {
     released.boardReview = await deps.boards.setBoardReview(record.boardId, null);
   }
-  if (record.held.storageHold) {
-    // Only this report's own objects, minus what any other holding
-    // report (open, or a takedown awaiting its close-out) still needs.
+  if (stillHoldsStorage(record)) {
+    // Only this report's own objects (a partial hold included), minus
+    // what any other holding report (open, or a takedown awaiting its
+    // close-out) still needs.
     const holds = await releaseReportHolds(record, deps);
     released.storage = holds.failed === 0;
   }

From b3ada59b8fdd251ba65a352492fd7011b7e154dc Mon Sep 17 00:00:00 2001
From: Robin ELM <64148042+Robin-ELM@users.noreply.github.com>
Date: Wed, 4 Nov 2026 21:35:13 +0300
Subject: [PATCH 4/5] Promote dev to prod (76f0c76)

---
 .github/workflows/report-sweep.yml           |  14 +-
 AGENTS.md                                    |   2 +-
 README.md                                    |  68 ++--
 SECURITY.md                                  |  47 +--
 docs/03-ai-sdlc.md                           |   4 +-
 docs/06-photo-intake.md                      |   2 +-
 docs/07-sam-lab.md                           |   2 +-
 docs/10-custom-domains.md                    |   2 +-
 docs/11-studio.md                            |  49 ++-
 docs/12-submission.md                        |   4 +-
 docs/13-auth.md                              | 167 +++++-----
 docs/14-design-system.md                     |  21 +-
 docs/15-board-plus.md                        | 334 ++++++++++---------
 docs/16-ai-usage.md                          |  59 ++--
 docs/17-showcase-sets.md                     |  36 +-
 docs/18-i18n.md                              | 107 +++---
 docs/19-meta-models.md                       |  45 ++-
 docs/20-abuse-runbook.md                     |  32 +-
 docs/DEPLOY.md                               |   4 +-
 docs/README.md                               |  76 +++--
 docs/adr/003-studio-architecture.md          |   9 +-
 docs/adr/004-report-and-hold.md              |  19 +-
 docs/build-log.md                            |   4 +-
 docs/launch-ops-runbook.md                   |   4 +-
 docs/security-review-2026-11-01.md           |   4 +-
 eval/studio-findings.md                      |   2 +-
 src/app/g/[slug]/BoardClient.tsx             |   7 +-
 src/app/g/[slug]/BoardThings.tsx             |   1 +
 src/app/g/[slug]/LibraryPins.tsx             |  15 +-
 src/app/g/[slug]/ReportBoard.tsx             |  23 +-
 src/app/g/[slug]/board-render.test.ts        |  12 +
 src/app/g/[slug]/board-report-render.test.ts |  12 +-
 src/app/g/[slug]/library-render.test.ts      |   6 +-
 src/app/g/[slug]/page.tsx                    |   2 +-
 src/app/me/LibraryParts.tsx                  |   4 +-
 src/domain/board-report.test.ts              |  37 +-
 src/domain/board-report.ts                   |  32 +-
 src/domain/board-view.ts                     |   2 +
 src/domain/library-strip.test.ts             |  15 +
 src/domain/library-strip.ts                  |   4 +-
 src/domain/make-sheet.test.ts                |  10 +-
 src/domain/make-sheet.ts                     |   4 +-
 src/domain/my-pins.ts                        |   2 +
 src/i18n/messages/de.json                    |   4 +-
 src/i18n/messages/de.lock.json               |   4 +-
 src/i18n/messages/en.json                    |   4 +-
 src/i18n/messages/es.json                    |   4 +-
 src/i18n/messages/es.lock.json               |   4 +-
 src/i18n/messages/fr.json                    |   4 +-
 src/i18n/messages/fr.lock.json               |   4 +-
 src/i18n/messages/id.json                    |   4 +-
 src/i18n/messages/id.lock.json               |   4 +-
 src/i18n/messages/it.json                    |   4 +-
 src/i18n/messages/it.lock.json               |   4 +-
 src/i18n/messages/pt-BR.json                 |   4 +-
 src/i18n/messages/pt-BR.lock.json            |   4 +-
 src/policy/policy.test.ts                    |   2 +-
 src/policy/policy.ts                         |  11 +-
 src/server/board-api.ts                      |   7 +-
 src/server/board-report.test.ts              |   8 +-
 src/server/my-pins.test.ts                   |   8 +
 src/server/my-pins.ts                        |   8 +-
 src/server/report-decide.test.ts             |  22 +-
 src/server/report-decide.ts                  |  12 +-
 src/server/scene-job.test.ts                 |  12 +
 src/server/scene-job.ts                      |   7 +
 src/ui/kit.test.ts                           |  12 +
 src/ui/pinneds.css                           |   3 +
 src/ui/stickers.tsx                          |  20 +-
 69 files changed, 902 insertions(+), 587 deletions(-)

diff --git a/.github/workflows/report-sweep.yml b/.github/workflows/report-sweep.yml
index 1a603336..b4dcc1dc 100644
--- a/.github/workflows/report-sweep.yml
+++ b/.github/workflows/report-sweep.yml
@@ -1,11 +1,11 @@
 # PIN-272 report backstop: the timed takedown of ADR-004.
 #
-# A face-flagged pin reported as someone's likeness is hidden at once
-# and tombstoned by itself once Policy.takedownHours have passed with
-# no operator decision (docs/20, docs/adr/004-report-and-hold.md).
-# The app has no scheduler, so this job runs `report:ops sweep`
-# daily; a report filed through the day waits at most one run past
-# its deadline. Content reported as illegal is never touched here.
+# Whatever a report hid is tombstoned by itself once Policy.takedownHours
+# have passed with no operator decision (PIN-278; docs/20,
+# docs/adr/004-report-and-hold.md). The app has no scheduler, so this
+# job runs `report:ops sweep` every six hours; a report waits at most
+# one run past its deadline. Content reported as illegal is taken down
+# too, with its Storage holds kept as evidence.
 #
 # PUBLIC REPO: anyone can read this job's log. The sweep prints counts
 # only (due / takenDown / skipped), never a report id, reference, slug
@@ -37,7 +37,7 @@ name: Report sweep
 
 on:
   schedule:
-    - cron: "47 6 * * *" # daily 06:47 UTC, from the default branch (main)
+    - cron: "17 */6 * * *" # every 6 h at :17 UTC, from the default branch (main)
   workflow_dispatch:
     inputs:
       environment:
diff --git a/AGENTS.md b/AGENTS.md
index d907c0b1..310dc88c 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -21,7 +21,7 @@ dropped (Oct 28); its docs are in `docs/archive/` — do not apply them.
    written dismissal. Medium+ security findings block merge.
    **Never merge to `main`** without Robin; promotion is a separate
    promotion PR into `main` (squash only, per the `Protect main`
-   ruleset) after a hosted dev smoke (`docs/DEPLOY.md` §4).
+   ruleset) after a hosted dev smoke (`docs/DEPLOY.md` §5).
 3. **AI behind the gateway.** All model calls go through the six
    capability ports in `src/gateway/index.ts` (`ElementNamer`,
    `Segmenter`, `SceneComposer`, `ChipSuggester`, `TapNamer`,
diff --git a/README.md b/README.md
index bee27d32..da3679bd 100644
--- a/README.md
+++ b/README.md
@@ -1,4 +1,4 @@
-# Pinneds — your stuff, pinned together
+# Pinneds: your stuff, pinned together
 
 Friends drop photos onto one shared board. Meta's models, called through the Meta Model
 API, cut out the things in them, and anyone can mix everyone's pins into new scenes that
@@ -52,7 +52,7 @@ and evidence for each: [`docs/19-meta-models.md`](docs/19-meta-models.md).
 
 | Model (ID) | What it does in Pinneds | Port |
 | --- | --- | --- |
-| **Muse Spark** (`muse-spark-1.3`) | Names 1–6 things per photo as short noun phrases SAM can cut, and flags faces (`elements.v1`). Names a cut-out you tapped, from its crop (`tap-name.v1`). Suggests scene ideas for the picked pins in the viewer's UI language, cached 24 h per language (`chips.v2`). | `ElementNamer`, `TapNamer`, `ChipSuggester` |
+| **Muse Spark** (`muse-spark-1.3`) | Names 1–6 things per photo as short noun phrases SAM 3.1 can cut, and flags faces (`elements.v1`). Names a cut-out you tapped, from its crop (`tap-name.v1`). Suggests scene ideas for the picked pins in the viewer's UI language, cached 24 h per language (`chips.v2`). | `ElementNamer`, `TapNamer`, `ChipSuggester` |
 | **SAM 3.1** (`sam-3.1`) | Cuts out each named thing (one concept per call, four calls at a time) and whatever you tap (point prompt), keeping the most confident usable mask. | `Segmenter` |
 | **Muse Image** (`muse-image-1.0`) | Composes 1–4 pins into one new scene through `/v1/responses` (`scene.v1`, `store: false`); a remix sends the parent scene first. It also made the source photos of the Meta-made landing sets. | `SceneComposer` |
 | **Muse Voice Transcribe** (`muse-voice-transcribe-1.0`) | Turns a spoken scene idea (up to 30 s) into text. The audio is never stored. | `SpeechTranscriber` |
@@ -73,7 +73,7 @@ flowchart LR
   point --> tapname["Muse Spark<br/>names the tapped pin"]
   tapname --> pins
   pins --> chips["Muse Spark<br/>idea chips"]
-  voice["Spoken idea"] --> asr["Muse Voice<br/>transcribes"]
+  voice["Spoken idea"] --> asr["Muse Voice Transcribe<br/>transcribes"]
   chips --> idea["Scene idea"]
   asr --> idea
   pins --> compose["Muse Image<br/>composes"]
@@ -110,17 +110,32 @@ Spec: [`docs/11-studio.md`](docs/11-studio.md) §5. Decisions:
   capability slugs, validated before any data path is built.
 - **Privacy.**
   - Original photos are never stored. An upload is checked, stripped of EXIF and
-    re-encoded into a working copy under `tmp/`. Only cut-outs (`elements/`) and scenes
-    (`scenes/`) persist, served through routes that check the board link; client
-    Firestore and Storage rules deny everything.
-  - The working copy is deleted when the uploader confirms their pins ("Pin N"). Any copy
-    older than Policy `workingCopyTtlHours` (24 h) is swept the next time someone adds a
-    photo to that board, and a bucket lifecycle rule in `storage.lifecycle.json` deletes
-    leftover working copies as the backstop.
+    re-encoded into a working copy; only cut-outs and scenes persist, served through
+    routes that check the board link. Client Firestore and Storage rules deny everything.
+  - The working copy is deleted when the uploader confirms their pins. If they never do,
+    the next photo added to that board sweeps any copy older than Policy
+    `workingCopyTtlHours` (24 h), and the bucket lifecycle rule in `storage.lifecycle.json`
+    is the backstop.
   - Calls to Meta run in Standard mode: not used for training, which is not the same as
     not stored. The Muse Image compose call sends `store: false`. We make no "zero data
     retention" claim.
 
+```mermaid
+flowchart LR
+  up["Upload<br/>(original never written)"] --> chk["Checked, EXIF stripped,<br/>re-encoded"]
+  chk --> wc["Working copy<br/>tmp/"]
+  wc --> spark["Muse Spark<br/>names"]
+  wc --> sam["SAM 3.1<br/>cuts out"]
+  sam --> el["Cut-outs<br/>elements/"]
+  el --> sc["Scenes<br/>scenes/"]
+  wc -->|"pins confirmed"| del["Working copy deleted"]
+  wc -.->|"older than 24 h: swept"| del
+  wc -.->|"1-day lifecycle rule"| del
+```
+
+*What persists: cut-outs and scenes. The original is never written; the working copy is
+temporary.*
+
 ## Run it locally
 
 ### Offline, with mock models (no key)
@@ -175,34 +190,30 @@ fixtures
 
 `PLUS_MODE` is `off` (the default: nothing is sold), `mock` (a no-money demo) or `stripe`.
 With `stripe` the app sells one pack, **Board Plus (€2.99, Stripe)**: once per board, it
-unlocks every board look and foil stickers and adds 20 creations (AI makes). Any member
+unlocks every board look and foil stickers and adds 20 creations. Any member
 can buy it for the board; guests never have to pay. Creations are a Policy switch
-(`credits.enabled`, off in code): when on, a maker's first 3 boards a week start with 5
-free (later ones start at 0), each AI scene uses one (photos and cut-outs never do), and a
-collage is free. A board without Plus cuts up to 15 free photos; Plus removes that limit. Purchases are granted by Stripe webhook only, and
+(`credits.enabled`: off in the code defaults, on in both hosted backends through
+`POLICY_OVERRIDES_JSON`). When on, a maker's first 3 boards a week start with 5 free
+creations (prod gives 20 during judging week; later boards start at 0), each AI scene uses
+one (photos and cut-outs never do), and a collage is free. A board without Plus cuts up to
+15 free photos; Plus removes that limit. Purchases are granted by Stripe webhook only, and
 keys come from Secret Manager, never git. Design and runbook:
 [`docs/15-board-plus.md`](docs/15-board-plus.md).
 
 ## Docs
 
-- [`docs/README.md`](docs/README.md): index of every doc
+- [`docs/README.md`](docs/README.md): index of every doc, in reading order
 - [`docs/19-meta-models.md`](docs/19-meta-models.md): each Meta model, prompt, cost and fallback
-- [`docs/build-log.md`](docs/build-log.md): who built what, PR by PR
 - [`docs/11-studio.md`](docs/11-studio.md): product and architecture spec
 - [`docs/adr/003-studio-architecture.md`](docs/adr/003-studio-architecture.md): Policy, ports, jobs, remix
-- [`docs/DEPLOY.md`](docs/DEPLOY.md): deploy runbook and env matrix
-- [`docs/13-auth.md`](docs/13-auth.md): optional Google sign-in
-- [`docs/15-board-plus.md`](docs/15-board-plus.md): Board Plus and creations
-- [`docs/16-ai-usage.md`](docs/16-ai-usage.md): AI call log and cost estimates
-- [`docs/17-showcase-sets.md`](docs/17-showcase-sets.md): how the landing sets are made
-- [`docs/18-i18n.md`](docs/18-i18n.md): languages and translation
-- [`SECURITY.md`](SECURITY.md) and [`AGENTS.md`](AGENTS.md): public-repo guardrails and agent rules
+- [`docs/build-log.md`](docs/build-log.md): who built what, PR by PR
+- [`SECURITY.md`](SECURITY.md): public-repo guardrails
 
 ## Known limits
 
-- **Cuts can miss.** Sometimes SAM finds no usable mask for a named thing, and it doesn't
-  become a pin; tapping it in the photo is the workaround. Spark names the same photo a
-  little differently from run to run.
+- **Cuts can miss.** Sometimes SAM 3.1 finds no usable mask for a named thing, and it does not
+  become a pin; tapping it in the photo is the workaround. Muse Spark names the same photo
+  a little differently from run to run.
 - **Costs are estimates** from Meta list prices (`src/gateway/costs.ts`). The provider
   dashboard is authoritative.
 - **Not every picture is from Meta.** The classic landing set, the `/new` look-picker
@@ -210,8 +221,7 @@ keys come from Secret Manager, never git. Design and runbook:
   photos are Higgsfield images (SAM 3.1 cut out the stickers). The try-on and cat landing
   sets are Meta end to end.
 - **AI-written text is English in places.** Pin names and some scene text stay English
-  whatever the UI language (PIN-200). Generated idea chips follow the UI language
-  (PIN-214); the fixed starter chips stay English until their translations land.
+  whatever the UI language. Idea chips, generated and fixed, follow the UI language.
 - **Machine translations.** Muse Spark Open wrote and reviewed them; no native speaker has
   checked them yet. Latin-script languages only.
 
@@ -225,7 +235,7 @@ Which agent built what, with PR numbers and dates: [`docs/build-log.md`](docs/bu
 
 ## License
 
-Copyright (C) 2026 Moria Crew. AGPL-3.0 — see `LICENSE`. In short: you may use, study and modify this
+Copyright (C) 2026 Moria Crew. AGPL-3.0, see `LICENSE`. In short: you may use, study and modify this
 code, but if you offer a modified version to others over a network you
 must release your source under the same licence. Hackathon note: the
 organisers separately receive a broad licence to submitted materials
diff --git a/SECURITY.md b/SECURITY.md
index f3ed76f0..507c779b 100644
--- a/SECURITY.md
+++ b/SECURITY.md
@@ -1,4 +1,4 @@
-# Security — public-repo guardrails for Pinned
+# Security: public-repo guardrails
 
 This repository is **public for its entire life**. Anything committed is
 world-readable forever, including in git history after deletion. These
@@ -16,13 +16,13 @@ photo. They apply to the human operator and to coding agents alike.
 
 Setup per clone: `pre-commit install` (see `AGENTS.md`). Never bypass a
 gate with `--no-verify`, force-push, or an allowlist edit in the same PR
-as the code it unblocks — allowlist changes need their own reviewed PR.
+as the code it unblocks. Allowlist changes need their own reviewed PR.
 
 ## Never commit (any branch, any file, any commit message)
 
-- API keys, tokens, passwords, session secrets (Meta, Baseten, Modal,
-  Fireworks, Stripe secret keys and the webhook signing secret,
-  Firebase, DB, storage) — values live only in local `.env`, host
+- API keys, tokens, passwords, session secrets (Meta, Baseten, Stripe
+  secret keys and the webhook signing secret, Firebase, DB, storage
+  and any other provider key). Values live only in local `.env`, host
   env, Secret Manager, GitHub Actions secrets. `.env.example` holds
   names with empty values.
 - Private keys/certs (`*.pem`, `*.key`, `*.p12`), credential JSON,
@@ -31,22 +31,24 @@ as the code it unblocks — allowlist changes need their own reviewed PR.
   photos together, emails, chat screenshots with identities. Test assets
   in `eval/` must be consented samples, clearly synthetic where possible.
 - Full request/response dumps from live AI calls containing user content.
-  Log shapes, counts, latency and cost — redact payloads (`--redact`).
+  Log shapes, counts, latency and cost; redact payloads (`--redact`).
 
-## Rate-limit client address (PIN-112)
+## Rate-limit client address
 
 Per-IP limits key on one address from `X-Forwarded-For`. Entries a
 client sends come first; the hosting platform appends its own after
 them, so only the platform-appended client entry can be trusted.
 `CLIENT_IP_TRUSTED_HOPS=n` makes the key the entry `n` positions from
-the right end; unset keeps the first entry (local default). A hosted
-backend sets `n` only after measuring its layout with the lab probe
-`GET /api/lab/client-ip` (dev only; it answers header counts and
-positions, never an address — usage in the route comment).
-`CLIENT_IP_HEADER` (a platform header read first) stays unset unless
-the probe shows the platform overwrites a client-sent copy.
+the right end (too few entries fall back to the first); unset keeps
+the first entry (local default). Each hosted backend sets it in its App
+Hosting config (`apphosting*.yaml`) after measuring its layout with the
+lab probe `GET /api/lab/client-ip` (dev and local only; it answers
+header counts and positions, never an address).
+`CLIENT_IP_HEADER` (a platform header read first, used only when it
+holds a single value) stays unset unless the probe shows the platform
+overwrites a client-sent copy.
 
-## If something leaks anyway — rotate first
+## If something leaks anyway: rotate first
 
 1. **Revoke/rotate the credential immediately.** Deleting the file or
    rewriting history does not un-leak a key; rotation does.
@@ -54,33 +56,34 @@ the probe shows the platform overwrites a client-sent copy.
 3. Then clean up: remove the secret, and only if it was a credential
    that *cannot* be rotated (personal data), purge history and ask
    GitHub Support to drop cached views. Personal photos: treat as
-   incident — inform the person, purge, document in Linear.
+   incident: inform the person, purge, document in Linear.
 4. Record what happened (no secret values) in the relevant Linear issue.
 
-## Repository settings inventory (PIN-20)
+## Repository settings inventory
 
 Settings live in GitHub (not in git); this inventory is the record.
 Verify anytime with `gh api repos/MoriaCrew/Pinned/rulesets` and
 `gh api repos/MoriaCrew/Pinned/rules/branches/main`.
 
-- **Ruleset `Protect main`** (active, default branch): PR required
-  (0 approvals — solo; review threads must resolve; squash only),
+- **Ruleset `Protect main`** (active, on `main` and `dev`): PR required
+  (0 approvals, solo; review threads must resolve; squash only),
   required checks `check`, `gitleaks (full history)`, `Cursor Bugbot`
   (branches need not be strictly up-to-date), linear history, no
   force-push, no branch deletion. Repository Admin bypass is
   *pull-requests-only*: even admins (and agents using admin tokens)
   cannot push directly, but may bypass at PR merge as break-glass.
-- **Merges:** squash only; delete branch on merge; auto-merge and
-  update-branch enabled. Wiki and Discussions off.
+- **Merges:** squash only; auto-merge and update-branch enabled;
+  branches are not deleted on merge (stacked PRs are retargeted by
+  hand). Wiki and Discussions off.
 - **Actions:** default `GITHUB_TOKEN` permissions read-only; workflows
   cannot approve PR reviews.
 - **Security features:** secret scanning + push protection +
   non-provider patterns + validity checks + AI detection on;
   Dependabot alerts + security updates on; private vulnerability
   reporting on. Forking stays allowed (public open-source repo);
-  the AGPL — not settings — governs reuse.
+  the AGPL, not settings, governs reuse.
 
 ## Reporting
 
 Found a secret or personal data in this repo? Contact the owner via
-GitHub (@Robin-ELM) — please do not open a public issue quoting it.
+GitHub (@Robin-ELM). Please do not open a public issue quoting it.
diff --git a/docs/03-ai-sdlc.md b/docs/03-ai-sdlc.md
index 5e202060..d64d46ab 100644
--- a/docs/03-ai-sdlc.md
+++ b/docs/03-ai-sdlc.md
@@ -1,4 +1,6 @@
-# Pinneds — AI SDLC: Linear → agent → PR → `dev` → `main`
+# 03. AI SDLC: Linear → agent → PR → `dev` → `main`
+
+_Internal process note: how the developer and the coding agents organise the work. The README and the build log cite it for context; it is not needed to use the app. Start at the [docs index](README.md)._
 
 _One human (Robin) steers; coding agents (Claude Code, Muse Code,
 Cursor) execute one Linear issue at a time. If a step slows delivery
diff --git a/docs/06-photo-intake.md b/docs/06-photo-intake.md
index 739e567c..df478a47 100644
--- a/docs/06-photo-intake.md
+++ b/docs/06-photo-intake.md
@@ -1,4 +1,4 @@
-# 06 — Photo intake and ephemeral storage (PIN-34)
+# 06. Photo intake and ephemeral storage
 
 ## Invariants
 
diff --git a/docs/07-sam-lab.md b/docs/07-sam-lab.md
index 5c52ddd7..35283290 100644
--- a/docs/07-sam-lab.md
+++ b/docs/07-sam-lab.md
@@ -1,4 +1,4 @@
-# 07 — SAM lab (PIN-36)
+# 07. SAM lab
 
 Dev-only tool at `/lab/sam` (enabled by `PINNED_LAB=1` on dev, or
 locally in memory mode; 404 elsewhere). Built to learn what SAM 3.1
diff --git a/docs/10-custom-domains.md b/docs/10-custom-domains.md
index f84fe2a7..5af1d246 100644
--- a/docs/10-custom-domains.md
+++ b/docs/10-custom-domains.md
@@ -1,4 +1,4 @@
-# 10 — Custom domains (pinneds.com)
+# 10. Custom domains (pinneds.com)
 
 Status: Firebase domains created 2026-10-28; DNS applied at
 GoDaddy the same day. Ownership is ACTIVE for apex + dev;
diff --git a/docs/11-studio.md b/docs/11-studio.md
index 757a685c..900bac70 100644
--- a/docs/11-studio.md
+++ b/docs/11-studio.md
@@ -1,4 +1,4 @@
-# 11 — Pinneds Studio (PIN-49)
+# 11. Pinneds Studio
 
 _Status: source of truth for the Studio pivot from Oct 28, 2026.
 Built from spec sections 1–8 of the Oct 28 hand-off (PIN-48),
@@ -162,8 +162,8 @@ object. The defaults below are proposals; tune them from evidence.
 | Models | `muse-spark-1.3`, `sam-3.1`, `muse-image-1.0`, `muse-voice-transcribe-1.0` |
 | Prompt versions | `elements.v1`, `scene.v1`, `tap-name.v1`, `chips.v2` |
 | `credits.enabled` / `credits.starterMakes` | `false` / 5 (PIN-151: the makes pool, docs/15; 25 before PIN-181; off = pre-credit behaviour exactly, on = 1 make per successful photo or AI scene, collage stays free) |
-| `demo.ttlHours` / `demo.starterMakes` / `demo.freePhotos` / `demo.maxPerIp` / `demo.maxTotal` / `demo.windowMs` / `demo.sweepBatch` | 24 / 2 / 3 / 3 / 200 / 86,400,000 / 5 (PIN-251: per-visitor demo boards cloned from the landing template, `docs/DEPLOY.md` §6.3; the caps bound a creation path outside the per-maker rule, worst case about `maxTotal` x `starterMakes` scenes per window) |
-| `report.perIp` / `report.maxBytes` / `report.messageMaxChars` / `report.sweepBatch` | 5 per 600,000 ms / 4,096 / 1,000 / 5 (PIN-266: the in-app report route and its backstop, `docs/20-abuse-runbook.md`, ADR-004; the takedown deadline is `takedownHours`) |
+| `demo.ttlHours` / `demo.starterMakes` / `demo.freePhotos` / `demo.maxPerIp` / `demo.maxTotal` / `demo.windowMs` / `demo.sweepBatch` | 24 / 2 / 3 / 3 / 200 / 86,400,000 / 5 (PIN-251: per-visitor demo boards cloned from the landing template, `docs/DEPLOY.md` §6 step 3; the caps bound a creation path outside the per-maker rule, worst case about `maxTotal` x `starterMakes` scenes per window) |
+| `report.perIp` / `report.maxBytes` / `report.messageMaxChars` / `report.sweepBatch` | 5 per 600,000 ms / 4,096 / 1,000 / 20 (PIN-266: the in-app report route and its backstop, `docs/20-abuse-runbook.md`, ADR-004; the takedown deadline is `takedownHours`) |
 
 > **A2 (budget), as of Oct 31:** the original hosted $2 / 200 calls
 > was too small for family play, so it was raised. Today the code
@@ -205,8 +205,24 @@ object. The defaults below are proposals; tune them from evidence.
 
 ### 5.3 Jobs
 
-- `DecomposeJob` and `SceneJob` documents move
-  `pending → running → ready / failed / refused`.
+- `DecomposeJob` and `SceneJob` documents move through five states;
+  `ready`, `failed` and `refused` are terminal.
+
+```mermaid
+stateDiagram-v2
+  [*] --> pending
+  pending --> running: claim before call
+  pending --> failed: stale sweep
+  running --> ready
+  running --> failed: error or stale sweep
+  running --> refused
+  ready --> [*]
+  failed --> [*]
+  refused --> [*]
+```
+
+_Job states for `DecomposeJob` and `SceneJob`; only one caller wins the claim. The stale sweep applies to `DecomposeJob` only._
+
 - They are idempotent by job id, with claim-before-call, as in
   `src/server/decompose-job.ts`.
 - The request does the work and writes the status; the client polls.
@@ -251,9 +267,11 @@ object. The defaults below are proposals; tune them from evidence.
 > are chosen or at TTL, and (b) a 1-day lifecycle rule as backstop.
 > (a) shipped: the app deletes the working copy at "Pin selected" and
 > an opportunistic per-board sweep deletes copies past the TTL
-> (`src/server/board-api.ts`, `decompose-job.ts`). (b) lands with
-> PIN-209. Until the 1-day rule is applied on a bucket, do not claim
-> a hard 24 h deletion in user-facing copy.
+> (`src/server/board-api.ts`, `decompose-job.ts`). (b) shipped:
+> `storage.lifecycle.json` now holds the 1-day rule on `tmp/` (PIN-209,
+> Oct 31). `firebase deploy` does not apply it; the operator applies
+> it to each bucket (`docs/DEPLOY.md` §6 step 2). Claim a 24 h
+> deletion in user-facing copy only for a bucket that has the rule.
 
 ### 5.6 Scene inputs
 
@@ -434,7 +452,8 @@ owning issue in brackets decides or verifies.
    **Default:** app deletes the working copy when pins are chosen
    (or at 24 h via a sweeper); operator tightens the lifecycle rule
    to 1 day as backstop. No 24 h claim in copy until both exist.
-   **Status:** the app side shipped; the 1-day rule is PIN-209 (A6).
+   **Status:** both shipped (A6); the operator applies the 1-day rule
+   per bucket (`docs/DEPLOY.md` §6 step 2).
    [PIN-53 + operator]
 6. **Slug validation:** a `%2F` slug reaches Firestore as a path.
    Validate at every route entry, or centrally in the repository?
@@ -443,17 +462,17 @@ owning issue in brackets decides or verifies.
    not 500), plus a unit test. Exactly 22 chars matches the current
    128-bit base64url generator. [PIN-51]
 7. **Preset fate:** `docs/archive/09` presets bundle a host persona with a
-   look. The game is gone — keep, halve, or delete?
+   look. The game is gone: keep, halve, or delete?
    **Default (A5):** looks become board themes (tokens + PIN-41
    art); personas are deleted in PIN-52. [PIN-52 / PIN-53]
-8. **Demo-board seeding:** how is the judge demo board populated —
+8. **Demo-board seeding:** how is the judge demo board populated:
    synthetic pins committed as fixtures, generated live on first
    visit, or seeded by a script against prod?
    **Default:** synthetic elements + scenes committed as small
    fixtures under `eval/` rules, seeded by an idempotent script per
    environment; no live paid calls on judge traffic. [PIN-55]
 9. **Faces copy:** `faces: note` shows "everyone in this photo OK
-   with being remixed?" — dismissible per photo, per board, or
+   with being remixed?", dismissible per photo, per board, or
    once per participant?
    **Default:** once per photo containing a face; never blocking
    (§2). Refusals from the provider render as a friendly `refused`
@@ -499,9 +518,9 @@ owning issue in brackets decides or verifies.
 
 | Issue | What | Blocked by | Executor |
 | --- | --- | --- | --- |
-| PIN-48 | Parent: Studio pivot hand-off | — | Muse Code |
-| PIN-49 | Spec into the repo (`docs/11`, ADR-003), agent rules rewritten | — | Muse Code |
-| PIN-50 | Slice 0: live spikes on synthetic images (§8) | — | Muse Code |
+| PIN-48 | Parent: Studio pivot hand-off | none | Muse Code |
+| PIN-49 | Spec into the repo (`docs/11`, ADR-003), agent rules rewritten | none | Muse Code |
+| PIN-50 | Slice 0: live spikes on synthetic images (§8) | none | Muse Code |
 | PIN-51 | Policy and gateway foundations (§5.1–5.2) | PIN-49 | Muse Code |
 | PIN-52 | Delete the game code, rename routes to boards | PIN-49 | Muse Code |
 | PIN-53 | Slice 1: photo → elements → pins | PIN-51, PIN-52 | Muse Code |
diff --git a/docs/12-submission.md b/docs/12-submission.md
index fd59acb2..96600435 100644
--- a/docs/12-submission.md
+++ b/docs/12-submission.md
@@ -1,4 +1,4 @@
-# 12 — Submission packet (PIN-81)
+# 12. Submission packet
 
 _Status: freeze-prep packet, Oct 29, 2026, refreshed Oct 31
 (PIN-219). Feature freeze Tue Nov 3, 2026 (end of day);
@@ -83,7 +83,7 @@ PR numbers and dates: [`build-log.md`](build-log.md).
 | Judges' board (private link from the PIN-81 tracker entry; never commit; not the landing demo board, `docs/DEPLOY.md` §6.3) | `<DEMO_BOARD_URL from Linear>` |
 | Pitch video (~3 min, §2; public since Nov 3) | https://www.youtube.com/watch?v=q6lkrA6fsCI |
 | How the app uses Meta's models (in the app, on prod since promotion #2, Nov 2) | https://pinneds.com/models |
-| Build log: who built what, with PR numbers | https://github.com/MoriaCrew/Pinned/blob/main/docs/build-log.md (on `main` only after the next promotion; use `blob/dev/…` until then) |
+| Build log: who built what, with PR numbers | https://github.com/MoriaCrew/Pinned/blob/main/docs/build-log.md |
 | Dev backend (live models; the only live demo before Nov 1) | https://dev.pinneds.com |
 
 Notes for whoever fills this in:
diff --git a/docs/13-auth.md b/docs/13-auth.md
index 7801a08c..a52e320e 100644
--- a/docs/13-auth.md
+++ b/docs/13-auth.md
@@ -1,23 +1,27 @@
-# 13 — Sign-in (`AUTH_MODE`, PIN-57)
+# 13. Sign-in
 
-Server foundation landed in PIN-83; the sign-in button (PIN-84)
-and the cross-board library (PIN-85) build on it. Spec:
-`docs/11-studio.md` section 5.4; the original claim flow is in
-`docs/archive/02`.
+Sign-in is optional and sits behind `AUTH_MODE` (PIN-57). With
+`optional`, a participant may sign in with Google to get a personal
+library across boards (My boards and My pins); it never gates a
+board, because the board link stays the only way in. The server
+foundation is PIN-83, the sign-in button PIN-84 and the cross-board
+library PIN-85. Spec: `docs/11-studio.md` section 5.4.
 
 ## Modes
 
-- `AUTH_MODE=link-only` (the default; prod today): board
-  participants never authenticate. Every route below returns the
-  uniform 404 and no user code runs on the board flow — the
-  flag-off parity tests in `src/server/user-session.test.ts` and
+- `AUTH_MODE=link-only` (the default in code and in
+  `apphosting.yaml`): board participants never authenticate. Every
+  route below returns the uniform 404 and no user code runs on the
+  board flow. The flag-off parity tests in
+  `src/server/user-session.test.ts` and
   `src/app/api/auth/auth-routes.test.ts` are the contract.
-- `AUTH_MODE=optional`: a participant *may* sign in with Google.
+- `AUTH_MODE=optional` (set in `apphosting.dev.yaml` and
+  `apphosting.prod.yaml`): a participant *may* sign in with Google.
   The link-only board flow keeps working unchanged; sign-in only adds
   identity linking.
 
 Unknown `AUTH_MODE` values fail closed to `link-only`
-(`src/config.ts`, FR8).
+(`parseConfig` in `src/config.ts`).
 
 ## Flow (optional mode)
 
@@ -31,8 +35,8 @@ Unknown `AUTH_MODE` values fail closed to `link-only`
    added by PIN-83 solely for this verification. PIN-94: exchange
    always verifies with revocation checking, and only Policy
    `authAllowedProviders` (default `google.com`) may mint a
-   session — enabling another Firebase provider (e.g. Anonymous)
-   in a console cannot sign anyone in by itself. PIN-160: the
+   session, so enabling another Firebase provider (Anonymous, for
+   example) in a console cannot sign anyone in by itself. PIN-160: the
    exchange refuses a cross-site request (403 `cross_site`) or a
    non-JSON body (415) before any body read, so another site
    cannot plant its own session in a visitor's browser (login
@@ -50,10 +54,10 @@ Unknown `AUTH_MODE` values fail closed to `link-only`
    automatically (never overwriting a different user's claim,
    never failing the join). Both paths maintain the
    `users/{uid}/boards/{slug}` index (doc-get/subcollection
-   reads only — no new Firestore index). Freshness (PIN-94,
+   reads only, so no new Firestore index). Freshness (PIN-94,
    narrowed by PIN-160): the user cookie carries the token's
    `auth_time`, and the Policy `authFreshWindowMs` window
-   (default 1h) now protects restore only — the one path that
+   (default 1h) now protects restore only, the one path that
    mints a participant cookie from the account alone; a stale
    restore restores nobody. The explicit claim route keeps its
    check (401 `stale_auth`), but join and board-open link the
@@ -68,35 +72,35 @@ Unknown `AUTH_MODE` values fail closed to `link-only`
 ## What is stored
 
 `users/{uid}` holds `uid`, optional `displayName` / `photoUrl`
-from the token, and timestamps. **Email is never stored** —
-nothing sends mail or keys identity off an address; the token's
-email claim is not even read. The profile and board index
-persist until a future account-deletion flow lands (not yet
-built; one board's row goes with "Remove from My boards",
-PIN-166); `userSessionDays` bounds the cookie only.
+from the token, and timestamps. **Email is never stored**:
+nothing sends mail or keys identity off an address, and the
+token's email claim is not even read. The profile and board index
+persist: there is no account-deletion flow yet (one board's row goes
+with "Remove from My boards", PIN-166), and `userSessionDays`
+bounds the cookie only.
 
 ## Operator steps to enable (per backend)
 
-Status Oct 29, 2026: done for both projects. The Google
-provider + authorized domains are enabled in dev and prod;
-the web config lives in Secret Manager under the
-`NEXT_PUBLIC_FIREBASE_*` names (referenced from
-`apphosting.yaml`, never literals in git — gitleaks enforces
-this). Dev runs `AUTH_MODE=optional` (PR #76); prod flips at
-promotion (PIN-76). The original runbook, for a new backend:
-
-1. Firebase console → Authentication → enable the Google
-   provider for the backend's project, and add the backend's
-   custom domain under Authentication → Settings →
-   Authorized domains.
-2. Register/copy the web app config; store
+_Operators only: this section is for whoever runs the hosted service; a visitor can skip it._
+
+Both projects (dev and prod) have the Google provider and the
+authorized domains enabled, and both run `AUTH_MODE=optional`. The
+web config lives in Secret Manager under the
+`NEXT_PUBLIC_FIREBASE_*` names (referenced from `apphosting.yaml`,
+never literals in git; gitleaks enforces this). The runbook, for
+a new backend:
+
+1. In the Firebase console, open Authentication and enable the
+   Google provider for the backend's project, then add the
+   backend's custom domain under Settings, Authorized domains.
+2. Register and copy the web app config; store
    `NEXT_PUBLIC_FIREBASE_API_KEY` and
    `NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN` in Secret Manager
    (`firebase apphosting:secrets:set` + `grantaccess` for the
    backend) and set `AUTH_MODE=optional` in that backend's
    `apphosting.*.yaml`. The root layout reads the values
    server-side and may prerender at build, so the shared
-   config grants BUILD + RUNTIME availability — a rebuild is
+   config grants BUILD + RUNTIME availability, and a rebuild is
    required either way.
 3. Make sure the runtime service account can verify tokens
    (Application Default Credentials; App Hosting's compute
@@ -107,11 +111,11 @@ promotion (PIN-76). The original runbook, for a new backend:
 
 Until step 2 lands for a backend, the `NEXT_PUBLIC_*`
 values resolve empty and the sign-in UI stays hidden even in
-optional mode — no dead buttons.
+optional mode, so there are no dead buttons.
 
-## Auth domain: sign-in on the app's own host (PIN-163)
+## Auth domain: sign-in on the app's own host
 
-By default the web config's `authDomain` is the
+PIN-163. By default the web config's `authDomain` is the
 `NEXT_PUBLIC_FIREBASE_AUTH_DOMAIN` secret, the project's
 `{project}.firebaseapp.com`, so Google's account chooser names
 that address. Putting the app host in the secret alone does not
@@ -134,33 +138,33 @@ paths, which Firebase Hosting serves and App Hosting does not
    project's own firebaseapp host, where only Firebase's reserved
    helper answers on these paths.
 2. authDomain: `src/config.ts` then serves the host of
-   `APP_BASE_URL` instead of the secret — only for an https
+   `APP_BASE_URL` instead of the secret, only for an https
    `APP_BASE_URL` and a valid project id (the proxy must exist);
    otherwise the secret's value, unchanged. The client project id
    always comes from `FIREBASE_PROJECT_ID`: `resolveAuthUi` never
    derives one from a non-firebaseapp authDomain.
-3. Flag off (the default, and prod today) is byte-identical to
+3. Flag off (unset, the default in code) is byte-identical to
    before; rollback is removing the flag and rebuilding.
 
+`apphosting.dev.yaml` and `apphosting.prod.yaml` both set
+`AUTH_SAME_ORIGIN` to `1`, so Google's chooser names the app host
+on `dev.pinneds.com` and `pinneds.com`.
+
+_Operators only: the rest of this section is console work, done once per environment._
+
 Operator step, per environment (console, not code):
 
-- Google Cloud console → APIs & Services → Credentials → the
-  project's web OAuth client → add the authorized redirect URI
-  `https://{app host}/__/auth/handler`, and keep the app host in
-  Firebase Authentication → Settings → Authorized domains.
-- Dev: done Oct 30 for `dev.pinneds.com`; `apphosting.dev.yaml`
-  sets `AUTH_SAME_ORIGIN=1`.
-- Prod, at promotion: add `https://pinneds.com/__/auth/handler`
-  to the prod project's web client, confirm `pinneds.com` is an
-  authorized domain, then set `AUTH_SAME_ORIGIN: "1"` beside
-  `AUTH_MODE: optional` in `apphosting.prod.yaml`.
+- In the Google Cloud console, open APIs & Services, Credentials,
+  the project's web OAuth client, and add the authorized redirect
+  URI `https://{app host}/__/auth/handler`. Keep the app host in
+  Firebase Authentication, Settings, Authorized domains.
 - Smoke after the rebuild: `GET https://{app host}/__/auth/handler`
   answers 200 (not the app's 404), and the Google chooser names
   the app host.
 
-## Sign-in UI + My boards + restore (PIN-84)
+## Sign-in UI, My boards and restore
 
-The client half of PIN-57b, still behind the same gates:
+PIN-84 is the client half, behind the same gates:
 
 1. Visibility: `resolveAuthUi` (src/domain/auth-ui.ts) enables
    the UI only when `AUTH_MODE=optional` AND the public web
@@ -186,7 +190,7 @@ The client half of PIN-57b, still behind the same gates:
    signed out. Each card's More menu has "Remove from My boards"
    (PIN-166): `DELETE /api/me/boards/{slug}` deletes the caller's
    own index row AND clears `userId` on the caller's own
-   participant there (only when it carries that uid) — never the
+   participant there (only when it carries that uid), never the
    board, nor anyone else's row or claim. The row alone would not
    hold (the next signed-in join or fresh `/claim` rewrites it).
    Side effects: the board's pins leave My pins and restore on
@@ -197,12 +201,12 @@ The client half of PIN-57b, still behind the same gates:
 4. Restore + auto-claim: in optional mode, `GET
    /api/boards/{slug}` with a user session but no participant
    cookie re-issues the participant cookie when the user holds
-   a claim on that board (the slug link is still required —
+   a claim on that board (the slug link is still required;
    sign-in never substitutes for it), and an unclaimed
    participant opening a board while signed in is claimed
    silently. Restore rotates `cookieSecretHash` like the
    reclaim-PIN path, so the previous device's cookie stops
-   working — the single-hash record cannot hold two live
+   working, because the single-hash record cannot hold two live
    cookies. Restore needs a fresh sign-in (PIN-94); the silent
    claim works at any sign-in age (PIN-160). Neither runs for a
    request the browser labels cross-site (`Sec-Fetch-Site` other
@@ -214,13 +218,12 @@ The client half of PIN-57b, still behind the same gates:
    Policy `signInNudge` (default true) and only ever shown
    when sign-in is available.
 
-Live Google proof still depends on the operator steps above;
-until then the hosted dev backend stays link-only and none of
-this renders there.
+A backend that has not finished the operator steps above stays
+link-only in practice: none of this renders there.
 
-## My pins library + pin-to-this-board (PIN-85)
+## My pins library and pin-to-this-board
 
-The cross-board library that closes PIN-57, behind the same
+PIN-85 is the cross-board library that closes PIN-57, behind the same
 gates (404 in link-only mode, 401 signed out):
 
 1. Library: `GET /api/me/elements` and the `/me/pins` page
@@ -228,19 +231,19 @@ gates (404 in link-only mode, 401 signed out):
    where their claim is live (user board index -> claimed
    participant -> `listElementsByOwner`), newest first,
    capped at Policy `libraryPageSize` (default 60). Only
-   PINNED things are listed (PIN-125): a candidate still in
+   PINNED elements are listed (PIN-125): a candidate still in
    review, left out, or cleared from the board's leftovers
    line keeps its element but never shows in the library
    (one pin read per board filters them). Cards
-   carry the source board's TITLE only — a slug never appears
+   carry the source board's TITLE only; a slug never appears
    in a library payload or URL. Each card also carries
    `familyId` (PIN-121): the original element's id for a
-   library copy (`sourceElementId`), else its own id — always
-   one of the caller's own things — so the Add sheet can tell
-   which things already sit on the board it is open on.
+   library copy (`sourceElementId`), else its own id (always
+   one of the caller's own pins), so the Add sheet can tell
+   which pins already sit on the board it is open on.
 2. Thumbnails: `GET /api/me/elements/{id}/image` authorizes
    by signed-in OWNERSHIP (the element's owner participant
-   must be claimed by the caller), not by board link — the
+   must be claimed by the caller), not by board link: the
    cross-board counterpart of the board-link image route.
    Every miss is the uniform 404. It stays `private, no-store`:
    the session, not the URL, authorizes it, so a cached copy
@@ -252,7 +255,7 @@ gates (404 in link-only mode, 401 signed out):
    participant; pinning twice returns `alreadyPinned`, never
    an error. The board Add sheet shows it under the photo
    target as the "From your other boards" strip (PIN-121; one
-   sticker per family, things already here greyed as "Already
+   sticker per family, pins already here greyed as "Already
    here", capped at Policy `libraryStripMax`, default 12) with
    "See all" for the full list; `/me/pins?board=<slug>` offers
    the same action per card.
@@ -262,9 +265,9 @@ gates (404 in link-only mode, 401 signed out):
    element under the pin's own board, so a true cross-board
    Pin cannot be written in this layout (and the delete
    cascade assumes the same). Pinning cross-board therefore
-   creates a copy Element on the target board — new id,
-   `sourceElementId` provenance, the SAME cutout/flattened
-   storage refs — owned by the current participant (the same
+   creates a copy Element on the target board (new id,
+   `sourceElementId` provenance, the SAME cut-out and flattened
+   storage refs) owned by the current participant (the same
    signed-in user, so credit stays theirs). Copies compose,
    remix and cascade natively from then on. `deleteMyElement`
    guards the shared objects: deleting the original or a
@@ -276,9 +279,9 @@ gates (404 in link-only mode, 401 signed out):
    its Firestore form needs the `sourceElementId` collection-
    group field index declared in `firestore.indexes.json`.
 
-## Scene delete (PIN-142, parent PIN-132)
+## Scene delete
 
-`DELETE /api/boards/{slug}/scenes/{sceneId}`: the scene's maker
+PIN-142. `DELETE /api/boards/{slug}/scenes/{sceneId}`: the scene's maker
 (participant cookie) or the board host (host cookie, see
 `docs/15-board-plus.md`). After the slug gate and the cross-site 403
 (no I/O), every failure before authorization is the uniform 404: no
@@ -295,9 +298,9 @@ route's `max-age` ends. The board view marks each scene `canDelete`
 (maker or host; only a UI hint, PIN-143), so a host's Delete shows
 after the first client poll (the page render has no host cookie).
 
-## Board delete (PIN-167)
+## Board delete
 
-`DELETE /api/boards/{slug}`: the board's host only (host cookie).
+PIN-167. `DELETE /api/boards/{slug}`: the board's host only (host cookie).
 Bodyless. After the slug gate come the cross-site 403 and the
 `Policy.boardDeletePerIp` 429, before any read; every other failure
 is the uniform 404 (no or bad host cookie, another board's host, an
@@ -318,9 +321,9 @@ after writing, and My boards skips one anyway, so a row left behind
 links nothing. Jobs in flight are not waited for: their board-record writes
 (elements, pins, scenes, events) are refused and they end quietly,
 but a job already running can still finish its AI call, update its
-own job doc and debit one make from the board's credit account. The
+own job doc and debit one creation from the board's credit account. The
 Firestore records stay (no route serves them; the shared-asset check
-below reads them). A library copy of a thing made on another live
+below reads them). A library copy of a pin made on another live
 board before the delete keeps working for its owner (it shares the
 original's bytes). Concurrent deletes: only the call that set the
 tombstone gets 204; the other gets the uniform 404. Errors on these
@@ -328,9 +331,9 @@ paths are logged with slug-shaped tokens blanked
 (`src/server/safe-log.ts`).
 
 Storage (PIN-169, `src/server/board-storage.ts`): then the board's
-three folders, built from the valid slug with the trailing slash —
-`tmp/boards/{slug}/`, `elements/boards/{slug}/`,
-`scenes/boards/{slug}/` — are listed and emptied, best-effort (never
+three folders, built from the valid slug with the trailing slash
+(`tmp/boards/{slug}/`, `elements/boards/{slug}/` and
+`scenes/boards/{slug}/`), are listed and emptied, best-effort (never
 fails the 204; errors logged by name only). Only an element folder
 whose cut-out a library copy on a live board still points at stays
 whole, decided from storage, so it holds even when the source record
@@ -361,10 +364,10 @@ Everyone else with the board open: the board poll's 404 (not a
 generic load error) renders the same not-found as an unknown link,
 which unmounts the board and so ends the polling.
 
-## Thing rename (PIN-156, parent PIN-134)
+## Pin rename
 
-`PATCH /api/boards/{slug}/elements/{elementId}` with JSON
-`{ label }`: the thing's owner only (participant cookie). After the
+PIN-156. `PATCH /api/boards/{slug}/elements/{elementId}` with JSON
+`{ label }`: the pin's owner only (participant cookie). After the
 slug gate come the checks that read nothing, so they answer the same
 for every element: cross-site 403, non-JSON 415, a body over
 `Policy.elementRenameMaxBytes` 413. Then every miss is the uniform
diff --git a/docs/14-design-system.md b/docs/14-design-system.md
index bad5cedb..963d2ba4 100644
--- a/docs/14-design-system.md
+++ b/docs/14-design-system.md
@@ -1,9 +1,10 @@
-# 14 — Pinneds design system (PIN-95)
+# 14. Pinneds design system
 
-Status: **Accepted** by Robin on Oct 29, 2026. Replaces the
-first-generation Studio look (`docs/archive/09`), which read as
-AI-generated. The product flow (`docs/11` §6) is unchanged; the
-look and the interaction design are rebuilt from scratch.
+The look and interaction design of Pinneds, decided on Oct 29, 2026
+(PIN-95). It replaces the first-generation Studio look
+(`docs/archive/09-design-system.md`), which read as AI-generated. The
+product flow (`docs/11` §6) is unchanged; the look and the
+interaction design were rebuilt from scratch.
 
 ## The idea
 
@@ -124,7 +125,9 @@ Principles:
   skin with synthetic samples from `public/lab/`; use it for QA and
   PR screenshots.
 
-## Landing and library screens (PIN-104)
+## Landing and library screens
+
+PIN-104 put the landing, My boards and My pins on the kit.
 
 - Landing (`/`), My boards, My pins and the not-found page sit on the
   Paper skin (`data-theme="paper"` + `pn-skin-root`, class
@@ -246,9 +249,9 @@ fill on its cream ground (2.1:1).
   `public/fonts/LICENSES.md`); the reading face and Bricolage
   Grotesque are preloaded.
 
-## Link card (PIN-102)
+## Link card
 
-A board link pasted into a chat shows a 1200 x 630 card in the
+PIN-102. A board link pasted into a chat shows a 1200 x 630 card in the
 board's skin (`src/app/g/[slug]/opengraph-image.tsx`, reused by
 `twitter-image.tsx`): wordmark, "{name} invited you to pin your
 things to" (earliest participant; dropped when nobody joined), the
@@ -290,7 +293,7 @@ No pins yet: three dashed ghost outlines.
 | Oct 30 | A thing's name tag wraps to up to 3 lines, "…" only past that (PIN-164) | One line cut most names after ~9 letters in the wide uppercase looks |
 | Oct 31 | One purchase replaces the Plus plans and makes packs: €2.99 once per board for Plus + 20 creations, bought by any joined member for the board; free pool 5; members change the look once the board has Plus; no host plan sold (PIN-181; supersedes the Oct 29 Plus row) | One clear thing to buy; guests never have to pay, and anyone who wants more can give it to the board |
 | Oct 31 | One Board Plus sheet is the only screen that asks for money: the perks plus one €2.99 purchase (Plus + 20 creations) for the board, through the credits checkout; no plan cards, no Host plan, no separate "Add makes" sheet; makes are called "creations" in the UI (PIN-182) | One clear thing to buy and one word for what it buys; any member can give it to the board, and nobody sees a price list |
-| Oct 31 | The Make sheet is a chat-style composer: mic and Stop are icon buttons inside the field (the chat convention, an exception to "icon-only for close, share, more"), "Make it" stays labelled; ideas are one scrolling row; tapping a pressed chip takes it back out (PIN-216) | Robin: the mic below the field felt awkward; the old sheet overflowed a 390x844 phone and wiped typed text |
+| Oct 31 | The Make sheet is a chat-style composer: mic and Stop are icon buttons inside the field (the chat convention, an exception to "icon-only for close, share, more"), "Make it" stays labelled; ideas are one scrolling row; tapping a pressed chip takes it back out (PIN-216) | The operator found the mic below the field awkward; the old sheet overflowed a 390x844 phone and wiped typed text |
 | Oct 31 | The creations indicator speaks only at `lowMakesWarning` or fewer left, as one quiet board-meta line with a text button (no card, nothing above the threshold); running out is an invitation into the Plus sheet, never an error; the count lives in the you menu as Board Plus; any joined member can change the look once Plus is on (PIN-183) | A board with plenty looks like a credits-off board; money is offered when it helps, not shown all the time |
 | Oct 31 | Busy boards get a sticky filter row above the pins (New / All / Mine / people) instead of reordering or paging the grid; the grid stays oldest first (PIN-218) | 100+ pins from 18 people is 40 rows; finding your own or a friend's pins, or what is new, should take one tap, and polling must never reshuffle the grid |
 | Oct 31 | When a page throws, visitors get the Paper dead end "Something came unpinned." with Try again and Go home, never the error, its message or digest; `global-error` carries the same screen when the root layout itself fails (PIN-212) | Judges and first-time visitors never see Next's bare "Application error"; same quiet look as not-found, one primary action |
diff --git a/docs/15-board-plus.md b/docs/15-board-plus.md
index 3b4584cb..1dffaab3 100644
--- a/docs/15-board-plus.md
+++ b/docs/15-board-plus.md
@@ -1,17 +1,32 @@
-# 15 — Board Plus (PIN-103)
-
-Server seam for an optional paid add-on. The UI is built
-separately; this page is the contract it builds on.
-`PLUS_MODE` is `off` (nothing can be bought), `mock` (demo) or
-`stripe` (the Board Plus pack via hosted Checkout, PIN-149; the
-makes and Plus land by webhook only, PIN-150 / PIN-181).
+# 15. Board Plus and creations
+
+Server seam for an optional paid add-on, introduced in PIN-103.
+The UI is built separately; this page is the contract it builds on.
+`PLUS_MODE` is `off` (nothing can be bought, the default), `mock`
+(demo) or `stripe` (the Board Plus pack via hosted Checkout,
+PIN-149; the creations and Plus land by webhook only, PIN-150 /
+PIN-181).
+
+**In one screen.** Board Plus is the one paid thing in Pinneds: a
+single pack, bought once for one board, that unlocks every look and
+foil stickers, removes the free-photo limit and adds 20 creations,
+for €2.99 through hosted Stripe Checkout. Any member can buy it for
+everyone on the board. A creation is one AI scene (adding a photo and
+cutting it out never uses one); when a board runs out, scenes fall
+back to free collages, so nothing stops working and guests never have
+to pay. New boards start with a free pool of 5 creations and 15 free
+photos, for a maker's first 3 boards in 7 days (prod gives 20
+creations during judging week). Nothing is sold while `PLUS_MODE=off`,
+the code default; dev runs Stripe in test mode and prod runs live
+Stripe. The rest of this page is the contract for the code and the
+operator runbook.
 
 ## What it is
 
 - The core loop is free while `Policy.credits.enabled` is off
-  (the shipped default, PIN-151): uploads, cut-outs, pins, scenes
-  and the AI budget are unchanged. With credits on, AI makes
-  ("creations" in the UI) spend the board pool instead (PIN-151
+  (the code default, PIN-151): uploads, cut-outs, pins, scenes
+  and the AI budget are unchanged. With credits on, AI creations
+  (`makes` in code) spend the board pool instead (PIN-151
   below). **A creation is one AI scene (PIN-229):** adding a photo
   and its cut-outs never uses one, so discarding cut-outs costs
   nothing; every AI scene uses one, even one the person does not
@@ -35,7 +50,7 @@ makes and Plus land by webhook only, PIN-150 / PIN-181).
 > - **Who is a maker:** the signed-in user when sign-in is on and
 >   the request carries a session, else the client address the
 >   rate limiter uses (`clientIp` in `src/server/rate-limit.ts`,
->   PIN-112) — IPv4 as is, IPv6 grouped by its /64, anything
+>   PIN-112): IPv4 as is, IPv6 grouped by its /64, anything
 >   unreadable in one shared bucket. People behind one shared
 >   IPv4 (office, school or event Wi-Fi, some mobile carriers)
 >   share one allowance while signed out; signing in gives each
@@ -57,8 +72,8 @@ makes and Plus land by webhook only, PIN-150 / PIN-181).
 >   unchanged.
 > - **The hard wall** stays the site-wide daily AI budget
 >   (`dailyBudgetUsd` / `dailyCallLimit`), which free and paid
->   makes share today (PIN-206 splits it). Tuning ideas after
->   launch: PIN-207.
+>   creations share today (splitting them is tracked as PIN-206).
+>   Tuning ideas after launch: PIN-207.
 
 > **Free photos rule (PIN-230).** Since a creation is an AI scene
 > (PIN-229), a free board's photo cost (~$0.02 a photo, docs/16)
@@ -86,12 +101,12 @@ makes and Plus land by webhook only, PIN-150 / PIN-181).
 >   use the Policy value. A board's own override
 >   (`policyOverrides.credits.freePhotosPerBoard`) wins over the
 >   stored amount: an operator's explicit choice for that one
->   board. (The demo board needs none: it is a normal board and
->   gets Plus, so no photo limit, once billing is live, DEPLOY
->   §6.4.)
+>   board. (The judges' board needs none: it is a normal board that
+>   gets Plus, so it has no photo limit, once billing is live;
+>   `docs/DEPLOY.md` section 6, step 4.)
 > - **At the limit:** `POST /photos` answers a typed 429
 >   `{ code: "free_photos_used" }` before intake, any job or any
->   AI call — checked before the daily cap, since waiting a day
+>   AI call, checked before the daily cap, since waiting a day
 >   would not help. The batch queue stops on it like the other
 >   coded 429s. A lost-response replay of a counted photo still
 >   gets its job back.
@@ -125,11 +140,13 @@ makes and Plus land by webhook only, PIN-150 / PIN-181).
   existing `Board.themeId`; `isBoardThemeId` accepts every skin id
   plus the first-generation theme ids.
 
-## The purchase (PIN-181)
+## The purchase
+
+Introduced in PIN-181.
 
 | What | Who can buy | Billing | Grants | Policy |
 | --- | --- | --- | --- | --- |
-| Board Plus · 20 creations (`pinneds_plus_20`) | any joined member or the host | €2.99 once, this board | 20 makes + `Board.plus = { plan: "board", source: "stripe" }` | `credits.packs`, `credits.plusOnPurchase` |
+| Board Plus · 20 creations (`pinneds_plus_20`) | any joined member or the host | €2.99 once, this board | 20 creations + `Board.plus = { plan: "board", source: "stripe" }` | `credits.packs`, `credits.plusOnPurchase` |
 
 It is bought through the credits buy route (PIN-149) and granted
 by the webhook (PIN-150 section). The plan ids `board` / `host`
@@ -258,7 +275,7 @@ host-only but answers every failure with the uniform 404
 - `GET /billing/return?intent={id}&result=success|cancel` → 302.
   The return redirector Stripe points at: it resolves the opaque
   intent server-side and lands on `/g/{slug}?billing=processing`
-  (success) or `?billing=cancelled` (cancel). It grants nothing —
+  (success) or `?billing=cancelled` (cancel). It grants nothing:
   credits arrive by webhook only (PIN-150), hence "processing".
   Unknown, expired and malformed intents all land on `/` with no
   flag, indistinguishable from each other. It is read-only
@@ -320,33 +337,38 @@ is `off`. Adapters live in `src/billing/` behind the `Checkout`
 port (`startCheckout({ slug, plan })`, which throws a typed
 `BoardNotFoundError` when the board is gone).
 
-- `off` (default; prod): every checkout answers `unavailable` and
+- `off` (the code default, used when `PLUS_MODE` is unset or not
+  an exact known value): every checkout answers `unavailable` and
   writes nothing. A leftover `source: "mock"` grant **does not
   count** in `off` (`hasPlus(board, mode)`): it unlocks no skin
   and the view shows `active: false`. A board already wearing a
   Plus skin keeps the stored id; the UI decides how to render
-  that (follow-up). The UI should present Plus honestly as not
-  available yet — never a buy button that pretends.
-- `mock` (dev backend via `apphosting.dev.yaml`; locally via
-  `.env.local`): grants the entitlement at once with
+  that (follow-up). The UI presents Plus honestly as not
+  available, never a buy button that pretends.
+- `mock` (locally via `.env.local`; the dev backend used it
+  until PIN-153): grants the entitlement at once with
   `source: "mock"`. No money moves; the UI must say it is a demo.
   The stored source keeps mock grants distinguishable forever.
   Never set `mock` on prod.
 - `stripe` (PIN-149): sells the Board Plus pack through hosted
-  Stripe Checkout (adapter section below). Requires
-  `STRIPE_SECRET_KEY` in the same env — `stripe` without a key
-  parses as `off` in config (fail closed: sells nothing, never
-  errors per request; `GET /api/health` shows the effective
-  mode). Plus comes only with that pack (PIN-181): the plan
-  route still answers `unavailable`, and a stored
+  Stripe Checkout (adapter section below). Requires both
+  `STRIPE_SECRET_KEY` and `STRIPE_WEBHOOK_SECRET` in the same env,
+  and, when `STRIPE_EXPECTED_LIVEMODE` (`live` or `test`) is set,
+  a key of that mode. Otherwise `stripe` parses as `off` in config
+  (fail closed: sells nothing, never errors per request;
+  `GET /api/health` shows the effective mode; `src/config.ts`,
+  `parsePlusMode`). Plus comes only with that pack (PIN-181): the
+  plan route still answers `unavailable`, and a stored
   `source: "stripe"` grant counts while a mock one does not.
-  **Dev runs `stripe` since PIN-153** (sandbox only: the dev
-  backend flips together with `Policy.credits.enabled` and
-  the registered webhook endpoint - PIN-153 section below).
-  Prod stays `off` until the PIN-210 prod switch turns on live
-  Stripe ("Going live on prod" below). PIN-149/PIN-150
-  deliberately shipped reference-only so no backend ever took
-  a payment with no fulfilment path.
+  **Dev runs `stripe` since PIN-153** (sandbox only, with
+  `STRIPE_EXPECTED_LIVEMODE=test`: the dev backend flips together
+  with `Policy.credits.enabled` and the registered webhook
+  endpoint, PIN-153 section below). **Prod runs `stripe` with live
+  Stripe since the PIN-210 prod switch** (`apphosting.prod.yaml`
+  on `main`, `STRIPE_EXPECTED_LIVEMODE=live`; "Going live on
+  prod" below). PIN-149/PIN-150 deliberately shipped
+  reference-only so no backend ever took a payment with no
+  fulfilment path.
 
 Check a backend with `GET /api/health` → `plusMode`.
 
@@ -381,11 +403,14 @@ list.
 | `checkoutPerIp` | 20 / 600,000 ms | buy route per-IP brake |
 | `webhookMaxBytes` | 1,048,576 | webhook body cap (PIN-178) |
 
-## Stripe catalog (PIN-146)
+## Stripe catalog
+
+_Operators only: this section is for whoever runs the hosted service; a visitor can skip it._
 
-What Pinneds sells is committed code: `src/billing/catalog.ts`
+Introduced in PIN-146. What Pinneds sells is committed code:
+`src/billing/catalog.ts`
 (`CATALOG_ITEMS`, catalog version `dev-v1`). Amounts are EUR
-cents, tax-inclusive (TTC) — the displayed price is the charged
+cents, tax-inclusive (TTC): the displayed price is the charged
 price. Runtime slices import the manifest; nothing reads Stripe
 object ids from config.
 
@@ -395,7 +420,7 @@ object ids from config.
 | `pinneds_credits_25` | 25 makes | €4.99 one-time | retired (PIN-181) |
 | `pinneds_credits_60` | 60 makes | €9.99 one-time | retired (PIN-181) |
 | `pinneds_credits_150` | 150 makes | €19.99 one-time | retired (PIN-181) |
-| `pinneds_host_monthly` | host plan | €4.99/month recurring | draft — seeded, not offered |
+| `pinneds_host_monthly` | host plan | €4.99/month recurring | draft, seeded, not offered |
 
 "Creations" is the customer-facing word for makes; code keeps
 `credits`/`makes`. The Checkout page shows the item's name
@@ -420,7 +445,7 @@ when a price is replaced.
 
 `scripts/seed-stripe-catalog.mjs` converges a Stripe **sandbox**
 onto the manifest (plain `fetch`, no SDK; it mirrors the
-manifest — a test pins the mirror). It is a dry-run unless
+manifest; a test pins the mirror). It is a dry-run unless
 `--apply` is passed, takes the secret from the env var named by
 `--env-var` (never printed; a live key is refused unless
 `--live --i-understand-live`, PIN-210), and prints item keys and
@@ -434,7 +459,7 @@ node --env-file=.env.local scripts/seed-stripe-catalog.mjs --env-var STRIPE_PINN
 Convergence: a product matched by metadata is reused (updated
 in place on copy/metadata drift); a price matched by lookup key
 is reused only when amount, currency, product, tax behavior and
-recurrence all match — those fields are immutable, so drift
+recurrence all match (those fields are immutable), so drift
 mints a new price with `transfer_lookup_key=true` and archives
 the old one. The price lookup reads archived prices too (Stripe
 lists only active ones unless asked, paginated like every list):
@@ -449,15 +474,14 @@ idempotency keys, and re-running a converged sandbox creates
 nothing. The pure decision functions
 (`catalogValidationErrors`, `planProduct`, `planPrice`,
 `buildCatalogPlan`) are unit-tested in
-`src/billing/catalog.test.ts`. This slice changes no runtime
-behavior in that slice; the runtime adapter followed in
-PIN-149 (below).
+`src/billing/catalog.test.ts`. That change added no runtime
+behaviour; the runtime adapter followed in PIN-149 (below).
 
-## Credit ledger (PIN-147)
+## Credit ledger
 
-`src/domain/credit-ledger.ts` is the pure per-board makes ledger
-(board-loop debit wiring lands in PIN-151, below):
-no Stripe calls in the domain — checkout/webhook
+Introduced in PIN-147. `src/domain/credit-ledger.ts` is the pure
+per-board makes ledger (board-loop debit wiring landed in PIN-151,
+below): no Stripe calls in the domain. The checkout and webhook
 slices translate Stripe events into its operations, taking amounts
 from `Policy.credits` (packs pinned to the PIN-146 catalog by a
 test, `starterMakes` granted once per board (5 since PIN-181),
@@ -501,9 +525,9 @@ dispute's (PIN-233); debits spend only `available`. Persistence sits behind the
 operation is one atomic per-board read-modify-write and a refusal
 writes nothing.
 
-## Credit storage + checkout intents (PIN-148)
+## Credit storage + checkout intents
 
-`FirestoreCreditLedgerStore`
+Introduced in PIN-148. `FirestoreCreditLedgerStore`
 (`src/server/firestore-credit-ledger-store.ts`) implements the
 ledger port by running the pure ops inside one Firestore
 transaction per board, so concurrent debits cannot overspend and
@@ -511,12 +535,12 @@ concurrent grants cannot double-credit; a throw aborts the
 transaction and writes nothing. Storage is multi-doc so no
 document grows unbounded:
 
-- `creditAccounts/{boardId}` — the account head only (`balance`,
+- `creditAccounts/{boardId}`: the account head only (`balance`,
   `frozen`, `pendingClawback`, `starterGranted`,
   `frozenByDispute`).
-- `creditAccounts/{boardId}/purchases/{purchaseId}` — one doc
+- `creditAccounts/{boardId}/purchases/{purchaseId}`: one doc
   per recorded purchase.
-- `creditAccounts/{boardId}/entries/{eventId}` — one append-only
+- `creditAccounts/{boardId}/entries/{eventId}`: one append-only
   doc per applied entry, keyed by event id, with an internal
   `_seq` (append order, stripped on reads; the board-repository
   pattern).
@@ -528,7 +552,7 @@ restart. Unknown boards read a zero balance. All access is
 direct doc reads plus whole-subcollection reads sorted in code:
 **no new composite indexes**, so `firestore.indexes.json` is
 unchanged and no index deploy is needed for this slice.
-`firestore.rules` stays deny-all — the Admin SDK server path
+`firestore.rules` stays deny-all: the Admin SDK server path
 owns these collections.
 
 `CheckoutIntent` (`src/server/checkout-intent.ts`, Firestore impl
@@ -538,12 +562,12 @@ UUID intent id; the board mapping exists only inside the stored
 record at `checkoutIntents/{intentId}` (top-level by intent id,
 so a webhook resolves it with one direct get). The
 public/Stripe-facing shape (`toPublicCheckoutIntent`) carries
-only the opaque intent id plus the pack offer — no board slug or
+only the opaque intent id plus the pack offer; no board slug or
 internal board id may ever reach Stripe metadata,
 `client_reference_id` or URLs; the checkout slice must send the
 intent id and nothing board-identifying. `purchaseId` equals the
 intent id (one opaque identity per purchase); creating an intent
-writes nothing to the ledger — the caller drives
+writes nothing to the ledger; the caller drives
 `recordPurchase`/`closePurchase` with that id. Intent `expiresAt`
 is `createdAt + Policy.credits.intentTtlSeconds`, and the
 per-board pending cap (`Policy.credits.pendingIntentCapPerBoard`,
@@ -552,7 +576,7 @@ against `checkoutIntentBoards/{boardId}` (`pendingIntentIds`),
 lazily expiring stale pending intents so an abandoned tab
 cannot block a board forever. `close`/`expire` free the cap
 slot. No routes, Stripe calls or board-loop wiring landed in
-this slice — store selection arrived with PIN-149, the first
+this slice; store selection arrived with PIN-149, the first
 slice to call these stores (below).
 
 Since PIN-178 the TTL only governs that cap slot. Intent status
@@ -565,11 +589,11 @@ finalizes an `expired` intent, so a late grant lands on it.
 The old `resolvePending` ("still payable") call is gone: the
 webhook resolves an intent by id whatever its status.
 
-## Stripe Checkout adapter + buy route (PIN-149)
+## Stripe Checkout adapter + buy route
 
-`StripeCreditCheckout` (`src/billing/stripe-checkout.ts`,
+Introduced in PIN-149. `StripeCreditCheckout` (`src/billing/stripe-checkout.ts`,
 official `stripe` SDK, server-only) implements the additive
-`CreditCheckout` port next to the plan-based `Checkout` port —
+`CreditCheckout` port next to the plan-based `Checkout` port:
 packs are not Plus plans, so the plan port's shape stays
 untouched and keeps answering `unavailable` in stripe mode.
 The client is dependency-injected (tests run a fake; no network
@@ -602,8 +626,8 @@ How a buy flows (`buyCredits`, `src/server/credit-checkout.ts`):
    fails, the intent and purchase are closed again so the cap
    slot is freed, and the caller gets a generic 503.
 
-Session parameters (checked against the current Stripe docs —
-Checkout Sessions create + Adaptive Pricing):
+Session parameters (checked against the current Stripe docs:
+Checkout Sessions create and Adaptive Pricing):
 
 - `mode: "payment"`, one line item at quantity 1 on the EUR
   base price. `expires_at` tracks the intent's expiry (floored
@@ -613,14 +637,13 @@ Checkout Sessions create + Adaptive Pricing):
   freed. A session paid in the gap after the intent's TTL
   still grants (PIN-178); the webhook stays the grant
   authority.
-- `adaptive_pricing: { enabled: true }` — Stripe presents the
+- `adaptive_pricing: { enabled: true }`: Stripe presents the
   payer's local currency and handles conversion; the session
   still settles in EUR. This only takes effect on eligible
   sessions and follows the Dashboard's Adaptive Pricing
-  setting; if the account cannot use it (e.g. a Managed
-  Payments conflict, to verify when the mode is first flipped
-  on dev), the fallback is explicit `currency_options` on the
-  catalog prices — not built today.
+  setting; if the account cannot use it (for example a Managed
+  Payments conflict), the fallback is explicit `currency_options`
+  on the catalog prices, not built today.
 - **No `payment_method_types`.** That is the legacy static
   list; eligible methods are Dashboard-managed (dynamic payment
   methods) and naming types would override the Dashboard
@@ -642,11 +665,12 @@ Hosted wiring in this slice was reference-only: dev referenced
 `STRIPE_SECRET_KEY` from Secret Manager in
 `apphosting.dev.yaml` but kept `PLUS_MODE=mock`, and prod
 referenced nothing, so no hosted backend took a Stripe payment
-before webhook grants landed. PIN-153 flips dev (below).
+before webhook grants landed. PIN-153 flipped dev (below).
 
-## Stripe webhook (PIN-150)
+## Stripe webhook
 
-`POST /api/billing/stripe/webhook` (Node runtime) is the only
+Introduced in PIN-150. `POST /api/billing/stripe/webhook` (Node
+runtime) is the only
 grant authority for credit packs: it hands the RAW body +
 `Stripe-Signature` header to the SDK's `constructEvent` with
 `STRIPE_WEBHOOK_SECRET` (env name via `src/config.ts`; the dev secret exists since
@@ -666,8 +690,8 @@ and every dead letter below. The service
 client (`src/billing/stripe-webhook.ts`), so tests verify
 real signatures with the SDK signer and fake only retrievals.
 
-Events PIN-153 must register on the endpoint (snapshot
-payloads, API version pinned in lockstep with the SDK) -
+Events registered on the endpoint by PIN-153 (snapshot
+payloads, API version pinned in lockstep with the SDK),
 exactly `STRIPE_WEBHOOK_EVENT_TYPES` in the service:
 
 - `checkout.session.completed`
@@ -731,11 +755,11 @@ and dispute lifecycle pages):
   money, mirroring the makes claw: once the makes clawback has
   landed, the webhook clears `Board.plus`
   (`decidePlusRevocation`) when a purchase is taken all the way
-  back — the money taken back on it (cumulative settled refunds
+  back: the money taken back on it (cumulative settled refunds
   plus lost disputes, `takenBackEurCents`) reaching the pack
   price; partial refunds and partial losses never. The event
   that gets there claws the remainder and names the reason
-  (`full_refund`, or `dispute_lost` with its dispute id) — and
+  (`full_refund`, or `dispute_lost` with its dispute id), and
   leaves a `Board.plusRevocation` tombstone with the removed
   grant. If another granted purchase on the board is still live
   (its take-back below its price, even with its makes clawed
@@ -758,7 +782,7 @@ and dispute lifecycle pages):
   actually-due revoke dead-letters `plus_revoke_unavailable`.
 - `async_payment_failed` + `expired` are the terminal
   events: they close the intent and its ledger purchase,
-  never grant; a purchase the ledger refuses to close (e.g.
+  never grant; a purchase the ledger refuses to close (for example
   partially pre-clawed) dead-letters for an operator. Stripe
   never reports one session both expired and paid, so a paid
   event after `expired` would dead-letter `dead_intent`.
@@ -861,19 +885,20 @@ pack (PIN-181); a separate host plan stays unbuilt: the draft
 Refunds and disputes claw back makes and, when a purchase is
 taken all the way back, revoke its Plus too (PIN-242 above).
 
-## Pool debit on makes (PIN-151)
+## Pool debit on makes
 
-`src/server/credit-pool.ts` is the one place the board loop
-touches the ledger. Everything sits behind
+Introduced in PIN-151. `src/server/credit-pool.ts` is the one
+place the board loop touches the ledger. Everything sits behind
 **`Policy.credits.enabled`, default `false`** (deep-overridable
 via env `POLICY_OVERRIDES_JSON` or per board, like every other
-credits key). While off, no ledger method is ever called — no
+credits key). While off, no ledger method is ever called: no
 starter grants, no debits, no pool gate, no `credits` field in
-the board view — so `AUTH_MODE=link-only` behaviour is exactly
+the board view, so `AUTH_MODE=link-only` behaviour is exactly
 the pre-credit behaviour, and the untouched existing suites
 prove it. Flipping the flag off mid-life restores that at once.
-No hosted backend enables it in this slice (activation is
-PIN-153). While on but unwired (no store in deps — only
+PIN-151 enabled it on no hosted backend; dev turned it on in
+PIN-153 and prod in PIN-210 (both via `POLICY_OVERRIDES_JSON`).
+While on but unwired (no store in deps, only
 possible in a test harness) the pool reads empty and debits
 refuse: fail closed, never gift a make.
 
@@ -885,9 +910,9 @@ Since PIN-205 creation first decides the amount for the maker
 (the pool, or 0 past `starterBoardsPerMaker`; "Free creations
 rule" above) and stores it on the board; a lazy grant uses that
 stored amount, and the Policy default only for boards without it.
-Every later credit touch — a board-view balance read (each
-5-second poll), a photo preflight, a scene run or a make's
-debit — first reads the account head with `getBalance`: one
+Every later credit touch (a board-view balance read on each
+5-second poll, a photo preflight, a scene run or a make's
+debit) first reads the account head with `getBalance`: one
 `creditAccounts/{boardId}` doc read, no transaction, no
 `purchases`/`entries` read (PIN-179). Only a missing head or
 `starterGranted: false` (a board that predates the flag, or a
@@ -908,7 +933,7 @@ PIN-151 photo row below applies again.
 | --- | --- | --- |
 | Photo (`DecomposeJob`) | only with `photosUseMakes`: the job finishing `ready` (one completed job per photo, any element count) | by default every photo; always failures/refusals, cap denies, tap-adds and tap naming on its working copy |
 | Scene/remix (`SceneJob`) | a ready scene recorded kind `ai` | refusals/failures, any collage (`AI_MOCK`, over-budget fallback, pool-empty lane) |
-| Riders | — | suggestion chips, dictation: still only Policy-capped |
+| Riders | none | suggestion chips, dictation: still only Policy-capped |
 
 **Debit points (exact seams).** Debit event ids are
 `debit:photo:{jobId}` / `debit:scene:{jobId}`, so a retry or
@@ -926,14 +951,14 @@ claim gates already refuse a second run).
   stale sweep, PIN-64), exactly as with credits off.
 - Scene: inside `runSceneJob`, after the composed image is
   stored and before the terminal `finish` syncs a `ready`
-  Scene — the only state the image route serves.
+  Scene, the only state the image route serves.
 
 **Idempotent uploads + stale runners.** A photo POST may carry a
 client-minted `uploadId` that becomes the job id (docs/06): a
 replay returns the existing job before the pool preflight, so it
 can never reach this seam twice. The runner also checks its own
-deadline (the summed Policy timeouts + `Policy.staleJobMarginMs` for its non-AI tail) *before* debiting — past it
-the job fails `stale_running` with no debit — and every job-store
+deadline (the summed Policy timeouts + `Policy.staleJobMarginMs` for its non-AI tail) *before* debiting: past it
+the job fails `stale_running` with no debit. Every job-store
 write is compare-and-set on the expected status. If a debited
 runner nevertheless loses its guarded `ready` finish (the
 board-api stale sweep at bound + 2 x margin failed
@@ -944,7 +969,7 @@ the make under the deterministic ledger event
 retries of the finish can never double-refund). If the request
 died after debiting (no live runner to refund), the sweep checks
 the ledger instead and keeps the paid job's candidates
-confirmable — the board never pays for a result it cannot pin.
+confirmable: the board never pays for a result it cannot pin.
 
 **Race rule.** The ledger debit is one atomic per-board
 read-modify-write, so two makes racing for the last credit
@@ -957,7 +982,7 @@ Once a debit lands the make is
 paid: the ready outcome is recorded on the job first, and if
 the terminal write itself throws it is retried once instead of
 discarding or overwriting the result. A non-pool ledger failure at the seam fails the job
-`credit_debit_failed` with the same discard/delete — failing
+`credit_debit_failed` with the same discard/delete, failing
 closed without claiming the pool was empty. An exception in
 the photo run before the seam also discards landed candidates
 while credits are on (off, the keep-what-landed PIN-64 rule
@@ -968,7 +993,7 @@ stands).
 photo.
 Scene: the existing free collage lane composes instead (the
 composer port is never called, the scene is honestly kind
-`collage` at $0, nothing debits) — decided inside
+`collage` at $0, nothing debits), decided inside
 `runSceneJob` before composing, exactly like the budget
 fallback it joins. The Policy daily caps and the PIN-61 AI
 budget gates keep applying in every mode; a pool-empty collage
@@ -995,9 +1020,10 @@ concurrent first touches grant once; replay after reload) runs
 against the fake Firestore in
 `src/server/firestore-credit-ledger-store.test.ts`.
 
-## Plus sheet + creations UI (PIN-152, PIN-182, PIN-183, PIN-231)
+## Plus sheet + creations UI
 
-The user-facing word for makes is **creations** (the code keeps
+Introduced in PIN-152 and reworked in PIN-182, PIN-183 and
+PIN-231. The user-facing word for makes is **creations** (the code keeps
 `makes` / `credits`). There is exactly one sheet that asks for
 money, the Board Plus sheet (`PlusSheet` in `src/ui/skin-picker.tsx`,
 mounted by `PlusFlow` in `src/app/g/[slug]/PlusFlow.tsx`); the
@@ -1022,7 +1048,7 @@ announced (`aria-live="polite"`).
   quiet line under the title in the board-meta style, no card:
   "N creations left · Get Plus", where "Get Plus" is a text button
   that opens the Plus sheet. At zero: "Out of creations. New scenes
-  will be collages." plus the same button — the free collage lane,
+  will be collages." plus the same button: the free collage lane,
   still labelled `Collage` on the print. Once the board has Plus
   the button reads "Add creations" (the same label on every way
   into the sheet below). The button is left out while billing is
@@ -1094,8 +1120,9 @@ announced (`aria-live="polite"`).
   Processing means "adding your creations…": the banner refetches
   the board a few times, and only a real rise in
   `availableMakes` (over the count kept from buy time) may
-  say "Your creations are in — N creations left." (plus "Plus is
-  on." once the refetched view has `plus.active`) — granting stays
+  say that the creations are in and how many are left (plus
+  "Plus is on." once the refetched view has `plus.active`;
+  `makes.added`, `makes.addedPlus`). Granting stays
   webhook-only (PIN-150) and the redirect alone never claims
   success. No rise after the refetches lands on a neutral "still
   waiting" line; cancelled/failed returns get one neutral line
@@ -1197,9 +1224,11 @@ code), `src/server/my-boards.test.ts` and `src/app/me/library-parts.test.ts`
 hosted flip ships with this slice: `Policy.credits.enabled`
 stays default `false` and no hosted `PLUS_MODE` changes.
 
-## Reconciliation + dev activation (PIN-153)
+## Reconciliation + dev activation
 
-`npm run billing:reconcile` (`scripts/billing-reconciliation.mjs`,
+_Operators only: this section is for whoever runs the hosted service; a visitor can skip it._
+
+Introduced in PIN-153. `npm run billing:reconcile` (`scripts/billing-reconciliation.mjs`,
 pure report logic in `src/domain/billing-reconciliation.ts`) is
 the operator safety net: a read-only join of paid Stripe
 Checkout Sessions (listed with the runtime key, by env name)
@@ -1254,8 +1283,8 @@ The script is automation-ready, in three output modes. Human mode
 (operator terminal) keeps the lines above and ends with one
 parseable `RECONCILIATION_JSON:{...}` line. `--json` sends the
 human lines to stderr and prints only the full payload
-(`{stripe, project, summary, report}`) on stdout — operator
-terminal only, since the report carries ids. `--summary-only` is
+(`{stripe, project, summary, report}`) on stdout (operator
+terminal only, since the report carries ids). `--summary-only` is
 the public-log mode: stdout is only `{stripe, project, summary}`,
 stderr only the aggregate `billing reconciliation …`, `SUMMARY …`
 and `refunds-disputes …` lines, and an error prints the Stripe
@@ -1268,7 +1297,7 @@ summary (`summarizeBillingReconciliation` in
 counts and booleans only, pinned by tests) carries
 `paidNoGrantCount`, `grantNoPaymentCount`, `deadLetterTotal`,
 `pendingPastTtlCount`, `anomalyCount`, `clean`, and
-`needsAttention` — true exactly when paid-no-grant > 0 or
+`needsAttention`, true exactly when paid-no-grant > 0 or
 `deadLetterTotal > 0`, the alert condition. Exit stays 1 for any
 non-clean report (a superset of the alert condition) or a runtime
 error, 0 clean, 2 usage/config.
@@ -1277,15 +1306,16 @@ error, 0 clean, 2 usage/config.
 `--summary-only` daily (06:17 UTC; GitHub runs the cron from the
 default branch, `main`) and on `workflow_dispatch`. The repo is
 public, so its log and step summary are too: the step summary is
-the heading `## Billing reconciliation (<env>) — exit <code>` and
-the summary JSON only. For the rows behind a red run, run the
+a heading naming the environment and the exit code (see the
+`Reconcile (fail = alert)` step in the workflow) and the summary
+JSON only. For the rows behind a red run, run the
 script in an operator terminal (command above). The job runs in
 GitHub Environment `reconcile-dev` or `reconcile-prod`: the
 dispatch input picks it, else repository variable
 `PINNED_RECONCILE_ENV` (`prod` selects `reconcile-prod`; unset or
 anything else is `reconcile-dev`; keep it unset until go-live). It
-authenticates to Google Cloud by Workload Identity Federation — no
-service-account key exists anywhere — and installs dependencies
+authenticates to Google Cloud by Workload Identity Federation (no
+service-account key exists anywhere) and installs dependencies
 with `npm ci --ignore-scripts` before that auth step, so no
 install-time code runs next to a credential. Every action is
 pinned to a full commit SHA.
@@ -1296,7 +1326,7 @@ paste them into issues, PRs or logs):
 1. **Environments.** Settings → Environments: create
    `reconcile-dev` and `reconcile-prod`. Restrict `reconcile-prod`
    deployment branches to `main` only (`reconcile-dev`: `main` and
-   `dev`). No required reviewers — they would hold the cron.
+   `dev`). No required reviewers: they would hold the cron.
 2. **Per environment** (not at repository level): secret
    `PINNED_RECONCILE_STRIPE_READ_KEY` (restricted read key:
    `rk_test_` in dev, `rk_live_` in prod; Checkout Sessions: Read,
@@ -1339,7 +1369,7 @@ gcloud iam service-accounts add-iam-policy-binding "$SA@$P.iam.gserviceaccount.c
 `<PROJECT_NUMBER>` comes from
 `gcloud projects describe "$P" --format="value(projectNumber)"`.
 Once enabled, a non-clean report or an error fails the run and
-lands in the step summary — that failed run is the dead-letter
+lands in the step summary; that failed run is the dead-letter
 alert, so watch Actions notifications for the workflow and drain
 dead letters per the runbook above before calling a billing change
 done. Never paste secret values into the workflow, issues or PRs.
@@ -1347,7 +1377,7 @@ done. Never paste secret values into the workflow, issues or PRs.
 **Refunds/disputes visibility (PIN-243).** Each run also lists
 Stripe refunds and disputes from the last 30 days
 (`refundsLast30Days`, `disputesLast30Days`, `openDisputes` in the
-summary; informational only — a refund is not an anomaly and
+summary; informational only: a refund is not an anomaly and
 never changes the exit code). The restricted read key in the
 PIN-210 table carries Charges and Refunds: Read and Payment
 Disputes: Read for this (the Dashboard's permission names; on the
@@ -1401,12 +1431,14 @@ and backfills the mapping; the PIN-147 pre-grant freeze /
 pre-clawback semantics then apply unchanged. A dispute for
 a genuinely unknown charge still dead-letters.
 
-## Going live on prod (PIN-210)
+## Going live on prod
+
+_Operators only: this section is for whoever runs the hosted service; a visitor can skip it._
 
-Prod (pinneds.com) sells the Board Plus pack with **live** Stripe
-only once the prod switch (merge order below) reaches `main`, after
-both live secrets exist: App Hosting fails the build when a
-referenced secret does not exist. The operator
+Introduced in PIN-210. Prod (pinneds.com) sells the Board Plus
+pack with **live** Stripe once the prod switch (merge order below)
+is on `main` and both live secrets exist: App Hosting fails the
+build when a referenced secret does not exist. The operator
 scripts default to sandbox. A live run needs a live key **and**
 `--live --i-understand-live`, touches only `moriacrew-pinned-prod`
 and `https://pinneds.com/api/billing/stripe/webhook`, and prints
@@ -1465,32 +1497,33 @@ is the reference.
    `gcloud secrets describe STRIPE_SECRET_KEY --project "$P" --format="value(name)"`,
    same for `STRIPE_WEBHOOK_SECRET`. Say so on PIN-210.
 
-**Merge order.** Live billing comes in two pieces (Robin, Oct 31):
+**Merge order.** Live billing came in two pieces (decided Oct 31):
 
-1. **This runbook and the operator scripts** (PIN-210, #182) merge
-   to `dev` before the Nov 3 freeze. They change nothing on prod or
-   dev: the scripts only run from an operator machine.
-2. **The prod switch** is a separate config-only PR (PIN-210, "turn
-   on live billing on prod"). It adds one block to
+1. **This runbook and the operator scripts** (PIN-210, #182)
+   merged to `dev` before the Nov 3 freeze. They change nothing on
+   prod or dev: the scripts only run from an operator machine.
+2. **The prod switch** was a separate config-only PR (PIN-210, #203,
+   "turn on live billing on prod"). It added one block to
    `apphosting.prod.yaml`: `PLUS_MODE=stripe`, both secret references
-   and `POLICY_OVERRIDES_JSON={"credits":{"enabled":true,"starterMakes":20}}`
-   (judging-week value, Robin Nov 2: 20 free creations per new board,
-   back to 5 after judging; the dev backend ignores that file). Merge
-   it only after step 4.
-   If that happens before the freeze, it rides promotion #2. If not,
-   run a config-only promotion as soon as step 4 is done, even during
-   judging week (`docs/DEPLOY.md` §4 recipe, §8). `dev` is frozen by
-   then, so that promotion carries only the switch.
+   and `POLICY_OVERRIDES_JSON` with credits on and `starterMakes` 5;
+   that value was raised to 20 on Nov 2 for judging week (20 free
+   creations per new board, back to 5 after judging; the dev backend
+   ignores that file). It
+   was to merge only after step 4. It is on `main` now, so the
+   `apphosting.prod.yaml` block is the source of truth for prod; a
+   later config-only change goes through `docs/DEPLOY.md` section 4
+   (promote) and section 8 (judging week).
 
 **Smoke after the rollout.** `GET https://pinneds.com/api/health`
 shows `plusMode: "stripe"`; a webhook POST with a bad
 `Stripe-Signature` answers 400; a new board shows 20 creations
 (the judging-week `starterMakes`).
-Robin buys the €2.99 pack **on the demo board** with a real card
-and keeps it (`docs/DEPLOY.md` §6.4: the demo board is a normal
-board, and this makes it a paying customer's board). Checkout says
-"Board Plus · 20 creations", the demo board shows Plus and 20 more
-creations, and the endpoint's delivery in Workbench is 200. Refund
+The operator buys the €2.99 pack **on the judges' board** with a
+real card and keeps it (`docs/DEPLOY.md` section 6, step 4: the
+judges' board is a normal board, and this makes it a paying
+customer's board). Checkout says
+"Board Plus · 20 creations", the judges' board shows Plus and 20
+more creations, and the endpoint's delivery in Workbench is 200. Refund
 check, on a throwaway board: buy the pack again, then refund it in
 the Dashboard (Payments → the payment → Refund, full). The refund
 events claw back the 20 creations and revoke the board's Plus
@@ -1505,7 +1538,7 @@ session grants once billing is back, or refund it). The pool
 stays on; `"enabled":false` in the override stops it too.
 Stopping for good: disable the endpoint in Workbench.
 
-**Go-live ops runbook (PIN-243; operator Dashboard steps —
+**Go-live ops runbook (PIN-243; operator Dashboard steps,
 documented here, never executed by an agent).** Run in order
 around the prod-switch merge above; this is Checklist B of
 `docs/security-review-2026-11-01.md` made executable:
@@ -1514,29 +1547,30 @@ around the prod-switch merge above; this is Checklist B of
    dev rollout, Stripe Dashboard (test mode) → Developers →
    Webhooks → the `dev.pinneds.com` endpoint → "Send test event"
    (`checkout.session.completed`): the delivery must be **200**,
-   not 400 (bad signature — Secret Manager
+   not 400 (bad signature: Secret Manager
    `STRIPE_WEBHOOK_SECRET` does not pair with the endpoint; roll
    the secret in Workbench and re-store it, PIN-153 section) and
    not 503 (billing off / config fail-closed; check
-   `GET /api/health` `plusMode` and the PIN-243/§F6 pairing +
-   livemode guards). Repeat against the live endpoint after the
-   prod rollout. Only this test delivery (or the live smoke
-   below) proves the pairing — Stripe never returns the secret.
+   `GET /api/health` `plusMode` and the pairing and live-mode
+   guards, finding F6 in `docs/security-review-2026-11-01.md`).
+   Repeat against the live endpoint after the prod rollout. Only
+   this test delivery (or the live smoke below) proves the
+   pairing: Stripe never returns the secret.
 2. **Check delivery history for accumulated 503s.** Same endpoint
    page → delivery history: during the billing-off era the prod
    webhook answered 503, so look for a backlog of failed/pending
    deliveries. Stripe retries for up to three days; resend only
    events for real paid sessions once pairing is proven, and let
    test/noise deliveries expire. A fresh run of non-2xx after
-   go-live means grants are not landing — stop and reconcile.
-3. **Live EUR 2.99 buy + refund smoke.** The "Smoke after the
-   rollout" paragraph above, unchanged: buy the pack on the demo
-   board with a real card and keep it; buy again on a throwaway
-   board and refund in full in the Dashboard (Payments → the
-   payment → Refund); confirm the 20 creations claw back, the
+   go-live means grants are not landing: stop and reconcile.
+3. **Live €2.99 buy + refund smoke.** The "Smoke after the
+   rollout" paragraph above, unchanged: buy the pack on the
+   judges' board with a real card and keep it; buy again on a
+   throwaway board and refund in full in the Dashboard (Payments →
+   the payment → Refund); confirm the 20 creations claw back, the
    endpoint delivery is 200, and the live reconcile command there
-   exits 0 (`clean=true`, `needsAttention=false`). Since PIN-242 (stacked below) note the changed behaviour:
-   a full refund also revokes Plus - confirm that here too.
+   exits 0 (`clean=true`, `needsAttention=false`). Since PIN-242 a
+   full refund also revokes Plus: confirm that here too.
 4. **Rollback rehearsal.** Set `PLUS_MODE=off` in
    `apphosting.prod.yaml` and roll out `main` (Rollback paragraph
    above): buying answers "unavailable", the webhook 503s and
diff --git a/docs/16-ai-usage.md b/docs/16-ai-usage.md
index cf1f8280..7d16a0f2 100644
--- a/docs/16-ai-usage.md
+++ b/docs/16-ai-usage.md
@@ -1,7 +1,10 @@
-# AI usage attribution (PIN-137)
+# 16. AI usage and cost log
 
-Every decorated AI call appends one `AiCallLog` (v2) record,
-including budget/cap denials (`denied_*` outcomes). Fields:
+This page covers what each AI call records (PIN-137 added the
+attribution fields), how a call is priced, and the operator report
+that rolls the log up. Every decorated AI call appends one
+`AiCallLog` (v2) record, including budget and cap denials
+(`denied_*` outcomes). Fields:
 `boardId` (slug, internal only), `participantId`,
 `userIdAtCall` (snapshot at call time, `null` for link-only,
 never backfilled), `sceneId`/`photoId`/`jobId` where the caller
@@ -20,16 +23,16 @@ Oct 30):
 
 | Operation | Billing unit | Estimate |
 | --- | --- | --- |
-| Spark (`nameElements`, `nameOne`, `suggestChips`) | tokens | $1.25 in / $4.25 out per 1M tokens |
+| Muse Spark (`nameElements`, `nameOne`, `suggestChips`) | tokens | $1.25 in / $4.25 out per 1M tokens |
 | SAM 3.1 (`segment`) | image | $2.50 per 1000 images |
 | Muse Image (`composeScene`) | generated image | flat $0.01 |
-| Muse Voice (`transcribe`) | audio second | $0.18 per hour |
+| Muse Voice Transcribe (`transcribe`) | audio second | $0.18 per hour |
 
 A scene costs the flat Muse Image price, whatever its token
 counts (PIN-180). Before the call the gateway reserves $0.01
 against the daily budget (so the $5 code default admits 500
-scenes, and prod's $50 during judging admits 5,000). After
-it, the `AiCallLog` row is priced at $0.01 per generated image:
+scenes, and prod's $50 a day, set in `apphosting.prod.yaml` for
+judging week, admits 5,000). After the call, the `AiCallLog` row is priced at $0.01 per generated image:
 `images` on the row is how many images the reply held, so a
 reply with no image (a refusal) and a failed call are priced
 at $0. Input and output tokens stay on the row for
@@ -37,16 +40,15 @@ attribution but never move the price. The scene job's own
 `costUsd` is the same $0.01 for an AI scene and $0 for a
 collage.
 
-## SAM `store` flag (PIN-213)
+## SAM `store` flag
 
-SAM store flag: PIN-213, default off until probed. `Policy.samStore`
-unset (the default) sends no `store` field on SAM `/v1/responses`
-calls, exactly as before; `false` sends `store: false` on every
-concept and tap (point) cut. Set it per board
-(`policyOverrides.samStore`) for the one live probe, then globally
-via `POLICY_OVERRIDES_JSON`. Muse Image compose already sends
-`store: false` (`Policy.sceneStore`). The SAM lab route does not use
-the flag.
+PIN-213. `Policy.samStore` unset (the default) sends no `store` field
+on SAM 3.1 `/v1/responses` calls; `false` sends `store: false` on
+every concept and tap (point) cut, and `true` sends `store: true`.
+The flag is meant to be set per board (`policyOverrides.samStore`)
+for one live probe, then globally via `POLICY_OVERRIDES_JSON`.
+Muse Image compose already sends `store: false` (`Policy.sceneStore`,
+default false). The SAM lab route does not use the flag.
 
 ## Collage reason
 
@@ -54,24 +56,26 @@ A scene that comes out as a collage records why, in
 `collageReason` on the scene and its job (also in the public
 scene and job payloads):
 
-- `budget`: the daily AI budget, call limit or AI switch
-  closed the composer (job errors `budget`, `call_limit`,
-  `budget_off`). The board shows one line on the print: AI was
-  busy, so this one is a collage, and no creation was used. No
-  make is debited for a collage.
-- `pool_empty`: the board has no makes left (PIN-151). Its
-  copy is the makes copy (PIN-152).
+- `budget`: the daily or hourly AI budget, the call limit or the AI
+  switch closed the composer (job errors `budget`, `hourly_budget`,
+  `call_limit`, `budget_off`). The board shows one line on the
+  print: AI was busy, so this one is a collage, and no creation was
+  used. No creation is debited for a collage.
+- `pool_empty`: the board has no creations left (PIN-151). Its
+  copy is the creations copy (PIN-152).
 - `mock`: offline demo mode (`AI_MOCK=1`). No extra line.
 
 Collages from before this field have no reason and show no line.
 
 A photo job the budget denied (the namer, or the cutter when
 no pin landed) ends `failed` with the same `errorCode`
-(`budget`, `call_limit` or `budget_off`), and the add sheet
-shows the budget line instead of the generic failure.
+(`budget`, `hourly_budget`, `call_limit` or `budget_off`), and the
+add sheet shows the budget line instead of the generic failure.
 
 ## Operator report
 
+_Operators only: this section is for whoever runs the hosted service; a visitor can skip it._
+
 ```sh
 npm run usage:costs -- --from 2026-10-01 --to 2026-10-31
 npm run usage:costs -- --days 7
@@ -87,8 +91,9 @@ Firestore TTL policies can only be created console-side. Rows
 carry `expireAtTs` (a Timestamp mirror of `expireAt`, written by
 `FirestoreGameRepository`) so the operator can enable a TTL
 policy on `aiCallLogs.expireAtTs` in the Firebase console or via
-`gcloud firestore fields ttls update`. Until that policy exists,
-rows are retained — code does not fake deletion. The same
+`gcloud firestore fields ttls update` (`docs/DEPLOY.md` §6, item 1).
+Until that policy exists, rows are retained; the code does not
+fake deletion. The same
 console step applies to `starterAllowances.expireAtTs` (PIN-204,
 the free-creations-per-maker counters keyed by a hashed client
 address or user id, docs/15): with the policy on, a counter goes
diff --git a/docs/17-showcase-sets.md b/docs/17-showcase-sets.md
index 2dfd65b9..7b07dc12 100644
--- a/docs/17-showcase-sets.md
+++ b/docs/17-showcase-sets.md
@@ -1,4 +1,4 @@
-# Landing showcase sets: how to make, add or change one
+# 17. Landing showcase sets: how to make, add or change one
 
 The landing page shows one **showcase set** per visit (PIN-175): the
 hero sticker pile, then the three "How it works" pictures. This page
@@ -6,17 +6,22 @@ is the working recipe for making a set, adding it to the landing and
 changing it later. The try-on and cat sets went through it on
 Oct 30 and 31, 2026.
 
-The rule for every set (PIN-170): every photo is synthetic, and every
-sticker and scene is made by this app's own pipeline. Spark names the
-things, SAM 3.1 cuts them out and Muse Image composes the scene. After
-that, files are only resized and cropped, never retouched by hand.
+The rule for every set made with this recipe (PIN-170): every photo is
+synthetic, and every sticker and scene is made by this app's own
+pipeline. Muse Spark names the things, SAM 3.1 cuts them out and Muse
+Image composes the scene. After that, files are only resized and
+cropped, never retouched by hand. The older `classic` set predates the
+recipe: its photo came from Higgsfield text-to-image, and its cut-outs
+and scene are eval fixtures (`public/landing/README.md`). It is
+synthetic too, and two of its cut-outs had a hole made transparent by
+hand, which that README records.
 
 Related:
 
 - Spike decisions and evidence:
   [`eval/showcase/README.md`](../eval/showcase/README.md) (PIN-171).
-- How the landing draws a set: `docs/14-design-system.md`, "Showcase
-  sets".
+- How the landing draws a set: the "Showcase sets" entry in
+  [`docs/14-design-system.md`](14-design-system.md).
 - What each shipped file is made from:
   [`public/landing/README.md`](../public/landing/README.md).
 
@@ -59,9 +64,9 @@ Run it as `node scripts/showcase-build.mjs <command>` or
   pass `--live`. `run` refuses a live app unless you pass `--live`.
 - **Specs hold no local paths.** A friend's photo is a relative name
   inside the photos folder (`cat/aye.webp`), so a spec can be
-  committed. PIN-172's manifest (`eval/showcase/sets.json`) is read the
-  same way: `plan` and `run` take one set spec, or a manifest
-  `{ "sets": [ ... ] }` plus set ids.
+  committed. `plan` and `run` take one set spec, or a manifest
+  `{ "sets": [ ... ] }` plus set ids (`scripts/showcase/spec.mjs`).
+  PIN-172's manifest is not in the repository.
 - **Nothing secret in output.** Board slugs, session cookies and keys
   are never printed, logged or written to `run.json`.
 
@@ -160,7 +165,7 @@ What cuts well, from the runs so far:
 - **Contrast.** Put a thing on a plain surface of another colour. A
   cream cable-knit scarf on a cream bench came out ragged.
 - **On its own.** Don't rest a thing on large furniture. With a scarf
-  on a green armchair, Spark named the armchair and dropped the scarf.
+  on a green armchair, Muse Spark named the armchair and dropped the scarf.
 - **Pairs give one sticker.** Tan suede boots came out as one boot.
 - **Big enough.** A person photo also yields small extras (tote,
   plant, sneakers). The tote cut-out was 82 px wide, too small for the
@@ -197,8 +202,9 @@ for a dry run of the whole chain before any live run.
 
 Also unset the Stripe variables, `DEMO_BOARD_SLUG` and
 `FIRESTORE_EMULATOR_HOST` (`serve` does). A live server also gets
-longer model timeouts through `POLICY_OVERRIDES_JSON` (Spark 90 s,
-SAM 60 s, scene 180 s; a longer value in the env file wins), and a
+longer model timeouts through `POLICY_OVERRIDES_JSON` (Muse Spark
+90 s, SAM 3.1 60 s, scene 180 s; a longer value in the env file wins;
+`LIVE_TIMEOUTS_MS` in `scripts/showcase/serve.mjs`), and a
 throwaway `SESSION_SECRET` when the env has none. Live calls run only on
 the operator's machine. CI stays on `AI_MOCK=1`.
 
@@ -248,7 +254,7 @@ set, and sets run one after another. These are the same calls
    - Download `GET /api/boards/{slug}/scenes/{id}/image`.
 
 Pick a scene's elements by a pattern on the label or description, not
-by an exact label. Spark names the same thing differently from run to
+by an exact label. Muse Spark names the same thing differently from run to
 run ("Smiling Woman", then "Selfie Woman").
 
 `run` reads a set spec like this one. Photo names are relative to the
@@ -507,7 +513,7 @@ work folder, outside git.
 - Source photos, raw outputs and run records stay outside git: the
   script's work folder, `.showcase-work/`, is git-ignored. A spec holds
   only relative photo names, so it holds no local path and may be
-  committed (PIN-172's manifest is one).
+  committed.
 - The model key lives in the operator's env file outside the repo.
   Never copy, print or log it, and never paste it into a PR or Linear.
   The script takes the env file path from `--env-file` or
diff --git a/docs/18-i18n.md b/docs/18-i18n.md
index 6cb888ea..b4967c2e 100644
--- a/docs/18-i18n.md
+++ b/docs/18-i18n.md
@@ -1,16 +1,17 @@
-# 18 — Languages (i18n, PIN-23)
+# 18. Languages
 
 Pinneds shows in the visitor's language when we support it, and
 anyone can switch language, back to English included, from the
-"you" menu. Parent issue PIN-23; this page lands with PIN-190 and
-grows with its siblings.
+"you" menu. This page is the guide to how that works and how to
+add a string or a language (PIN-23 is the parent issue; PIN-190
+built the foundation).
 
 ## Decisions (Oct 31)
 
 - **Languages:** English (source and fallback), French, Spanish,
   Portuguese (Brazil), German, Italian, Indonesian
   (`src/i18n/locales.ts`, `LOCALES`).
-- **Register:** informal everywhere — fr *tu*, es *tú* (Latin
+- **Register:** informal everywhere: fr *tu*, es *tú* (Latin
   American, no *vosotros*), pt-BR *você*, de *du*, it *tu*, id
   *kamu*.
 - **Which language a request gets:** the saved choice (cookie
@@ -45,13 +46,13 @@ grows with its siblings.
 
 ## Turning languages on
 
-`UI_LOCALES` (`src/config.ts`) is a comma list, e.g.
+`UI_LOCALES` (`src/config.ts`) is a comma list, for example
 `UI_LOCALES=en,fr,es,pt-BR,de,it,id`. Unknown codes are dropped
 and English is always on. **Default in `src/config.ts`: English
 only.** PIN-199 turned all seven on for the **dev** backend through
 `apphosting.dev.yaml`; PIN-209 turned them on for **prod** in
-`apphosting.prod.yaml` from the first promotion (see "Turning prod
-on").
+`apphosting.prod.yaml` (see "Turning prod on"). Both files carry
+the same seven-language line today.
 
 With English only, `getLocale()` never reads the request, so pages
 render exactly as before (static ones stay static). With more than
@@ -77,7 +78,9 @@ stays English.
   fails on any file not listed in `src/i18n/en-only-files.ts`.
   That list only shrinks: each PIN-23 child deletes its own block.
 
-## Server errors (PIN-196)
+## Server errors
+
+PIN-196.
 
 - User-facing server errors (`BoardApiError`, `PhotoIntakeError`,
   `SceneJobRequestError`, `BoardPlusError`) take
@@ -96,7 +99,7 @@ stays English.
 - The tap fallback label ("My find") is a pin's name, so it stays
   English with the other pin names (PIN-200).
 
-## Idea chips (PIN-214)
+## Idea chips
 
 Idea chips follow the UI language since PIN-214. The Make sheet's
 fixed chips are catalog keys (`make.chip.*`, `FIXED_CHIP_KEYS` in
@@ -108,13 +111,12 @@ Spark, whose prompt `chips.v2` names the language
 labels as they are. The 24 h chips cache is keyed by prompt
 version, language and label set, so French and German viewers of
 the same picks never share an entry, and chips.v1 (English) entries
-are never served again. Until the translate run fills
-`make.chip.*`, the fixed chips fall back to English like any other
-key.
+are never served again. `make.chip.*` is translated in every
+catalog, so the fixed chips show in the viewer's language too.
 
-## Words (PIN-202)
+## Words
 
-One word per idea, in every language. The glossary
+PIN-202. One word per idea, in every language. The glossary
 (`src/i18n/glossary.json`) holds each language's term.
 
 - **Pin** (FR *épingle*, others *pin*): a cut-out object on a board
@@ -143,12 +145,21 @@ One word per idea, in every language. The glossary
 
 ## Adding a language
 
-1. Check the fonts cover its script (see above).
-2. Add the code to `LOCALES`, its own name to `LOCALE_NAMES` and
-   its English name to `LOCALE_ENGLISH_NAMES` (AI prompts, PIN-214)
-   in `src/i18n/locales.ts`, an empty `{}` catalog in
-   `src/i18n/messages/`, and the import in `src/i18n/index.ts`.
-3. Translate it with the script, then add it to `UI_LOCALES`.
+1. Check the fonts cover its script (Latin-1 only for now, see
+   "Decisions").
+2. Add the code to `LOCALES`, its own name to `LOCALE_NAMES` and its
+   English name to `LOCALE_ENGLISH_NAMES` (used in AI prompts,
+   PIN-214) in `src/i18n/locales.ts`, an empty `{}` catalog in
+   `src/i18n/messages/<code>.json`, and the import in
+   `src/i18n/index.ts`.
+3. Add a register line to `prompts/translate-ui.v1.md` and its fixed
+   terms to `src/i18n/glossary.json`.
+4. `npm run i18n:translate -- --locale <code>`, then
+   `npm run i18n:check`.
+5. Screenshot it at 390px (landing, board, and for long languages
+   the sheets and the Language list) and fix any clipping with CSS,
+   never by changing the meaning.
+6. Add it to `UI_LOCALES` on dev first.
 
 ## Translations
 
@@ -193,9 +204,11 @@ that must not drift per language (pin, board, scene, creation,
 `prompts/translate-ui.v1.md`. Change a term there, then re-run the
 affected keys with `--force --keys`.
 
-### Costs (PIN-198, PIN-199)
+### Costs
+
+Estimates from list prices; the provider dashboard is authoritative.
 
-- First pass, six languages: **$0.98 total, about $0.16 per
+- First pass (PIN-198), six languages: **$0.98 total, about $0.16 per
   language** (20 calls each, reviewer pass included).
 - A delta of a few dozen keys costs under $0.10 for all languages.
 - PIN-199 polish and delta runs together: about $0.12.
@@ -206,31 +219,17 @@ affected keys with `--force --keys`.
   by the Muse Spark reviewer pass. **No native-speaker review yet.**
 - Style fixes by hand (PIN-199): German without gender stars, Italian
   "appuntare" for pin, `ui.remixOfBy` word order in de/it/es.
-- **French is pending Robin's review** on dev.pinneds.com before prod
-  turns it on. It is informal ("tu") everywhere; grep `fr.json` for
-  `vous|votre|vos|-ez` after any change.
-
-### Adding a language
-
-1. Check the fonts cover its script (Latin-1 only for now).
-2. Add the code to `LOCALES`, its name to `LOCALE_NAMES` and its
-   English name to `LOCALE_ENGLISH_NAMES` in
-   `src/i18n/locales.ts`, an empty `{}` catalog in
-   `src/i18n/messages/<code>.json`, and the import in
-   `src/i18n/index.ts`.
-3. Add a register line to `prompts/translate-ui.v1.md` and its fixed
-   terms to `src/i18n/glossary.json`.
-4. `npm run i18n:translate -- --locale <code>`, then
-   `npm run i18n:check`.
-5. Screenshot it at 390px (landing, board, and for long languages
-   the sheets and the Language list) and fix any clipping with CSS,
-   never by changing the meaning.
-6. Add it to `UI_LOCALES` on dev first.
+- **French** was read by the operator on dev.pinneds.com before prod
+  turned it on (see "Turning prod on"). It is informal ("tu")
+  everywhere; grep `fr.json` for `vous|votre|vos|-ez` after any
+  change.
 
 ### Turning prod on
 
-Robin chose all seven languages for prod on Oct 31 (PIN-209) and
-signed off the French on dev.pinneds.com the same day (after the
+_Operators only: this section is for whoever runs the hosted service; a visitor can skip it._
+
+PIN-209. The operator chose all seven languages for prod on Oct 31
+and signed off the French on dev.pinneds.com the same day (after the
 PIN-202 "pins, not things" pass), so `apphosting.prod.yaml` carries
 the same line as dev (a plain `value:` is available at build and
 runtime, which `UI_LOCALES` needs):
@@ -240,22 +239,22 @@ runtime, which `UI_LOCALES` needs):
     value: en,fr,es,pt-BR,de,it,id
 ```
 
-So the seven languages go live with the next `dev` → `main`
-promotion. Before each promotion, new English strings must not reach
-prod untranslated: the pre-flight in `docs/DEPLOY.md` (§3, step
-"Translations complete") runs `npm run i18n:check -- --strict`, which
-fails while any language misses a string; if it does, run the
-translate delta on `dev` (PIN-223, PIN-227) and Robin reads the French
-for the new strings on dev.pinneds.com. The smoke (§5) checks French,
-a saved English choice and an unknown language on pinneds.com.
+The seven languages are live on prod. Before each promotion, new
+English strings must not reach prod untranslated: the pre-flight in
+`docs/DEPLOY.md` (§3, step "Translations complete") runs
+`npm run i18n:check -- --strict`, which fails while any language
+misses a string; if it does, run the translate delta on `dev`
+(PIN-223, PIN-227) and the operator reads the French for the new
+strings on dev.pinneds.com. The smoke (§5) checks French, a saved
+English choice and an unknown language on pinneds.com.
 
 To roll back, remove the line (or list fewer codes) in
 `apphosting.prod.yaml` and promote: visitors fall back to English,
 and saved language cookies for a language that is off are ignored.
 
-### Checks done on dev (PIN-199)
+### Checks done on dev
 
-At 390px every language was checked on the landing page and a board;
+PIN-199. At 390px every language was checked on the landing page and a board;
 German and Indonesian (the longest) also on the Add sheet, Make
 sheet, Plus sheet and the "you" menu with the Language list
 (`eval/screenshots/pin-199-*`). The only layout fix needed was the
diff --git a/docs/19-meta-models.md b/docs/19-meta-models.md
index 60ca446d..5c7c29e0 100644
--- a/docs/19-meta-models.md
+++ b/docs/19-meta-models.md
@@ -1,11 +1,11 @@
-# 19 — Meta models in Pinneds (PIN-211)
+# 19. Meta models in Pinneds
 
 Pinneds uses five Meta models. Four run inside the app, behind six capability ports in
 `src/gateway/`; the fifth ran at build time to translate the UI. Per model: what goes in,
 what comes out, which Policy keys govern it, what happens when it fails, and what we
 measured. Spec: `docs/11-studio.md` §3 and §5.2; decisions:
 `docs/adr/003-studio-architecture.md`; cost accounting: `docs/16-ai-usage.md`.
-Visitors get the plain-language version in the app at `/models` (PIN-237): the cat
+Visitors get the plain-language version in the app at `/models`: the cat
 showcase set step by step, then what each model sees and never sees. Its claims follow
 this page: change both together.
 
@@ -24,17 +24,31 @@ authoritative.
 
 ## The shared path for every runtime call
 
-- **Adapters.** `src/gateway/ports.ts` defines the ports. `getCapabilityPorts`
-  (`src/gateway/index.ts`) returns the mock adapters (`mock-ports.ts`) under `AI_MOCK=1`,
-  the default, and the Meta adapters (`meta-ports.ts` over `meta-gateway.ts`: plain
-  `fetch` to `META_API_BASE_URL`, no provider SDK) otherwise. `fixture-ports.ts` replays
-  the PIN-50 spike (`eval/fixtures/studio/fixtures.json`) for contract tests.
-- **Decorators.** Product code only gets the decorated ports (`src/server/ai-ports.ts`).
-  `decoratePorts` (`src/gateway/decorators.ts`) runs: timeout (Policy `timeoutsMs`) → one
-  retry on 429/5xx (`retries`, `retryBackoffMs`) → reserve budget, fail closed
-  (`src/gateway/budget.ts`: `dailyBudgetUsd`, `dailyCallLimit` and the per-port caps
-  below) → call → one `AiCallLog` row with units, `promptVersion` and estimated cost →
-  a typed `ready / failed / refused` outcome.
+```mermaid
+flowchart LR
+  code["Product code"] --> ports["Decorated ports<br/>(src/server/ai-ports.ts)"]
+  ports --> t["Timeout"]
+  t --> r["Retry once on 429 or 5xx"]
+  r --> b["Reserve budget, fail closed"]
+  b --> c["Call"]
+  c --> l["Log estimated cost"]
+  l --> o["Outcome: ready, failed or refused"]
+  c --> meta["Meta adapter<br/>(meta-gateway.ts)"]
+  c --> mock["Mock adapter<br/>(AI_MOCK=1)"]
+  c --> fix["Fixture adapter<br/>(contract tests)"]
+  meta --> api["Meta Model API"]
+```
+
+_Six ports (`ElementNamer`, `Segmenter`, `SceneComposer`, `ChipSuggester`, `TapNamer`, `SpeechTranscriber`) share one chain; each call goes to one of three adapters._
+
+- **Adapters.** `getCapabilityPorts` (`src/gateway/index.ts`) returns the mock adapters
+  under `AI_MOCK=1`, the default, and the Meta adapters otherwise (plain `fetch` to
+  `META_API_BASE_URL`, no provider SDK). `fixture-ports.ts` replays the PIN-50 spike
+  (`eval/fixtures/studio/fixtures.json`) for contract tests.
+- **Decorators.** Product code only gets the decorated ports. `decoratePorts`
+  (`src/gateway/decorators.ts`) reads Policy `timeoutsMs`, `retries`, `retryBackoffMs`,
+  `dailyBudgetUsd`, `dailyCallLimit` and the per-port caps below (`src/gateway/budget.ts`).
+  Each row in the AI call log carries units, `promptVersion` and estimated cost.
 - **Refusals.** `classifyPortError` maps refusal and content-policy codes to `refused`.
   Callers turn `failed` and `refused` into a friendly line or a fallback, never a 500.
 - **Images out** leave as inline `data:` URLs built from the stripped working copy or a
@@ -116,8 +130,9 @@ the route passes `getLocale()` down, and the prompt names the language
   `scenesPerBoardPerDay` (40), and `credits.*` when credits are on.
 - Sent: `POST /responses` with only `model`, `store`, `input` and
   `tools: [{type: "image_generation", size}]`. Per pin a text label
-  "Element N (from <display name>): label — description", then the flattened cut-out; the
-  idea comes last. Owners' display names reach Muse Image only as these credit labels.
+  "Element N (from <display name>): label" (plus the description when it differs from the
+  label), then the flattened cut-out; the idea comes last. Owners' display names reach
+  Muse Image only as these credit labels.
 - Remix: the parent scene image goes first with the base-scene label, then the new pins.
   Stateless: no `previous_response_id`, and `store` is always `false` for a remix.
 - Refusal: HTTP 200 with no image is `refused` (`sceneImageOutcome`): a friendly line,
diff --git a/docs/20-abuse-runbook.md b/docs/20-abuse-runbook.md
index 5a009a25..4f276b93 100644
--- a/docs/20-abuse-runbook.md
+++ b/docs/20-abuse-runbook.md
@@ -1,4 +1,6 @@
-# 20 — Abuse reports and illegal content (PIN-239, PIN-266)
+# 20. Abuse reports and illegal content
+
+_Operators only: this page is for whoever runs the hosted service. A visitor can skip it and start at the [docs index](README.md)._
 
 One page for the human on duty. Scope: a report that a board, a pin
 or a scene holds illegal or abusive content, above all CSAM (child
@@ -40,14 +42,14 @@ and acts at once, reversibly, per this table:
 
 | Scope | Reporter | Reason | Automatic action |
 | --- | --- | --- | --- |
-| pin / scene | anyone | any | the pin's refs get `held:` (image 404, never composed), the scenes using it are hidden; a scene is hidden |
-| pin with a face | anyone | `likeness` | as above, plus a deadline: tombstoned by the daily sweep if nobody decided within `takedownHours` |
-| whole board | participant | any | every pin held and scene hidden; board under review (uploads, scenes, tap-adds answer 423; banner on the page) |
-| whole board | anyone | `illegal` | as above, plus Storage temporary holds on every object (evidence), severity high |
-| whole board | visitor | not `illegal` | nothing hidden (anyone with a link can join and report); the report is queued |
-
-Nothing is deleted automatically except the one deadline case, and an
-`illegal` report is never deleted by the app. The reporter sees a
+| pin / scene | anyone | any | the pin's refs get `held:` (image 404, never composed), the scenes using it are hidden; a scene is hidden. Deadline: tombstoned by the sweep if nobody decided within `takedownHours` |
+| whole board | participant | any | every pin held and scene hidden; board under review (uploads, scenes, tap-adds answer 423; banner on the page). Same deadline: the board is tombstoned |
+| whole board | anyone | `illegal` | as above, plus Storage temporary holds on every object (evidence), severity high. Same deadline; the takedown keeps the holds |
+| whole board | visitor | not `illegal` | nothing hidden (anyone with a link can join and report); the report is queued, no deadline |
+
+Every hold carries the deadline (`takedownHours`, 24 h): the sweep
+tombstones what nobody decided (PIN-278). An `illegal` report's
+Storage holds survive that takedown, so the bytes stay as evidence. The reporter sees a
 receipt with the board's **reference** (first 16 hex of
 `sha256("pinned-report-v1:" + slug)`, `boardReportRef`), never the
 slug. The same reference is the only board identifier in the alert
@@ -109,11 +111,13 @@ failed, the bytes stay. That is the point for section 6; for an
 ordinary takedown that reports `storage hold true`, run
 `release-holds` afterwards (section 7, step 3).
 
-**Timed takedown.** A `likeness` report on a face-flagged pin carries
-`deleteAt`; `.github/workflows/report-sweep.yml` runs
-`report:ops sweep` daily and tombstones what passed its deadline
-with no decision (never an `illegal` report). Deciding before the
-deadline, either way, cancels it. The step summary shows counts only.
+**Timed takedown.** Every report that held something carries
+`deleteAt` (`takedownHours` after it was filed; the receipt says so).
+`.github/workflows/report-sweep.yml` runs `report:ops sweep` every
+six hours and tombstones what passed its deadline with no decision,
+`illegal` reports included (their Storage holds stay, section 6).
+Deciding before the deadline, either way, cancels it. The step summary
+shows counts only.
 
 **Reply to the reporter** when they left an email (the record's
 `email` line): the decision and the date, nothing else; never the
diff --git a/docs/DEPLOY.md b/docs/DEPLOY.md
index 945e09a1..3500e76b 100644
--- a/docs/DEPLOY.md
+++ b/docs/DEPLOY.md
@@ -1,5 +1,7 @@
 # Deploying Pinneds (dev → prod)
 
+_Operators only: this page is for whoever runs the hosted service. A visitor can skip it and start at the [docs index](README.md)._
+
 _Owner: Robin. Every operator step below is written so a local Claude
 Code session with `gcloud`, `firebase` and `gh` logged in can run it,
 with Robin approving each command. Console-only steps are marked
@@ -282,7 +284,7 @@ element; delete the throwaway board.
      ```
      Test-fire once per project with a report on a throwaway board
      (`docs/launch-ops-runbook.md` §3 rule: an alert nobody saw
-     arrive is not an alert). The daily backstop
+     arrive is not an alert). The backstop (every 6 h)
      (`.github/workflows/report-sweep.yml`) needs its own identity:
      its header lists the operator steps.
    - GCP billing budget (e.g. $25) with 50/90/100 % emails. Meta
diff --git a/docs/README.md b/docs/README.md
index 6506d9d0..1d05eae2 100644
--- a/docs/README.md
+++ b/docs/README.md
@@ -1,63 +1,81 @@
 # Docs index
 
-One line per document. Start with the repo [`README.md`](../README.md), then
-[`11-studio.md`](11-studio.md) for the spec and [`19-meta-models.md`](19-meta-models.md)
-for how each Meta model is used. Numbers 01, 02 and 05 are archived with the dropped game;
-04 was removed on Day 1 (PIN-18).
+One line per document, in reading order for a first-time visitor. Start with the repo
+[`README.md`](../README.md), then [`19-meta-models.md`](19-meta-models.md) for how each
+Meta model is used and [`11-studio.md`](11-studio.md) for the spec. Internal runbooks for
+whoever runs the hosted service are grouped near the end; the archive holds the photo game
+Pinneds started as. Numbers 01, 02 and 05 are archived with that game, 08 and 09 were
+superseded by `14-design-system.md` and archived on Oct 31; 04 was removed before the
+pivot.
 
-## Current docs (`docs/`)
+## Start here
+
+| Doc | What it covers |
+| --- | --- |
+| [`README.md`](../README.md) | What Pinneds is, how the Meta models power it, the architecture, how to run it, known limits |
+| [`19-meta-models.md`](19-meta-models.md) | Each Meta model: prompt and version, Policy keys, inputs, fallbacks, cost, evidence, what leaves the server |
+| [`11-studio.md`](11-studio.md) | Studio spec: product, decisions, Policy, ports, jobs, data model, storage, UX, test plan, issue map |
+| [`adr/003-studio-architecture.md`](adr/003-studio-architecture.md) | ADR-003: Policy as data, capability ports and decorators, jobs, Element/Pin split, stateless remix |
+| [`build-log.md`](build-log.md) | Who built what: each coding agent's PRs with dates, the evidence for each claim, and what the record does not show |
+
+## Product and features
 
 | Doc | What it covers |
 | --- | --- |
-| [`03-ai-sdlc.md`](03-ai-sdlc.md) | How work flows: Linear issue → coding agent → PR → review, for a solo developer |
 | [`06-photo-intake.md`](06-photo-intake.md) | Photo intake: checks, EXIF stripping, the short-lived working copy, what is never stored |
-| [`07-sam-lab.md`](07-sam-lab.md) | SAM 3.1 lab notes and measurements (`/lab/sam`, dev only) |
-| docs/08 (UX principles, superseded by docs/14) | First minimal, icon-first UX rules |
-| docs/09 (first design system, superseded by docs/14) | Per-board looks and themes from the game era |
-| [`10-custom-domains.md`](10-custom-domains.md) | pinneds.com and dev.pinneds.com domain setup |
-| [`11-studio.md`](11-studio.md) | Studio spec: product, decisions, Policy, ports, jobs, data model, storage, UX, test plan |
-| [`12-submission.md`](12-submission.md) | Hackathon submission packet and video plan |
-| [`13-auth.md`](13-auth.md) | Optional Google sign-in (`AUTH_MODE`), claim flow, My boards and My pins |
 | [`14-design-system.md`](14-design-system.md) | The Pinneds design system: look, words, UI kit, landing showcase sets |
-| [`15-board-plus.md`](15-board-plus.md) | Board Plus and creations: `PLUS_MODE`, Stripe Checkout, webhook grants, ledger, runbook |
+| [`13-auth.md`](13-auth.md) | Optional Google sign-in (`AUTH_MODE`), claim flow, My boards and My pins, delete and rename |
+| [`15-board-plus.md`](15-board-plus.md) | Board Plus and creations: `PLUS_MODE`, Stripe Checkout, webhook grants, ledger |
 | [`16-ai-usage.md`](16-ai-usage.md) | AI call log, cost estimate per operation, collage reasons, usage report |
-| [`17-showcase-sets.md`](17-showcase-sets.md) | Recipe for making a landing showcase set with the app's own pipeline |
 | [`18-i18n.md`](18-i18n.md) | UI languages: how a request picks one, `UI_LOCALES`, adding strings, translation runs |
-| [`19-meta-models.md`](19-meta-models.md) | Each Meta model: prompt and version, Policy keys, inputs, fallbacks, cost, evidence |
-| [`20-abuse-runbook.md`](20-abuse-runbook.md) | Abuse reports and illegal content: the in-app report and its automatic hold, the operator's decide script, the manual hold path, NCMEC CyberTipline, takedown clock |
-| [`DEPLOY.md`](DEPLOY.md) | Prod runbook and env matrix (lands with PIN-209) |
-| [`launch-ops-runbook.md`](launch-ops-runbook.md) | Launch ops: hourly AI sub-cap, GCP budget alerts, soft-kill drill, demo-board protection (PIN-240) |
-| [`build-log.md`](build-log.md) | Who built what: each coding agent's PRs with dates, the evidence for each claim, and what the record does not show (PIN-248) |
+| [`17-showcase-sets.md`](17-showcase-sets.md) | Recipe for making a landing showcase set with the app's own pipeline |
+| [`adr/004-report-and-hold.md`](adr/004-report-and-hold.md) | ADR-004: reports hold first (reversibly), the operator decides, timed takedown only for face-flagged likeness reports, no model as judge |
+| [`12-submission.md`](12-submission.md) | Hackathon submission packet: pitch, evidence table, video plan, form answers |
 
-## Decisions (`docs/adr/`)
+ADR-001 (hosting) and ADR-002 (no friction) still stand; they live in the archived
+[`archive/02-architecture.md`](archive/02-architecture.md).
+
+## Measurements and lab notes
 
 | Doc | What it covers |
 | --- | --- |
-| [`adr/003-studio-architecture.md`](adr/003-studio-architecture.md) | ADR-003: Policy as data, capability ports and decorators, jobs, Element/Pin split, stateless remix |
-| [`adr/004-report-and-hold.md`](adr/004-report-and-hold.md) | ADR-004: reports hold first (reversibly), the operator decides, timed takedown only for face-flagged likeness reports, no model as judge, alert through Monitoring |
+| [`../eval/studio-findings.md`](../eval/studio-findings.md) | Measured results: fidelity, naming, speed, cost, refusals, live runs |
+| [`../eval/showcase/README.md`](../eval/showcase/README.md) | Showcase-set spike decisions and evidence |
+| [`07-sam-lab.md`](07-sam-lab.md) | SAM 3.1 lab notes and measurements (`/lab/sam`, dev only) |
 
-ADR-001 (hosting) and ADR-002 (no friction) still stand; they live in the archived
-`archive/02-architecture.md`.
+## Internal runbooks (operators only)
+
+For whoever runs the hosted service. A visitor can skip them.
+
+| Doc | What it covers |
+| --- | --- |
+| [`DEPLOY.md`](DEPLOY.md) | Environments, env matrix, pre-flight, promotion to `main`, smoke, judging week |
+| [`launch-ops-runbook.md`](launch-ops-runbook.md) | Launch ops: hourly AI sub-cap, GCP budget alerts, soft-kill drill, demo-board protection |
+| [`20-abuse-runbook.md`](20-abuse-runbook.md) | Abuse reports and illegal content: the in-app report and its automatic hold, the operator's decide script, the manual hold path, NCMEC CyberTipline, takedown clock |
+| [`security-review-2026-11-01.md`](security-review-2026-11-01.md) | Pre-launch security review (Nov 1) with the status of each finding and the fixes that closed it |
+| [`10-custom-domains.md`](10-custom-domains.md) | pinneds.com and dev.pinneds.com domain setup |
+| [`03-ai-sdlc.md`](03-ai-sdlc.md) | How work flows: Linear issue, coding agent, PR, review, for a solo developer |
 
 ## Archive (`docs/archive/`, history only)
 
-The photo game Pinneds started as was dropped on Oct 28. Don't apply these docs.
+The photo game Pinneds started as was dropped on Oct 28, 2026. These pages are kept for
+the record; do not apply them.
 
 | Doc | What it covers |
 | --- | --- |
 | [`archive/01-requirements.md`](archive/01-requirements.md) | Day-1 requirements for the game (FR/NFR IDs) |
 | [`archive/02-architecture.md`](archive/02-architecture.md) | Game architecture, including ADR-001 and ADR-002 |
 | [`archive/05-research-synthesis.md`](archive/05-research-synthesis.md) | Day-1 research synthesis |
+| [`archive/08-ux-principles.md`](archive/08-ux-principles.md) | First minimal, icon-first UX rules (superseded by `14-design-system.md`) |
+| [`archive/09-design-system.md`](archive/09-design-system.md) | The first-generation Studio look and its per-board themes (superseded by `14-design-system.md`) |
 
 ## Key files outside `docs/`
 
 | File | What it covers |
 | --- | --- |
+| [`SECURITY.md`](../SECURITY.md) | Public-repo guardrails: never-commit list, scanners, leak runbook, repository settings |
 | [`AGENTS.md`](../AGENTS.md) | Rules for coding agents working in this repo |
-| [`SECURITY.md`](../SECURITY.md) | Public-repo guardrails: never-commit list, scanners, leak runbook |
 | [`prompts/README.md`](../prompts/README.md) | Prompt contracts and the list of versioned templates |
 | [`eval/README.md`](../eval/README.md) | Rules for evaluation fixtures (synthetic only, source noted) |
-| [`eval/studio-findings.md`](../eval/studio-findings.md) | Measured results: fidelity, naming, speed, cost, refusals, live runs |
-| [`eval/showcase/README.md`](../eval/showcase/README.md) | Showcase-set spike decisions and evidence |
 | [`public/landing/README.md`](../public/landing/README.md) | Where each landing image comes from |
 | [`.env.example`](../.env.example) | Every environment variable, with safe local defaults |
diff --git a/docs/adr/003-studio-architecture.md b/docs/adr/003-studio-architecture.md
index 9025be16..77235562 100644
--- a/docs/adr/003-studio-architecture.md
+++ b/docs/adr/003-studio-architecture.md
@@ -1,9 +1,14 @@
-# ADR-003: Studio architecture — Policy as data, capability ports, jobs (PIN-49, Oct 28 2026)
+# ADR-003: Studio architecture (Policy as data, capability ports, jobs)
 
-_Status: Accepted. Supersedes the game architecture in
+_Status: Accepted Oct 28, 2026 (PIN-49). Supersedes the game architecture in
 `docs/archive/02` (ADR-001 hosting and ADR-002 no-friction stand).
 Spec: `docs/11-studio.md` §5._
 
+_Since then (Nov 4, 2026): three more ports (`ChipSuggester`, `TapNamer`,
+`SpeechTranscriber`) run under the same chain, and the `tmp/` lifecycle rule in the
+repo is 1 day (A6; the operator applies it per bucket, `docs/DEPLOY.md` §6). Current
+state: `docs/19-meta-models.md`._
+
 ## Context
 
 Studio replaces the game loop (persona, judging, reveal) with a
diff --git a/docs/adr/004-report-and-hold.md b/docs/adr/004-report-and-hold.md
index 2a48bcd6..13e980cd 100644
--- a/docs/adr/004-report-and-hold.md
+++ b/docs/adr/004-report-and-hold.md
@@ -1,6 +1,6 @@
-# ADR-004: Reports hold first, decide second, delete on a timer only for faces (PIN-266, Nov 4 2026)
+# ADR-004: Reports hold first, decide second, delete on a timer only for faces
 
-_Status: Accepted (Robin, Nov 4 2026). Extends ADR-003. Runbook:
+_Status: Accepted Nov 4, 2026 (PIN-266). Extends ADR-003. Runbook:
 `docs/20-abuse-runbook.md`. Policy row: `docs/11-studio.md` §5.1
 (`report.*`, `takedownHours`)._
 
@@ -47,12 +47,15 @@ with counsel.
    with a link can join and report, so one click must not blank a
    friend group's board). `illegal` adds Storage temporary holds on
    the board's folders.
-4. **Delete on a timer only for faces.** A `likeness` report on an
-   element Spark flagged as a face sets `deleteAt = now +
-   takedownHours`; the backstop tombstones it if nobody decided by
-   then. Nothing else is deleted automatically, and content reported
-   as `illegal` is never deleted by the app: it is preserved for the
-   runbook's §7.
+4. **Delete on a timer.** _Amended 2026-11-04 (PIN-278): the
+   operator does not watch the queue by default._ Every report that
+   holds something sets `deleteAt = now + takedownHours`; the backstop
+   tombstones it if nobody decided by then. Content reported as
+   `illegal` is tombstoned too, but its Storage temporary holds
+   survive the takedown, so the bytes are preserved for the runbook's
+   §7 until `release-holds`. A queued-only report (nothing hidden) has
+   no deadline. _Before:_ only a `likeness` report on a face-flagged
+   element had a deadline, and `illegal` was never deleted by the app.
 5. **No model as judge.** Suspected illegal content never leaves the
    project (the runbook's "nothing reads image bytes" holds for the
    automation too), a model verdict is not a defensible takedown
diff --git a/docs/build-log.md b/docs/build-log.md
index 8afd27ac..3aeb7c60 100644
--- a/docs/build-log.md
+++ b/docs/build-log.md
@@ -259,8 +259,8 @@ Nov 2, 19:30 UTC, and again Nov 4, 16:20 UTC):
 
 | Day (ET) | Muse Code | Claude Code |
 | --- | --- | --- |
-| Oct 26 | Repo guardrails before kickoff; scaffold, Firebase, App Hosting, live models on dev (#1–#18; #11 not shown, #16 is a promotion) | — |
-| Oct 27 – Oct 28 morning | The photo-game prototype (#19–#39, not #31) and domains (#40–#42) | — |
+| Oct 26 | Repo guardrails before kickoff; scaffold, Firebase, App Hosting, live models on dev (#1–#18; #11 not shown, #16 is a promotion) | None |
+| Oct 27 – Oct 28 morning | The photo-game prototype (#19–#39, not #31) and domains (#40–#42) | None |
 | Oct 28 14:56 – Oct 29 06:26 | The Studio core (#43–#71) | Drafted the hand-off before the run |
 | Oct 29 | Sign-in (#72–#79); hardening (#80, #84, #88, #92, #93) | Design system and UI rebuild (#81–#107 without Muse Code's, to Oct 30 06:14) |
 | Oct 30 | Tap naming, photo choice, dictation (#100, #103, #106); AI call log (#108, #110); Stripe billing (#117–#132) | Scene viewer, delete, rename, board delete (§5) |
diff --git a/docs/launch-ops-runbook.md b/docs/launch-ops-runbook.md
index 83e321bb..2fa7cd43 100644
--- a/docs/launch-ops-runbook.md
+++ b/docs/launch-ops-runbook.md
@@ -1,4 +1,6 @@
-# Launch ops runbook (PIN-240)
+# Launch ops runbook
+
+_Operators only: this page is for whoever runs the hosted service. A visitor can skip it and start at the [docs index](README.md)._
 
 _Owner: Robin (operator). Launch guardrails for judging week:
 the hourly AI sub-cap, GCP budget alerts, the soft-kill drill,
diff --git a/docs/security-review-2026-11-01.md b/docs/security-review-2026-11-01.md
index 91108126..eba41e59 100644
--- a/docs/security-review-2026-11-01.md
+++ b/docs/security-review-2026-11-01.md
@@ -1,4 +1,6 @@
-# Pinned — Pre-launch security review (dev / main), 2026-11-01
+# Pre-launch security review (dev and main), 2026-11-01
+
+_Operators only: the review as written on Nov 1, 2026, kept for the record with the status of each finding; the build log cites it as evidence. Start at the [docs index](README.md) for the product._
 
 > **Status, Nov 2, 2026.** The findings below were fixed on `dev` in PIN-238–243
 > (#216, #218–#222) and reached prod with promotion #2 (#226): F1 report link, upload
diff --git a/eval/studio-findings.md b/eval/studio-findings.md
index 88a82f9d..b43642dd 100644
--- a/eval/studio-findings.md
+++ b/eval/studio-findings.md
@@ -1,4 +1,4 @@
-# Studio Slice 0 — spike findings (PIN-50)
+# Studio slice 0: spike findings
 
 _Generated by `scripts/studio-spike.mjs` from live local runs on synthetic images. Per A1 this file holds the findings; `docs/11` is not edited. Thresholds: docs/11 s8. Raw redacted data: `eval/fixtures/studio/fixtures.json` + `call-log.json`. Contact sheets: `eval/contact-sheets/`._
 
diff --git a/src/app/g/[slug]/BoardClient.tsx b/src/app/g/[slug]/BoardClient.tsx
index b408187e..518a8e98 100644
--- a/src/app/g/[slug]/BoardClient.tsx
+++ b/src/app/g/[slug]/BoardClient.tsx
@@ -108,6 +108,8 @@ export interface BoardClientPolicy {
   jobPollIntervalMs: number;
   /** Policy report.messageMaxChars: the report sheet's message cap (PIN-271). */
   reportMessageMaxChars: number;
+  /** Policy takedownHours: the deadline a hold's receipt quotes (PIN-278). */
+  takedownHours: number;
   uploadMaxPx: number;
   uploadJpegQuality: number;
   pinsPerScene: { min: number; max: number };
@@ -1585,9 +1587,12 @@ function BoardBody({
           email={legalContactEmail}
           reportRef={reportRef}
           messageMaxChars={policy.reportMessageMaxChars}
+          takedownHours={policy.takedownHours}
           targets={{
             // The pins on the grid only: leftover candidates are never on the board for others.
-            pins: cards.filter((card) => card.status === "pinned").map((card) => ({ id: card.element.id, label: card.element.label })),
+            pins: cards
+              .filter((card) => card.status === "pinned" && !card.element.held)
+              .map((card) => ({ id: card.element.id, label: card.element.label })),
             // The same catalogue numbers the prints show ("Nº 03": ready scenes, oldest first).
             scenes: [...numbers.entries()].map(([id, index]) => ({ id, index })),
           }}
diff --git a/src/app/g/[slug]/BoardThings.tsx b/src/app/g/[slug]/BoardThings.tsx
index c75cea62..af119210 100644
--- a/src/app/g/[slug]/BoardThings.tsx
+++ b/src/app/g/[slug]/BoardThings.tsx
@@ -109,6 +109,7 @@ export function BoardThings({
                 state={picking && pickIndex !== undefined ? "picked" : "rest"}
                 pickIndex={pickIndex}
                 foil={card.pinId === foilPinId}
+                held={card.element.held}
                 onToggle={() => onTapPin(card.pinId)}
               />
               {mine && !picking ? <PinMore card={card} deletion={deletion} onRename={onRename} /> : null}
diff --git a/src/app/g/[slug]/LibraryPins.tsx b/src/app/g/[slug]/LibraryPins.tsx
index 00479d8e..9b944a79 100644
--- a/src/app/g/[slug]/LibraryPins.tsx
+++ b/src/app/g/[slug]/LibraryPins.tsx
@@ -26,6 +26,8 @@ export function libraryPinLabel(state: LibraryPinState, locale: Locale): string
       return t(locale, "add.libraryAlready");
     case "failed":
       return t(locale, "add.libraryRetry");
+    case "held":
+      return t(locale, "ui.underReview");
     default:
       return t(locale, "add.libraryPin");
   }
@@ -48,7 +50,7 @@ export function withLibraryCopy(
 }
 
 /** In flight or already on the board: a tap does nothing. */
-const isInert = (state: LibraryPinState) => state === "pinning" || state === "pinned" || state === "already";
+const isInert = (state: LibraryPinState) => state === "pinning" || state === "pinned" || state === "already" || state === "held";
 
 /**
  * The signed-in user's library (GET /api/me/elements) and the
@@ -211,6 +213,7 @@ export function LibraryStrip({
                       seed={card.elementId}
                       size={72}
                       state={state === "already" ? "dropped" : "rest"}
+                      held={state === "held"}
                     />
                     {state === "pinned" ? (
                       <span className="pn-add-strip-check" aria-hidden="true">
@@ -218,7 +221,7 @@ export function LibraryStrip({
                       </span>
                     ) : null}
                   </span>
-                  {state === "idle" ? (
+                  {state === "idle" || state === "held" ? (
                     <span className="pn-pin-tag">
                       <span className="pn-pin-tag-text">{card.label}</span>
                     </span>
@@ -230,7 +233,7 @@ export function LibraryStrip({
                   )}
                 </button>
                 <span className="pn-sr" role="status">
-                  {state === "idle" || state === "already" ? "" : spoken}
+                  {state === "idle" || state === "already" || state === "held" ? "" : spoken}
                 </span>
               </li>
             );
@@ -284,13 +287,13 @@ export function LibraryList({
         const state = stateOf(card);
         const done = state === "pinned" || state === "already";
         return (
-          <li key={card.elementId} className="pn-add-lib-row" data-done={done ? "" : undefined}>
-            <Sticker src={card.imageUrl} alt="" seed={card.elementId} size={64} />
+          <li key={card.elementId} className="pn-add-lib-row" data-done={done || state === "held" ? "" : undefined}>
+            <Sticker src={card.imageUrl} alt="" seed={card.elementId} size={64} held={state === "held"} />
             <span className="pn-add-lib-text">
               <b>{card.label}</b>
               <span>{tf(locale, "add.libraryFrom", { board: card.sourceBoardTitle })}</span>
             </span>
-            {done ? (
+            {state === "held" ? null : done ? (
               <span className="pn-add-lib-done" role="status">
                 <Icon name="check" size={18} />
                 {libraryPinLabel(state, locale)}
diff --git a/src/app/g/[slug]/ReportBoard.tsx b/src/app/g/[slug]/ReportBoard.tsx
index d586cc03..9fe74d18 100644
--- a/src/app/g/[slug]/ReportBoard.tsx
+++ b/src/app/g/[slug]/ReportBoard.tsx
@@ -143,12 +143,24 @@ export function ReportForm({
   );
 }
 
-/** The receipt: what happened and the reference to quote. */
-export function ReportReceipt({ result, email }: { result: ReportResult; email?: string | null }) {
+/** The receipt: what happened (a hold names its deadline, Policy `takedownHours`; PIN-278) and the reference to quote. */
+export function ReportReceipt({
+  result,
+  email,
+  takedownHours,
+}: {
+  result: ReportResult;
+  email?: string | null;
+  takedownHours: number;
+}) {
   const locale = useLocale();
   return (
     <div className={styles.reportReceipt} role="status">
-      <p>{tf(locale, result.held ? "board.reportHeld" : "board.reportReceived", { ref: result.reference })}</p>
+      <p>
+        {result.held
+          ? tf(locale, "board.reportHeld", { ref: result.reference, hours: takedownHours })
+          : tf(locale, "board.reportReceived", { ref: result.reference })}
+      </p>
       {email ? (
         <p className={styles.reportManual}>
           {t(locale, "board.reportFollowUp")} <span className={styles.reportMono}>{email}</span>
@@ -164,6 +176,7 @@ export function ReportBoard({
   reportRef,
   targets,
   messageMaxChars,
+  takedownHours,
   onReported,
 }: {
   slug: string;
@@ -171,6 +184,8 @@ export function ReportBoard({
   reportRef?: string | null;
   targets: ReportTargets;
   messageMaxChars: number;
+  /** Policy `takedownHours`, quoted on a hold's receipt. */
+  takedownHours: number;
   onReported?: (result: ReportResult) => void;
 }) {
   const locale = useLocale();
@@ -281,7 +296,7 @@ export function ReportBoard({
           keyboardAware
         >
           {result ? (
-            <ReportReceipt result={result} email={email} />
+            <ReportReceipt result={result} email={email} takedownHours={takedownHours} />
           ) : (
             <form onSubmit={(event) => void send(event)}>
               <ReportForm
diff --git a/src/app/g/[slug]/board-render.test.ts b/src/app/g/[slug]/board-render.test.ts
index 63e2ca6c..d17035d2 100644
--- a/src/app/g/[slug]/board-render.test.ts
+++ b/src/app/g/[slug]/board-render.test.ts
@@ -40,6 +40,18 @@ describe("board things grid (PIN-98)", () => {
     card({ pinId: "cand", status: "candidate" }),
   ];
 
+  it("a held pin keeps its tag and owner but is no pick toggle (PIN-279)", () => {
+    const held = [card({ pinId: "held", element: { id: "e-held", ownerId: "p1", label: "Teal mug", faceFlag: false, imageUrl: "/img/held", held: true } })];
+    const out = html(
+      h(BoardThings, { cards: held, count: 1, meId: "p1", picking: false, pickNumbers: new Map(), onTapPin: noop, deletion }),
+    );
+    expect(out).toContain('data-pin-id="held"');
+    expect(out).toContain("Under review");
+    expect(out).toContain("Teal mug");
+    expect(out).not.toContain("aria-pressed");
+    expect(out).not.toContain("/img/held");
+  });
+
   it("makes pinned things pick toggles and leaves candidates out of the grid (PIN-122)", () => {
     const out = html(
       h(BoardThings, { cards, count: 2, meId: "p1", picking: false, pickNumbers: new Map(), onTapPin: noop, deletion }),
diff --git a/src/app/g/[slug]/board-report-render.test.ts b/src/app/g/[slug]/board-report-render.test.ts
index be01015a..1badcca6 100644
--- a/src/app/g/[slug]/board-report-render.test.ts
+++ b/src/app/g/[slug]/board-report-render.test.ts
@@ -33,7 +33,7 @@ describe("report foot (PIN-271)", () => {
   it("opens a sheet instead of a mail: a button, the address and the reference as text, never the slug", () => {
     const ref = boardReportRef(SLUG);
     const out = renderToStaticMarkup(
-      h(ReportBoard, { slug: SLUG, email: "contact@example.com", reportRef: ref, targets, messageMaxChars: 1000 }),
+      h(ReportBoard, { slug: SLUG, email: "contact@example.com", reportRef: ref, targets, messageMaxChars: 1000, takedownHours: 24 }),
     );
     expect(out).toContain("Report this board");
     expect(out).toContain('aria-haspopup="dialog"');
@@ -46,8 +46,8 @@ describe("report foot (PIN-271)", () => {
   });
 
   it("renders nothing without a reference, and no address line without an address", () => {
-    expect(renderToStaticMarkup(h(ReportBoard, { slug: SLUG, email: "c@e.co", reportRef: null, targets, messageMaxChars: 1000 }))).toBe("");
-    const out = renderToStaticMarkup(h(ReportBoard, { slug: SLUG, email: null, reportRef: boardReportRef(SLUG), targets, messageMaxChars: 1000 }));
+    expect(renderToStaticMarkup(h(ReportBoard, { slug: SLUG, email: "c@e.co", reportRef: null, targets, messageMaxChars: 1000, takedownHours: 24 }))).toBe("");
+    const out = renderToStaticMarkup(h(ReportBoard, { slug: SLUG, email: null, reportRef: boardReportRef(SLUG), targets, messageMaxChars: 1000, takedownHours: 24 }));
     expect(out).not.toContain("<dt>Email</dt>");
     expect(out).toContain("<dt>Board reference</dt>");
   });
@@ -100,11 +100,11 @@ describe("report form (PIN-271)", () => {
 describe("report receipt (PIN-271)", () => {
   it("says what happened and shows the reference and the follow-up address", () => {
     const ref = boardReportRef(SLUG);
-    const held = renderToStaticMarkup(h(ReportReceipt, { result: { reference: ref, held: true }, email: "contact@example.com" }));
-    expect(held).toContain(`Hidden while we check. Your reference: ${ref}`);
+    const held = renderToStaticMarkup(h(ReportReceipt, { result: { reference: ref, held: true }, email: "contact@example.com", takedownHours: 24 }));
+    expect(held).toContain(`Hidden now and removed in 24 hours unless we clear it. Your reference: ${ref}`);
     expect(held).toContain("contact@example.com");
     expect(held).not.toContain(SLUG);
-    const received = renderToStaticMarkup(h(ReportReceipt, { result: { reference: ref, held: false }, email: null }));
+    const received = renderToStaticMarkup(h(ReportReceipt, { result: { reference: ref, held: false }, email: null, takedownHours: 24 }));
     expect(received).toContain(`Received. We&#x27;ll take a look. Your reference: ${ref}`);
     expect(received).not.toContain("Questions about a report?");
   });
diff --git a/src/app/g/[slug]/library-render.test.ts b/src/app/g/[slug]/library-render.test.ts
index a9b73c55..0e132213 100644
--- a/src/app/g/[slug]/library-render.test.ts
+++ b/src/app/g/[slug]/library-render.test.ts
@@ -63,11 +63,12 @@ describe("See all list (PIN-85 rows, PIN-121)", () => {
     const states = new Map([
       ["lamp", "already" as const],
       ["hat", "pinned" as const],
+      ["cap", "held" as const],
     ]);
     const out = renderToStaticMarkup(
       h(LibraryList, {
         status: "success",
-        cards: [card("mug", "Teal mug"), card("lamp", "Brass lamp"), card("hat", "Straw hat")],
+        cards: [card("mug", "Teal mug"), card("lamp", "Brass lamp"), card("hat", "Straw hat"), { ...card("cap", "Wool cap"), held: true }],
         stateOf: (c: MyPinCard) => states.get(c.elementId) ?? "idle",
         onPin: noop,
         onRetry: noop,
@@ -77,6 +78,9 @@ describe("See all list (PIN-85 rows, PIN-121)", () => {
     expect(out).toContain('aria-label="Pin here: Teal mug"');
     expect(out).toContain("Already here");
     expect(out).toContain("Pinned");
+    // PIN-279: a held thing shows the placeholder and no Pin here.
+    expect(out).toContain("pn-sticker-held");
+    expect(out).not.toContain("Pin here: Wool cap");
   });
 });
 
diff --git a/src/app/g/[slug]/page.tsx b/src/app/g/[slug]/page.tsx
index 79eb63c1..23f89cd5 100644
--- a/src/app/g/[slug]/page.tsx
+++ b/src/app/g/[slug]/page.tsx
@@ -154,7 +154,7 @@ export default async function BoardPage({
       initialBilling={query.billing ?? null}
       legalContactEmail={getConfig().legalContactEmail}
       reportRef={boardReportRef(slug)}
-      policy={{ pollIntervalMs: resolved.boardPollIntervalMs, jobPollIntervalMs: resolved.jobPollIntervalMs, uploadMaxPx: resolved.uploadMaxPx, uploadJpegQuality: resolved.uploadJpegQuality, pinsPerScene: resolved.pinsPerScene, sceneChips, scenePromptMaxChars: resolved.scenePromptMaxChars, elementLabelMaxChars: resolved.elementLabelMaxChars, sceneSize: resolved.sceneSize, elementsPerPhotoMax: resolved.elementsPerPhoto.max, photosPerBatch: resolved.photosPerBatch, batchUploadConcurrency: resolved.batchUploadConcurrency, uploadRetryMaxAttempts: resolved.uploadRetryMaxAttempts, uploadRetryBackoffMs: resolved.uploadRetryBackoffMs, signInNudge: resolved.signInNudge, libraryStripMax: resolved.libraryStripMax, reportMessageMaxChars: resolved.report.messageMaxChars, dictationMaxSeconds: resolved.dictationMaxSeconds, dictationEnabled: resolved.dictationsPerParticipantPerDay > 0 && resolved.dailyBudgetUsd > 0 && resolved.dailyCallLimit > 0, makes: { packs: resolved.credits.packs, lowMakesWarning: resolved.credits.lowMakesWarning, lowFreePhotosWarning: resolved.credits.lowFreePhotosWarning } }}
+      policy={{ pollIntervalMs: resolved.boardPollIntervalMs, jobPollIntervalMs: resolved.jobPollIntervalMs, uploadMaxPx: resolved.uploadMaxPx, uploadJpegQuality: resolved.uploadJpegQuality, pinsPerScene: resolved.pinsPerScene, sceneChips, scenePromptMaxChars: resolved.scenePromptMaxChars, elementLabelMaxChars: resolved.elementLabelMaxChars, sceneSize: resolved.sceneSize, elementsPerPhotoMax: resolved.elementsPerPhoto.max, photosPerBatch: resolved.photosPerBatch, batchUploadConcurrency: resolved.batchUploadConcurrency, uploadRetryMaxAttempts: resolved.uploadRetryMaxAttempts, uploadRetryBackoffMs: resolved.uploadRetryBackoffMs, signInNudge: resolved.signInNudge, libraryStripMax: resolved.libraryStripMax, reportMessageMaxChars: resolved.report.messageMaxChars, takedownHours: resolved.takedownHours, dictationMaxSeconds: resolved.dictationMaxSeconds, dictationEnabled: resolved.dictationsPerParticipantPerDay > 0 && resolved.dailyBudgetUsd > 0 && resolved.dailyCallLimit > 0, makes: { packs: resolved.credits.packs, lowMakesWarning: resolved.credits.lowMakesWarning, lowFreePhotosWarning: resolved.credits.lowFreePhotosWarning } }}
     />
   );
 }
diff --git a/src/app/me/LibraryParts.tsx b/src/app/me/LibraryParts.tsx
index 7ea3a7a0..aa8a5bfe 100644
--- a/src/app/me/LibraryParts.tsx
+++ b/src/app/me/LibraryParts.tsx
@@ -141,11 +141,11 @@ export function PinLibrary({
   return (
     <ul className="pn-pins pn-lib-pins" data-pinnable={boardSlug ? "" : undefined}>
       {cards.map((card) => (
-        <Pin key={card.elementId} as="li" src={card.imageUrl} label={card.label} seed={card.elementId}>
+        <Pin key={card.elementId} as="li" src={card.imageUrl} label={card.label} seed={card.elementId} held={card.held}>
           <span className="pn-lib-from">
             {tf(locale, "myPins.fromBoardTitle", { board: card.sourceBoardTitle })}
           </span>
-          {boardSlug ? <PinToBoardButton slug={boardSlug} elementId={card.elementId} label={card.label} /> : null}
+          {boardSlug && !card.held ? <PinToBoardButton slug={boardSlug} elementId={card.elementId} label={card.label} /> : null}
         </Pin>
       ))}
     </ul>
diff --git a/src/domain/board-report.test.ts b/src/domain/board-report.test.ts
index e7565f70..e9644e44 100644
--- a/src/domain/board-report.test.ts
+++ b/src/domain/board-report.test.ts
@@ -101,29 +101,36 @@ describe("planReportHold (PIN-268, ADR-004 decision table)", () => {
         held: { elementIds: ["el-1"], sceneIds: ["sc-a"], boardReview: false, storageHold: false },
         severity: "normal",
         queuedOnly: false,
+        deleteAt: 1_000 + 24 * HOUR,
       },
     });
   });
 
-  it("element + likeness + faceFlag: the one timed takedown, takedownHours from now", () => {
-    const result = planReportHold({
-      ...base,
-      scope: "element",
-      reason: "likeness",
-      element: { id: "el-2", faceFlag: true },
-    });
-    expect(result.ok && result.plan.deleteAt).toBe(1_000 + 24 * HOUR);
-    expect(result.ok && result.plan.held.sceneIds).toEqual(["sc-a", "sc-b"]);
-  });
-
-  it("no deadline without a face flag, with another reason, or ever for illegal", () => {
+  it("every holding plan carries the deadline, takedownHours from now (PIN-278)", () => {
+    const likeness = planReportHold({ ...base, scope: "element", reason: "likeness", element: { id: "el-2", faceFlag: true } });
+    expect(likeness.ok && likeness.plan.deleteAt).toBe(1_000 + 24 * HOUR);
+    expect(likeness.ok && likeness.plan.held.sceneIds).toEqual(["sc-a", "sc-b"]);
     for (const input of [
       { ...base, scope: "element" as const, reason: "likeness" as const, element: { id: "el-2", faceFlag: false } },
       { ...base, scope: "element" as const, reason: "inappropriate" as const, element: { id: "el-2", faceFlag: true } },
       { ...base, scope: "element" as const, reason: "illegal" as const, element: { id: "el-2", faceFlag: true } },
+      { ...base, scope: "scene" as const, reason: "other" as const, scene: { id: "sc-a", hidden: false } },
       { ...base, scope: "board" as const, reason: "illegal" as const },
+      { ...base, reporterKind: "participant" as const, reason: "ownership" as const },
+    ]) {
+      const result = planReportHold(input);
+      expect(result.ok && result.plan.queuedOnly).toBe(false);
+      expect(result.ok && result.plan.deleteAt).toBe(1_000 + 24 * HOUR);
+    }
+  });
+
+  it("a queued-only report (nothing hidden) has no deadline", () => {
+    for (const input of [
+      { ...base, reporterKind: "visitor" as const, reason: "other" as const },
+      { ...base, scope: "scene" as const, reason: "other" as const, scene: { id: "sc-hidden", hidden: true } },
     ]) {
       const result = planReportHold(input);
+      expect(result.ok && result.plan.queuedOnly).toBe(true);
       expect(result.ok && "deleteAt" in result.plan).toBe(false);
     }
   });
@@ -131,7 +138,7 @@ describe("planReportHold (PIN-268, ADR-004 decision table)", () => {
   it("scene: hides that scene; an already hidden scene is queued only", () => {
     expect(planReportHold({ ...base, scope: "scene", scene: { id: "sc-b", hidden: false } })).toEqual({
       ok: true,
-      plan: { held: { elementIds: [], sceneIds: ["sc-b"], boardReview: false, storageHold: false }, severity: "normal", queuedOnly: false },
+      plan: { held: { elementIds: [], sceneIds: ["sc-b"], boardReview: false, storageHold: false }, severity: "normal", queuedOnly: false, deleteAt: 1_000 + 24 * HOUR },
     });
     const hidden = planReportHold({ ...base, scope: "scene", scene: { id: "sc-hidden", hidden: true } });
     expect(hidden.ok && hidden.plan.queuedOnly).toBe(true);
@@ -152,6 +159,7 @@ describe("planReportHold (PIN-268, ADR-004 decision table)", () => {
         held: { elementIds: ["el-1", "el-2"], sceneIds: ["sc-a", "sc-b"], boardReview: true, storageHold: false },
         severity: "normal",
         queuedOnly: false,
+        deleteAt: 1_000 + 24 * HOUR,
       },
     });
   });
@@ -162,6 +170,7 @@ describe("planReportHold (PIN-268, ADR-004 decision table)", () => {
       held: { elementIds: ["el-1", "el-2"], sceneIds: ["sc-a", "sc-b"], boardReview: true, storageHold: true },
       severity: "high",
       queuedOnly: false,
+      deleteAt: 1_000 + 24 * HOUR,
     });
   });
 
@@ -182,7 +191,7 @@ describe("planReportHold (PIN-268, ADR-004 decision table)", () => {
     expect(scene.ok && scene.plan.held).toEqual({ elementIds: [], sceneIds: ["sc-b"], boardReview: false, storageHold: true });
     // An already hidden scene reported as illegal is still listed, so its folder gets the hold (never queued only).
     const hiddenIllegal = planReportHold({ ...base, scope: "scene", reason: "illegal", scene: { id: "sc-hidden", hidden: true } });
-    expect(hiddenIllegal.ok && hiddenIllegal.plan).toEqual({ held: { elementIds: [], sceneIds: ["sc-hidden"], boardReview: false, storageHold: true }, severity: "high", queuedOnly: false });
+    expect(hiddenIllegal.ok && hiddenIllegal.plan).toEqual({ held: { elementIds: [], sceneIds: ["sc-hidden"], boardReview: false, storageHold: true }, severity: "high", queuedOnly: false, deleteAt: 1_000 + 24 * HOUR });
   });
 });
 
diff --git a/src/domain/board-report.ts b/src/domain/board-report.ts
index ea7904b0..7385e983 100644
--- a/src/domain/board-report.ts
+++ b/src/domain/board-report.ts
@@ -6,10 +6,10 @@
  * board), one reason and an optional message. `planReportHold`
  * turns it into a HoldPlan, the decision table of ADR-004: what to
  * hide right away (reversibly, never a delete), whether the board
- * goes under review, whether Storage gets a temporary hold, and
- * the one case that gets a deletion deadline (a face-flagged pin
- * reported as someone's likeness). The server applies the plan and
- * records what it actually held, so a dismiss can put it back.
+ * goes under review, whether Storage gets a temporary hold, and the
+ * deletion deadline every holding plan carries (`takedownHours`,
+ * PIN-278). The server applies the plan and records what it
+ * actually held, so a dismiss can put it back.
  *
  * Client-safe: no I/O, no Policy import (the caller passes the two
  * numbers it needs). The report reference (`boardReportRef` in
@@ -68,7 +68,7 @@ export interface ReportRecord {
   severity: ReportSeverity;
   createdAt: number;
   status: ReportStatus;
-  /** Timed takedown deadline (face-flagged likeness only); absent otherwise. */
+  /** Timed takedown deadline: every report that held something carries one (PIN-278); absent on a queued-only report. */
   deleteAt?: number;
   held: ReportHeld;
   decidedAt?: number;
@@ -154,7 +154,7 @@ export interface ReportPlanInput {
   reason: ReportReason;
   reporterKind: ReporterKind;
   now: number;
-  /** Policy `takedownHours`: the deadline of the one timed takedown. */
+  /** Policy `takedownHours`: the deadline of every holding plan. */
   takedownHours: number;
   /** The element an element-scope report names; null when the id matched nothing. */
   element?: Pick<Element, "id" | "faceFlag"> | null;
@@ -168,9 +168,9 @@ export interface ReportPlanInput {
 export interface HoldPlan {
   held: ReportHeld;
   severity: ReportSeverity;
-  /** Set only for a face-flagged pin reported as a likeness. */
+  /** Set on every plan that holds something: the backstop tombstones it if nobody decided by then (PIN-278). */
   deleteAt?: number;
-  /** True when nothing is hidden: the report is queued and alerted only. */
+  /** True when nothing is hidden: the report is queued and alerted only, with no deadline. */
   queuedOnly: boolean;
 }
 
@@ -179,11 +179,19 @@ export type PlanResult = { ok: true; plan: HoldPlan } | { ok: false; error: "tar
 const HOUR_MS = 3_600_000;
 
 /**
- * The ADR-004 decision table. Pure: hides and locks only, never
- * deletes; the one deadline it sets is acted on later by the
- * backstop, and never for `illegal`.
+ * The ADR-004 decision table (decision 4 as amended by PIN-278).
+ * Pure: hides and locks only, never deletes; the deadline it sets on
+ * every holding plan is acted on later by the backstop, `illegal`
+ * included (its Storage holds keep the bytes as evidence).
  */
 export function planReportHold(input: ReportPlanInput): PlanResult {
+  const result = planHold(input);
+  if (!result.ok || result.plan.queuedOnly) return result;
+  return { ok: true, plan: { ...result.plan, deleteAt: input.now + input.takedownHours * HOUR_MS } };
+}
+
+/** What to hide and lock; the deadline is added by `planReportHold`. */
+function planHold(input: ReportPlanInput): PlanResult {
   const severity: ReportSeverity = input.reason === "illegal" ? "high" : "normal";
   const scenes = input.boardScenes ?? [];
   const visibleScenes = scenes.filter((scene) => !scene.hidden);
@@ -194,7 +202,6 @@ export function planReportHold(input: ReportPlanInput): PlanResult {
     const sceneIds = visibleScenes
       .filter((scene) => scene.elementIds.includes(element.id))
       .map((scene) => scene.id);
-    const timed = input.reason === "likeness" && element.faceFlag === true;
     // `illegal` on a pin: its objects (and its scenes') get the Storage
     // hold too, so no later delete can free the evidence.
     return {
@@ -202,7 +209,6 @@ export function planReportHold(input: ReportPlanInput): PlanResult {
       plan: {
         held: { elementIds: [element.id], sceneIds, boardReview: false, storageHold: severity === "high" },
         severity,
-        ...(timed ? { deleteAt: input.now + input.takedownHours * HOUR_MS } : {}),
         queuedOnly: false,
       },
     };
diff --git a/src/domain/board-view.ts b/src/domain/board-view.ts
index daae411d..7c4c8180 100644
--- a/src/domain/board-view.ts
+++ b/src/domain/board-view.ts
@@ -18,6 +18,8 @@ export interface BoardViewElement {
   label: string;
   faceFlag: boolean;
   imageUrl: string;
+  /** PIN-279: under a report hold; the picture is a 404 and the pin is not pickable. */
+  held?: boolean;
 }
 
 export interface BoardViewPin {
diff --git a/src/domain/library-strip.test.ts b/src/domain/library-strip.test.ts
index abe31190..a9e3da5d 100644
--- a/src/domain/library-strip.test.ts
+++ b/src/domain/library-strip.test.ts
@@ -133,6 +133,21 @@ describe("library strip (PIN-121)", () => {
 });
 
 describe("library pin state helpers (PIN-121)", () => {
+  it("a thing under a report hold reads held, whatever this sheet did or the board shows (PIN-279)", () => {
+    const held: MyPinCard = {
+      elementId: "mug",
+      label: "Teal mug",
+      description: "",
+      faceFlag: false,
+      held: true,
+      sourceBoardTitle: "Kitchen chaos",
+      imageUrl: "/api/me/elements/mug/image?kind=cutout",
+      createdAt: 1,
+    };
+    expect(libraryPinState(held, new Map([["mug", "pinned"]]), new Set(["mug"]))).toBe("held");
+    expect(libraryPinState({ ...held, held: false }, new Map(), new Set())).toBe("idle");
+  });
+
   it("treats an original as its own family", () => {
     expect(familyOf(card("lamp"))).toBe("lamp");
     expect(familyOf(card("copy", { familyId: "lamp" }))).toBe("lamp");
diff --git a/src/domain/library-strip.ts b/src/domain/library-strip.ts
index fbd094c7..36399889 100644
--- a/src/domain/library-strip.ts
+++ b/src/domain/library-strip.ts
@@ -8,7 +8,7 @@
 import type { MyPinCard } from "./my-pins";
 
 /** One library thing's pin-here state on this board. */
-export type LibraryPinState = "idle" | "pinning" | "pinned" | "already" | "failed";
+export type LibraryPinState = "idle" | "pinning" | "pinned" | "already" | "failed" | "held";
 
 /**
  * Sticker placeholders while the library loads. A visual stand-in
@@ -61,6 +61,8 @@ export function libraryPinState(
   local: ReadonlyMap<string, LibraryPinState>,
   onBoard: ReadonlySet<string>,
 ): LibraryPinState {
+  // PIN-279: a thing under a report hold cannot be pinned anywhere, whatever this sheet did.
+  if (card.held) return "held";
   const mine = local.get(familyOf(card));
   if (mine) return mine;
   return onBoard.has(familyOf(card)) ? "already" : "idle";
diff --git a/src/domain/make-sheet.test.ts b/src/domain/make-sheet.test.ts
index f705aa94..2e61a750 100644
--- a/src/domain/make-sheet.test.ts
+++ b/src/domain/make-sheet.test.ts
@@ -106,10 +106,14 @@ describe("idea chips (PIN-216)", () => {
 });
 
 describe("make sheet logic (PIN-70)", () => {
-  it("only pinned pins are selectable, never candidates", () => {
-    const cards = [card("p1", "e1"), card("c1", "e2", "candidate")];
+  it("only pinned pins are selectable, never candidates nor a pin under a report hold (PIN-279)", () => {
+    const held = card("h1", "e3");
+    held.element = { ...held.element, held: true };
+    const cards = [card("p1", "e1"), card("c1", "e2", "candidate"), held];
     expect(selectableCards(cards).map((c) => c.pinId)).toEqual(["p1"]);
-    expect(selectedCards(cards, new Set(["p1", "c1"])).map((c) => c.pinId)).toEqual(["p1"]);
+    expect(selectedCards(cards, new Set(["p1", "c1", "h1"])).map((c) => c.pinId)).toEqual(["p1"]);
+    // A pick made before the hold landed is pruned like a deleted pin.
+    expect([...pruneSelection(new Set(["p1", "h1"]), selectableCards(cards).map((c) => c.pinId))]).toEqual(["p1"]);
   });
 
   it("toggles picks and rejects (never evicts) at the Policy cap", () => {
diff --git a/src/domain/make-sheet.ts b/src/domain/make-sheet.ts
index a596f09f..70d72c2f 100644
--- a/src/domain/make-sheet.ts
+++ b/src/domain/make-sheet.ts
@@ -12,9 +12,9 @@ import type {
   PinCard,
 } from "./board-view";
 
-/** Only real pins can be picked — candidates are not pinned yet. */
+/** Only real pins can be picked — candidates are not pinned yet, and a pin under a report hold (PIN-279) has no picture to compose. */
 export function selectableCards(cards: readonly PinCard[]): PinCard[] {
-  return cards.filter((card) => card.status === "pinned");
+  return cards.filter((card) => card.status === "pinned" && !card.element.held);
 }
 
 /**
diff --git a/src/domain/my-pins.ts b/src/domain/my-pins.ts
index 642e61d1..2b4c7c15 100644
--- a/src/domain/my-pins.ts
+++ b/src/domain/my-pins.ts
@@ -22,6 +22,8 @@ export interface MyPinCard {
   label: string;
   description: string;
   faceFlag: boolean;
+  /** PIN-279: under a report hold; no picture is served and it cannot be pinned anywhere. */
+  held?: boolean;
   /** Title (never slug) of the board the element lives on. */
   sourceBoardTitle: string;
   /** Owner-checked thumbnail route (no board slug in the URL). */
diff --git a/src/i18n/messages/de.json b/src/i18n/messages/de.json
index 227b82b5..e071327b 100644
--- a/src/i18n/messages/de.json
+++ b/src/i18n/messages/de.json
@@ -238,6 +238,7 @@
   "request.reportEmailInvalid": "Diese E-Mail-Adresse sieht nicht richtig aus.",
   "request.reportFailed": "Diese Meldung konnte nicht gesendet werden. Bitte versuche es erneut.",
   "request.boardUnderReview": "Diese Pinnwand ist pausiert, während wir eine Meldung prüfen.",
+  "request.pinUnderReview": "Dieser Pin ist ausgeblendet, während wir eine Meldung prüfen.",
   "add.title": "Foto hinzufügen",
   "add.pick": "Foto aufnehmen oder auswählen",
   "add.takePhoto": "Foto aufnehmen",
@@ -294,7 +295,7 @@
   "board.reportCancel": "Abbrechen",
   "board.reportClose": "Schließen",
   "board.reportDone": "Fertig",
-  "board.reportHeld": "Ausgeblendet, während wir prüfen. Deine Referenz: {ref}",
+  "board.reportHeld": "Jetzt ausgeblendet und in {hours} Stunden entfernt, falls wir es nicht freigeben. Deine Referenz: {ref}",
   "board.reportReceived": "Meldung erhalten. Wir schauen es uns an. Deine Referenz: {ref}",
   "board.reportFollowUp": "Fragen zu einer Meldung? Schreib an diese Adresse und gib die Referenz an:",
   "board.underReviewNotice": "Diese Pinnwand ist pausiert, während wir eine Meldung prüfen.",
@@ -532,6 +533,7 @@
   "ui.leftOut": "ausgelassen",
   "ui.pickedN": "{n} ausgewählt",
   "ui.picked": "ausgewählt",
+  "ui.underReview": "In Prüfung",
   "ui.pinWithState": "{label}, {state}",
   "ui.peopleNamed": "{count}: {names}",
   "ui.ownerThing": "{thing} von {owner}",
diff --git a/src/i18n/messages/de.lock.json b/src/i18n/messages/de.lock.json
index ce488387..e47e13c0 100644
--- a/src/i18n/messages/de.lock.json
+++ b/src/i18n/messages/de.lock.json
@@ -242,6 +242,7 @@
     "request.reportEmailInvalid": "518710625cda91c8",
     "request.reportFailed": "bb4c2dfb0b3c402a",
     "request.boardUnderReview": "f96f3142f35ca0b1",
+    "request.pinUnderReview": "811d8a5d0c5e9d98",
     "add.title": "787d8913e7221b88",
     "add.pick": "e516b916371de9c5",
     "add.takePhoto": "f3ff70e1103d5024",
@@ -298,7 +299,7 @@
     "board.reportCancel": "80d4e90ec5dfc046",
     "board.reportClose": "4bf7f68d2c68166f",
     "board.reportDone": "67f787692773bd8e",
-    "board.reportHeld": "da8ea2d2313c8bcc",
+    "board.reportHeld": "992b4891c8d02602",
     "board.reportReceived": "40fc7ed20d3c9be8",
     "board.reportFollowUp": "d927818d772d2f3f",
     "board.underReviewNotice": "f96f3142f35ca0b1",
@@ -536,6 +537,7 @@
     "ui.leftOut": "6d5006b4c8a11cd1",
     "ui.pickedN": "3fa8f926180a137e",
     "ui.picked": "3e1527888db21123",
+    "ui.underReview": "00c1ccc75e3b7be8",
     "ui.pinWithState": "369f50e2cf331f7d",
     "ui.peopleNamed": "c0a39100d2a70a69",
     "ui.ownerThing": "f4b655f6990997a6",
diff --git a/src/i18n/messages/en.json b/src/i18n/messages/en.json
index fc57fa94..3f6e62bc 100644
--- a/src/i18n/messages/en.json
+++ b/src/i18n/messages/en.json
@@ -238,6 +238,7 @@
   "request.reportEmailInvalid": "That email address does not look right.",
   "request.reportFailed": "That report could not be sent. Please try again.",
   "request.boardUnderReview": "This board is paused while we check a report.",
+  "request.pinUnderReview": "That pin is hidden while we check a report.",
   "add.title": "Add a photo",
   "add.pick": "Take or pick a photo",
   "add.takePhoto": "Take photo",
@@ -294,7 +295,7 @@
   "board.reportCancel": "Cancel",
   "board.reportClose": "Close",
   "board.reportDone": "Done",
-  "board.reportHeld": "Hidden while we check. Your reference: {ref}",
+  "board.reportHeld": "Hidden now and removed in {hours} hours unless we clear it. Your reference: {ref}",
   "board.reportReceived": "Received. We'll take a look. Your reference: {ref}",
   "board.reportFollowUp": "Questions about a report? Write to this address and quote the reference:",
   "board.underReviewNotice": "This board is paused while we check a report.",
@@ -532,6 +533,7 @@
   "ui.leftOut": "left out",
   "ui.pickedN": "picked {n}",
   "ui.picked": "picked",
+  "ui.underReview": "Under review",
   "ui.pinWithState": "{label}, {state}",
   "ui.peopleNamed": "{count}: {names}",
   "ui.ownerThing": "{owner}'s {thing}",
diff --git a/src/i18n/messages/es.json b/src/i18n/messages/es.json
index ac720337..2962fcbf 100644
--- a/src/i18n/messages/es.json
+++ b/src/i18n/messages/es.json
@@ -238,6 +238,7 @@
   "request.reportEmailInvalid": "Esa dirección de correo no parece válida.",
   "request.reportFailed": "No se pudo enviar el reporte. Intenta de nuevo.",
   "request.boardUnderReview": "Este tablero está en pausa mientras revisamos un reporte.",
+  "request.pinUnderReview": "Ese pin está oculto mientras revisamos un reporte.",
   "add.title": "Agrega una foto",
   "add.pick": "Toma o elige una foto",
   "add.takePhoto": "Tomar foto",
@@ -294,7 +295,7 @@
   "board.reportCancel": "Cancelar",
   "board.reportClose": "Cerrar",
   "board.reportDone": "Listo",
-  "board.reportHeld": "Oculto mientras revisamos. Tu referencia: {ref}",
+  "board.reportHeld": "Oculto por ahora y se eliminará en {hours} horas a menos que lo aprobemos. Tu referencia: {ref}",
   "board.reportReceived": "Recibido. Lo revisaremos. Tu referencia: {ref}",
   "board.reportFollowUp": "¿Dudas sobre un reporte? Escríbenos a esta dirección y menciona la referencia:",
   "board.underReviewNotice": "Este tablero está en pausa mientras revisamos un reporte.",
@@ -532,6 +533,7 @@
   "ui.leftOut": "excluida",
   "ui.pickedN": "elegida n.º {n}",
   "ui.picked": "elegida",
+  "ui.underReview": "En revisión",
   "ui.pinWithState": "{label}, {state}",
   "ui.peopleNamed": "{count}: {names}",
   "ui.ownerThing": "{thing} de {owner}",
diff --git a/src/i18n/messages/es.lock.json b/src/i18n/messages/es.lock.json
index ce488387..e47e13c0 100644
--- a/src/i18n/messages/es.lock.json
+++ b/src/i18n/messages/es.lock.json
@@ -242,6 +242,7 @@
     "request.reportEmailInvalid": "518710625cda91c8",
     "request.reportFailed": "bb4c2dfb0b3c402a",
     "request.boardUnderReview": "f96f3142f35ca0b1",
+    "request.pinUnderReview": "811d8a5d0c5e9d98",
     "add.title": "787d8913e7221b88",
     "add.pick": "e516b916371de9c5",
     "add.takePhoto": "f3ff70e1103d5024",
@@ -298,7 +299,7 @@
     "board.reportCancel": "80d4e90ec5dfc046",
     "board.reportClose": "4bf7f68d2c68166f",
     "board.reportDone": "67f787692773bd8e",
-    "board.reportHeld": "da8ea2d2313c8bcc",
+    "board.reportHeld": "992b4891c8d02602",
     "board.reportReceived": "40fc7ed20d3c9be8",
     "board.reportFollowUp": "d927818d772d2f3f",
     "board.underReviewNotice": "f96f3142f35ca0b1",
@@ -536,6 +537,7 @@
     "ui.leftOut": "6d5006b4c8a11cd1",
     "ui.pickedN": "3fa8f926180a137e",
     "ui.picked": "3e1527888db21123",
+    "ui.underReview": "00c1ccc75e3b7be8",
     "ui.pinWithState": "369f50e2cf331f7d",
     "ui.peopleNamed": "c0a39100d2a70a69",
     "ui.ownerThing": "f4b655f6990997a6",
diff --git a/src/i18n/messages/fr.json b/src/i18n/messages/fr.json
index 95b3d965..4d5d3703 100644
--- a/src/i18n/messages/fr.json
+++ b/src/i18n/messages/fr.json
@@ -238,6 +238,7 @@
   "request.reportEmailInvalid": "Cette adresse e-mail n'a pas l'air correcte.",
   "request.reportFailed": "Ce signalement n'a pas pu être envoyé. Réessaie.",
   "request.boardUnderReview": "Ce tableau est en pause le temps qu'on vérifie un signalement.",
+  "request.pinUnderReview": "Cette épingle est masquée le temps qu'on vérifie un signalement.",
   "add.title": "Ajouter une photo",
   "add.pick": "Prends ou choisis une photo",
   "add.takePhoto": "Prendre une photo",
@@ -294,7 +295,7 @@
   "board.reportCancel": "Annuler",
   "board.reportClose": "Fermer",
   "board.reportDone": "Terminé",
-  "board.reportHeld": "Masqué le temps qu'on vérifie. Ta référence : {ref}",
+  "board.reportHeld": "Masqué pour l'instant et supprimé dans {hours} heures sauf si on le rétablit. Ta référence : {ref}",
   "board.reportReceived": "Reçu. On va regarder. Ta référence : {ref}",
   "board.reportFollowUp": "Des questions sur un signalement ? Écris à cette adresse en indiquant la référence :",
   "board.underReviewNotice": "Ce tableau est en pause le temps qu'on vérifie un signalement.",
@@ -532,6 +533,7 @@
   "ui.leftOut": "laissé de côté",
   "ui.pickedN": "sélectionné n° {n}",
   "ui.picked": "sélectionné",
+  "ui.underReview": "En cours de vérification",
   "ui.pinWithState": "{label}, {state}",
   "ui.peopleNamed": "{count} : {names}",
   "ui.ownerThing": "{thing} de {owner}",
diff --git a/src/i18n/messages/fr.lock.json b/src/i18n/messages/fr.lock.json
index ce488387..e47e13c0 100644
--- a/src/i18n/messages/fr.lock.json
+++ b/src/i18n/messages/fr.lock.json
@@ -242,6 +242,7 @@
     "request.reportEmailInvalid": "518710625cda91c8",
     "request.reportFailed": "bb4c2dfb0b3c402a",
     "request.boardUnderReview": "f96f3142f35ca0b1",
+    "request.pinUnderReview": "811d8a5d0c5e9d98",
     "add.title": "787d8913e7221b88",
     "add.pick": "e516b916371de9c5",
     "add.takePhoto": "f3ff70e1103d5024",
@@ -298,7 +299,7 @@
     "board.reportCancel": "80d4e90ec5dfc046",
     "board.reportClose": "4bf7f68d2c68166f",
     "board.reportDone": "67f787692773bd8e",
-    "board.reportHeld": "da8ea2d2313c8bcc",
+    "board.reportHeld": "992b4891c8d02602",
     "board.reportReceived": "40fc7ed20d3c9be8",
     "board.reportFollowUp": "d927818d772d2f3f",
     "board.underReviewNotice": "f96f3142f35ca0b1",
@@ -536,6 +537,7 @@
     "ui.leftOut": "6d5006b4c8a11cd1",
     "ui.pickedN": "3fa8f926180a137e",
     "ui.picked": "3e1527888db21123",
+    "ui.underReview": "00c1ccc75e3b7be8",
     "ui.pinWithState": "369f50e2cf331f7d",
     "ui.peopleNamed": "c0a39100d2a70a69",
     "ui.ownerThing": "f4b655f6990997a6",
diff --git a/src/i18n/messages/id.json b/src/i18n/messages/id.json
index 2506c09e..7b0af408 100644
--- a/src/i18n/messages/id.json
+++ b/src/i18n/messages/id.json
@@ -238,6 +238,7 @@
   "request.reportEmailInvalid": "Alamat email itu sepertinya salah.",
   "request.reportFailed": "Laporan tidak bisa dikirim. Coba lagi ya.",
   "request.boardUnderReview": "Papan ini dijeda sementara kami cek laporan.",
+  "request.pinUnderReview": "Pin itu disembunyikan sementara kami cek laporan.",
   "add.title": "Tambah foto",
   "add.pick": "Ambil atau pilih foto",
   "add.takePhoto": "Ambil foto",
@@ -294,7 +295,7 @@
   "board.reportCancel": "Batal",
   "board.reportClose": "Tutup",
   "board.reportDone": "Selesai",
-  "board.reportHeld": "Disembunyikan sementara kami cek. Referensimu: {ref}",
+  "board.reportHeld": "Disembunyikan sekarang dan akan dihapus dalam {hours} jam kecuali kami pulihkan. Referensi kamu: {ref}",
   "board.reportReceived": "Diterima. Akan kami cek. Referensimu: {ref}",
   "board.reportFollowUp": "Ada pertanyaan soal laporan? Tulis ke alamat ini dan cantumkan referensi:",
   "board.underReviewNotice": "Papan ini dijeda sementara kami cek laporan.",
@@ -532,6 +533,7 @@
   "ui.leftOut": "tidak terpilih",
   "ui.pickedN": "{n} terpilih",
   "ui.picked": "terpilih",
+  "ui.underReview": "Sedang ditinjau",
   "ui.pinWithState": "{label}, {state}",
   "ui.peopleNamed": "{count}: {names}",
   "ui.ownerThing": "{thing} milik {owner}",
diff --git a/src/i18n/messages/id.lock.json b/src/i18n/messages/id.lock.json
index ce488387..e47e13c0 100644
--- a/src/i18n/messages/id.lock.json
+++ b/src/i18n/messages/id.lock.json
@@ -242,6 +242,7 @@
     "request.reportEmailInvalid": "518710625cda91c8",
     "request.reportFailed": "bb4c2dfb0b3c402a",
     "request.boardUnderReview": "f96f3142f35ca0b1",
+    "request.pinUnderReview": "811d8a5d0c5e9d98",
     "add.title": "787d8913e7221b88",
     "add.pick": "e516b916371de9c5",
     "add.takePhoto": "f3ff70e1103d5024",
@@ -298,7 +299,7 @@
     "board.reportCancel": "80d4e90ec5dfc046",
     "board.reportClose": "4bf7f68d2c68166f",
     "board.reportDone": "67f787692773bd8e",
-    "board.reportHeld": "da8ea2d2313c8bcc",
+    "board.reportHeld": "992b4891c8d02602",
     "board.reportReceived": "40fc7ed20d3c9be8",
     "board.reportFollowUp": "d927818d772d2f3f",
     "board.underReviewNotice": "f96f3142f35ca0b1",
@@ -536,6 +537,7 @@
     "ui.leftOut": "6d5006b4c8a11cd1",
     "ui.pickedN": "3fa8f926180a137e",
     "ui.picked": "3e1527888db21123",
+    "ui.underReview": "00c1ccc75e3b7be8",
     "ui.pinWithState": "369f50e2cf331f7d",
     "ui.peopleNamed": "c0a39100d2a70a69",
     "ui.ownerThing": "f4b655f6990997a6",
diff --git a/src/i18n/messages/it.json b/src/i18n/messages/it.json
index 928e31c2..99b557b0 100644
--- a/src/i18n/messages/it.json
+++ b/src/i18n/messages/it.json
@@ -238,6 +238,7 @@
   "request.reportEmailInvalid": "Quell'indirizzo email non sembra corretto.",
   "request.reportFailed": "Segnalazione non inviata. Riprova.",
   "request.boardUnderReview": "Questa bacheca è in pausa mentre controlliamo una segnalazione.",
+  "request.pinUnderReview": "Quel pin è nascosto mentre verifichiamo una segnalazione.",
   "add.title": "Aggiungi una foto",
   "add.pick": "Scatta o scegli una foto",
   "add.takePhoto": "Scatta una foto",
@@ -294,7 +295,7 @@
   "board.reportCancel": "Annulla",
   "board.reportClose": "Chiudi",
   "board.reportDone": "Fatto",
-  "board.reportHeld": "Nascosto mentre controlliamo. Il tuo riferimento: {ref}",
+  "board.reportHeld": "Nascosta per ora e rimossa tra {hours} ore a meno che non la sblocchiamo. Il tuo riferimento: {ref}",
   "board.reportReceived": "Ricevuto. Diamo un'occhiata. Il tuo riferimento: {ref}",
   "board.reportFollowUp": "Domande su una segnalazione? Scrivi a questo indirizzo citando il riferimento:",
   "board.underReviewNotice": "Questa bacheca è in pausa mentre controlliamo una segnalazione.",
@@ -532,6 +533,7 @@
   "ui.leftOut": "esclusa",
   "ui.pickedN": "scelta n. {n}",
   "ui.picked": "scelta",
+  "ui.underReview": "In verifica",
   "ui.pinWithState": "{label}, {state}",
   "ui.peopleNamed": "{count}: {names}",
   "ui.ownerThing": "{thing} di {owner}",
diff --git a/src/i18n/messages/it.lock.json b/src/i18n/messages/it.lock.json
index ce488387..e47e13c0 100644
--- a/src/i18n/messages/it.lock.json
+++ b/src/i18n/messages/it.lock.json
@@ -242,6 +242,7 @@
     "request.reportEmailInvalid": "518710625cda91c8",
     "request.reportFailed": "bb4c2dfb0b3c402a",
     "request.boardUnderReview": "f96f3142f35ca0b1",
+    "request.pinUnderReview": "811d8a5d0c5e9d98",
     "add.title": "787d8913e7221b88",
     "add.pick": "e516b916371de9c5",
     "add.takePhoto": "f3ff70e1103d5024",
@@ -298,7 +299,7 @@
     "board.reportCancel": "80d4e90ec5dfc046",
     "board.reportClose": "4bf7f68d2c68166f",
     "board.reportDone": "67f787692773bd8e",
-    "board.reportHeld": "da8ea2d2313c8bcc",
+    "board.reportHeld": "992b4891c8d02602",
     "board.reportReceived": "40fc7ed20d3c9be8",
     "board.reportFollowUp": "d927818d772d2f3f",
     "board.underReviewNotice": "f96f3142f35ca0b1",
@@ -536,6 +537,7 @@
     "ui.leftOut": "6d5006b4c8a11cd1",
     "ui.pickedN": "3fa8f926180a137e",
     "ui.picked": "3e1527888db21123",
+    "ui.underReview": "00c1ccc75e3b7be8",
     "ui.pinWithState": "369f50e2cf331f7d",
     "ui.peopleNamed": "c0a39100d2a70a69",
     "ui.ownerThing": "f4b655f6990997a6",
diff --git a/src/i18n/messages/pt-BR.json b/src/i18n/messages/pt-BR.json
index b8736bc7..b9257630 100644
--- a/src/i18n/messages/pt-BR.json
+++ b/src/i18n/messages/pt-BR.json
@@ -238,6 +238,7 @@
   "request.reportEmailInvalid": "Esse e-mail não parece certo.",
   "request.reportFailed": "Não deu para enviar a denúncia. Tente de novo.",
   "request.boardUnderReview": "Este quadro está pausado enquanto verificamos uma denúncia.",
+  "request.pinUnderReview": "Esse pin está oculto enquanto analisamos uma denúncia.",
   "add.title": "Adicionar foto",
   "add.pick": "Tire ou escolha uma foto",
   "add.takePhoto": "Tirar foto",
@@ -294,7 +295,7 @@
   "board.reportCancel": "Cancelar",
   "board.reportClose": "Fechar",
   "board.reportDone": "Pronto",
-  "board.reportHeld": "Oculto enquanto verificamos. Seu protocolo: {ref}",
+  "board.reportHeld": "Ocultado agora e removido em {hours} horas, a menos que liberemos. Sua referência: {ref}",
   "board.reportReceived": "Recebido. Vamos dar uma olhada. Seu protocolo: {ref}",
   "board.reportFollowUp": "Dúvidas sobre a denúncia? Escreva para este endereço e informe o protocolo:",
   "board.underReviewNotice": "Este quadro está pausado enquanto verificamos uma denúncia.",
@@ -532,6 +533,7 @@
   "ui.leftOut": "ficou de fora",
   "ui.pickedN": "escolhida nº {n}",
   "ui.picked": "escolhida",
+  "ui.underReview": "Em análise",
   "ui.pinWithState": "{label}, {state}",
   "ui.peopleNamed": "{count}: {names}",
   "ui.ownerThing": "{thing} de {owner}",
diff --git a/src/i18n/messages/pt-BR.lock.json b/src/i18n/messages/pt-BR.lock.json
index ce488387..e47e13c0 100644
--- a/src/i18n/messages/pt-BR.lock.json
+++ b/src/i18n/messages/pt-BR.lock.json
@@ -242,6 +242,7 @@
     "request.reportEmailInvalid": "518710625cda91c8",
     "request.reportFailed": "bb4c2dfb0b3c402a",
     "request.boardUnderReview": "f96f3142f35ca0b1",
+    "request.pinUnderReview": "811d8a5d0c5e9d98",
     "add.title": "787d8913e7221b88",
     "add.pick": "e516b916371de9c5",
     "add.takePhoto": "f3ff70e1103d5024",
@@ -298,7 +299,7 @@
     "board.reportCancel": "80d4e90ec5dfc046",
     "board.reportClose": "4bf7f68d2c68166f",
     "board.reportDone": "67f787692773bd8e",
-    "board.reportHeld": "da8ea2d2313c8bcc",
+    "board.reportHeld": "992b4891c8d02602",
     "board.reportReceived": "40fc7ed20d3c9be8",
     "board.reportFollowUp": "d927818d772d2f3f",
     "board.underReviewNotice": "f96f3142f35ca0b1",
@@ -536,6 +537,7 @@
     "ui.leftOut": "6d5006b4c8a11cd1",
     "ui.pickedN": "3fa8f926180a137e",
     "ui.picked": "3e1527888db21123",
+    "ui.underReview": "00c1ccc75e3b7be8",
     "ui.pinWithState": "369f50e2cf331f7d",
     "ui.peopleNamed": "c0a39100d2a70a69",
     "ui.ownerThing": "f4b655f6990997a6",
diff --git a/src/policy/policy.test.ts b/src/policy/policy.test.ts
index fba82260..a507d9a0 100644
--- a/src/policy/policy.test.ts
+++ b/src/policy/policy.test.ts
@@ -419,7 +419,7 @@ describe("Policy (PIN-59, docs/11 §5.1)", () => {
       perIp: { limit: 5, windowMs: 600_000 },
       maxBytes: 4096,
       messageMaxChars: 1000,
-      sweepBatch: 5,
+      sweepBatch: 20,
     });
     const p = resolvePolicy(
       { report: { messageMaxChars: 500 } },
diff --git a/src/policy/policy.ts b/src/policy/policy.ts
index c7e201fe..506285b1 100644
--- a/src/policy/policy.ts
+++ b/src/policy/policy.ts
@@ -304,9 +304,10 @@ export const PolicySchema = z
      * body and is read from the env-level Policy before any board
      * read (like sceneRequestMaxBytes); `messageMaxChars` caps the
      * reporter's free text (stored with the report, never logged).
-     * `sweepBatch` is how many due reports one backstop run takes
-     * down (0 turns the timed takedown off); the deadline itself is
-     * the existing `takedownHours`.
+     * `sweepBatch` is how many due reports one backstop run (every
+     * 6 h) takes down (0 turns the timed takedown off); the deadline
+     * itself is the existing `takedownHours`, on every holding report
+     * (PIN-278).
      */
     report: z
       .object({
@@ -318,13 +319,13 @@ export const PolicySchema = z
           .default({ limit: 5, windowMs: 600_000 }),
         maxBytes: z.number().int().min(1).default(4096),
         messageMaxChars: z.number().int().min(1).default(1000),
-        sweepBatch: z.number().int().min(0).default(5),
+        sweepBatch: z.number().int().min(0).default(20),
       })
       .default({
         perIp: { limit: 5, windowMs: 600_000 },
         maxBytes: 4096,
         messageMaxChars: 1000,
-        sweepBatch: 5,
+        sweepBatch: 20,
       }),
     /** One-time "sign in to keep your pins" nudge after the first
      * pinned pin (PIN-84). Only ever renders when sign-in is on. */
diff --git a/src/server/board-api.ts b/src/server/board-api.ts
index a7f9ec1b..b525000d 100644
--- a/src/server/board-api.ts
+++ b/src/server/board-api.ts
@@ -14,7 +14,7 @@ import "server-only";
  * (photo-intake, PIN-64). The bucket 1-day lifecycle backstop is
  * an operator step; until it lands no copy may claim 24h deletion.
  */
-import { emptyBoardCounters, type Board, type DecomposeJob, type Element, type Participant, type Pin, type Scene, type SceneJob } from "../domain/board";
+import { emptyBoardCounters, isHeldRef, type Board, type DecomposeJob, type Element, type Participant, type Pin, type Scene, type SceneJob } from "../domain/board";
 import { activityLines } from "../domain/board-activity";
 import { normalizeElementLabel } from "../domain/element-label";
 import { isLiveBoard, type BoardRepository } from "../domain/board-repository";
@@ -184,6 +184,9 @@ export function publicElement(slug: string, element: Element) {
     description: element.description,
     maskBox: element.maskBox,
     faceFlag: element.faceFlag,
+    // PIN-279: under a report hold the picture is a 404 and the pin
+    // cannot be picked; the flag says why, nothing else about the report.
+    held: isHeldRef(element.cutoutRef),
     createdAt: element.createdAt,
     imageUrl: elementImageUrl(slug, element.id, "cutout"),
     flattenedUrl: elementImageUrl(slug, element.id, "flattened"),
@@ -1352,7 +1355,7 @@ export async function requestScene(
         error.code === "scenes_per_participant_day" ||
         error.code === "scenes_per_board_day"
           ? 429
-          : error.code === "scene_id_conflict"
+          : error.code === "scene_id_conflict" || error.code === "element_under_review"
             ? 409
             : error.code === "element_not_found" ||
                 error.code === "parent_not_found"
diff --git a/src/server/board-report.test.ts b/src/server/board-report.test.ts
index 5d83f16b..a3e23a61 100644
--- a/src/server/board-report.test.ts
+++ b/src/server/board-report.test.ts
@@ -75,6 +75,7 @@ describe("createReport (PIN-270)", () => {
       severity: "normal",
       createdAt: NOW,
       status: "open",
+      deleteAt: NOW + h.policy.takedownHours * HOUR,
       held: { elementIds: ["mug"], sceneIds: ["s-mug", "s-both"], boardReview: false, storageHold: false },
     });
     expect(await h.reports.get("rep-1")).toEqual(result.record);
@@ -86,6 +87,7 @@ describe("createReport (PIN-270)", () => {
     expect(event).toEqual({
       severity: "WARNING",
       event: REPORT_RECEIVED_EVENT,
+      deleteAt: NOW + h.policy.takedownHours * HOUR,
       reference: boardReportRef(SLUG),
       reason: "inappropriate",
       scope: "element",
@@ -101,8 +103,10 @@ describe("createReport (PIN-270)", () => {
     const timed = await createReport(SLUG, { scope: "element", targetId: "friend", reason: "likeness" }, null, h.deps);
     expect(timed.record.deleteAt).toBe(NOW + h.policy.takedownHours * HOUR);
     expect((await h.reports.listOpenDue(NOW + 25 * HOUR, 10)).map((r) => r.id)).toEqual(["rep-1"]);
+    // PIN-278: every holding report carries the deadline, face flag or not.
     const plain = await createReport(SLUG, { scope: "element", targetId: "mug", reason: "likeness" }, null, h.deps);
-    expect(plain.record).not.toHaveProperty("deleteAt");
+    expect(plain.record.deleteAt).toBe(NOW + h.policy.takedownHours * HOUR);
+    expect((await h.reports.listOpenDue(NOW + 25 * HOUR, 10)).map((r) => r.id)).toEqual(["rep-1", plain.record.id]);
   });
 
   it("scene: hides that scene only", async () => {
@@ -158,7 +162,7 @@ describe("createReport (PIN-270)", () => {
     const result = await createReport(SLUG, { scope: "board", reason: "illegal" }, null, h.deps);
     expect(result.record.severity).toBe("high");
     expect(result.record.held).toMatchObject({ elementIds: ["mug", "friend", "copy"], sceneIds: ["s-mug", "s-both"], boardReview: true, storageHold: true });
-    expect(result.record).not.toHaveProperty("deleteAt");
+    expect(result.record.deleteAt).toBe(NOW + h.policy.takedownHours * HOUR);
     const expectedHeld = [
       ...refsOf("mug"),
       ...refsOf("friend"),
diff --git a/src/server/my-pins.test.ts b/src/server/my-pins.test.ts
index f9f9c9ec..45db1ee9 100644
--- a/src/server/my-pins.test.ts
+++ b/src/server/my-pins.test.ts
@@ -208,6 +208,14 @@ async function makeHarness(): Promise<Harness> {
 }
 
 describe("listMyElements (PIN-85)", () => {
+  it("a thing under a report hold is flagged held, so no sheet offers to pin it (PIN-279)", async () => {
+    const h = await makeHarness();
+    await h.sceneDeps.boards.holdElement("el-mug");
+    const page = await listMyElements(ALICE, h.pins);
+    expect(page.elements.find((c) => c.elementId === "el-mug")).toMatchObject({ held: true });
+    expect(page.elements.find((c) => c.elementId === "el-lamp")).not.toHaveProperty("held");
+  });
+
   it("collects owned elements across claimed boards, newest first, title labels only", async () => {
     const h = await makeHarness();
     const page = await listMyElements(ALICE, h.pins);
diff --git a/src/server/my-pins.ts b/src/server/my-pins.ts
index c7387709..170c1dc0 100644
--- a/src/server/my-pins.ts
+++ b/src/server/my-pins.ts
@@ -29,7 +29,7 @@ import "server-only";
  * appears in a response or URL (title label only).
  */
 import { createHash, randomUUID } from "node:crypto";
-import type { Element, Participant, Pin } from "../domain/board";
+import { isHeldRef, type Element, type Participant, type Pin } from "../domain/board";
 import { isLiveBoard, type BoardRepository } from "../domain/board-repository";
 import {
   clampLibraryLimit,
@@ -39,6 +39,7 @@ import {
 import type { UserProfile } from "../domain/user";
 import type { UserRepository } from "../domain/user-repository";
 import type { Policy } from "../policy/policy";
+import { userMessage } from "../i18n/user-message";
 import { BoardApiError } from "./board-session";
 import type { DerivativeStore } from "./derivative-store";
 
@@ -113,6 +114,7 @@ export async function listMyElements(
         label: element.label,
         description: element.description,
         faceFlag: element.faceFlag,
+        ...(isHeldRef(element.cutoutRef) ? { held: true } : {}),
         sourceBoardTitle: board.title,
         imageUrl: myPinImageUrl(element.id, "cutout"),
         createdAt: element.createdAt,
@@ -225,6 +227,10 @@ export async function pinFromLibrary(
   if (!source || !(await ownsElement(user, source, deps.boards))) {
     throw new BoardApiError("Element not found.", 404);
   }
+  // PIN-279: a pin under a report hold is not copied anywhere.
+  if (isHeldRef(source.cutoutRef)) {
+    throw new BoardApiError(userMessage("request.pinUnderReview"), 409, "element_under_review");
+  }
 
   const now = deps.now?.() ?? Date.now();
   const newId = deps.newId ?? randomUUID;
diff --git a/src/server/report-decide.test.ts b/src/server/report-decide.test.ts
index 0ff41ad2..613269f5 100644
--- a/src/server/report-decide.test.ts
+++ b/src/server/report-decide.test.ts
@@ -162,25 +162,33 @@ describe("report decisions (PIN-272)", () => {
     expect(late?.outcome).toBe("already_gone");
   });
 
-  it("the sweep takes down due likeness reports in deadline order, batch-capped, and never an illegal one", async () => {
+  it("the sweep takes down every due report in deadline order, batch-capped, illegal included with its Storage holds kept (PIN-278)", async () => {
     const h = await harness();
     const timed = await h.file(SLUG, { scope: "element", targetId: "friend", reason: "likeness" });
     expect(timed.deleteAt).toBe(NOW + 24 * HOUR);
-    // An illegal record with a deadline must not exist by construction; the sweep refuses it anyway.
-    await h.reports.create({ ...timed, id: "forged", reason: "illegal", deleteAt: NOW + 1, targetId: "mug" });
+    const illegal = await h.file(SLUG, { scope: "element", targetId: "mug", reason: "illegal" });
+    expect(illegal.deleteAt).toBe(NOW + 24 * HOUR);
     // A due report on a thing that no longer exists closes as already_gone.
     await h.reports.create({ ...timed, id: "ghost", targetId: "ghost", deleteAt: NOW + 2 });
 
-    expect(await sweepDueReports(h.deps, NOW + 23 * HOUR, 10)).toEqual({ due: 2, takenDown: 1, skipped: 1 });
-    expect((await h.reports.get("forged"))?.status).toBe("open");
+    expect(await sweepDueReports(h.deps, NOW + 23 * HOUR, 10)).toEqual({ due: 1, takenDown: 1, skipped: 0 });
     expect((await h.reports.get("ghost"))?.status).toBe("takedown");
     expect(await h.boards.getElement("friend")).not.toBeNull();
+    expect(await h.boards.getElement("mug")).not.toBeNull();
 
     expect(await sweepDueReports(h.deps, NOW + 25 * HOUR, 0)).toEqual({ due: 0, takenDown: 0, skipped: 0 });
-    expect(await sweepDueReports(h.deps, NOW + 25 * HOUR, 10)).toEqual({ due: 2, takenDown: 1, skipped: 1 });
+    expect(await sweepDueReports(h.deps, NOW + 25 * HOUR, 1)).toEqual({ due: 1, takenDown: 1, skipped: 0 });
+    expect(await sweepDueReports(h.deps, NOW + 25 * HOUR, 10)).toEqual({ due: 1, takenDown: 1, skipped: 0 });
     expect(await h.boards.getElement("friend")).toBeNull();
+    expect(await h.boards.getElement("mug")).toBeNull();
     expect((await h.reports.get(timed.id))).toMatchObject({ status: "takedown", note: "timed takedown (takedownHours)" });
-    expect(await sweepDueReports(h.deps, NOW + 25 * HOUR, 10)).toEqual({ due: 1, takenDown: 0, skipped: 1 });
+    expect((await h.reports.get(illegal.id))).toMatchObject({ status: "takedown", held: { storageHold: true } });
+    // The evidence is still there, under its hold.
+    for (const ref of refsOf("mug")) {
+      expect(h.store.isHeld(ref)).toBe(true);
+      expect(await h.store.get(ref)).not.toBeNull();
+    }
+    expect(await sweepDueReports(h.deps, NOW + 25 * HOUR, 10)).toEqual({ due: 0, takenDown: 0, skipped: 0 });
   });
 
   it("dismiss never brings back a scene another open report holds on its own", async () => {
diff --git a/src/server/report-decide.ts b/src/server/report-decide.ts
index c626a5ba..86beccb2 100644
--- a/src/server/report-decide.ts
+++ b/src/server/report-decide.ts
@@ -299,10 +299,10 @@ export interface SweepSummary {
 }
 
 /**
- * The timed takedown (ADR-004 decision 4): open reports whose
- * `deleteAt` passed, `batch` at a time, oldest deadline first. Only a
- * face-flagged likeness report ever carries a deadline; an `illegal`
- * report is skipped here whatever its record says.
+ * The timed takedown (ADR-004 decision 4, amended by PIN-278): open
+ * reports whose `deleteAt` passed, `batch` at a time, oldest deadline
+ * first. Every holding report carries a deadline, `illegal` included:
+ * its takedown keeps the Storage holds, so the bytes stay as evidence.
  */
 export async function sweepDueReports(deps: ReportDecideDeps, now: number, batch: number): Promise<SweepSummary> {
   const summary: SweepSummary = { due: 0, takenDown: 0, skipped: 0 };
@@ -310,10 +310,6 @@ export async function sweepDueReports(deps: ReportDecideDeps, now: number, batch
   const due = await deps.reports.listOpenDue(now, batch);
   summary.due = due.length;
   for (const record of due) {
-    if (record.reason === "illegal") {
-      summary.skipped += 1;
-      continue;
-    }
     const result = await takedownReport(record.id, { ...deps, now: () => now }, "timed takedown (takedownHours)");
     if (result) summary.takenDown += 1;
     else summary.skipped += 1;
diff --git a/src/server/scene-job.test.ts b/src/server/scene-job.test.ts
index a36d7d2e..b86bd34e 100644
--- a/src/server/scene-job.test.ts
+++ b/src/server/scene-job.test.ts
@@ -548,6 +548,18 @@ describe("deleted-element exclusion and hidden scenes", () => {
     expect(await h.jobs.listForBoard("board-1")).toHaveLength(0);
   });
 
+  it("a pin under a report hold is refused up front, typed, with no composer call (PIN-279)", async () => {
+    const h = await makeHarness();
+    await h.boards.holdElement("el2");
+    const error = await startSceneJob(
+      { boardId: "board-1", participantId: "p1", elementIds: ["el1", "el2"], prompt: "x" },
+      h.deps,
+    ).catch((e: unknown) => e);
+    expect(error).toMatchObject({ code: "element_under_review" });
+    expect(h.calls).toHaveLength(0);
+    expect(await h.jobs.listForBoard("board-1")).toHaveLength(0);
+  });
+
   it("deleting an element between create and run fails typed with no composer call", async () => {
     const h = await makeHarness();
     const pending: SceneJob = {
diff --git a/src/server/scene-job.ts b/src/server/scene-job.ts
index 98ae50d6..36ecc197 100644
--- a/src/server/scene-job.ts
+++ b/src/server/scene-job.ts
@@ -32,6 +32,7 @@ import type {
   Scene,
   SceneJob,
 } from "../domain/board";
+import { isHeldRef } from "../domain/board";
 import { isLiveBoard, type BoardRepository } from "../domain/board-repository";
 import { parseSceneSize, validSceneSize, type SceneSize } from "../domain/scene-ratio";
 import { startOfUtcDay } from "../domain/time";
@@ -68,6 +69,7 @@ export class SceneJobRequestError extends Error {
       | "bad_prompt"
       | "pins_per_scene"
       | "element_not_found"
+      | "element_under_review"
       | "scenes_per_participant_day"
       | "scenes_per_board_day"
       | "scene_id_conflict"
@@ -514,6 +516,11 @@ export async function startSceneJob(
         "element_not_found",
       );
     }
+    // PIN-279: a pin under a report hold has no servable bytes. Refuse
+    // up front with a line the sheet can show, instead of a failed job.
+    if (isHeldRef(element.cutoutRef)) {
+      throw new SceneJobRequestError(userMessage("request.pinUnderReview"), "element_under_review");
+    }
   }
 
   // Policy daily caps at request time (UTC day, like uploadPhoto);
diff --git a/src/ui/kit.test.ts b/src/ui/kit.test.ts
index ff1affd2..ab3ad6b2 100644
--- a/src/ui/kit.test.ts
+++ b/src/ui/kit.test.ts
@@ -60,6 +60,18 @@ describe("UI kit components (PIN-97)", () => {
     expect(picked).toContain(">2<");
   });
 
+  it("a held sticker shows the under-review placeholder instead of a picture, and a held pin is no pick button (PIN-279)", () => {
+    const held = html(h(Sticker, { src: "/a.webp", seed: "x", held: true }));
+    expect(held).toContain("pn-sticker-held");
+    expect(held).toContain("Under review");
+    expect(held).not.toContain("<img");
+    const pin = html(h(Pin, { src: "/a.webp", label: "Duck", owner: { id: "p1", name: "Robin" }, held: true, onToggle: () => {} }));
+    expect(pin).not.toContain("<button");
+    expect(pin).toContain("Under review");
+    expect(pin).toContain("Duck");
+    expect(pin).toContain("Robin");
+  });
+
   it("makes a pickable pin a pressed button with a full spoken label", () => {
     const markup = html(
       h(Pin, {
diff --git a/src/ui/pinneds.css b/src/ui/pinneds.css
index 1fda4a3e..2e88d44d 100644
--- a/src/ui/pinneds.css
+++ b/src/ui/pinneds.css
@@ -242,6 +242,9 @@
   filter: drop-shadow(var(--kw) 0 0 var(--keyline)) drop-shadow(calc(-1 * var(--kw)) 0 0 var(--keyline)) drop-shadow(0 var(--kw) 0 var(--keyline)) drop-shadow(0 calc(-1 * var(--kw)) 0 var(--keyline)) var(--lift);
   transition: filter .25s ease, opacity .25s ease;
 }
+/* PIN-279: a pin under a report hold shows a quiet placeholder where its picture was. */
+.pn-sticker-held { position: absolute; inset: 5px; display: grid; place-items: center; padding: 6px; border: 2px dashed var(--keyline); border-radius: var(--radius-md); background: var(--surface-raised); color: var(--ink-muted); font: 600 12px/14px var(--font-ui); text-align: center; overflow-wrap: anywhere; }
+.pn-sticker[data-held] { rotate: 0deg; }
 .pn-sticker::before { content: ""; display: var(--pushpin); position: absolute; z-index: 2; top: 2px; left: 50%; width: 15px; height: 15px; translate: -50% 0; border-radius: 50%;
   background: radial-gradient(circle at 34% 32%, color-mix(in srgb, var(--accent) 35%, var(--surface-raised)) 0 2.5px, var(--accent) 3.5px); box-shadow: 1px 4px 3px var(--shade); }
 .pn-sticker[data-state="picked"] { scale: 1.06; rotate: 0deg; }
diff --git a/src/ui/stickers.tsx b/src/ui/stickers.tsx
index 2be4bb6b..610f3183 100644
--- a/src/ui/stickers.tsx
+++ b/src/ui/stickers.tsx
@@ -27,6 +27,7 @@ export function Sticker({
   loading = "lazy",
   style,
   className,
+  held,
 }: {
   src: string;
   alt?: string;
@@ -40,7 +41,10 @@ export function Sticker({
   loading?: "lazy" | "eager";
   style?: CSSProperties;
   className?: string;
+  /** PIN-279: under a report hold; a quiet placeholder stands where the picture was. */
+  held?: boolean;
 }) {
+  const locale = useLocale();
   const vars: Record<string, string | number> = { "--t": tilt ?? stickerTilt(seed) };
   if (size !== undefined) vars["--pn-size"] = typeof size === "number" ? `${size}px` : size;
   if (state === "cutting" || foil) vars["--src"] = `url("${src}")`;
@@ -49,9 +53,14 @@ export function Sticker({
       className={cx("pn-sticker", className)}
       data-state={state}
       data-foil={foil ? "" : undefined}
+      data-held={held ? "" : undefined}
       style={{ ...(vars as CSSProperties), ...style }}
     >
-      <img src={src} alt={alt} draggable={false} loading={loading} decoding="async" />
+      {held ? (
+        <span className="pn-sticker-held">{t(locale, "ui.underReview")}</span>
+      ) : (
+        <img src={src} alt={alt} draggable={false} loading={loading} decoding="async" />
+      )}
       {foil ? <span className="pn-foil" aria-hidden="true" /> : null}
       {state === "picked" && pickIndex ? (
         <span className="pn-sticker-badge" aria-hidden="true">
@@ -82,6 +91,7 @@ export function Pin({
   speakOwner = true,
   children,
   className,
+  held,
 }: {
   src: string;
   label: string;
@@ -104,10 +114,14 @@ export function Pin({
   /** Extra controls under the pin (e.g. a More menu for the owner). */
   children?: ReactNode;
   className?: string;
+  /** PIN-279: under a report hold; placeholder instead of the picture, never a pick button. */
+  held?: boolean;
 }) {
   const locale = useLocale();
   const picked = state === "picked";
-  const sticker = <Sticker src={src} seed={seed ?? label} state={state} pickIndex={pickIndex} size={size} foil={foil} />;
+  const sticker = (
+    <Sticker src={src} seed={seed ?? label} state={state} pickIndex={pickIndex} size={size} foil={foil} held={held} />
+  );
   const tag = (
     <span className="pn-pin-tag">
       <span className="pn-pin-tag-text">{label}</span>
@@ -119,7 +133,7 @@ export function Pin({
       <span className="pn-pin-owner-name">{owner.name}</span>
     </span>
   ) : null;
-  if (onToggle) {
+  if (onToggle && !held) {
     const named = owner && speakOwner ? tf(locale, "ui.ownerThing", { owner: owner.name, thing: label }) : label;
     // `picked` and `dropped` are different states, so at most one status applies.
     const status = picked

From f9e7ecfdd0625811e40cc2193764f2872981b9da Mon Sep 17 00:00:00 2001
From: Robin ELM <64148042+Robin-ELM@users.noreply.github.com>
Date: Wed, 4 Nov 2026 21:49:59 +0300
Subject: [PATCH 5/5] Promote dev to prod (848eb0b)

---
 src/ui/kit.test.ts  | 6 ++++++
 src/ui/stickers.tsx | 8 +++++---
 2 files changed, 11 insertions(+), 3 deletions(-)

diff --git a/src/ui/kit.test.ts b/src/ui/kit.test.ts
index ab3ad6b2..437f2ede 100644
--- a/src/ui/kit.test.ts
+++ b/src/ui/kit.test.ts
@@ -65,6 +65,12 @@ describe("UI kit components (PIN-97)", () => {
     expect(held).toContain("pn-sticker-held");
     expect(held).toContain("Under review");
     expect(held).not.toContain("<img");
+    // The foil perk never paints a held pin's shape either.
+    const foiled = html(h(Sticker, { src: "/a.webp", seed: "x", held: true, foil: true }));
+    expect(foiled).not.toContain("pn-foil");
+    expect(foiled).not.toContain("data-foil");
+    expect(foiled).not.toContain("--src");
+    expect(foiled).not.toContain("/a.webp");
     const pin = html(h(Pin, { src: "/a.webp", label: "Duck", owner: { id: "p1", name: "Robin" }, held: true, onToggle: () => {} }));
     expect(pin).not.toContain("<button");
     expect(pin).toContain("Under review");
diff --git a/src/ui/stickers.tsx b/src/ui/stickers.tsx
index 610f3183..3feb27fb 100644
--- a/src/ui/stickers.tsx
+++ b/src/ui/stickers.tsx
@@ -47,12 +47,14 @@ export function Sticker({
   const locale = useLocale();
   const vars: Record<string, string | number> = { "--t": tilt ?? stickerTilt(seed) };
   if (size !== undefined) vars["--pn-size"] = typeof size === "number" ? `${size}px` : size;
-  if (state === "cutting" || foil) vars["--src"] = `url("${src}")`;
+  // PIN-279: a held pin has no picture anywhere, foil mask included.
+  const foiled = Boolean(foil) && !held;
+  if (!held && (state === "cutting" || foiled)) vars["--src"] = `url("${src}")`;
   return (
     <span
       className={cx("pn-sticker", className)}
       data-state={state}
-      data-foil={foil ? "" : undefined}
+      data-foil={foiled ? "" : undefined}
       data-held={held ? "" : undefined}
       style={{ ...(vars as CSSProperties), ...style }}
     >
@@ -61,7 +63,7 @@ export function Sticker({
       ) : (
         <img src={src} alt={alt} draggable={false} loading={loading} decoding="async" />
       )}
-      {foil ? <span className="pn-foil" aria-hidden="true" /> : null}
+      {foiled ? <span className="pn-foil" aria-hidden="true" /> : null}
       {state === "picked" && pickIndex ? (
         <span className="pn-sticker-badge" aria-hidden="true">
           {pickIndex}