From 0395043a6d548b825343c7141be49cd611528227 Mon Sep 17 00:00:00 2001
From: zhanglinghao <zhangczssx@gmail.com>
Date: Sun, 4 Oct 2026 03:16:05 +0800
Subject: [PATCH 1/5] Review desk: tick, comment and submit each stop in a
 page; the agent wakes on submit (bin/vh desk)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The static review page could only be read: replies went back through chat as
codes, outlines and captions were raw .md links, and every page was a one-off.
The maintainer tried a prototype desk on a real film, submitted through it
twice, and asked for an automatic hand-back, outlines split by content,
reusable infrastructure, studio as its home, and zh/en by the first request.

- tools/desk/: stdlib server on 127.0.0.1 (Host check, per-run token, same
  origin, project files only, HTTP Range), a reader that turns the project's
  own files into the desk's data and renders anything it can't parse as
  escaped markdown with a warning, feedback that lands in
  out/review/feedback/ and verbatim in REVIEW.md, and a watcher.
- bin/vh desk <project> | desk wait | desk feedback | desk data; bin/vh new
  --lang zh|en writes the BRIEF's new "Review language" line, which the desk
  and bin/vh review (when the gate JSON has no lang) follow.
- The data contract in tools/desk/README.md, including three optional gate
  JSON keys (listen, music labels, film) that replace the prototype's
  hardcoded bits; templates updated to match (BRIEF Outline table named by
  content, SCRIPT caption table with 术语, DECISIONS strikethrough, NOTES
  上屏说法).
- Effort wiring: studio stops in the desk with the watcher armed in the
  background, chat as the fallback (CLAUDE.md, playbook/01, bin/vh effort).
- Docs learned on the film: outline names by content, a concept serves the
  stated focus, endings that lift the theme without slogans, the optional
  术语卡, at least one light look, and sweeping stale lines after a gate.
- CI: the reader on committed zh/en fixtures (incl. the fallback), a server
  on a free port, a submission waking the watcher and landing in REVIEW.md,
  the timeout, new --lang and review's language default.
---
 .gitignore                                    |   1 +
 AGENTS.md                                     |  11 +-
 CHANGELOG.md                                  |  17 +
 CLAUDE.md                                     |  11 +-
 README.md                                     |   5 +-
 README.zh-CN.md                               |   5 +-
 bin/vh                                        |  29 +-
 playbook/01-pipeline.md                       |  25 +-
 playbook/03-motion-design.md                  |   1 +
 playbook/09-narrative.md                      |   5 +-
 playbook/12-ideation.md                       |   3 +-
 templates/BRIEF.md                            |   8 +
 templates/DECISIONS.md                        |   3 +-
 templates/NOTES.md                            |   7 +-
 templates/SCRIPT.md                           |   3 +
 tools/ci.sh                                   | 134 +++-
 tools/desk/README.md                          | 135 ++++
 tools/desk/desk.py                            |  71 ++
 tools/desk/feedback.py                        | 253 +++++++
 tools/desk/fixtures/en/BRIEF.md               |  24 +
 tools/desk/fixtures/en/DECISIONS.md           |  10 +
 tools/desk/fixtures/en/NOTES.md               |  11 +
 tools/desk/fixtures/en/REVIEW.md              |   6 +
 tools/desk/fixtures/en/SCRIPT.md              |   7 +
 tools/desk/fixtures/zh/BRIEF.md               |  32 +
 tools/desk/fixtures/zh/DECISIONS.md           |  17 +
 tools/desk/fixtures/zh/NOTES.md               |  13 +
 tools/desk/fixtures/zh/REVIEW.md              |  23 +
 tools/desk/fixtures/zh/SCRIPT.md              |  11 +
 tools/desk/fixtures/zh/STORYBOARD.md          |   8 +
 tools/desk/fixtures/zh/audio/music.beats.json |   6 +
 tools/desk/fixtures/zh/out/review/gate-1.json |  20 +
 tools/desk/fixtures/zh/shots.json             |   8 +
 tools/desk/reader.py                          | 653 ++++++++++++++++++
 tools/desk/server.py                          | 245 +++++++
 tools/desk/static/desk.css                    | 193 ++++++
 tools/desk/static/desk.js                     | 536 ++++++++++++++
 tools/desk/static/index.html                  |  41 ++
 tools/review.py                               |  20 +-
 video-types/02-knowledge-short.md             |   1 +
 40 files changed, 2574 insertions(+), 38 deletions(-)
 create mode 100644 tools/desk/README.md
 create mode 100644 tools/desk/desk.py
 create mode 100644 tools/desk/feedback.py
 create mode 100644 tools/desk/fixtures/en/BRIEF.md
 create mode 100644 tools/desk/fixtures/en/DECISIONS.md
 create mode 100644 tools/desk/fixtures/en/NOTES.md
 create mode 100644 tools/desk/fixtures/en/REVIEW.md
 create mode 100644 tools/desk/fixtures/en/SCRIPT.md
 create mode 100644 tools/desk/fixtures/zh/BRIEF.md
 create mode 100644 tools/desk/fixtures/zh/DECISIONS.md
 create mode 100644 tools/desk/fixtures/zh/NOTES.md
 create mode 100644 tools/desk/fixtures/zh/REVIEW.md
 create mode 100644 tools/desk/fixtures/zh/SCRIPT.md
 create mode 100644 tools/desk/fixtures/zh/STORYBOARD.md
 create mode 100644 tools/desk/fixtures/zh/audio/music.beats.json
 create mode 100644 tools/desk/fixtures/zh/out/review/gate-1.json
 create mode 100644 tools/desk/fixtures/zh/shots.json
 create mode 100644 tools/desk/reader.py
 create mode 100644 tools/desk/server.py
 create mode 100644 tools/desk/static/desk.css
 create mode 100644 tools/desk/static/desk.js
 create mode 100644 tools/desk/static/index.html

diff --git a/.gitignore b/.gitignore
index 7bbf24a..cc67e14 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,5 +1,6 @@
 node_modules/
 out/
+!tools/desk/fixtures/*/out/
 renders/
 .venv/
 references/repos/
diff --git a/AGENTS.md b/AGENTS.md
index 533d04a..542d826 100644
--- a/AGENTS.md
+++ b/AGENTS.md
@@ -13,7 +13,7 @@
 2. **读流程和自查**：读 `playbook/01-pipeline.md` 和 `playbook/02-verification.md`；涉及配音或音乐时，再读 `playbook/04-audio.md`。
 3. **建项目**：运行 `bin/vh new <type> <slug>`，它会建好 `projects/<日期>-<slug>/`，复制模板，并把该类型的 prompt 块填进 BRIEF（类型的默认做法，立意定了再取舍）；手绘类还会复制引擎、装好依赖。其他引擎的初始化方式见 `engines/README.md`。
 4. **先想立意，再看案例和参考**：建完项目，先把材料里只属于它的数字、原话、物件列进 NOTES.md 的素材清单，自己想 5–8 个点子；这时先不看 BRIEF 末尾的 TYPE 块、`styles/`、`recipes/` 和案例，免得点子往看过的东西上靠。然后再看下面这些参考，用它们补强，收敛成 2–3 张立意卡（做法见 `playbook/12-ideation.md`，例子见 `cases/oneshot-five.md`）。人已经给了立意，就记进 BRIEF，不再出卡，最多附一个备选。参考：打开类型文档"可参考的案例"和"社区 skill 参考"两节列出的文件；需要看真实代码时读 `references/repos/` 里的源码。本仓库自己做过的片子在 `showcase/`，各带 BRIEF、STORYBOARD、NOTES 和源码，是最直接的样板。分镜时，镜头怎么动、全片节奏怎么排，先查 `recipes/`：按意图和能量筛（`bin/vh recipes list`），把选中的配方 id 写进 STORYBOARD 的"配方"列，写代码前读配方全文。
-5. **停下来给人审**：`standard` 和 `studio` 必过下面三道关卡，`quick` 不设关卡；人点名要亲自拍板的事，按"导演模式"另外停，`quick` 也一样。每次停默认做一页决定优先的审阅页（`bin/vh review` 生成本地 HTML，做法见 `playbook/01-pipeline.md` 的"审阅页"），聊天里只发要人定的事和页面路径；只有一两个纯文字的选择时，直接在聊天里问也行。然后**停下来等人回复**，不要自己往下做：
+5. **停下来给人审**：`standard` 和 `studio` 必过下面三道关卡，`quick` 不设关卡；人点名要亲自拍板的事，按"导演模式"另外停，`quick` 也一样。每次停默认做一页决定优先的审阅页（`bin/vh review` 生成本地 HTML，做法见 `playbook/01-pipeline.md` 的"审阅页"），聊天里只发要人定的事和页面路径；只有一两个纯文字的选择时，直接在聊天里问也行。`studio` 默认在审阅台停（`bin/vh desk`，同一份 gate JSON，人在页面里逐条勾选、点评、提交）：停之前在后台挂上 `bin/vh desk wait`，人一提交就接着做；没有后台唤醒的 agent 退回"人回聊天说一声"（`playbook/01-pipeline.md` 的"审阅台"）。审阅页和审阅台的界面语言按用户第一句话的语言定（BRIEF 的 `Review language`，`bin/vh new … --lang en`）。然后**停下来等人回复**，不要自己往下做：
    - ① **立意和大纲**：2–3 张彼此拉得开的立意卡，每张写明由它推出的画面（专属风格，或参考 `styles/` 的预设，可以几个）和钩子，配一帧画面（`playbook/12-ideation.md` 第 7 节）。选一张卡，立意、风格方向和钩子就一起定了，人可以在回复里换预设或钩子。再附按推荐立意写的 BRIEF、3–7 段大纲、引擎和费用。不要默认只给一种口味；
    - ② **分镜**：按大纲的段落拆页，每页 3–6 镜的关键帧，没把握的镜头标出来，逐镜默认通过。长片再附一版全长灰盒 animatic；
    - ③ **初版**：draft 成片加联系表，并写出你自己最不满意的 2–3 处。
@@ -38,6 +38,7 @@
 |---|---|---|---|
 | 适合 | 试方向、草稿、随手发 | 大多数正式视频 | 发布片、旗舰内容、会被反复看的片子 |
 | 人工关卡 | 0 道，直接出片。选 quick 就等于授权跳过关卡，把这一点记进 REVIEW.md；需求有歧义时最多问 1 个问题；人点名要拍板的事照样停（导演模式） | 3 道 | 3 道；关卡 ① 每张立意卡附一段 10–20 s 草图，关卡 ② 附全长 animatic |
+| 在哪审 | 不设关卡；导演模式要停的在聊天里问，或用静态审阅页 | 静态审阅页（`bin/vh review`）；人想逐条勾选、点评时开审阅台（`bin/vh desk`） | 审阅台（`bin/vh desk`）：人在页面里勾选、点评、提交；每次停后在后台挂上 `bin/vh desk wait`，提交就接着做；没有后台唤醒的 agent 退回"人回聊天说一声" |
 | 立意 | 自己想 3 个一句话点子，挑 1 个，写一行理由 | 关卡 ① 给 2–3 张立意卡，每张配一帧画面 | 同左，每张配一段 10–20 s 的草图（look-dev） |
 | 风格 | 从立意推出来，可以参考 `styles/` 的预设，写明借了什么 | 写在每张立意卡的"画面"一行（专属，或借一个预设）；选卡就一起定了，人可以在回复里换 | 同左；每张卡的草图就是那种风格的小样，借来的预设人想看时在 E0 补小样 |
 | 分镜 | 简表：镜头、时长、reads | 完整 STORYBOARD + 分镜预览图 | 同左 + animatic |
@@ -77,7 +78,7 @@ effort 管 agent 自己查得多细，导演模式管人拍板哪些事，两个
   - `review`：agent 出一个结果，放进下一页（没有下一页就随交付给），不为它单独停，人不说话就算通过；
   - `delegate`：agent 自己定，写进 `DECISIONS.md`，人随时能翻案。
 - **没点名的按档位**：`quick` 全部 `delegate`；`standard` 的 `concept` 是 `own`（风格和钩子写在立意卡上，选卡就一起定了；人单独点名 `style` 或 `hook` 时另问），`outline` 和 `storyboard` 是 `review`，其余 `delegate`；`studio` 同 `standard`，其余改成 `review`。
-- **每次停，默认做一页审阅页**，聊天里只发 `bin/vh review` 打印的几行；只有一两个纯文字的选择时，直接在聊天里问也行。一页默认最多 3 个决定，每个带推荐，上游的先问，其余默认通过；人想一次看更多也可以。人的原话逐字记进 `REVIEW.md`。人说不清哪里不对时，先做 look-dev：同一段 10–20 s，只改一个变量，出 2–3 个变体。
+- **每次停，默认做一页审阅页**，聊天里只发 `bin/vh review` 打印的几行；`studio` 再开审阅台（`bin/vh desk`），把它的地址一起发；只有一两个纯文字的选择时，直接在聊天里问也行。一页默认最多 3 个决定，每个带推荐，上游的先问，其余默认通过；人想一次看更多也可以。人的原话逐字记进 `REVIEW.md`。人说不清哪里不对时，先做 look-dev：同一段 10–20 s，只改一个变量，出 2–3 个变体。
 - **关卡是底线**：`standard` 和 `studio` 的关卡 ①②③ 照停，导演模式只加停、不减停；要全程不停，只能由用户本人说"不用审、直接出"。
 
 ## quick 路径卡
@@ -147,13 +148,13 @@ OpenVideoHarness/
 ├── install.sh                一键安装（克隆、依赖、参考仓库、注册 skill）
 ├── CONTRIBUTING.md           改本仓库本身时的分支、PR 和推送规则（人和 agent 都适用）
 ├── .github/                  CI（Linux + macOS 跑 tools/ci.sh）和 main 分支的规则集
-├── bin/vh                    命令行：doctor · setup · types · effort · new · style · recipes · hf-init · install-skill · sync-agents · tts · voices · captions · beats · music · sfx · mix · mux · qa · readcheck · storyboard · rhythm · cover-preview · sheet · check · gif · review
-├── tools/                    bin/vh 背后的脚本（audio/：tts、captions、beats、music、sfx、mix、qa；sheet.py、readcheck.py、review.py；给人拍板用的图：storyboard.py、rhythm.py、style_compare.py、cover_preview.py、audio/roll.py，共用 vhdraw.py）；ci.sh 是仓库自检
+├── bin/vh                    命令行：doctor · setup · types · effort · new · style · recipes · hf-init · install-skill · sync-agents · tts · voices · captions · beats · music · sfx · mix · mux · qa · readcheck · storyboard · rhythm · cover-preview · sheet · check · gif · review · desk
+├── tools/                    bin/vh 背后的脚本（audio/：tts、captions、beats、music、sfx、mix、qa；sheet.py、readcheck.py、review.py；desk/：审阅台的服务、读取约定和等待提交，约定写在 desk/README.md；给人拍板用的图：storyboard.py、rhythm.py、style_compare.py、cover_preview.py、audio/roll.py，共用 vhdraw.py）；ci.sh 是仓库自检
 ├── skills/open-video-harness/  轻量 skill：在任何目录把做视频的请求引到本仓库
 ├── video-types/              9 类视频（09 实验中）：工作流、审美、禁止项、prompt 增量块、自查重点、案例、社区 skill
 ├── playbook/                 跨类型的通用知识
 │   ├── 00-paradigm.md          范式与引擎选型
-│   ├── 01-pipeline.md          十阶段流程（0–9）、reads、人工关卡、导演模式和审阅页、subagent 并行
+│   ├── 01-pipeline.md          十阶段流程（0–9）、reads、人工关卡、导演模式、审阅页和审阅台、subagent 并行
 │   ├── 02-verification.md      验证闭环与各引擎的取帧命令
 │   ├── 03-motion-design.md     缓动、时长、排版、安全区、转场
 │   ├── 04-audio.md             配音（双语）、字幕、配乐、音效、歌曲、混音
diff --git a/CHANGELOG.md b/CHANGELOG.md
index d6269b8..2d85b53 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,23 @@
 
 ## Unreleased
 
+**The review desk: tick, comment and submit in a page, and the agent carries on by itself (`bin/vh desk`)**
+- Why: reviewing a film's first gate through the static pages, the maintainer found the outline, captions and stages hard to read (some were raw `.md` links), had no way to tick or comment in place, had to reply in chat with codes like "1 S1", and got a new one-off page every time. A prototype desk fixed that, and after two real rounds in it: "返回还是要手动给你触发，我觉得可以加一个监控", the outline should be split by content, not by 起承转合, reuse needs a basic infrastructure, and the desk belongs to `studio`, in Chinese or English by the first request.
+- `tools/desk/` (stdlib Python, offline, no CDN, light and dark): `bin/vh desk <project> [--port N]` serves one project on 127.0.0.1 (the first free port of 8780–8799; a second start prints the running one's address). Ten views read fresh from the project's own files: this round (decisions with options, least sure, decided for you), concept and outline (a time bar by segment), captions or narration (grouped by segment, term chips, a rough reading speed), the storyboard synced to its video, sound (sections named from the gate JSON, listen prompts, timecoded notes), fact check, the film with timecoded notes (C key), the decision ledger, history, and every doc rendered as text. Any item can be marked ok / change / question with a line and a "change to"; a tray collects them and submits once.
+- A submission is checked (a real gate page, its decisions and options, sizes) and written as `out/review/feedback/<round>-<time>.md`, then into `REVIEW.md` verbatim as a dated, fenced section before the template's reference sections (CLAUDE.md asks for the human's words word for word), then the `.json`. `bin/vh desk wait <project> [--timeout s]` blocks until that file appears, prints it and exits 0 (3 on timeout), so an agent that armed it in the background is woken; the page shows whether one is waiting. `bin/vh desk feedback` prints the latest submission, `bin/vh desk data` what the desk read. Only requests addressed to the server's own host are answered, a submission needs the page's per-run token and JSON from the same origin, and `/p/` serves only ordinary files inside the project.
+- The data contract is written down in `tools/desk/README.md`: which BRIEF sections and tables (a new Outline table whose segment names say what happens, with an optional tag column for 起承转合), the SCRIPT caption or narration table with an optional 术语 column, the NOTES 素材清单 (an optional 上屏说法 column; struck rows are dropped), the DECISIONS ledger and its strikethrough for superseded entries, REVIEW's quotes, `shots.json`, the gate JSON plus three optional keys (`listen`, `music` with section labels, `film`), the feedback JSON, and English header equivalents. Whatever it can't parse is shown as formatted text with a warning, never hidden; older projects without the tables still show every document.
+- Language: a BRIEF Spec line `Review language: zh | en`, set from the user's first request (`bin/vh new … --lang en`, default zh); the desk's UI and `bin/vh review` (when the gate JSON has no `lang`) follow it, and the desk can switch. Captions and data stay in the project's language.
+- Effort: CLAUDE.md's effort table gets a 在哪审 row (quick: no gates; standard: the static page, the desk when wanted; studio: the desk, the watcher armed after each stop, chat as the fallback for agents without background wake-ups), and step 5, director mode, `playbook/01-pipeline.md` (a new 审阅台 section) and `bin/vh new`'s next-step line say the same. Templates: BRIEF (the Review language line, the Outline table), SCRIPT (the caption table and 术语), DECISIONS (strike through what a gate superseded), NOTES (上屏说法).
+- CI: the reader on two committed fixtures (`tools/desk/fixtures/zh`, `en`; `.gitignore` lets their `out/` in), a server on a free port (data with markup escaped, a 206 range, each refusal), a submission that wakes `desk wait` and lands in REVIEW.md, the timeout, `new --lang`, and `bin/vh review`'s language default. `bin/vh desk -h` is covered by the dispatcher's `-h` check.
+
+**Docs: what one film's gates taught**
+- Outlines are named by content or stage ("按下发送 / 信道编码与调制 / 基站接住"); 起承转合 is at most a small tag (`playbook/09-narrative.md` §3 and §9, `playbook/01-pipeline.md`'s director table, the BRIEF template).
+- A concept serves the focus the user named: a seventh check in `playbook/12-ideation.md` §5, and a plain, direct card among the 2–3 when the user names the focus (the "two constellations" pun was rejected as "太刻意").
+- Endings that lift the theme without a slogan: answer the hook's question again at a human level (`playbook/09-narrative.md` §3).
+- An optional 术语卡 for short explainers when the user wants real terms: a small label, then a plain-language caption; still no English abbreviations unless asked (`video-types/02-knowledge-short.md`).
+- Look-dev doesn't default to dark or night palettes; at least one light option (`playbook/03-motion-design.md` §0).
+- After a gate changes the concept, sweep DECISIONS and NOTES' 上屏说法 for stale lines and strike them through (`playbook/01-pipeline.md`, the DECISIONS and NOTES templates).
+
 **The installer downloads less: a shallow clone**
 - Why: after #51 a full clone is about 550 MB on disk (351 MB to download), 336 MB of it `.git`, because earlier versions of the sample films stay in the history (`showcase/04-intro-film/media/final.mp4` alone is 48 MB, and v3's media moved to `v3/`).
 - `install.sh` clones with `--depth 1 --single-branch`: about 215 MB to download and 420 MB on disk (measured 2026-10-04 at a881f4f). Re-running it on such a checkout fetches the newest commit with `--depth 1` and moves to it with `git reset --keep`, since there is nothing to fast-forward along: untracked and ignored files (`LOCAL.md`, `projects/`) and edits to files the update doesn't touch stay. Before fetching, it stops if the checkout has commits of your own or isn't on a branch that tracks the repo (a detached HEAD, a branch of your own). When the update would overwrite an edited file, or an untracked one that isn't ignored, it stops with a hint and puts `origin/main` back, so `git status` and the next run see the checkout as it was. A full clone (made by hand, or by an earlier installer) is still updated with `git pull --ff-only`, because a depth-1 fetch would make it shallow.
diff --git a/CLAUDE.md b/CLAUDE.md
index f7afa84..61fdad6 100644
--- a/CLAUDE.md
+++ b/CLAUDE.md
@@ -10,7 +10,7 @@
 2. **读流程和自查**：读 `playbook/01-pipeline.md` 和 `playbook/02-verification.md`；涉及配音或音乐时，再读 `playbook/04-audio.md`。
 3. **建项目**：运行 `bin/vh new <type> <slug>`，它会建好 `projects/<日期>-<slug>/`，复制模板，并把该类型的 prompt 块填进 BRIEF（类型的默认做法，立意定了再取舍）；手绘类还会复制引擎、装好依赖。其他引擎的初始化方式见 `engines/README.md`。
 4. **先想立意，再看案例和参考**：建完项目，先把材料里只属于它的数字、原话、物件列进 NOTES.md 的素材清单，自己想 5–8 个点子；这时先不看 BRIEF 末尾的 TYPE 块、`styles/`、`recipes/` 和案例，免得点子往看过的东西上靠。然后再看下面这些参考，用它们补强，收敛成 2–3 张立意卡（做法见 `playbook/12-ideation.md`，例子见 `cases/oneshot-five.md`）。人已经给了立意，就记进 BRIEF，不再出卡，最多附一个备选。参考：打开类型文档"可参考的案例"和"社区 skill 参考"两节列出的文件；需要看真实代码时读 `references/repos/` 里的源码。本仓库自己做过的片子在 `showcase/`，各带 BRIEF、STORYBOARD、NOTES 和源码，是最直接的样板。分镜时，镜头怎么动、全片节奏怎么排，先查 `recipes/`：按意图和能量筛（`bin/vh recipes list`），把选中的配方 id 写进 STORYBOARD 的"配方"列，写代码前读配方全文。
-5. **停下来给人审**：`standard` 和 `studio` 必过下面三道关卡，`quick` 不设关卡；人点名要亲自拍板的事，按"导演模式"另外停，`quick` 也一样。每次停默认做一页决定优先的审阅页（`bin/vh review` 生成本地 HTML，做法见 `playbook/01-pipeline.md` 的"审阅页"），聊天里只发要人定的事和页面路径；只有一两个纯文字的选择时，直接在聊天里问也行。然后**停下来等人回复**，不要自己往下做：
+5. **停下来给人审**：`standard` 和 `studio` 必过下面三道关卡，`quick` 不设关卡；人点名要亲自拍板的事，按"导演模式"另外停，`quick` 也一样。每次停默认做一页决定优先的审阅页（`bin/vh review` 生成本地 HTML，做法见 `playbook/01-pipeline.md` 的"审阅页"），聊天里只发要人定的事和页面路径；只有一两个纯文字的选择时，直接在聊天里问也行。`studio` 默认在审阅台停（`bin/vh desk`，同一份 gate JSON，人在页面里逐条勾选、点评、提交）：停之前在后台挂上 `bin/vh desk wait`，人一提交就接着做；没有后台唤醒的 agent 退回"人回聊天说一声"（`playbook/01-pipeline.md` 的"审阅台"）。审阅页和审阅台的界面语言按用户第一句话的语言定（BRIEF 的 `Review language`，`bin/vh new … --lang en`）。然后**停下来等人回复**，不要自己往下做：
    - ① **立意和大纲**：2–3 张彼此拉得开的立意卡，每张写明由它推出的画面（专属风格，或参考 `styles/` 的预设，可以几个）和钩子，配一帧画面（`playbook/12-ideation.md` 第 7 节）。选一张卡，立意、风格方向和钩子就一起定了，人可以在回复里换预设或钩子。再附按推荐立意写的 BRIEF、3–7 段大纲、引擎和费用。不要默认只给一种口味；
    - ② **分镜**：按大纲的段落拆页，每页 3–6 镜的关键帧，没把握的镜头标出来，逐镜默认通过。长片再附一版全长灰盒 animatic；
    - ③ **初版**：draft 成片加联系表，并写出你自己最不满意的 2–3 处。
@@ -35,6 +35,7 @@
 |---|---|---|---|
 | 适合 | 试方向、草稿、随手发 | 大多数正式视频 | 发布片、旗舰内容、会被反复看的片子 |
 | 人工关卡 | 0 道，直接出片。选 quick 就等于授权跳过关卡，把这一点记进 REVIEW.md；需求有歧义时最多问 1 个问题；人点名要拍板的事照样停（导演模式） | 3 道 | 3 道；关卡 ① 每张立意卡附一段 10–20 s 草图，关卡 ② 附全长 animatic |
+| 在哪审 | 不设关卡；导演模式要停的在聊天里问，或用静态审阅页 | 静态审阅页（`bin/vh review`）；人想逐条勾选、点评时开审阅台（`bin/vh desk`） | 审阅台（`bin/vh desk`）：人在页面里勾选、点评、提交；每次停后在后台挂上 `bin/vh desk wait`，提交就接着做；没有后台唤醒的 agent 退回"人回聊天说一声" |
 | 立意 | 自己想 3 个一句话点子，挑 1 个，写一行理由 | 关卡 ① 给 2–3 张立意卡，每张配一帧画面 | 同左，每张配一段 10–20 s 的草图（look-dev） |
 | 风格 | 从立意推出来，可以参考 `styles/` 的预设，写明借了什么 | 写在每张立意卡的"画面"一行（专属，或借一个预设）；选卡就一起定了，人可以在回复里换 | 同左；每张卡的草图就是那种风格的小样，借来的预设人想看时在 E0 补小样 |
 | 分镜 | 简表：镜头、时长、reads | 完整 STORYBOARD + 分镜预览图 | 同左 + animatic |
@@ -74,7 +75,7 @@ effort 管 agent 自己查得多细，导演模式管人拍板哪些事，两个
   - `review`：agent 出一个结果，放进下一页（没有下一页就随交付给），不为它单独停，人不说话就算通过；
   - `delegate`：agent 自己定，写进 `DECISIONS.md`，人随时能翻案。
 - **没点名的按档位**：`quick` 全部 `delegate`；`standard` 的 `concept` 是 `own`（风格和钩子写在立意卡上，选卡就一起定了；人单独点名 `style` 或 `hook` 时另问），`outline` 和 `storyboard` 是 `review`，其余 `delegate`；`studio` 同 `standard`，其余改成 `review`。
-- **每次停，默认做一页审阅页**，聊天里只发 `bin/vh review` 打印的几行；只有一两个纯文字的选择时，直接在聊天里问也行。一页默认最多 3 个决定，每个带推荐，上游的先问，其余默认通过；人想一次看更多也可以。人的原话逐字记进 `REVIEW.md`。人说不清哪里不对时，先做 look-dev：同一段 10–20 s，只改一个变量，出 2–3 个变体。
+- **每次停，默认做一页审阅页**，聊天里只发 `bin/vh review` 打印的几行；`studio` 再开审阅台（`bin/vh desk`），把它的地址一起发；只有一两个纯文字的选择时，直接在聊天里问也行。一页默认最多 3 个决定，每个带推荐，上游的先问，其余默认通过；人想一次看更多也可以。人的原话逐字记进 `REVIEW.md`。人说不清哪里不对时，先做 look-dev：同一段 10–20 s，只改一个变量，出 2–3 个变体。
 - **关卡是底线**：`standard` 和 `studio` 的关卡 ①②③ 照停，导演模式只加停、不减停；要全程不停，只能由用户本人说"不用审、直接出"。
 
 ## quick 路径卡
@@ -144,13 +145,13 @@ OpenVideoHarness/
 ├── install.sh                一键安装（克隆、依赖、参考仓库、注册 skill）
 ├── CONTRIBUTING.md           改本仓库本身时的分支、PR 和推送规则（人和 agent 都适用）
 ├── .github/                  CI（Linux + macOS 跑 tools/ci.sh）和 main 分支的规则集
-├── bin/vh                    命令行：doctor · setup · types · effort · new · style · recipes · hf-init · install-skill · sync-agents · tts · voices · captions · beats · music · sfx · mix · mux · qa · readcheck · storyboard · rhythm · cover-preview · sheet · check · gif · review
-├── tools/                    bin/vh 背后的脚本（audio/：tts、captions、beats、music、sfx、mix、qa；sheet.py、readcheck.py、review.py；给人拍板用的图：storyboard.py、rhythm.py、style_compare.py、cover_preview.py、audio/roll.py，共用 vhdraw.py）；ci.sh 是仓库自检
+├── bin/vh                    命令行：doctor · setup · types · effort · new · style · recipes · hf-init · install-skill · sync-agents · tts · voices · captions · beats · music · sfx · mix · mux · qa · readcheck · storyboard · rhythm · cover-preview · sheet · check · gif · review · desk
+├── tools/                    bin/vh 背后的脚本（audio/：tts、captions、beats、music、sfx、mix、qa；sheet.py、readcheck.py、review.py；desk/：审阅台的服务、读取约定和等待提交，约定写在 desk/README.md；给人拍板用的图：storyboard.py、rhythm.py、style_compare.py、cover_preview.py、audio/roll.py，共用 vhdraw.py）；ci.sh 是仓库自检
 ├── skills/open-video-harness/  轻量 skill：在任何目录把做视频的请求引到本仓库
 ├── video-types/              9 类视频（09 实验中）：工作流、审美、禁止项、prompt 增量块、自查重点、案例、社区 skill
 ├── playbook/                 跨类型的通用知识
 │   ├── 00-paradigm.md          范式与引擎选型
-│   ├── 01-pipeline.md          十阶段流程（0–9）、reads、人工关卡、导演模式和审阅页、subagent 并行
+│   ├── 01-pipeline.md          十阶段流程（0–9）、reads、人工关卡、导演模式、审阅页和审阅台、subagent 并行
 │   ├── 02-verification.md      验证闭环与各引擎的取帧命令
 │   ├── 03-motion-design.md     缓动、时长、排版、安全区、转场
 │   ├── 04-audio.md             配音（双语）、字幕、配乐、音效、歌曲、混音
diff --git a/README.md b/README.md
index 3c1fea4..c795e09 100644
--- a/README.md
+++ b/README.md
@@ -243,7 +243,7 @@ Just say "quick draft" or "make it studio quality" in your request, or start the
 
 ### You choose what you decide
 
-Effort sets how hard the agent checks its own work; director mode sets what you decide yourself. Each of twelve decisions (concept, spec, outline, script, style, hook, main character, theme music, storyboard, edit rhythm, voice, title and cover) can be yours to **own** (it shows you options and waits), yours to **review** (it shows you the result and carries on unless you object), or **delegated** (it decides and writes down why in `DECISIONS.md`). Every stop is, by default, a local page from `bin/vh review`: at most three decisions on the first screen, each with a recommendation and a one-line reply, then pictures, the animatic and music you can play in the browser. `standard` and `studio` still stop at the concept and outline, storyboard and first draft.
+Effort sets how hard the agent checks its own work; director mode sets what you decide yourself. Each of twelve decisions (concept, spec, outline, script, style, hook, main character, theme music, storyboard, edit rhythm, voice, title and cover) can be yours to **own** (it shows you options and waits), yours to **review** (it shows you the result and carries on unless you object), or **delegated** (it decides and writes down why in `DECISIONS.md`). Every stop is, by default, a local page from `bin/vh review`: at most three decisions on the first screen, each with a recommendation and a one-line reply, then pictures, the animatic and music you can play in the browser. At `studio` the stop is the review desk (`bin/vh desk`) instead: the outline, captions, storyboard, sound, facts and the draft each get a page, you mark any item ok, change or question, add a line, and submit; the agent is waiting in the background and carries on as soon as you do, with your words copied into `REVIEW.md`. Both pages come in English or Chinese, set from the language of your first request. `standard` and `studio` still stop at the concept and outline, storyboard and first draft.
 
 > **Deep involvement:** a 90 s explainer on how satellites avoid collisions, studio quality. I'll pick the hook, the main character, the theme melody, and the title and cover; decide the rest yourself.
 
@@ -309,7 +309,7 @@ More in [playbook/04-audio.md](playbook/04-audio.md).
 | Command | What it does |
 |---|---|
 | `doctor` / `setup` | Check your setup / install dependencies and fetch references |
-| `types` / `new <type> <name> [--style <style[,style]>] [--effort <level>] [--aspect 9:16] [--watch phone\|feed\|desktop] [--res 1080p\|4k]` | List the 9 types / start a new project (aspect, target screen and resolution can be set up front) |
+| `types` / `new <type> <name> [--style <style[,style]>] [--effort <level>] [--aspect 9:16] [--watch phone\|feed\|desktop] [--res 1080p\|4k] [--lang zh\|en]` | List the 9 types / start a new project (aspect, target screen, resolution and the review pages' language can be set up front) |
 | `effort [quick\|standard\|studio]` | What each effort level does |
 | `style list` / `style <style>` / `style gallery` / `style compare a,b,c` / `style apply <style> <project>` | Browse styles / render a sample / rebuild the overview / compare styles side by side / attach styles to a project as references |
 | `recipes list [--intent …] [--energy …] [--engine …]` / `recipes check` | Find shot recipes by what the shot must say and how loud it is / validate a recipe |
@@ -317,6 +317,7 @@ More in [playbook/04-audio.md](playbook/04-audio.md).
 | `mix` / `qa` / `mux` | Mix / check the mix / put sound and subtitles on the video |
 | `sheet` / `check` / `readcheck` / `gif` | Timestamped contact sheet / find black, frozen or silent stretches / is text on screen long enough to read / make a GIF for your README |
 | `review <project> [gate]` | The review page for a stop: the decisions first, then pictures, animatic and audio, one page per storyboard segment |
+| `desk <project>` / `desk wait <project>` | The review desk: a local page to tick, comment and submit each stop / wait for the submission (what the agent runs in the background) |
 | `storyboard` / `rhythm` / `cover-preview` | Pictures to decide from: labelled storyboard pages / a rhythm map (too-long shots and unreadable text in red) / a cover at real feed sizes |
 | `hf-init` / `install-skill` / `sync-agents` | Set up HyperFrames / register the skill / sync AGENTS.md |
 
diff --git a/README.zh-CN.md b/README.zh-CN.md
index 402918e..4909fec 100644
--- a/README.zh-CN.md
+++ b/README.zh-CN.md
@@ -243,7 +243,7 @@ bin/vh new promo launch-film --style cutout-jazz   # 挂上一种风格当参考
 
 ### 哪些事你来拍板
 
-努力程度管 agent 自己查多细，导演模式管哪些事由你拍板。立意、规格、大纲、旁白稿、风格、钩子、主角、主旋律、分镜、剪辑节奏、配音、标题和封面，这十二件事每件都可以设成 **own**（出几个选项，等你挑）、**review**（出一个结果给你看，你不说话就算通过）或 **delegate**（它自己定，理由写进 `DECISIONS.md`）。每次停下来，默认给你一个本地页面（`bin/vh review`）：第一屏最多三件要你定的事，每件带推荐和一句回复写法，下面是能在浏览器里直接看、直接听的图、animatic 和配乐。`standard` 和 `studio` 照样在立意和大纲、分镜、初版三处停。
+努力程度管 agent 自己查多细，导演模式管哪些事由你拍板。立意、规格、大纲、旁白稿、风格、钩子、主角、主旋律、分镜、剪辑节奏、配音、标题和封面，这十二件事每件都可以设成 **own**（出几个选项，等你挑）、**review**（出一个结果给你看，你不说话就算通过）或 **delegate**（它自己定，理由写进 `DECISIONS.md`）。每次停下来，默认给你一个本地页面（`bin/vh review`）：第一屏最多三件要你定的事，每件带推荐和一句回复写法，下面是能在浏览器里直接看、直接听的图、animatic 和配乐。`studio` 改在审阅台停（`bin/vh desk`）：大纲、字幕、分镜、声音、事实和小样各有一页，每一条都能点"可以 / 要改 / 疑问"、写一句，最后提交；agent 在后台等着，你一提交它就接着做，你的原话同时抄进 `REVIEW.md`。两种页面都有中文和英文，按你第一句话的语言定。`standard` 和 `studio` 照样在立意和大纲、分镜、初版三处停。
 
 > **深度参与**：做一支 90 秒的知识视频，讲卫星怎么避免相撞，要精品。钩子、主角、主旋律、标题和封面我来定，其余你定。
 
@@ -309,7 +309,7 @@ AI 听不见声音，所以声音这边尽量做成"可以计算、可以测量"
 | 命令 | 作用 |
 |---|---|
 | `doctor` / `setup` | 检查环境 / 安装依赖、拉取参考资料 |
-| `types` / `new <类型> <名字> [--style <风格[,风格]>] [--effort <档位>] [--aspect 9:16] [--watch phone\|feed\|desktop] [--res 1080p\|4k]` | 列出 9 类视频 / 建一个新项目（画幅、在哪块屏上看、分辨率可以一开始就定） |
+| `types` / `new <类型> <名字> [--style <风格[,风格]>] [--effort <档位>] [--aspect 9:16] [--watch phone\|feed\|desktop] [--res 1080p\|4k] [--lang zh\|en]` | 列出 9 类视频 / 建一个新项目（画幅、在哪块屏上看、分辨率、审阅页的语言可以一开始就定） |
 | `effort [quick\|standard\|studio]` | 看三档努力程度各做什么 |
 | `style list` / `style <风格>` / `style gallery` / `style compare a,b,c` / `style apply <风格> <项目>` | 看风格 / 渲一段样片 / 重建风格总览 / 几个风格并排对照 / 给项目挂参考风格 |
 | `recipes list [--intent …] [--energy …] [--engine …]` / `recipes check` | 按这一镜要说什么、多响来找镜头配方 / 校验一张配方 |
@@ -317,6 +317,7 @@ AI 听不见声音，所以声音这边尽量做成"可以计算、可以测量"
 | `mix` / `qa` / `mux` | 混音 / 混音质检 / 给成片合上声音和字幕 |
 | `sheet` / `check` / `readcheck` / `gif` | 带时间戳的联系表 / 查黑场、冻帧、静音 / 查字停得够不够久 / 做 README 用的 GIF |
 | `review <项目> [关卡]` | 生成审阅页：先列要你定的事，再放图、animatic 和音频，分镜一段一页 |
+| `desk <项目>` / `desk wait <项目>` | 审阅台：每次停在本地网页里勾选、点评、提交 / 等你提交（agent 在后台跑它） |
 | `storyboard` / `rhythm` / `cover-preview` | 拍板用的图：带标注的分镜页 / 节奏图（太长的镜头、读不完的字标红）/ 封面在各平台信息流里的实际大小 |
 | `hf-init` / `install-skill` / `sync-agents` | 初始化 HyperFrames / 注册 skill / 同步 AGENTS.md |
 
diff --git a/bin/vh b/bin/vh
index 5ded771..b686022 100755
--- a/bin/vh
+++ b/bin/vh
@@ -8,9 +8,10 @@
 #  make
 #   types                       list video types and their docs
 #   effort [quick|standard|studio]  how much iteration, review and polish each level means (CLAUDE.md "努力程度")
-#   new <type> <slug> [--style <preset[,preset]>] [--effort quick|standard|studio] [--aspect 16:9|9:16|1:1] [--watch phone|feed|desktop] [--res 1080p|4k] [--dir <folder>]
+#   new <type> <slug> [--style <preset[,preset]>] [--effort quick|standard|studio] [--aspect 16:9|9:16|1:1] [--watch phone|feed|desktop] [--res 1080p|4k] [--lang zh|en] [--dir <folder>]
 #                               create projects/<date>-<slug> from templates (+ engine: p5 for handdrawn/mv, HyperFrames for short/promo/data/meme);
-#                               --aspect: short/promo/data/meme only; --dir (or $OVH_PROJECTS): make it in <folder>/<date>-<slug> outside the harness
+#                               --aspect: short/promo/data/meme only; --lang: the review pages' language (default zh; set it from the user's first request);
+#                               --dir (or $OVH_PROJECTS): make it in <folder>/<date>-<slug> outside the harness
 #   style list | <preset> [--draft] | gallery [--mp4] | check <preset>   style library: list presets, render a 5 s swatch, build styles/gallery.jpg
 #                               (the swatch render's other options: styles/_swatch/render.sh -h)
 #   recipes list [--intent X --energy N --engine E …] | check [file…]   shot recipes (recipes/): filter by frontmatter, validate it
@@ -21,6 +22,10 @@
 #   style compare a,b,c [--frame t] | style apply <preset[,preset]> <project>   presets side by side (posters, or swatch frames at t) / attach presets to a project as references
 #   cover-preview <image> [more…] [--text-px N]   a cover at real feed sizes (Bilibili, Douyin, YouTube, Xiaohongshu) + a small-size legibility check
 #   review <project> [gate]     decision-first review page: out/review/gate-<gate>.json → gate-<gate>.html (+ index.html); prints the chat message (playbook/01-pipeline.md, 审阅页)
+#   desk <project> [--port N] | desk wait <project> [--timeout s] | desk feedback <project> [--round r] [--json] | desk data <project>
+#                               the review desk (studio's review surface, tools/desk/README.md): a local page on 127.0.0.1 where the reviewer
+#                               ticks, comments and submits; wait: block until they submit, print it, exit 0 (an agent runs it in the background);
+#                               feedback: the latest submission; data: what the desk reads from the project, as JSON
 #  sound
 #   tts <project> [provider] [voice] [zh|en] [instruct] [--beats map.json] [--align gemini] [--join block|all] [--resume]  voiceover from audio/script.txt
 #                               (中文 || English; [direction] per line; lines snap to beats; @speakers A=Kore B=Puck + "A: …" lines = a dialogue;
@@ -294,8 +299,8 @@ PY
 }
 
 cmd_new() {
-  [ $# -ge 2 ] || { echo "usage: bin/vh new <type> <slug> [--style <preset[,preset]>] [--effort quick|standard|studio] [--aspect 16:9|9:16|1:1] [--watch phone|feed|desktop] [--res 1080p|4k] [--dir <folder>]"; cmd_types; exit 1; }
-  local type=$1 slug=$2 doc style="" effort="" aspect="" res="" parent="" wh="" watch="" outres=""; doc=$(type_doc "$type") || { echo "unknown type: $type"; cmd_types; exit 1; }
+  [ $# -ge 2 ] || { echo "usage: bin/vh new <type> <slug> [--style <preset[,preset]>] [--effort quick|standard|studio] [--aspect 16:9|9:16|1:1] [--watch phone|feed|desktop] [--res 1080p|4k] [--lang zh|en] [--dir <folder>]"; cmd_types; exit 1; }
+  local type=$1 slug=$2 doc style="" effort="" aspect="" res="" parent="" wh="" watch="" outres="" lang=""; doc=$(type_doc "$type") || { echo "unknown type: $type"; cmd_types; exit 1; }
   shift 2
   while [ $# -gt 0 ]; do case "$1" in
     --style)  style=${2:?--style needs a preset or a comma list (bin/vh style list)}; shift 2 ;;
@@ -304,8 +309,10 @@ cmd_new() {
     --dir)    parent=${2:?--dir needs a folder: the project goes in <folder>/<date>-<slug>}; shift 2 ;;
     --watch)  watch=${2:?--watch needs phone, feed or desktop}; shift 2 ;;
     --res)    outres=${2:?--res needs 1080p or 4k}; shift 2 ;;
+    --lang)   lang=${2:?--lang needs zh or en}; shift 2 ;;
     *) echo "unknown option: $1"; exit 1 ;;
   esac; done
+  case "$lang" in ""|zh|en) ;; *) echo "unknown --lang: $lang (zh | en: the language of the review pages, from the user's first request)"; exit 1 ;; esac
   local s styles=""; if [ -n "$style" ]; then styles=$(parse_styles "$style") || { cmd_style list; exit 1; }; fi
   case "${effort:-standard}" in quick|standard|studio) ;; *) echo "unknown effort: $effort (quick | standard | studio)"; exit 1 ;; esac
   case "$watch" in ""|phone|feed|desktop) ;; *) echo "unknown --watch: $watch (phone: a vertical phone · feed: landscape in a phone feed, not rotated · desktop: a computer, or a phone turned sideways)"; exit 1 ;; esac
@@ -348,7 +355,7 @@ b = open(brief).read().replace("<!-- 在这里贴 video-types/*.md 的 \"Prompt
 open(brief, "w").write(b)
 PY
   [ -n "$wh" ] && sedi "s/^- Output: {W}x{H},/- Output: $wh,/" "$dir/BRIEF.md"
-  sedi "s/^- Watch on: {watch}/- Watch on: $watch/; s/^- Resolution: {res}/- Resolution: ${outres:-1080p}/" "$dir/BRIEF.md"
+  sedi "s/^- Watch on: {watch}/- Watch on: $watch/; s/^- Resolution: {res}/- Resolution: ${outres:-1080p}/; s/^- Review language: zh /- Review language: ${lang:-zh} /" "$dir/BRIEF.md"
   case "$type:$res" in short:portrait|promo:landscape|data:landscape|meme:landscape|*:) ;;   # the type's own frame: nothing to say
     *) printf '\n> **画幅 %s（%s，建项目时用 --aspect 选定）**：上面 TYPE 块写的画幅，以及按它算的尺寸（安全框、每行字数、字号），以这一行为准按新画幅重算。\n' "$aspect" "$wh" >> "$dir/BRIEF.md" ;;
   esac
@@ -379,9 +386,14 @@ PY
   echo "   watch on : $watch · ${outres:-1080p}  (text-size floor and readability check: playbook/03 §4)"
   [ -n "$styles" ] && echo "   style ref: $(printf '%s\n' $styles | sed 's|^|styles/|' | paste -sd, - | sed 's/,/, /g') (copies in style-refs/; references, not rules: note in DECISIONS.md what each lends)"
   echo "   effort   : ${effort:-standard}  (bin/vh effort ${effort:-standard} shows what that means)"
+  echo "   review in: ${lang:-zh}  (the review pages' language: --lang en for an English-speaking user)"
   echo "   next     : open Claude Code in the repo root and say what the video is about;"
-  if [ "${effort:-standard}" = quick ]; then echo "              the agent fills $(rel "$dir")/BRIEF.md and renders straight through; it stops only for what you say you'll decide."
-  else echo "              the agent fills $(rel "$dir")/BRIEF.md and STORYBOARD.md and stops for your review (concept and outline, storyboard, first draft)."; fi
+  case "${effort:-standard}" in
+    quick) echo "              the agent fills $(rel "$dir")/BRIEF.md and renders straight through; it stops only for what you say you'll decide." ;;
+    studio) echo "              the agent fills $(rel "$dir")/BRIEF.md and STORYBOARD.md and stops for your review (concept and outline, storyboard, first draft)"
+            echo "              in the review desk (bin/vh desk): tick, comment and submit in the page, and it carries on." ;;
+    *) echo "              the agent fills $(rel "$dir")/BRIEF.md and STORYBOARD.md and stops for your review (concept and outline, storyboard, first draft)." ;;
+  esac
 }
 
 cmd_effort() { # print the effort hub from CLAUDE.md; with a level, only that column of the table
@@ -413,6 +425,8 @@ cmd_rhythm() { [ $# -gt 0 ] || { echo "usage: bin/vh rhythm <project> [--segment
 cmd_cover_preview() { [ $# -gt 0 ] || { echo "usage: bin/vh cover-preview <image> [more…] [--text-px N] [--out file.png]"; exit 1; }
   uv run -q --no-project --with pillow --with numpy --with scipy python "$ROOT/tools/cover_preview.py" "$@"; }
 cmd_review() { python3 "$ROOT/tools/review.py" "$@"; }
+cmd_desk() { [ $# -gt 0 ] || { cmd_usage desk; exit 1; }   # stdlib only: no uv, works offline; exec, so stopping
+  exec python3 "$ROOT/tools/desk/desk.py" "$@"; }            # a backgrounded bin/vh desk stops the server itself
 
 swatch_deps() { # the swatch renderer's pinned HyperFrames (render.sh and determinism.sh do not install it themselves);
   # $1 = the slug or scene folder: a Blender scene (swatch.py and no swatch.js) does not need it
@@ -638,6 +652,7 @@ case "${1:-help}" in
   install-skill) shift; cmd_install_skill "$@" ;;
   recipes) shift; python3 "$ROOT/tools/recipes.py" "$@" ;;
   review) shift; cmd_review "$@" ;;
+  desk) shift; cmd_desk "$@" ;;
   new) shift; cmd_new "$@" ;; style) shift; cmd_style "$@" ;; readcheck) shift; cmd_readcheck "$@" ;;
   storyboard) shift; cmd_storyboard "$@" ;; rhythm) shift; cmd_rhythm "$@" ;; cover-preview) shift; cmd_cover_preview "$@" ;; effort) shift; cmd_effort "$@" ;; sync-agents) cmd_sync_agents ;; hf-init) shift; cmd_hf_init "$@" ;; sheet) shift; cmd_sheet "$@" ;; check) shift; cmd_check "$@" ;; gif) shift; cmd_gif "$@" ;;
   help|-h|--help) cmd_help ;;
diff --git a/playbook/01-pipeline.md b/playbook/01-pipeline.md
index 721b8b4..b1d8836 100644
--- a/playbook/01-pipeline.md
+++ b/playbook/01-pipeline.md
@@ -27,7 +27,7 @@ projects/2026-10-01-leo-doppler/
 ├── assets/           图片、字体、图标（记录来源和许可）
 ├── src/ 或 compositions/ 或 scenes/   场景代码（结构按引擎惯例）
 ├── out/check/        联系表、strip、crop
-├── out/review/       审阅页：gate-<n>.json → gate-<n>.html，最新一页也是 index.html（bin/vh review）
+├── out/review/       审阅页：gate-<n>.json → gate-<n>.html，最新一页也是 index.html（bin/vh review）；feedback/ 是审阅台收到的提交（bin/vh desk）
 └── out/final.mp4
 ```
 
@@ -49,13 +49,13 @@ projects/2026-10-01-leo-doppler/
 
 ## 三道人工关卡
 
-人的判断力最值钱的地方，是在改动还便宜的时候。`standard` 和 `studio` 在下面三处停下来；人还点名要亲自拍板的事，按 CLAUDE.md 的"导演模式"另外停。每次停默认做一页决定优先的审阅页（见下面的"审阅页"），聊天里只发要人定的事和页面路径：
+人的判断力最值钱的地方，是在改动还便宜的时候。`standard` 和 `studio` 在下面三处停下来；人还点名要亲自拍板的事，按 CLAUDE.md 的"导演模式"另外停。每次停默认做一页决定优先的审阅页（见下面的"审阅页"），聊天里只发要人定的事和页面路径；`studio` 默认在审阅台停，人在页面里勾选、点评、提交，agent 在后台等着接着做（见下面的"审阅台"）：
 
 1. **立意和大纲（关卡 ①）**：先定立意：2–3 张立意卡，每张写明推出的画面和钩子，配一帧画面，选一张卡就把风格方向和钩子一起定了（`12-ideation.md` 第 7 节）。再定给谁看、多长，加 3–7 段大纲。不确认就往下做，后面几乎所有工作都可能白做；立意定错的代价最大，因为风格、结构、主体都是从它推出来的。
 2. **分镜（关卡 ②）**：逐镜头的画面、reads 和转场，按大纲的段落拆页，每页 3–6 镜的关键帧，可以是草图或灰盒。人看图比读文字快得多。改分镜只要几分钟，改写好的代码要几小时。节奏要紧的片子（卡配乐、有旁白、长于约 30 秒），这一关再附一版 animatic，做法见下。
 3. **初版（关卡 ③）**：draft 成片加联系表。agent 要主动说出自己最不满意的 2–3 处，并给出可选的修法，比等人来挑更高效。
 
-每一关，人的原话都逐字记进 `REVIEW.md`；agent 自己定的事和理由记进 `DECISIONS.md`。只有用户明确说"不用审、直接出"才能跳过，做法见下面的"授权的无人值守模式"。跳过也不等于不写这些文件：BRIEF 和 STORYBOARD 仍然是后续自查的依据。
+每一关，人的原话都逐字记进 `REVIEW.md`；agent 自己定的事和理由记进 `DECISIONS.md`。关卡改了立意或大纲以后，顺手扫一遍 `DECISIONS.md` 和 `NOTES.md` 素材清单的"上屏说法"：作废的决定整行划掉、注明原因（`~~…~~（关卡 ① 后作废）`），不再用的素材也划掉，免得后面照着旧的做。只有用户明确说"不用审、直接出"才能跳过，做法见下面的"授权的无人值守模式"。跳过也不等于不写这些文件：BRIEF 和 STORYBOARD 仍然是后续自查的依据。
 
 ### 规格：一开始就定下，有默认值
 
@@ -81,7 +81,7 @@ projects/2026-10-01-leo-doppler/
 |---|---|---|---|---|---|
 | 关卡 ① | 阶段 1 | `concept` 立意 | 2–3 张彼此拉得开的立意卡：一句话装置、为什么是这份材料、主体、首尾、推出的画面和声音、风险；每张一帧画面，`studio` 每张一段 10–20 s 草图。见 `playbook/12-ideation.md` | 2–3 | 分镜后：很高，等于重做 |
 | | | `spec` 规格 | BRIEF 的 Spec 几行（画幅、分辨率、帧率、时长、在哪看），默认值见下面的"规格"；默认列在审阅页的"我替你定了"里，人点名 `spec=own` 时给 2 个方案（例如横屏 1080p 给电脑看，或者另出一个竖版进信息流） | 1–2 | 写场景后：中，换画幅要重排版式 |
-| | | `outline` 大纲 | 3–7 段，一段一句，加一条时长条；骨架和节拍见 `playbook/09-narrative.md` 的"骨架菜单"和"节拍表" | 1 | 分镜后：高 |
+| | | `outline` 大纲 | 3–7 段，一段一句，加一条时长条，写成 BRIEF 的 Outline 表；段名按内容或阶段起（"按下发送 / 信道编码与调制 / 基站接住"），起承转合这类结构标签最多是段名旁的小标签；骨架和节拍见 `playbook/09-narrative.md` 的"骨架菜单"和"节拍表" | 1 | 分镜后：高 |
 | | | `style` 风格 | 默认写在每张立意卡的"画面"一行，选卡就定了；人单独点名 `style=own` 时，选卡之后再出从选中立意推出的画面和 1–2 个可借的预设，在同一时刻的对照图；`studio` 每个候选再真渲一段本片内容的小样 | 2–3 | 写场景后：高 |
 | | | `hook` 钩子卡 | 默认写在每张立意卡的"钩子"一行，选卡就定了；人点名 `hook=own` 时，选定立意之后，要发平台的片子出 3 张不同类型的钩子卡，每张配 2 个草拟标题和 1 个封面版式；见 `playbook/10-hooks-and-packaging.md` 的"在关卡 ① 怎么用" | 3 | 低：只动开头一段 |
 | E0 样帧 | 阶段 2 | `character` 主角 / 主体 | 设定图（`templates/CHARACTER.md`） | 1–2 | 镜头画完后：高 |
@@ -143,12 +143,27 @@ projects/2026-10-01-leo-doppler/
 ```
 
 - **必填**：`summary`，一句话说这页要你定什么、看完要多久；`decisions`，没有要定的写 `[]`。每个决定要有 `question`、`recommend` 和 `reply`（不写 `reply` 就用选项名拼）。选项的 `id` 别用纯数字，免得和决定的编号混在一起；同一页的几个决定也别共用 `id`（一个用 A / B，另一个用 H1 / H2），人随手回一个"A"才不会有歧义。
-- **选填**：`why`、`cost`，选项的 `label` / `pro` / `con`；`decided` 和 `delegated`（都是列表，一项一条）、`not_reviewed`（一句话：这页不审什么）、`title`、`lang`（`zh` / `en`）、`gate`（和文件名不一致时以文件名为准）。
+- **选填**：`why`、`cost`，选项的 `label` / `pro` / `con`；`decided` 和 `delegated`（都是列表，一项一条）、`not_reviewed`（一句话：这页不审什么）、`title`、`lang`（`zh` / `en`；不写就用 BRIEF 的 `Review language`）、`gate`（和文件名不一致时以文件名为准）。审阅台还认 `listen`、`music`、`film` 三个可选字段（见下面的"审阅台"），这一页不管它们。
 - `assets[].for` 写决定或分段的 `id`，图就放在它下面，不写就放进"其他材料"；视频加 `t0` / `t1` 只播一段，加 `poster` 指定封面帧。附录的 `text` 可以放简单的竖线表格（`| a | b |`、`|---|---|`）。写了 `animatic`，每个分段页只播自己那一段，播到段尾就停。
 - `least_sure` 写镜头号，那一镜就标红；文字里出现的镜头号会链到那一镜。镜头的 `note` 写"默认会这样改"，照样默认通过，但单独标出来。
 - `include`：一个 JSON 文件（或几个的列表），路径相对项目，只补 gate JSON 没写的键，gate JSON 写了的优先；`bin/vh storyboard` 写的 `out/check/storyboard/review.json` 就是给它用的。
 - 路径只收项目里的文件和 http(s) 链接。缺推荐、缺文件、`for` 指向不存在的 `id` 时，页面照样生成，但退出码是 1，也不打印聊天消息：先改好。字段形状不对（该是列表的写成了字符串）时退出码是 2，什么都不写。
 
+### 审阅台：在页面里勾选、点评、提交
+
+静态审阅页只能看，回复还得回聊天里打"1 S1"。审阅台（`bin/vh desk`）是一个本地网页：同一份 gate JSON 之外，它把立意和大纲、字幕或旁白稿、分镜（跟着视频走）、声音、事实核对、小样的逐秒点评、决定账本和历史都排出来，每一条都能点"可以 / 要改 / 疑问"、写一句、写"改成"，最后一次提交。agent 在后台等着，人一提交就接着做，不用回聊天。
+
+- **什么时候用**：`studio` 默认用它；`standard` 默认还是静态审阅页，人想逐条点评时也可以开审阅台；`quick` 不设关卡，导演模式要停的那几处在聊天里问或用静态页。
+- **语言**：界面语言取 BRIEF 的 `Review language`（`zh` / `en`），按用户第一句话的语言定，建项目时用 `bin/vh new … --lang en`；页面右上角也能切换。字幕和项目文档照旧用项目自己的语言。
+- **每次停，agent 这样做**：
+  1. 写 `out/review/gate-<n>.json`，运行 `bin/vh review <project> <n>`：检查 JSON、生成静态页当备份、打印聊天消息；
+  2. 在后台运行 `bin/vh desk <project>` 起服务（只听 127.0.0.1；已经在跑就只打印地址）；
+  3. 在后台运行 `bin/vh desk wait <project>`，人一提交它就打印反馈、退出，agent 随之被唤醒。Claude Code 用后台命令，超时给到上限（`timeout` 7200000 ms，`wait` 默认等 7100 s）；服务也一样，超时被停掉了，下一次停时再起一遍；
+  4. 聊天里发 `bin/vh review` 打印的几行，加上审阅台的地址，然后停下；
+  5. 被唤醒后，读它打印的反馈（`bin/vh desk feedback <project>` 随时可以再看）。人的原话审阅台已经原样抄进了 `REVIEW.md` 的一节，agent 在那一节下补"定了 / 改了"；替人定的事照常记进 `DECISIONS.md`。没标的条目都算通过。
+- **没有后台唤醒的 agent**（或者 `wait` 超时了）：人提交后回聊天说一声"看审阅台"，agent 用 `bin/vh desk feedback <project>` 读。页面顶上会写 agent 这会儿有没有在等。服务没起来时，页面把回复复制到剪贴板，人直接贴进聊天。
+- **页面读什么**：项目文件本身，每次刷新重读，不另存状态。表格怎么写才排得出来（BRIEF 的 Outline 表、SCRIPT 的字幕或旁白表、NOTES 素材清单、DECISIONS 的划线约定、REVIEW、`shots.json`）、gate JSON 给审阅台加的 `listen`（请你听这几处）、`music`（音轨、节拍表、乐段的名字）、`film`（逐秒点评放哪支视频），以及提交的 JSON 格式，都在 `tools/desk/README.md`。读不出结构的文档不会消失：照原文排版显示在对应的页面和"文档"页里。
+
 ### animatic：打磨之前先定节奏
 
 animatic 是整片长度的灰盒预演，属于阶段 3，放进关卡 ② 的审阅页，不是一个新阶段。
diff --git a/playbook/03-motion-design.md b/playbook/03-motion-design.md
index 48a338a..b24fb19 100644
--- a/playbook/03-motion-design.md
+++ b/playbook/03-motion-design.md
@@ -15,6 +15,7 @@
 - 前 25% 把全部内容倒上屏，然后画面冻结；
 - 场景之间一律 crossfade；
 - 紫青渐变、玻璃拟态、Inter 字体、暗底光球；
+- 画面默认往深色、夜色上靠。提外观方案时至少放一个浅色的：一次关卡里人要"换个清新画风"，否掉的正是夜色方案；
 - 字号按网页尺寸来，太小；
 - 画面里满是标签、说明文字、写着剧情的牌子；
 - 所有元素一个速度、一个缓动、同时入场；
diff --git a/playbook/09-narrative.md b/playbook/09-narrative.md
index 09349e0..6ceed72 100644
--- a/playbook/09-narrative.md
+++ b/playbook/09-narrative.md
@@ -49,7 +49,7 @@
 2. 每拍写六件事：功能；观众此刻知道什么 → 变成知道什么；好奇缺口（0–5）；能量（0–5）；母题或主体的状态；转场出。
 3. 时间先按比例分，再用 reads 和旁白字数回算。放不下就合并节拍，不压缩 reads（`01`：放不下就加长镜头或删一条 read）。
 4. 旁白字数上限 = 窗口秒数 × 句内语速 × 0.85（留出句间停顿）。语速取 `04-audio.md` 的语速表：知识科普 4.5–5.5 字/秒，原理讲解 3.5–4.5 字/秒。下面模板 A 按 4.3、模板 B 按 4.0 估：都在原理讲解的范围里，对知识科普偏保守，宁可稿子短一点。
-5. 关卡 ① 的"3–7 段大纲"就是节拍表压缩后的样子：起、承、转、合各一句"观众看完会知道什么"。
+5. 关卡 ① 的"3–7 段大纲"就是节拍表压缩后的样子：每段一句"观众看完会知道什么"。段名按内容或阶段起（"按下发送""信道编码与调制""基站接住"），人一眼看得出这段讲什么；起承转合是自己检查结构用的，给人看时最多是段名旁的小标签（BRIEF 大纲表的"标签"列）。一位用户看过按起承转合命名的大纲后说："一般我们还是放内容划分段落阶段的"。
 
 **模板 A：90 s**（旁白驱动的讲解或知识片，约 320 字）【综合】
 
@@ -83,6 +83,7 @@
 起 = #0–1（约 16%），承 = #2–4（约 44%），转 = #5–6（约 20%），合 = #7–8（约 20%）。换挡在约 1/3 处（#3）和约 2/3 处（#5 → #6）。
 
 - **软回环**：结尾回扣开头的画面或句子，但带一处变化（`STORYBOARD.md` 对照检查里的"结尾与开头呼应"）。讲解类默认用它；首尾帧相同的硬回环怎么选，见 `video-types/02` 的"结尾"一条。
+- **升华，不喊口号**【综合】：人常要结尾"升华主题"，可口号式的升华（"科技让我们更近"）读起来刻意。一位用户的原话："升华也不好过于刻意，最好能吸引人让人共情"。一个做法：把钩子问的问题在结尾再答一遍，这次落到人身上。开头问"按下发送之后，这句话去了哪儿"，讲完技术，结尾让同一个人把一句话发给一个具体的人；画面和动作替你说，字幕少一点，那一层意思留给观众自己想到。
 - **张力曲线速记**：每拍两个数（缺口、能量），写在 STORYBOARD 的 Arc 一行，拍内的变化用箭头。模板 A 是 `缺口 3 3 3 4 5 5→1 1 1→2；能量 4 2 3 3 1 5 3 2`。先画曲线再填内容，分镜阶段就能看出"没有转"或"结尾太平"【综合】。
 - **reads 量级**：一个节拍的 reads 少于窗口秒数 ÷ 3 才放得下（经验值），多了就合并或删【综合】。画面文字的最少停留时间和字幕读速仍按 `03-motion-design.md` §2。
 
@@ -219,7 +220,7 @@ Chekhov's gun：第一幕挂在墙上的枪，后面必须响；反过来，没
 ## 9. 接进流程
 
 **三道关卡里，叙事这一层交什么**【综合】：
-- 关卡 ①：Spine 一句话；选的骨架和一句理由（第 1 节的表）；一行张力曲线，例如"缺口 3 → 4 → 5 → 1，转在 60%"；再加 3–7 段大纲。写明替人定了什么：驱动力、骨架、要不要软回环。
+- 关卡 ①：Spine 一句话；选的骨架和一句理由（第 1 节的表）；一行张力曲线，例如"缺口 3 → 4 → 5 → 1，转在 60%"；再加 3–7 段大纲，段名按内容起（第 3 节第 5 条）。写明替人定了什么：驱动力、骨架、要不要软回环。
 - 关卡 ②：节拍表（附录 A1 或 A2）加分镜和分镜预览图；长于约 30 s 或卡配乐时附 animatic；有配乐的，配乐的章节就按节拍表分，主题在哪个节拍第一次完整出现也在这时定（`11-composition.md` 第 1 节）；写出自己最没把握的 2 个节拍，通常是"转"和换挡。
 - 关卡 ③：静音看一遍成片，看得出起承转合吗？把联系表按节拍分行，逐拍核对"观众 前 → 后"有没有发生。
 
diff --git a/playbook/12-ideation.md b/playbook/12-ideation.md
index 9d39e24..73c09ce 100644
--- a/playbook/12-ideation.md
+++ b/playbook/12-ideation.md
@@ -81,7 +81,7 @@
 - 同类型的案例：类型文档"可参考的案例"一节、`cases/opus55-gallery.md` 第 3 节、`cases/oneshot-five.md`；
 - 风格预设（`bin/vh style list`）、镜头配方和全片骨架（`bin/vh recipes list`）。第 1 节表里的五个立意已经写成了全片骨架：`recipes/sequences/` 的 time-dilation-replay、machine-eye-portrait、making-of-self、mascot-style-tour、workflow-as-story。拿来用时，换掉的是材料，不是立意的检验：它还得对你的材料成立。
 
-然后收敛成 2–3 张**彼此拉得开**的立意卡，不是同一个点子的三个变体。至少一张不从风格预设出发。每张卡：
+然后收敛成 2–3 张**彼此拉得开**的立意卡，不是同一个点子的三个变体。至少一张不从风格预设出发；人点明了片子的重点时，再放一张平实、直接讲这个重点的卡（第 5 节第 7 条）。每张卡：
 
 ```text
 立意 A：{一句话装置}
@@ -105,6 +105,7 @@
 4. 用到了素材清单里只属于这份材料的东西吗？
 5. 看完以后，观众会跟别人转述哪一个画面或哪一句话？说不出来，就是还不够。
 6. 做得出来吗？在选定的引擎和档位的时间里能不能实现？不能，就写清楚降到什么版本。
+7. 它服务人说的重点吗？人点明了重点，立意就围着重点转；一个巧妙的装置要是把重点挤到一边，看的人只觉得刻意。例子：一支讲"手机消息怎么经过各个通信环节"的片子，立意卡用了"两个星座"（调制的星座图和卫星星座的双关），被否掉，原话是"太刻意 且没必要提这个技术点"；后来定下的是平实的"一句话的一生"，跟着那句话走完每个环节。
 
 ## 6. 立意和规则：底线不动，口味可以改
 
diff --git a/templates/BRIEF.md b/templates/BRIEF.md
index ec5dcb1..ceea687 100644
--- a/templates/BRIEF.md
+++ b/templates/BRIEF.md
@@ -8,6 +8,7 @@
 - Output: {W}x{H}, {fps} fps, exactly {N}s ({frames} frames)
 - Watch on: {watch}  <!-- 主要在哪看，定字号下限和可读性检查缩到多宽（playbook/03 §4）：phone 手机竖屏；feed 横屏片放在手机信息流里，竖着拿、不转屏；desktop 电脑，或手机转成横屏全屏。bin/vh new 按画幅填了默认值，人说了发在哪就照着改 -->
 - Resolution: {res}  <!-- 默认 1080p。4k：照常按 1080p 写合成和字号，出片时渲成 4K（HyperFrames `render --resolution 4k`，竖屏 `portrait-4k`，方形 `square-4k`，4:5 没有 4K 预设；Manim `-qk --fps 30`；Remotion `--scale=2`）；canvas、Three.js 要按像素密度开大，否则会糊（engines/README.md"出 4K"）；手绘引擎暂不支持 4K；draft 用 1080p，4K 成片裁一两帧看锐不锐 -->
+- Review language: zh  <!-- zh | en：审阅页和审阅台的界面语言，按用户第一句话的语言定（bin/vh new --lang）；字幕和项目文档照旧用项目自己的语言 -->
 - Engine: {HyperFrames | Remotion | Manim CE | ClaudeAnimationBase (p5.brush) | other}
 - Platform / audience: {where it plays, who watches, sound-on or muted}
 - Language: {zh-CN | en}, narration: {TTS voice | user recording | song | none}
@@ -21,6 +22,13 @@
 - What the viewer should know/feel at the end: {…}
 - Source material: {paper path / product URL / data.csv / song path / script}
 
+## Outline
+<!-- 关卡 ① 的 3–7 段大纲（playbook/09-narrative.md 第 3 节）。段名按内容或阶段起，看名字就知道这段讲什么，例如"按下发送 / 信道编码与调制 / 基站接住"；起承转合、幕这类结构标签最多写进"标签"列，可以不写。
+     审阅台按这张表画时间条（列名的约定见 tools/desk/README.md）；时间写"0–10 s"，有配乐时也可以加"小节"列。 -->
+| # | 段落 | 标签 | 时间 | 观众看完知道 / 感到 | 关键画面 |
+|---|---|---|---|---|---|
+| 1 | {按内容起的段名} | {可不写：起 / 承 / 转 / 合} | {0–10 s} | {…} | {…} |
+
 ## Style
 - Style refs (repo presets): {none}  <!-- styles/ 里拿来参考的预设，bin/vh new --style a,b 或 bin/vh style apply 会填；参考，不是规定：借了什么记进 DECISIONS.md，和它们不一样不用解释 -->
 - Refs (2–3 named works): {…}
diff --git a/templates/DECISIONS.md b/templates/DECISIONS.md
index 90d1c1c..bcfc3e5 100644
--- a/templates/DECISIONS.md
+++ b/templates/DECISIONS.md
@@ -23,7 +23,8 @@ Director: {照抄 BRIEF 的 Director 行；没写就写"按 {effort} 的默认"}
 
 ## agent 定的事
 
-<!-- 一条一行：日期 · 决定 · 定了什么 — 理由 — 翻案：改哪里、要花多少 -->
+<!-- 一条一行：日期 · 决定 · 定了什么 — 理由 — 翻案：改哪里、要花多少。
+     作废的不删：整行划掉，后面注明原因，改后的另起一条，例如 `- ~~2026-10-03 style · 夜色画面 — 理由：…~~（关卡 ① 后作废）`。审阅台把划掉的收进"已经作废的"。 -->
 - {YYYY-MM-DD} engine · {HyperFrames} — 理由：{…} — 翻案：{…}
 - {YYYY-MM-DD} 口味覆盖 · TASTE #14 段落之间经黑场淡出再淡入，各 0.6 s，不叠字；#18 一个画面停 6–15 s，旁白在走 — 理由：书信体的立意，段落之间是翻页，不是切换；写在关卡 ① 批过的立意卡 B 上 — 翻案：换回硬切或带承载物的转场，约 20 分钟（只动转场）
 - {YYYY-MM-DD} voice · {Qwen 女声 Serena，语速约 4.5 字/秒} — 理由：{…} — 翻案：重跑 `bin/vh tts`，约 5 分钟；每句的起止会变，要重新锁时（E3）
diff --git a/templates/NOTES.md b/templates/NOTES.md
index 27b6394..352f5ba 100644
--- a/templates/NOTES.md
+++ b/templates/NOTES.md
@@ -4,9 +4,10 @@
 
 ## 素材清单
 <!-- 想立意之前先列（playbook/12-ideation.md 第 2 节）：10–20 条只属于这份材料的东西。数字带单位和出处，原话照抄并注明出处和时间，还有物件、界面、矛盾和意外。私人材料要公开时，先把会上屏的原话、截图、人像列给本人确认。 -->
-| # | 素材 | 类别 | 出处 |
-|---|---|---|---|
-| 1 | {…} | {数字 / 原话 / 物件 / 矛盾 / 意外} | {文件、行号、链接、时间} |
+<!-- "上屏说法"可选：这条素材上屏时怎么说，审阅台的事实核对页把它和原文并排，给人查有没有简化到错。不再用的素材整格划掉（~~…~~），关卡改了立意以后顺手扫一遍这一列。 -->
+| # | 素材 | 类别 | 上屏说法 | 出处 |
+|---|---|---|---|---|
+| 1 | {…} | {数字 / 原话 / 物件 / 矛盾 / 意外} | {…} | {文件、行号、链接、时间} |
 
 ## 待核实的事实
 <!-- 拿不准的数字、引文、论文元数据写在这里，不要编进视频 -->
diff --git a/templates/SCRIPT.md b/templates/SCRIPT.md
index 9d6a07d..f830100 100644
--- a/templates/SCRIPT.md
+++ b/templates/SCRIPT.md
@@ -12,6 +12,9 @@
 |---|---|---|---|---|---|
 | {h1} | {钩子} | {两颗卫星，每秒 11.7 公里，撞了。} | {2.9} | {3.0} | {−0.1} |
 
+<!-- 没有旁白、靠字幕讲的片子，写字幕稿：| # | 段落 | 时间 | 术语 | 字幕 | 画面 | 素材 |。"段落"写 BRIEF 大纲的段名，"时间"写"0–3.2 s"（有配乐也可以写"小节"），"素材"写 NOTES 素材清单的编号（#2）。
+     "术语"列可选：人想保留真实的专业词时，写这一关的名字（"信道编码"），字幕用一句大白话解释它（video-types/02 的"术语卡"）。审阅台按这些列名读（tools/desk/README.md）。 -->
+
 ## 超了先砍什么
 
 - {哪几句可以删、可以并；哪一句必须留}
diff --git a/tools/ci.sh b/tools/ci.sh
index 226a19c..3c778c1 100755
--- a/tools/ci.sh
+++ b/tools/ci.sh
@@ -385,12 +385,142 @@ SH
   rm -rf "$t"
 }
 
+# the review desk (bin/vh desk, tools/desk/README.md): its reader on the committed fixtures (zh, and en with a NOTES.md
+# whose table is missing, which must come back as text), a server on a free port (the page, the data, a 206 range, and
+# what it refuses), a submission that wakes bin/vh desk wait and lands verbatim in REVIEW.md, the watcher's timeout,
+# bin/vh new --lang, and bin/vh review's language default
+desk_checks() {
+  local t pid wpid url i rc a
+  t=$(mktemp -d "${TMPDIR:-/tmp}/vh-ci.XXXXXX")
+  vh desk data tools/desk/fixtures/zh > "$t/zh.json" && vh desk data tools/desk/fixtures/en > "$t/en.json"
+  if python3 - "$t/zh.json" "$t/en.json" <<'PY'
+import json, sys
+zh, en = (json.load(open(p, encoding="utf-8")) for p in sys.argv[1:3])
+bad = []
+def want(cond, what):
+    if not cond: bad.append(what)
+o = zh["outline"]
+want(zh["lang"] == "zh" and zh["project"]["title"] == "一杯水的旅程" and zh["project"]["effort"] == "studio", "zh: lang, title, effort")
+want([x["title"] for x in o] == ["拧开水龙头", "水厂和管道", "落进杯子"] and [x["tag"] for x in o] == ["起", "承", "合"], "zh: outline titles and tags")
+want([(x["t0"], x["t1"]) for x in o] == [(0, 8), (8, 16), (16, 24)], "zh: outline times")
+c = {r["id"]: r for r in zh["captions"]["rows"]}
+want(zh["captions"]["kind"] == "caption" and len(c) == 5 and c["c03"]["term"] == "沉淀" and c["c03"]["seg"] == "2", "zh: captions, terms, segments")
+want((c["c05"]["t0"], c["c05"]["t1"]) == (16, 24) and c["c04"]["facts"] == ["#1"], "zh: bars → seconds past the beat map, fact refs")
+f = {x["id"]: x for x in zh["facts"]}
+want(f["#3"]["dropped"] and not f["#1"]["dropped"] and f["#1"]["onscreen"] and [x["done"] for x in zh["fact_todo"]] == [False, True], "zh: facts, struck rows, to-verify")
+a = zh["agent_decided"]
+want([x["superseded"] for x in a] == [False, True, False] and a[1]["note"] == "（关卡 ① 后作废）" and a[2]["group"] == "关卡 ① 之后", "zh: DECISIONS strikethrough and groups")
+h = zh["history"]
+want(len(h) == 1 and h[0]["quotes"][0]["text"].startswith("大纲按内容分段") and [n["k"] for n in h[0]["notes"]] == ["定了", "改了"], "zh: REVIEW history")
+r = zh["rounds"]
+want([x["id"] for x in r] == ["1"] and r[0]["data"]["listen"][0]["t"] == 7.5 and r[0]["data"]["least_sure"][1] == {"id": "", "note": "配乐会不会太甜"}, "zh: the gate page and its listen prompts")
+want([s["label"] for s in zh["music"]["sections"]] == ["拧开", "管道", "杯子"], "zh: music section labels from the gate JSON")
+want([s["seg"] for s in zh["shots"]["items"]] == ["1", "2", "3"], "zh: shots matched to the outline")
+sb = next((d for d in zh["docs"] if d["file"] == "STORYBOARD.md"), None)
+want(sb and sb["sections"][0]["title"] == "Shots" and "<li>S1" in sb["sections"][0]["html"] and not zh["warnings"], "zh: STORYBOARD.md (no table) as formatted text")
+want(en["lang"] == "en" and [x["title"] for x in en["outline"]][0] == "Open the tap" and en["outline"][0]["tag"] == "setup", "en: lang, outline from English headers")
+c = {r["id"]: r for r in en["captions"]["rows"]}
+want(en["captions"]["kind"] == "narration" and c["n3"]["seg"] == "3" and c["n2"]["term"] == "settling" and c["n1"]["t0"] == 0.5, "en: narration table")
+notes = next((d for d in en["docs"] if d["file"] == "NOTES.md"), {"sections": []})
+want(en["facts"] == [] and any("NOTES.md" in w for w in en["warnings"]) and any("water in city pipes" in s["html"] for s in notes["sections"]), "en: NOTES.md without its table comes back as text, with a warning")
+want(en["agent_decided"][1]["superseded"] and en["history"][0]["quotes"][0]["text"] == "Name the parts by what happens in them." and en["rounds"] == [], "en: DECISIONS, REVIEW, no gate page")
+if bad:
+    print("\n".join(bad))
+sys.exit(1 if bad else 0)
+PY
+  then ok "desk reads the zh and en fixtures (outline, captions and terms, bars, facts, ledger, history, gate extras), and a doc without its table as text"
+  else bad "desk reader on tools/desk/fixtures"; fi
+  # a server on a free port, on a copy (a submission writes into the project)
+  cp -R tools/desk/fixtures/zh "$t/p" && printf '<img src=x onerror=alert(1)>\n' >> "$t/p/STORYBOARD.md"
+  "$VH_BASH" "$ROOT/bin/vh" desk "$t/p" --port 0 > "$t/srv.log" 2>&1 & pid=$!   # bin/vh execs python: $! is the server
+  url=""; for i in $(seq 50); do url=$(sed -n 's#^desk: \(http://127\.0\.0\.1:[0-9]*/\).*#\1#p' "$t/srv.log"); [ -n "$url" ] && break; sleep 0.2; done
+  if [ -z "$url" ]; then bad "desk server did not start: $(head -3 "$t/srv.log")"; kill "$pid" 2>/dev/null; rm -rf "$t"; return; fi
+  cat > "$t/client.py" <<'PY'
+import http.client, json, sys, urllib.parse
+u = urllib.parse.urlsplit(sys.argv[1]); proj = sys.argv[2]; what = sys.argv[3]
+def req(method, path, body=None, headers=None):
+    c = http.client.HTTPConnection(u.hostname, u.port, timeout=10)
+    h = {"Host": f"127.0.0.1:{u.port}"}
+    h.update(headers or {})
+    c.request(method, path, body=body, headers=h)
+    r = c.getresponse(); data = r.read(); c.close()
+    return r.status, r.headers, data
+bad = []
+def want(cond, msg):
+    if not cond: bad.append(msg)
+s, _, page = req("GET", "/")
+token = page.decode().split('name="desk-token" content="')[1].split('"')[0]
+fb = lambda **k: json.dumps(dict({"round": "1", "lang": "zh", "decisions": {"look": "L2"}, "defaulted": [], "general": "",
+    "items": [{"target": "seg:1", "status": "change", "label": "大纲 第 1 段", "text": "开头再快一点 ``` 第 0 帧就要有水声"}]}, **k)).encode()
+H = {"Content-Type": "application/json", "X-Desk-Token": token}
+if what == "serve":
+    s, _, d = req("GET", "/api/data")
+    d = json.loads(d) if s == 200 else {}
+    sb = next((x for x in d.get("docs", []) if x["file"] == "STORYBOARD.md"), {"sections": [], "intro": ""})
+    html = sb["intro"] + "".join(x["html"] for x in sb["sections"])
+    want(s == 200 and d["project"]["slug"] == "p" and "&lt;img src=x" in html and "<img src=x" not in html, f"GET /api/data: {s}, markup in a doc escaped")
+    raw = open(proj + "/NOTES.md", "rb").read()
+    s, h, body = req("GET", "/p/NOTES.md", headers={"Range": "bytes=2-9"})
+    want(s == 206 and h["Content-Range"] == f"bytes 2-9/{len(raw)}" and body == raw[2:10], f"Range: {s} {h.get('Content-Range')}")
+    s, h, body = req("GET", "/p/NOTES.md")
+    want(s == 200 and body == raw and h["Accept-Ranges"] == "bytes", f"whole file: {s}")
+    for p in ("/p/%2e%2e/BRIEF.md", "/p/..%2f..%2fetc/passwd", "/p/out/review/.desk.json", "/p/nope.md", "/BRIEF.md"):
+        want(req("GET", p)[0] == 404, f"{p} served")
+    want(req("GET", "/api/data", headers={"Host": "evil.test"})[0] == 403, "another Host answered")
+    want(req("POST", "/api/feedback", fb(), {"Content-Type": "application/json"})[0] == 403, "a post without the token")
+    want(req("POST", "/api/feedback", fb(), dict(H, Origin="http://evil.test"))[0] == 403, "a post from another origin")
+    want(req("POST", "/api/feedback", fb(), dict(H, **{"Content-Type": "text/plain"}))[0] == 415, "a post that isn't JSON")
+    want(req("POST", "/api/feedback", fb(round="9"), H)[0] == 400, "a round with no gate page")
+    want(req("POST", "/api/feedback", fb(decisions={"look": "L9"}), H)[0] == 400, "an option the gate page doesn't have")
+    want(req("POST", "/api/feedback", fb(items=[{"target": "x", "status": "ok"}]), H)[0] == 400, "a bad target")
+    want(json.loads(req("GET", "/api/status")[2])["listening"] is False, "listening before the watcher")
+else:
+    want(json.loads(req("GET", "/api/status")[2])["listening"] is True, "the page doesn't see the watcher")
+    s, _, d = req("POST", "/api/feedback", fb(), H)
+    want(s == 200 and json.loads(d)["listening"] is True and json.loads(d)["saved"].startswith("out/review/feedback/1-"), f"submit: {s} {d[:200]}")
+print("\n".join(bad))
+sys.exit(1 if bad else 0)
+PY
+  if a=$(python3 "$t/client.py" "$url" "$t/p" serve); then ok "desk server: page, data with markup escaped, a 206 range; refuses other hosts, paths out of the project, hidden files, posts without the token, from another origin or not JSON, an unknown round, option or target"
+  else bad "desk server: $a"; fi
+  "$VH_BASH" "$ROOT/bin/vh" desk wait "$t/p" --timeout 30 > "$t/wait.out" 2>&1 & wpid=$!
+  for i in $(seq 50); do [ -f "$t/p/out/review/feedback/.listening" ] && break; sleep 0.2; done
+  a=$(python3 "$t/client.py" "$url" "$t/p" submit); rc=$?
+  wait "$wpid"; i=$?
+  if [ $rc = 0 ] && [ $i = 0 ] && grep -q '第 0 帧就要有水声' "$t/wait.out" && [ ! -e "$t/p/out/review/feedback/.listening" ] \
+    && python3 - "$t/p/REVIEW.md" <<'PY'
+import re, sys
+s = open(sys.argv[1], encoding="utf-8").read()
+m = re.search(r"^## 审阅台反馈 · 关卡 1 · .*?(?=^## )", s, re.M | re.S)
+sys.exit(0 if m and "开头再快一点 ``` 第 0 帧就要有水声" in m.group(0) and "\n````text\n" in m.group(0)
+         and s.index("## 审阅台反馈") < s.index("## 授权跳过怎么记") and "决定 look：L2" in m.group(0) else 1)
+PY
+  then ok "desk: a submission wakes bin/vh desk wait (exit 0) and goes into REVIEW.md verbatim, fenced, before the template's reference sections"
+  else bad "desk submit + wait: client '$a' rc $rc, wait rc $i: $(head -c 300 "$t/wait.out")"; fi
+  a=$(vh desk feedback "$t/p" --round 1) && case "$a" in *"第 0 帧就要有水声"*"json: "*) true ;; *) false ;; esac \
+    && vh desk feedback "$t/p" --json | python3 -c "import json, sys; d = json.load(sys.stdin); sys.exit(0 if d['decisions'] == {'look': 'L2'} and d['project'] == 'p' else 1)" \
+    && ok "desk feedback prints the latest submission (text and --json)" || bad "desk feedback: $a"
+  a=$(vh desk "$t/p" --port 0 2>&1); case "$a" in *"already serving p"*) ok "desk: a second start points to the running server" ;; *) bad "desk second start: $a" ;; esac
+  kill "$pid"; wait "$pid" 2>/dev/null
+  [ ! -e "$t/p/out/review/.desk.json" ] && ok "desk: stopping the server removes out/review/.desk.json" || bad "desk left .desk.json behind"
+  vh desk wait "$t/p" --timeout 1 > /dev/null 2>&1; rc=$?; [ $rc = 3 ] && ok "desk wait exits 3 on timeout" || bad "desk wait --timeout 1 exited $rc"
+  # the language: bin/vh new --lang writes the BRIEF line; bin/vh review takes it when the gate JSON has no lang
+  if OVH_PROJECTS="$t/new" vh new math ci-lang --lang en >/dev/null 2>&1 && grep -q '^- Review language: en ' "$t"/new/*-ci-lang/BRIEF.md \
+    && OVH_PROJECTS="$t/new" vh new math ci-zh >/dev/null 2>&1 && grep -q '^- Review language: zh ' "$t"/new/*-ci-zh/BRIEF.md; then
+    vh new math ci-x --lang fr >/dev/null 2>&1; rc=$?; [ $rc = 1 ] && ok "new --lang writes Review language (default zh) and rejects fr" || bad "new --lang fr exited $rc"
+  else bad "new --lang: Review language not written"; fi
+  cp -R tools/desk/fixtures/zh "$t/rz" && cp -R tools/desk/fixtures/zh "$t/re" && sed 's/^- Review language: zh /- Review language: en /' tools/desk/fixtures/zh/BRIEF.md > "$t/re/BRIEF.md"
+  if vh review "$t/rz" 1 >/dev/null 2>&1 && vh review "$t/re" 1 >/dev/null 2>&1 && grep -q '<html lang="zh-CN">' "$t/rz/out/review/gate-1.html" && grep -q '<html lang="en">' "$t/re/out/review/gate-1.html"
+  then ok "review: a gate JSON without lang takes the BRIEF's Review language, and the desk's extra keys pass"; else bad "review language from the BRIEF"; fi
+  rm -rf "$t"
+}
+
 case "${1:-all}" in
-  --smoke) smoke_checks; decision_checks ;;
+  --smoke) smoke_checks; decision_checks; desk_checks ;;
   --committed)   # exactly what a push would send: HEAD in a clean temporary checkout, uncommitted changes left out
     w="$(mktemp -d "${TMPDIR:-/tmp}/vh-ci.XXXXXX")/head"; git worktree add -q --detach "$w" HEAD || exit 2
     (cd "$w" && tools/ci.sh); rc=$?; git worktree remove --force "$w"; rmdir "$(dirname "$w")"; exit $rc ;;
-  all) static_checks; doc_checks; smoke_checks; decision_checks ;;
+  all) static_checks; doc_checks; smoke_checks; decision_checks; desk_checks ;;
   *) echo "usage: tools/ci.sh [--smoke | --committed]"; exit 2 ;;
 esac
 [ $fails = 0 ] && ok "all checks passed" || printf '\033[31m%s check(s) failed\033[0m\n' "$fails"
diff --git a/tools/desk/README.md b/tools/desk/README.md
new file mode 100644
index 0000000..5bc13b7
--- /dev/null
+++ b/tools/desk/README.md
@@ -0,0 +1,135 @@
+# 审阅台（bin/vh desk）
+
+审阅台是一个本地网页：人在页面里逐条勾选"可以 / 要改 / 疑问"、写一句、提交；agent 在后台等着，人一提交就接着做。它是 `studio` 档位默认的审阅界面，`standard` 想用也可以（什么时候用、agent 怎么挂等待，见 `playbook/01-pipeline.md` 的"审阅台"）。这一页讲它读什么、写什么，也就是项目文件要怎么写，审阅台才排得出来。
+
+**文件是唯一的事实来源。** 审阅台每次刷新都从项目文件重新读，自己不存状态；人的草稿只留在浏览器里，提交以后才落进项目。读不出结构的文档不会被藏起来：每份文档都在"文档"页原样排版，结构化的页面空着时，就地显示那份文档的原文，"文档"页顶上列出哪些没按约定读出来。
+
+## 命令
+
+```bash
+bin/vh desk <项目> [--port N]                  # 起服务，只听 127.0.0.1；默认 8780–8799 里第一个空闲端口；这个项目已经有一个在跑，就只打印它的地址
+bin/vh desk wait <项目> [--timeout 秒]          # 等人提交：打印反馈，退出码 0；超时退出码 3（默认 7100 s）
+bin/vh desk feedback <项目> [--round 1b] [--json]   # 打印最近一次提交
+bin/vh desk data <项目>                        # 审阅台从项目里读出了什么（JSON），排查"为什么这一页是空的"时用
+```
+
+只用 Python 标准库，不联网，页面不从 CDN 拉任何东西，浅色和深色都有，界面有中文和英文。
+
+## 读什么
+
+表格按表头的**开头几个字**认列（中英文都行，英文不分大小写），列的顺序随意，多出来的列不管。
+
+### BRIEF.md
+
+| 位置 | 读什么 | 英文项目 |
+|---|---|---|
+| 第一行 `# BRIEF：片名` | 片名 | `# BRIEF: title` |
+| `## Spec` 的 `- 键: 值` | 全部列出；`Effort`、`Review language`（`zh` / `en`，界面语言）、`Output`、`Watch on` 放在立意卡上 | 同左 |
+| `## Content` 的 `- 键: 值` | `Concept (one line)`、`Spine (one line)`、`Recurring motif`、`What the viewer should know/feel at the end`；`Specifics` 下面缩进的几条 | 同左 |
+| `## Outline`（或 `## 大纲`）里的表 | 每段一行，见下 | `## Outline` |
+
+大纲表的列：
+
+| 列（开头是） | 用途 | 英文 |
+|---|---|---|
+| `#` | 段号；不写就按顺序编 | `#` |
+| `段落` | **段名，按内容或阶段起**（"按下发送""信道编码与调制"） | `Segment` |
+| `标签` | 可选的小标签，起承转合、幕之类，显示在段名旁边的小框里 | `Tag` |
+| `环节` / `阶段` | 可选，这一段讲的环节 | `Stage` |
+| `时间` | `0–10 s`、`1:30–1:52`；时间条按它画 | `Time` |
+| `小节` | `4–7`；没有"时间"列时，用配乐的节拍表换成秒 | `Bars` |
+| `观众` | 观众看完知道 / 感到什么 | `Viewer`、`Takeaway` |
+| `关键画面` / `画面` | 关键画面 | `Key visual`、`Visual` |
+
+旧写法的段名"承 · 发出去"会拆成标签"承"和段名"发出去"。
+
+### SCRIPT.md
+
+第一张带 `字幕`（字幕稿）或 `旁白`（旁白稿）列的表。
+
+| 列（开头是） | 用途 | 英文 |
+|---|---|---|
+| `#` | 条目编号，点评按它记 | `#`、`ID` |
+| `段` / `段落` | 属于大纲哪一段：写段名或段号；对不上时按时间归段 | `Segment` |
+| `时间` 或 `小节` | 同大纲 | `Time`、`Bars` |
+| `术语` | 可选，术语卡上的词（`video-types/02` 的"术语卡"） | `Term` |
+| `字幕` / `旁白` | 正文；读速按"这一条占的时间"粗算 | `Caption`、`On-screen`、`Narration`、`VO` |
+| `画面` | 画面 | `Visual` |
+| `素材` | NOTES 素材清单的编号（`#2 #4`） | `Facts`、`Source` |
+
+### NOTES.md
+
+- `## 素材清单` 里的表：`#`、`素材`、`类别`、`上屏说法`（可选）、`出处`。不再用的素材整格划掉 `~~…~~`（老写法"（关卡 ① 后不用）……"也认），事实核对页把它淡化、不给点评。英文：`## Material`，列 `#`、`Item`、`Kind`、`On screen`、`Source`。
+- `## 待核实的事实` 里的 `- [ ]` / `- [x]`。英文：`## To verify`。
+
+### DECISIONS.md
+
+- 表头以 `决定` 开头的表：`决定`、`谁拍板`、`状态`、`在哪看`（导演模式的账本）。英文：`Decision`、`Who`、`Status`、`Where`。
+- `## agent 定的事` 下的每条 `- 日期 话题 · 定了什么 — 理由：… — 翻案：…`，中间可以有 `###` 小标题（显示成分组）。**作废的整行划掉**，后面写原因：`- ~~2026-10-03 style · 夜色画面 — 理由：…~~（关卡 ① 后作废）`，审阅台把它收进"已经作废的"，不再给"翻案"按钮。英文：`## Decided by the agent`，`— why: … — undo: …`。
+
+### REVIEW.md
+
+每个 `## ` 小节是一轮：`- 原话（说明）："……"` 是人的原话，`- 定了：…`、`- 改了：…`（同一行写 `定了：A　改了：B` 也行）是之后的处理。只有空占位的小节（模板里还没填的关卡 ②③）和模板最后两节参考文字不算历史。标题以"暂停"开头、又没写"恢复"的小节，让顶栏显示"暂停"。英文：`- Verbatim: "…"`、`- Decided: …`、`- Changed: …`，`Paused`。
+
+### shots.json
+
+和 `bin/vh storyboard` 同一份（格式见 `bin/vh storyboard -h`）：一个列表，或 `{"video", "note", "shots": [...]}`；每镜 `id`、`start`、`end`、`segment`、`label`、`reads`、`caption`、`transition`、`unsure`、`frame`。关键帧取 `frame`，没有就取 `bin/vh storyboard` 写的 `out/check/storyboard/frames/<id>.png`。分镜页播放的视频：`shots.json` 的 `video`，否则最新审阅页的 `animatic`，否则 `out/animatic.mp4`、`out/draft.mp4`。
+
+### out/review/gate-<n>.json
+
+和 `bin/vh review` 是同一份文件，字段见 `playbook/01-pipeline.md` 的"审阅页"（`include` 照样生效）。最新的一份（按修改时间）是"这一轮"。审阅台另外认几个可选字段，`bin/vh review` 不管它们：
+
+```json
+{
+  "listen": [{"t": 9.4, "note": "17 个字飞出手机：每个字一个八音盒的音"}],
+  "music": {"audio": "audio/film_mix.wav", "beats": "audio/film.beats.json", "roll": "audio/film.roll/overview.png",
+            "labels": {"type": "打字", "send": "发送"}},
+  "film": "out/review/open-F2.mp4"
+}
+```
+
+- `listen`：声音页的"请你听这几处"，`t` 是秒。
+- `music`：声音页播哪条音轨、读哪份节拍表、乐段在色块上叫什么（`labels` 把乐段的 `name` 换成人看得懂的名字）。不写时，读 `audio/` 里最新的 `*.beats.json`，音轨取同名的 `*_mix.wav`，没有再取 `*.wav`，谱面取同名的 `.roll/overview.png`。节拍表也用来把"小节"换成秒。
+- `film`：逐秒点评页放哪支视频；不写就用 `assets` 里第一支视频。时长从视频本身读。
+
+路径都相对项目目录；审阅台只给项目目录里的文件（不给隐藏文件，不出项目目录）。
+
+## 写什么
+
+提交后，服务按这个顺序写：
+
+1. `out/review/feedback/<轮>-<YYYYMMDD-HHMMSS>.md`：一条一行的文字版，人的话原样不动；
+2. `REVIEW.md`：插一节 `## 审阅台反馈 · 关卡 <轮> · <日期 时间>`，把上面的文字整段原样放进代码块，下面留一行"定了：　改了："给 agent 填；插在模板的"授权跳过怎么记"之前，没有这一节就接在文末；
+3. `out/review/feedback/<轮>-<YYYYMMDD-HHMMSS>.json`：最后写，原子替换。`bin/vh desk wait` 等的就是它。
+
+JSON 的格式：
+
+```json
+{
+  "round": "1c", "lang": "zh", "project": "2026-10-01-glass-of-water", "submitted_at": "2026-10-04T02:38:50",
+  "decisions": {"look": "F2"}, "defaulted": [],
+  "items": [
+    {"target": "seg:9", "status": "change", "label": "大纲 第 9 段 这一次", "text": "这个压根没有升华主题……"},
+    {"target": "cap:c11", "status": "change", "label": "字幕 c11", "text": "", "orig": "信号好，一次装 8 个；信号差，只装 2 个。", "suggest": "……"},
+    {"target": "time:12.4", "status": "ask", "label": "小样 0:12.4", "text": "这里看不清", "t": 12.4}
+  ],
+  "general": "大体可以"
+}
+```
+
+- `decisions`：这一页每个决定选了哪个选项；`defaulted` 列出人没动、按推荐算的。
+- `items[].status`：`ok` 可以、`change` 要改、`ask` 疑问。没标的条目都算通过。
+- `items[].target` 的前缀说明点评的是什么：`dec:` 决定、`least:` 没把握的、`deleg:` 替人定的（gate JSON `delegated` 的序号）、`concept:line` 立意、`seg:` 大纲段、`cap:` 字幕或旁白条、`shot:` 镜头、`fact:` 素材、`time:` 小样的某一秒、`atime:` 音轨的某一秒、`led:` DECISIONS 里 agent 定的事（序号）、`doc:<文件>#<小节>` 文档的某一节。
+- `suggest` 是人直接写的"改成"，`orig` 是原句。
+
+服务会检查：轮次对得上一份 `gate-<轮>.json`（还没有审阅页时用 `notes`），决定和选项都在那一页里，状态和 target 合法，单条文字不超过 4000 字、整份不超过 256 KiB。
+
+## 安全
+
+- 只绑定 127.0.0.1，只回答 Host 是自己的请求（挡住 DNS rebinding）。
+- 提交要带页面里那一次启动生成的令牌、JSON 格式，浏览器带了 Origin 时必须是同源；所以同一个浏览器里别的网页既读不到项目，也没法冒充人提交反馈。
+- `/p/` 只给项目目录里的普通文件：不出目录、不跟着符号链接出去、不给隐藏文件和 `*.env`。
+
+## 测试
+
+`tools/ci.sh` 用 `tools/desk/fixtures/` 里的两个小项目（中文、英文）测读取（包括读不出表格时退回原文），在空闲端口起一个服务测 `/api/data`、206 Range、提交到临时副本、REVIEW.md 的追加，测 `wait` 在有提交时退出 0，以及 `bin/vh desk -h`。
diff --git a/tools/desk/desk.py b/tools/desk/desk.py
new file mode 100644
index 0000000..564346e
--- /dev/null
+++ b/tools/desk/desk.py
@@ -0,0 +1,71 @@
+"""bin/vh desk: the review desk, a local page where the reviewer ticks, comments and submits each stop.
+
+  bin/vh desk <project> [--port N]              serve the desk (127.0.0.1; default: the first free port of 8780–8799;
+                                                --port 0: any free port). Already serving this project: print its URL.
+  bin/vh desk wait <project> [--timeout s]      block until the reviewer submits, print the feedback, exit 0 (3 on
+                                                timeout; default 7100 s). An agent runs it in the background after each
+                                                stop: its exit is the wake-up call.
+  bin/vh desk feedback <project> [--round r] [--json]   print the latest submission (exit 1 when there is none)
+  bin/vh desk data <project>                    print the data the desk shows, as JSON (what reader.py makes of the files)
+
+The desk reads the same out/review/gate-<n>.json as bin/vh review, plus the project's markdown (the contract is in
+tools/desk/README.md). A submission goes to out/review/feedback/<round>-<time>.json and .md, and its text into
+REVIEW.md as a dated section. <project> is a folder, or a name under $OVH_PROJECTS / projects/ (date prefix optional).
+"""
+import argparse, json, sys
+from pathlib import Path
+
+HERE = Path(__file__).resolve().parent
+sys.path.insert(0, str(HERE))
+sys.path.insert(0, str(HERE.parent))
+
+
+def find(arg):
+    from vhdraw import project_dir   # the lookup bin/vh new, storyboard and review use (no pillow needed)
+    try:
+        return project_dir(arg)
+    except SystemExit as e:
+        print(e, file=sys.stderr)
+        return None
+
+
+def main(argv):
+    sub = argv[0] if argv and argv[0] in ("wait", "feedback", "data") else "serve"
+    rest = argv[1:] if sub != "serve" else argv
+    ap = argparse.ArgumentParser(prog="bin/vh desk" + ("" if sub == "serve" else " " + sub),
+                                 description=__doc__.split("\n\n")[0], formatter_class=argparse.RawDescriptionHelpFormatter)
+    ap.add_argument("project", help="project folder, or its name under projects/")
+    if sub == "serve":
+        ap.add_argument("--port", type=int, help="port on 127.0.0.1 (default: the first free of 8780–8799; 0: any free)")
+    elif sub == "wait":
+        ap.add_argument("--timeout", type=float, default=7100, help="seconds to wait (default 7100, under Claude Code's 2 h)")
+    elif sub == "feedback":
+        ap.add_argument("--round", help="only this gate page (1, 2b, E3 …)")
+        ap.add_argument("--json", action="store_true", help="print the JSON record instead of the text")
+    a = ap.parse_args(rest)
+    project = find(a.project)
+    if not project:
+        return 2
+    if sub == "serve":
+        import server
+        return server.serve(project, a.port)
+    import feedback as F
+    if sub == "wait":
+        return F.wait(project, a.timeout)
+    if sub == "feedback":
+        path, rec = F.latest(project, a.round)
+        if not path:
+            print(f"no feedback{' for round ' + a.round if a.round else ''} in {project}/out/review/feedback/", file=sys.stderr)
+            return 1
+        if a.json:
+            print(json.dumps(rec, ensure_ascii=False, indent=1))
+        else:
+            F.show(path, rec)
+        return 0
+    import reader
+    print(json.dumps(reader.read_project(project), ensure_ascii=False, indent=1))
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(main(sys.argv[1:]))
diff --git a/tools/desk/feedback.py b/tools/desk/feedback.py
new file mode 100644
index 0000000..70832a3
--- /dev/null
+++ b/tools/desk/feedback.py
@@ -0,0 +1,253 @@
+"""Review desk, feedback: check a submission, save it, copy the reviewer's words into REVIEW.md, and wait for one.
+
+A submission is saved as out/review/feedback/<round>-<YYYYMMDD-HHMMSS>.json plus a .md copy an agent or a human
+reads; the same .md text goes into REVIEW.md verbatim, as a dated section (CLAUDE.md: the human's words are recorded
+word for word). The .json is written last, atomically: it is what the watcher (wait) waits for.
+"""
+import datetime, json, os, re, signal, sys, threading, time
+from pathlib import Path
+
+MAX_BODY = 256 * 1024
+MAX_ITEMS, MAX_DECISIONS = 400, 20
+LIMIT = {"text": 4000, "suggest": 2000, "orig": 2000, "label": 300, "general": 8000}
+STATUS = ("ok", "change", "ask")
+TARGET = re.compile(r"^(dec|least|deleg|concept|seg|cap|shot|fact|time|atime|led|doc|asset):[^\x00-\x1f]{1,180}$")
+ROUND = re.compile(r"^[A-Za-z0-9_-]{1,24}$")
+NO_ROUND = "notes"           # comments sent while no gate page is out
+REFERENCE = re.compile(r"^## (授权跳过怎么记|给人看的提示|How to record a waived gate|Notes for the reviewer)", re.M)
+WORDS = {
+    "zh": dict(title="# 审阅反馈 · {round} · {at}", decision="决定 {id}：{v}", default="（按推荐，没改）",
+               st={"ok": "可以", "change": "要改", "ask": "疑问"}, orig="（原句：{x}）", suggest="改成「{x}」",
+               general="整体意见：{x}", rest="其余未标注的条目默认通过。", colon="：",
+               head="## 审阅台反馈 · {round} · {at}", round_name="关卡 {r}", no_round="随手点评",
+               page="- 页面：审阅台（`bin/vh desk`）；反馈原件 `{json}`",
+               said="- 原话（审阅台里逐条写的，照抄）：", after="- 定了：　改了："),
+    "en": dict(title="# Review feedback · {round} · {at}", decision="Decision {id}: {v}", default=" (the recommendation, untouched)",
+               st={"ok": "ok", "change": "change", "ask": "question"}, orig=" (was: {x})", suggest="change to “{x}”",
+               general="Overall: {x}", rest="Everything not marked passes by default.", colon=": ",
+               head="## Review desk feedback · {round} · {at}", round_name="gate {r}", no_round="notes",
+               page="- Page: the review desk (`bin/vh desk`); the original `{json}`",
+               said="- Verbatim (written item by item in the desk):", after="- Decided:　Changed:"),
+}
+_lock = threading.Lock()
+
+
+def _text(x, key, where):
+    if x is None:
+        return ""
+    if not isinstance(x, str):
+        raise ValueError(f"{where}: expected text")
+    x = re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", x.replace("\r\n", "\n").replace("\r", "\n"))
+    if len(x) > LIMIT[key]:
+        raise ValueError(f"{where}: longer than {LIMIT[key]} characters")
+    return x
+
+
+def gate_options(project, rid):
+    """{decision id: [option ids]} of out/review/gate-<rid>.json; None when there is no such page."""
+    p = Path(project) / "out" / "review" / f"gate-{rid}.json"
+    try:
+        d = json.loads(p.read_text(encoding="utf-8-sig"))
+    except (OSError, ValueError):
+        return None
+    out = {}
+    for x in (d.get("decisions") or []) if isinstance(d, dict) else []:
+        if isinstance(x, dict) and isinstance(x.get("id"), str):
+            out[x["id"]] = [o.get("id") if isinstance(o, dict) else str(o) for o in x.get("options") or []]
+    return out
+
+
+def validate(project, fb):
+    """A submission from the desk → the clean record to save. Raises ValueError with what is wrong."""
+    if not isinstance(fb, dict):
+        raise ValueError("expected a JSON object")
+    rid = fb.get("round")
+    if not isinstance(rid, str) or not ROUND.match(rid):
+        raise ValueError("round: a gate page id like 1, 2b or E3")
+    opts = gate_options(project, rid)
+    if opts is None and rid != NO_ROUND:
+        raise ValueError(f"round {rid}: there is no out/review/gate-{rid}.json")
+    decisions, defaulted = {}, []
+    dec = fb.get("decisions") or {}
+    if not isinstance(dec, dict) or len(dec) > MAX_DECISIONS:
+        raise ValueError("decisions: an object of at most 20 {id: option}")
+    for k, v in dec.items():
+        if not isinstance(v, str) or k not in (opts or {}) or (opts[k] and v not in opts[k]):
+            raise ValueError(f"decisions: {k!r} → {v!r} is not a decision and option of gate-{rid}.json")
+        decisions[k] = v
+    for k in fb.get("defaulted") or []:
+        if isinstance(k, str) and k in decisions:
+            defaulted.append(k)
+    items = fb.get("items") or []
+    if not isinstance(items, list) or len(items) > MAX_ITEMS:
+        raise ValueError(f"items: a list of at most {MAX_ITEMS}")
+    clean = []
+    for i, it in enumerate(items):
+        w = f"items[{i}]"
+        if not isinstance(it, dict):
+            raise ValueError(f"{w}: expected an object")
+        tgt, st = it.get("target"), it.get("status")
+        if not isinstance(tgt, str) or not TARGET.match(tgt):
+            raise ValueError(f"{w}.target: like cap:c04, shot:S03, time:12.4, doc:BRIEF.md#Spec")
+        if st not in STATUS:
+            raise ValueError(f"{w}.status: ok, change or ask")
+        c = {"target": tgt, "status": st, "label": _text(it.get("label"), "label", w + ".label") or tgt,
+             "text": _text(it.get("text"), "text", w + ".text")}
+        for k in ("suggest", "orig"):
+            if it.get(k):
+                c[k] = _text(it[k], k, f"{w}.{k}")
+        t = it.get("t")
+        if t is not None:
+            if not isinstance(t, (int, float)) or isinstance(t, bool) or not 0 <= t < 1e6:
+                raise ValueError(f"{w}.t: seconds")
+            c["t"] = round(float(t), 2)
+        clean.append(c)
+    lang = fb.get("lang") if fb.get("lang") in WORDS else "zh"
+    return {"round": rid, "lang": lang, "decisions": decisions, "defaulted": defaulted, "items": clean,
+            "general": _text(fb.get("general"), "general", "general").strip()}
+
+
+def to_markdown(fb):
+    """The .md copy: what the reviewer marked and wrote, one line each, their words untouched."""
+    w = WORDS[fb.get("lang") if fb.get("lang") in WORDS else "zh"]
+    lines = [w["title"].format(round=fb["round"], at=fb.get("submitted_at", "")), ""]
+    for k, v in fb["decisions"].items():
+        lines.append("- " + w["decision"].format(id=k, v=v) + (w["default"] if k in fb.get("defaulted", []) else ""))
+    for it in fb["items"]:
+        line = f"- {it['label']} [{it['target']}] · {w['st'][it['status']]}"
+        if it.get("orig") and it["target"].startswith("cap:"):
+            line += w["orig"].format(x=it["orig"])
+        if it.get("text"):
+            line += w["colon"] + it["text"].strip()
+        if it.get("suggest") and it.get("suggest") != it.get("orig"):
+            line += (" → " if it.get("text") else w["colon"]) + w["suggest"].format(x=it["suggest"])
+        lines.append(line.replace("\n", "\n  "))
+    if fb.get("general"):
+        lines += ["", w["general"].format(x=fb["general"])]
+    lines += ["", w["rest"]]
+    return "\n".join(lines) + "\n"
+
+
+def _write(p, text):
+    tmp = p.with_name(p.name + ".part")
+    tmp.write_text(text, encoding="utf-8")
+    os.replace(tmp, p)
+
+
+def append_review(project, fb, md, json_rel):
+    """Copy the submission into REVIEW.md as a dated section, before the template's reference sections
+    (授权跳过怎么记 / 给人看的提示) when they are there, else at the end. The agent adds 定了 / 改了 under it."""
+    w = WORDS[fb.get("lang") if fb.get("lang") in WORDS else "zh"]
+    p = Path(project) / "REVIEW.md"
+    old = p.read_text(encoding="utf-8") if p.exists() else ("# REVIEW：人的原话\n" if fb.get("lang") != "en" else "# REVIEW: the human's words\n")
+    run = max([len(x) for x in re.findall(r"`+", md)] + [2])
+    fence = "`" * (run + 1)
+    rname = w["no_round"] if fb["round"] == NO_ROUND else w["round_name"].format(r=fb["round"])
+    at = fb.get("submitted_at", "").replace("T", " ")[:16]
+    block = "\n".join([w["head"].format(round=rname, at=at), "", w["page"].format(json=json_rel), w["said"], "",
+                       fence + "text", md.rstrip("\n"), fence, "", w["after"], "", ""])
+    m = REFERENCE.search(old)
+    new = old[:m.start()] + block + old[m.start():] if m else old.rstrip("\n") + "\n\n" + block
+    _write(p, new)
+
+
+def save(project, fb, now=None):
+    """Save a validated submission: the .md, then REVIEW.md, then the .json (the watcher's trigger). → the .json path."""
+    project = Path(project)
+    now = now or datetime.datetime.now()
+    fb = dict(fb, project=project.name, submitted_at=now.isoformat(timespec="seconds"))
+    out = project / "out" / "review" / "feedback"
+    with _lock:
+        out.mkdir(parents=True, exist_ok=True)
+        stem, n = f"{fb['round']}-{now:%Y%m%d-%H%M%S}", 1
+        while (out / f"{stem}.json").exists() or (out / f"{stem}.md").exists():
+            n += 1
+            stem = f"{fb['round']}-{now:%Y%m%d-%H%M%S}-{n}"
+        md = to_markdown(fb)
+        _write(out / f"{stem}.md", md)
+        rel = f"out/review/feedback/{stem}.json"
+        append_review(project, fb, md, rel)
+        _write(out / f"{stem}.json", json.dumps(fb, ensure_ascii=False, indent=1) + "\n")
+    return out / f"{stem}.json"
+
+
+def listening(project):
+    """Is an agent waiting for this project's feedback (bin/vh desk wait running)? {listening, since, until}."""
+    flag = Path(project) / "out" / "review" / "feedback" / ".listening"
+    try:
+        info = json.loads(flag.read_text())
+        os.kill(int(info["pid"]), 0)
+    except PermissionError:   # alive, someone else's process
+        pass
+    except (OSError, ValueError, KeyError, TypeError):
+        return {"listening": False}
+    if float(info.get("until") or 0) < time.time():
+        return {"listening": False}
+    return {"listening": True, "since": info.get("since"), "until": info.get("until")}
+
+
+def latest(project, rid=None):
+    """The newest submission (for one round when rid is given): (json path, record) or (None, None)."""
+    fdir = Path(project) / "out" / "review" / "feedback"
+    best = (None, None, "")
+    for f in fdir.glob("*.json") if fdir.is_dir() else []:
+        try:
+            j = json.loads(f.read_text(encoding="utf-8"))
+        except (OSError, ValueError):
+            continue
+        if not isinstance(j, dict) or (rid and j.get("round") != rid):
+            continue
+        key = f"{j.get('submitted_at', '')}|{f.name}"
+        if key > best[2]:
+            best = (f, j, key)
+    return best[0], best[1]
+
+
+def show(path, record, out=sys.stdout):
+    md = path.with_suffix(".md")
+    try:
+        text = md.read_text(encoding="utf-8")
+    except OSError:
+        text = to_markdown(record)
+    out.write(text if text.endswith("\n") else text + "\n")
+    out.write(f"json: {path}\n")
+    out.flush()
+
+
+def wait(project, timeout, poll=1.0, out=sys.stdout):
+    """Block until a new feedback file appears, print it, return 0; 3 on timeout. Keeps feedback/.listening
+    ({pid, since, until}) while waiting, so the desk can say an agent is waiting; files already there are ignored."""
+    fdir = Path(project) / "out" / "review" / "feedback"
+    fdir.mkdir(parents=True, exist_ok=True)
+    flag, start = fdir / ".listening", time.time()
+    seen = {p.name for p in fdir.glob("*.json")}
+    _write(flag, json.dumps({"pid": os.getpid(), "since": start, "until": start + timeout}))
+
+    def done(code):
+        try:
+            if json.loads(flag.read_text()).get("pid") == os.getpid():
+                flag.unlink()
+        except (OSError, ValueError):
+            pass
+        return code
+
+    def stop(signum, _frame):
+        raise SystemExit(done(128 + signum))
+    for s in (signal.SIGTERM, signal.SIGINT, signal.SIGHUP):
+        signal.signal(s, stop)
+    while time.time() - start < timeout:
+        new = sorted(p for p in fdir.glob("*.json") if p.name not in seen)
+        if new:
+            for p in new:
+                try:
+                    show(p, json.loads(p.read_text(encoding="utf-8")), out)
+                except (OSError, ValueError):
+                    continue
+            out.write("The reviewer's words are also in REVIEW.md (a dated section): add what you decided and changed "
+                      "under it. Items not marked pass by default.\n")
+            out.flush()
+            return done(0)
+        time.sleep(poll)
+    out.write(f"no feedback within {timeout:.0f} s; arm it again: bin/vh desk wait {project}\n")
+    out.flush()
+    return done(3)
diff --git a/tools/desk/fixtures/en/BRIEF.md b/tools/desk/fixtures/en/BRIEF.md
new file mode 100644
index 0000000..9fdd2b3
--- /dev/null
+++ b/tools/desk/fixtures/en/BRIEF.md
@@ -0,0 +1,24 @@
+# BRIEF: The trip of a glass of water
+
+<!-- A test project for the review desk (tools/ci.sh): English headers, a narration table, no material table in
+     NOTES.md (so that doc comes back as formatted text), no review page yet. The content is made up. -->
+
+## Spec
+- Effort: standard
+- Review language: en
+- Output: 1920x1080, 30 fps, exactly 24s (720 frames)
+- Watch on: desktop
+
+## Content
+- Concept (one line): Follow one drop from the tap into the glass.
+- Spine (one line): Someone is thirsty and opens the tap; the water was cleaned at a plant, carried by pipes, and lands in a glass.
+- Recurring motif: the drop.
+- What the viewer should know/feel at the end: a glass of water has a few steps behind it.
+
+## Outline
+
+| # | Segment | Tag | Stage | Time | Viewer takeaway | Key visual |
+|---|---|---|---|---|---|---|
+| 1 | Open the tap | setup | use | 0–8 s | someone is thirsty | the tap, close up |
+| 2 | The plant and the pipes | | settle · carry | 8–16 s | water is cleaned, then carried | a settling tank, a pipe in section |
+| 3 | Into the glass | payoff | — | 16–24 s | a glass of water has steps behind it | the drop lands |
diff --git a/tools/desk/fixtures/en/DECISIONS.md b/tools/desk/fixtures/en/DECISIONS.md
new file mode 100644
index 0000000..7d3646e
--- /dev/null
+++ b/tools/desk/fixtures/en/DECISIONS.md
@@ -0,0 +1,10 @@
+# DECISIONS: who decides, what was decided, why
+
+| Decision | Who | Status | Where |
+|---|---|---|---|
+| concept | own | decided (gate 1) | REVIEW.md gate 1 |
+
+## Decided by the agent
+
+- 2026-10-01 engine · HyperFrames — why: a test — undo: low
+- ~~2026-10-01 style · a night palette — why: a test — undo: low~~ (superseded after gate 1)
diff --git a/tools/desk/fixtures/en/NOTES.md b/tools/desk/fixtures/en/NOTES.md
new file mode 100644
index 0000000..6f26e33
--- /dev/null
+++ b/tools/desk/fixtures/en/NOTES.md
@@ -0,0 +1,11 @@
+# NOTES
+
+## Material
+
+Not a table yet, so the desk shows this as written:
+
+- water in city pipes moves at about 1 m/s (source: an example, for the test)
+- a glass holds about 250 mL
+
+## To verify
+- [ ] the flow speed — source: to find
diff --git a/tools/desk/fixtures/en/REVIEW.md b/tools/desk/fixtures/en/REVIEW.md
new file mode 100644
index 0000000..f7ad8a5
--- /dev/null
+++ b/tools/desk/fixtures/en/REVIEW.md
@@ -0,0 +1,6 @@
+# REVIEW: the human's words
+
+## Gate 1 concept and outline
+- Page: `out/review/gate-1.html` (2026-10-02)
+- Verbatim: "Name the parts by what happens in them."
+- Decided: three parts named by content
diff --git a/tools/desk/fixtures/en/SCRIPT.md b/tools/desk/fixtures/en/SCRIPT.md
new file mode 100644
index 0000000..de85f5c
--- /dev/null
+++ b/tools/desk/fixtures/en/SCRIPT.md
@@ -0,0 +1,7 @@
+# SCRIPT: narration
+
+| # | Segment | Time | Term | Narration | Visual | Facts |
+|---|---|---|---|---|---|---|
+| n1 | Open the tap | 0.5–3.5 s | | Thirsty? Open the tap. | the tap | |
+| n2 | The plant and the pipes | 8.5–12 s | settling | First the plant lets the grit sink. | a settling tank | |
+| n3 | 3 | 16.5–21 s | | And then it lands: about a quarter of a litre. | the glass | #2 |
diff --git a/tools/desk/fixtures/zh/BRIEF.md b/tools/desk/fixtures/zh/BRIEF.md
new file mode 100644
index 0000000..5785aff
--- /dev/null
+++ b/tools/desk/fixtures/zh/BRIEF.md
@@ -0,0 +1,32 @@
+# BRIEF：一杯水的旅程
+
+<!-- 审阅台的测试项目（tools/ci.sh 用它）。内容是编的，只为了覆盖读取约定里的每一种写法。 -->
+
+## Spec
+- Effort: studio  <!-- 测试用 -->
+- Director: default
+- Output: 1920x1080, 30 fps, exactly 24s (720 frames)
+- Watch on: desktop
+- Resolution: 1080p
+- Review language: zh  <!-- zh | en -->
+- Engine: HyperFrames
+
+## Content
+- Concept (one line): 跟着一滴水，从水龙头走进杯子。
+- Specifics（出处见 NOTES.md 素材清单）:
+  - 管道里每秒走一米左右（#1）
+  - 一杯水大约 250 毫升（#2）
+- Spine (one line): 有人口渴，拧开水龙头；水先在水厂被处理，再沿管道送来，最后落进杯子。
+- Recurring motif: 那一滴水。
+- What the viewer should know/feel at the end: 知道一杯水背后有几个环节。
+
+## Outline（按内容分段；起承转合只写在"标签"列）
+
+| # | 段落 | 标签 | 环节 | 时间 | 观众看完知道 / 感到 | 关键画面 |
+|---|---|---|---|---|---|---|
+| 1 | 拧开水龙头 | 起 | 用水 | 0–8 s | 有人口渴，**一杯水**从哪儿来？ | 水龙头特写 |
+| 2 | 水厂和管道 | 承 | 沉淀 · 输送 | 8–16 s | 水先被处理，再送进管道 | 沉淀池、管道剖面 |
+| 3 | 落进杯子 | 合 | — | 16–24 s | 一杯水背后有好几个环节 | 水滴落进杯子 |
+
+## Style
+- Palette: bg #F4F8F6, fg #23405A, ONE accent #1F9E8F
diff --git a/tools/desk/fixtures/zh/DECISIONS.md b/tools/desk/fixtures/zh/DECISIONS.md
new file mode 100644
index 0000000..0d39a5a
--- /dev/null
+++ b/tools/desk/fixtures/zh/DECISIONS.md
@@ -0,0 +1,17 @@
+# DECISIONS：谁拍板，定了什么，为什么
+
+Director: 按 studio 的默认
+
+| 决定 | 谁拍板 | 状态 | 在哪看 |
+|---|---|---|---|
+| concept 立意 | own | 已定（关卡 ①） | REVIEW.md 关卡 ① |
+| style 风格 | review | 待关卡 ① 过目 | `out/review/gate-1.json` |
+
+## agent 定的事
+
+- 2026-10-01 engine · HyperFrames — 理由：测试用 — 翻案：低
+- ~~2026-10-01 style · 夜色画面 — 理由：测试用 — 翻案：低~~（关卡 ① 后作废）
+
+### 关卡 ① 之后
+
+- 2026-10-02 style · 浅色清新的画面 — 理由：人要清新 — 翻案：改常量，低
diff --git a/tools/desk/fixtures/zh/NOTES.md b/tools/desk/fixtures/zh/NOTES.md
new file mode 100644
index 0000000..0b51d11
--- /dev/null
+++ b/tools/desk/fixtures/zh/NOTES.md
@@ -0,0 +1,13 @@
+# NOTES
+
+## 素材清单
+
+| # | 素材 | 类别 | 上屏说法 | 出处 |
+|---|---|---|---|---|
+| 1 | 城市供水管道的流速约 0.5–1.5 m/s | 数字 | "每秒走一米左右" | 示例出处（测试用） |
+| 2 | 一杯水约 250 mL | 数字 | "大约 250 毫升" | 示例出处（测试用） |
+| 3 | ~~水龙头每分钟出水约 6 升~~（关卡 ① 后不用） | 数字 | | 示例出处（测试用） |
+
+## 待核实的事实
+- [ ] #1 流速区间 — 来源：待查 — 状态：待查
+- [x] #2 一杯水的容量 — 状态：已核实
diff --git a/tools/desk/fixtures/zh/REVIEW.md b/tools/desk/fixtures/zh/REVIEW.md
new file mode 100644
index 0000000..7722476
--- /dev/null
+++ b/tools/desk/fixtures/zh/REVIEW.md
@@ -0,0 +1,23 @@
+# REVIEW：人的原话
+
+## 关卡 ① 立意和大纲
+- 页面：`out/review/gate-1.html`（2026-10-02）
+- 原话："大纲按内容分段就好，别拿起承转合当段名。"
+- 定了：大纲按内容分三段　改了：段名
+
+## 关卡 ② 分镜
+- 页面：
+- 原话：
+- 定了：　改了：
+
+## 授权跳过怎么记
+
+只有用户本人在对话里明确说不用审，才能跳过。
+
+```text
+- 用户授权跳过（YYYY-MM-DD）。原话："……"（逐字照抄，不转述）
+```
+
+## 给人看的提示
+
+最有效的意见带镜头号或时间点，再加原因。
diff --git a/tools/desk/fixtures/zh/SCRIPT.md b/tools/desk/fixtures/zh/SCRIPT.md
new file mode 100644
index 0000000..6da06b6
--- /dev/null
+++ b/tools/desk/fixtures/zh/SCRIPT.md
@@ -0,0 +1,11 @@
+# SCRIPT：字幕稿
+
+<!-- 无旁白：这里是屏幕字幕。时间按小节写，审阅台用 audio/music.beats.json 换成秒（120 BPM，一小节 2 s）。 -->
+
+| # | 段落 | 小节 | 术语 | 字幕 | 画面 | 素材 |
+|---|---|---|---|---|---|---|
+| c01 | 拧开水龙头 | 1–2 | | 口渴了，拧开水龙头。 | 水龙头特写 | |
+| c02 | 拧开水龙头 | 3–4 | | 这一杯水，是从哪儿来的？ | 水流 | |
+| c03 | 水厂和管道 | 5–6 | 沉淀 | 先在水厂里，让泥沙慢慢沉下去。 | 沉淀池 | |
+| c04 | 水厂和管道 | 7–8 | 输送 | 再沿着管道，每秒走一米左右。 | 管道剖面 | #1 |
+| c05 | 落进杯子 | 9–12 | | 最后落进杯子：一杯，大约 250 毫升。 | 杯子 | #2 |
diff --git a/tools/desk/fixtures/zh/STORYBOARD.md b/tools/desk/fixtures/zh/STORYBOARD.md
new file mode 100644
index 0000000..a9bcc0b
--- /dev/null
+++ b/tools/desk/fixtures/zh/STORYBOARD.md
@@ -0,0 +1,8 @@
+# STORYBOARD
+
+三镜，开头 8 秒是水龙头。这一页没有镜头表，审阅台照原文排版显示。
+
+## Shots
+- S1 水龙头，0–8 s
+- S2 管道，8–16 s
+- S3 杯子，16–24 s
diff --git a/tools/desk/fixtures/zh/audio/music.beats.json b/tools/desk/fixtures/zh/audio/music.beats.json
new file mode 100644
index 0000000..a43c8a7
--- /dev/null
+++ b/tools/desk/fixtures/zh/audio/music.beats.json
@@ -0,0 +1,6 @@
+{"bpm": 120, "offset": 0.0, "beats": [0.0, 0.5, 1.0, 1.5, 2.0, 2.5, 3.0, 3.5, 4.0, 4.5, 5.0, 5.5],
+ "downbeats": [0.0, 2.0, 4.0, 6.0, 8.0, 10.0],
+ "sections": [{"name": "tap", "start": 0.0, "end": 8.0, "bars": 4}, {"name": "pipes", "start": 8.0, "end": 16.0, "bars": 4},
+              {"name": "glass", "start": 16.0, "end": 24.0, "bars": 4}],
+ "hits": [{"t": 8.0, "what": "drop:drop"}, {"t": 16.0, "what": "pour:pour"}],
+ "duration": 24.0}
diff --git a/tools/desk/fixtures/zh/out/review/gate-1.json b/tools/desk/fixtures/zh/out/review/gate-1.json
new file mode 100644
index 0000000..1f45ebe
--- /dev/null
+++ b/tools/desk/fixtures/zh/out/review/gate-1.json
@@ -0,0 +1,20 @@
+{
+ "title": "一杯水的旅程 · 关卡 ①",
+ "summary": "测试用的审阅页：只有 1 件要定",
+ "decisions": [
+  {"id": "look", "question": "用哪种画面？",
+   "options": [{"id": "L1", "label": "浅色清新", "pro": "人要清新", "con": "偏凉"},
+               {"id": "L2", "label": "纸面手绘", "pro": "暖", "con": "和管道的硬线条不搭"}],
+   "recommend": "L1", "why": "人说要清新", "cost": "现在改：低", "reply": "L1 / L2"}
+ ],
+ "decided": ["大纲按内容分三段"],
+ "delegated": ["档位 studio", "横屏 1080p、30 fps"],
+ "least_sure": [{"id": "S2", "note": "管道剖面会不会太像课件"}, "配乐会不会太甜"],
+ "listen": [{"t": 7.5, "note": "水滴落下前的停顿"}],
+ "music": {"beats": "audio/music.beats.json", "labels": {"tap": "拧开", "pipes": "管道", "glass": "杯子"}},
+ "not_reviewed": "不审分镜",
+ "appendix": [
+  {"title": "大纲（表）", "text": "| 段 | 时间 |\n|---|---|\n| 拧开水龙头 | 0–8 s |"},
+  {"title": "字幕稿", "path": "SCRIPT.md"}
+ ]
+}
diff --git a/tools/desk/fixtures/zh/shots.json b/tools/desk/fixtures/zh/shots.json
new file mode 100644
index 0000000..51dd393
--- /dev/null
+++ b/tools/desk/fixtures/zh/shots.json
@@ -0,0 +1,8 @@
+{
+ "note": "测试用的三镜",
+ "shots": [
+  {"id": "S1", "segment": "拧开水龙头", "start": 0, "end": 8, "label": "水龙头", "reads": ["有人口渴", "拧开水龙头"], "caption": "口渴了，拧开水龙头。"},
+  {"id": "S2", "segment": "水厂和管道", "start": 8, "end": 16, "label": "管道", "reads": "水在管道里走", "unsure": "管道剖面会不会太像课件"},
+  {"id": "S3", "segment": "合 · 落进杯子", "start": 16, "end": 24, "label": "杯子", "reads": ["水滴落进杯子"], "transition": "硬切"}
+ ]
+}
diff --git a/tools/desk/reader.py b/tools/desk/reader.py
new file mode 100644
index 0000000..89bd417
--- /dev/null
+++ b/tools/desk/reader.py
@@ -0,0 +1,653 @@
+"""Review desk, core: read one project folder into the desk's data (one JSON object).
+
+The project's markdown and JSON stay the only source of truth: this module reads them and writes nothing. What it
+reads is the contract in tools/desk/README.md (BRIEF Spec / Content / Outline, SCRIPT's caption or narration table,
+NOTES 素材清单, DECISIONS, REVIEW, shots.json, out/review/gate-*.json, the score's beat map, out/review/feedback/).
+What it cannot parse is not lost: every project doc also comes back as safe HTML (render_md), and the desk shows that
+wherever a structured view would be empty, with a warning that says what was not found.
+
+Paths in the output are relative to the project; the desk serves them under /p/.
+"""
+import html, json, os, re, sys
+from pathlib import Path
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+import review as R   # noqa: E402  (tools/review.py: merge_includes, review_lang, the gate names)
+
+DOCS = ["BRIEF.md", "STORYBOARD.md", "SCRIPT.md", "STYLE.md", "NOTES.md", "DECISIONS.md", "REVIEW.md",
+        "LESSONS.md", "PACKAGING.md", "CHARACTER.md"]
+MAX_DOC = 1_000_000          # bytes; a bigger doc is listed but not read
+MAX_FEEDBACK = 200           # newest feedback files read
+MAX_TICKS = 1500             # music hits drawn on the sound bar
+STAGE_OF_GATE = {"1": 1, "E0": 2, "E1": 3, "2": 3, "E2": 4, "E3": 4, "E4": 6, "3": 8, "E5": 8}
+REFERENCE_SECTIONS = re.compile(r"^(授权跳过怎么记|给人看的提示|How to record a waived gate|Notes for the reviewer)")
+
+
+# ---------- markdown: comments, sections, tables, bullets ----------
+
+def strip_comments(text):
+    return re.sub(r"<!--.*?-->", "", text, flags=re.S)
+
+
+def _fence(line, fence):
+    """(fence still open, this line is inside or opens/closes a fence)"""
+    s = line.strip()
+    if fence:
+        if s and set(s) == {fence[0]} and len(s) >= len(fence):
+            return None, True
+        return fence, True
+    m = re.match(r"(`{3,}|~{3,})", s)
+    return (m.group(1), True) if m else (None, False)
+
+
+def sections(text, level=2):
+    """[(title, body)] of the level-2 ('## ') sections, fences respected; text before the first one has title ''."""
+    out, title, buf, fence, mark = [], "", [], None, "#" * level + " "
+    for line in text.split("\n"):
+        fence, inside = _fence(line, fence)
+        if not inside and line.startswith(mark):
+            out.append((title, "\n".join(buf)))
+            title, buf = line[len(mark):].strip(), []
+        else:
+            buf.append(line)
+    out.append((title, "\n".join(buf)))
+    return out
+
+
+def section(text, *patterns):
+    """The body of the first '## ' section whose title matches one of the regexes (case-insensitive), else ''."""
+    for title, body in sections(text)[1:]:
+        if any(re.search(p, title, re.I) for p in patterns):
+            return body
+    return ""
+
+
+SEP = re.compile(r"^\s*\|?\s*:?-{2,}:?\s*(\|\s*:?-{2,}:?\s*)*\|?\s*$")
+
+
+def cells(line):
+    s = line.strip()
+    s = s[1:] if s.startswith("|") else s
+    s = s[:-1] if s.endswith("|") and not s.endswith("\\|") else s
+    return [c.strip().replace("\\|", "|") for c in re.split(r"(?<!\\)\|", s)]
+
+
+class Table:
+    def __init__(self, head, rows):
+        self.head, self.rows = head, rows
+
+    def col(self, *keys):
+        """Index of the first header that starts with one of the keys (case-insensitive), else None."""
+        for k in keys:
+            for i, h in enumerate(self.head):
+                if h.lower().startswith(k.lower()):
+                    return i
+        return None
+
+    def has(self, *keys):
+        return self.col(*keys) is not None
+
+    def get(self, row, *keys):
+        i = self.col(*keys)
+        return row[i] if i is not None and i < len(row) else ""
+
+
+def tables(text):
+    """Every pipe table in text, fences respected."""
+    lines, out, i, fence = text.split("\n"), [], 0, None
+    while i < len(lines):
+        fence, inside = _fence(lines[i], fence)
+        if not inside and lines[i].strip().startswith("|") and i + 1 < len(lines) and SEP.match(lines[i + 1]):
+            head, rows, j = cells(lines[i]), [], i + 2
+            while j < len(lines) and lines[j].strip().startswith("|"):
+                rows.append(cells(lines[j]))
+                j += 1
+            out.append(Table(head, rows))
+            i = j
+            continue
+        i += 1
+    return out
+
+
+def first_table(text, *keys):
+    """The first table with a column for one of the keys."""
+    return next((t for t in tables(text) if t.has(*keys)), None)
+
+
+def bullets(text):
+    """Top-level '- Key: value' bullets, each with the indented '- …' bullets under it: [(key, value, [sub])]."""
+    out = []
+    for line in text.split("\n"):
+        m = re.match(r"^- ([^:：\n]+?)[:：][ \t]*(.*)$", line)
+        if m:
+            out.append((m.group(1).strip(), m.group(2).strip(), []))
+            continue
+        m = re.match(r"^\s{2,}[-*] (.+)$", line)
+        if m and out:
+            out[-1][2].append(m.group(1).strip())
+    return out
+
+
+def plain(s):
+    """A cell or bullet as plain text: no **, no backticks, no surrounding space."""
+    return re.sub(r"\*\*(.+?)\*\*", r"\1", (s or "")).replace("`", "").strip()
+
+
+def struck(s):
+    """(text, struck through?, the note after it): '~~a~~（关卡 ① 后作废）' → ('a', True, '（关卡 ① 后作废）')."""
+    m = re.match(r"^\s*~~(.+?)~~\s*(.*)$", s or "", re.S)
+    return (m.group(1).strip(), True, m.group(2).strip()) if m else ((s or "").strip(), False, "")
+
+
+# ---------- times ----------
+
+_N = r"(\d+(?::\d+(?:\.\d+)?)?(?:\.\d+)?)"
+
+
+def _secs(x):
+    if ":" in x:
+        m, s = x.split(":", 1)
+        return int(m) * 60 + float(s)
+    return float(x)
+
+
+def span(s):
+    """'0–10 s', '1:30–1:52', '12.5 s' → (t0, t1); no time → (None, None); one time → (t, None)."""
+    s = (s or "").replace("—", "–")
+    m = re.search(_N + r"\s*(?:s|秒)?\s*(?:[–~～至到-]|to)\s*" + _N, s)
+    if m:
+        return _secs(m.group(1)), _secs(m.group(2))
+    m = re.search(_N, s)
+    return (_secs(m.group(1)), None) if m else (None, None)
+
+
+def bar_clock(beats):
+    """bar k (1-based) → its start in seconds, from a beat map's downbeats (the last bar's length carries on past
+    them); a map with only a bpm counts 4/4 bars. None without a beat map."""
+    db = [float(x) for x in beats.get("downbeats") or [] if isinstance(x, (int, float))]
+    bpm = beats.get("bpm")
+    bar_s = db[-1] - db[-2] if len(db) >= 2 else (240.0 / float(bpm) if isinstance(bpm, (int, float)) and bpm > 0 else None)
+    if not bar_s:
+        return None
+
+    def start(k):
+        if db and k <= len(db):
+            return db[k - 1]
+        return (db[-1] + (k - len(db)) * bar_s) if db else (k - 1) * bar_s
+    return start
+
+
+def bar_span(cell, start):
+    """'4–7' (bars) → (start of bar 4, end of bar 7) with a bar clock, else (None, None)."""
+    n = [int(x) for x in re.findall(r"\d+", cell or "")]
+    if not n or not start:
+        return None, None
+    return round(start(n[0]), 3), round(start(n[-1] + 1), 3)
+
+
+# ---------- safe markdown → HTML (for docs the structured views can't show) ----------
+
+LIST = re.compile(r"^(\s*)([-*+]|\d+[.)])\s+(.*)$")
+
+
+def _link(m):
+    text, url = m.group(1), html.unescape(m.group(2))
+    if url.startswith("#"):
+        return text
+    if re.match(r"^https?://", url):
+        return f'<a href="{html.escape(url, quote=True)}" target="_blank" rel="noopener noreferrer">{text}</a>'
+    if not re.match(r"^[a-z][a-z0-9+.-]*:", url, re.I) and not url.startswith("/") and ".." not in url.split("/"):
+        return f'<a href="/p/{html.escape(url, quote=True)}" target="_blank" rel="noopener">{text}</a>'
+    return text
+
+
+def inline(s):
+    """One line of markdown → HTML. Everything is escaped; code spans stay literal."""
+    out = []
+    for i, part in enumerate(re.split(r"(`[^`]+`)", s)):
+        if i % 2:
+            out.append("<code>" + html.escape(part[1:-1]) + "</code>")
+            continue
+        p = html.escape(part, quote=False)
+        p = re.sub(r"\[([^\]]+)\]\(([^)\s]+)\)", _link, p)
+        p = re.sub(r"\*\*(.+?)\*\*", r"<strong>\1</strong>", p)
+        p = re.sub(r"~~(.+?)~~", r"<del>\1</del>", p)
+        p = re.sub(r"(?<![*\w])\*(?![\s*])(.+?)(?<![\s*])\*(?![*\w])", r"<em>\1</em>", p)
+        out.append(p)
+    return "".join(out)
+
+
+def _list_html(items):
+    out, stack = [], []
+    for ind, ordered, text in items:
+        tag = "ol" if ordered else "ul"
+        while stack and ind < stack[-1][0]:
+            out.append(f"</li></{stack.pop()[1]}>")
+        if stack and ind == stack[-1][0]:
+            out.append("</li>")
+        else:
+            out.append(f"<{tag}>")
+            stack.append((ind, tag))
+        m = re.match(r"^\[( |x|X)\]\s+(.*)$", text, re.S)
+        body = (("☑ " if m.group(1).lower() == "x" else "☐ ") + inline(m.group(2))) if m else inline(text)
+        out.append("<li>" + body.replace("\n", "<br>"))
+    while stack:
+        out.append(f"</li></{stack.pop()[1]}>")
+    return "".join(out)
+
+
+def _starts_block(lines, i):
+    s = lines[i].strip()
+    return (not s or s.startswith(("#", ">", "```", "~~~")) or LIST.match(lines[i]) is not None
+            or (s.startswith("|") and i + 1 < len(lines) and SEP.match(lines[i + 1]) is not None))
+
+
+def render_md(text):
+    """Markdown → HTML for display. Everything is escaped first; only a small subset becomes markup: headings,
+    paragraphs, lists (nested by indent, task boxes), pipe tables, fenced code, blockquotes, rules, **bold**, *italic*,
+    `code`, ~~strike~~, and links to http(s) or to a project file (/p/…). HTML comments are dropped."""
+    lines, out, i = strip_comments(text).split("\n"), [], 0
+    while i < len(lines):
+        line, s = lines[i], lines[i].strip()
+        if not s:
+            i += 1
+            continue
+        m = re.match(r"(`{3,}|~{3,})", s)
+        if m:
+            fence, buf, i = m.group(1), [], i + 1
+            while i < len(lines) and not (lines[i].strip() and set(lines[i].strip()) == {fence[0]} and len(lines[i].strip()) >= len(fence)):
+                buf.append(lines[i])
+                i += 1
+            out.append("<pre><code>" + html.escape("\n".join(buf)) + "</code></pre>")
+            i += 1
+            continue
+        m = re.match(r"(#{1,6})\s+(.*)$", s)
+        if m:
+            n = len(m.group(1))
+            out.append(f"<h{n}>{inline(m.group(2).rstrip('#').strip())}</h{n}>")
+            i += 1
+            continue
+        if re.fullmatch(r"(-\s*){3,}|(\*\s*){3,}|(_\s*){3,}", s):
+            out.append("<hr>")
+            i += 1
+            continue
+        if s.startswith("|") and i + 1 < len(lines) and SEP.match(lines[i + 1]):
+            head, j = cells(lines[i]), i + 2
+            rows = []
+            while j < len(lines) and lines[j].strip().startswith("|"):
+                rows.append(cells(lines[j]))
+                j += 1
+            th = "".join(f"<th>{inline(h)}</th>" for h in head)
+            tr = "".join("<tr>" + "".join(f"<td>{inline(c)}</td>" for c in r) + "</tr>" for r in rows)
+            out.append(f'<div class="tw"><table><thead><tr>{th}</tr></thead><tbody>{tr}</tbody></table></div>')
+            i = j
+            continue
+        if s.startswith(">"):
+            buf = []
+            while i < len(lines) and lines[i].strip().startswith(">"):
+                buf.append(re.sub(r"^\s*>\s?", "", lines[i]))
+                i += 1
+            out.append("<blockquote>" + render_md("\n".join(buf)) + "</blockquote>")
+            continue
+        if LIST.match(line):
+            items = []
+            while i < len(lines):
+                m = LIST.match(lines[i])
+                if m:
+                    items.append((len(m.group(1).expandtabs(4)), m.group(2)[0].isdigit(), m.group(3)))
+                elif lines[i].strip() and lines[i][:1] in " \t" and items:
+                    items[-1] = (items[-1][0], items[-1][1], items[-1][2] + "\n" + lines[i].strip())
+                elif not lines[i].strip() and i + 1 < len(lines) and (LIST.match(lines[i + 1]) or lines[i + 1][:1] in " \t" and lines[i + 1].strip()):
+                    pass
+                else:
+                    break
+                i += 1
+            out.append(_list_html(items))
+            continue
+        buf = [s]
+        i += 1
+        while i < len(lines) and not _starts_block(lines, i):
+            buf.append(lines[i].strip())
+            i += 1
+        out.append("<p>" + "<br>".join(inline(b) for b in buf) + "</p>")
+    return "".join(out)
+
+
+# ---------- the project ----------
+
+def _read(p, warnings):
+    try:
+        if p.stat().st_size > MAX_DOC:
+            warnings.append(f"{p.name}: larger than {MAX_DOC // 1000} kB, not read")
+            return ""
+        return p.read_text(encoding="utf-8-sig", errors="replace")
+    except OSError:
+        return ""
+
+
+def _json(p, warnings):
+    try:
+        return json.loads(p.read_text(encoding="utf-8-sig"))
+    except FileNotFoundError:
+        return None
+    except (OSError, ValueError) as e:
+        warnings.append(f"{p.name}: not readable JSON ({e})")
+        return None
+
+
+def _rel(project, p):
+    return Path(os.path.relpath(p, project)).as_posix()
+
+
+def _inside(project, rel):
+    """project / rel when that is a file inside the project (no absolute paths, no way out), else None."""
+    if not isinstance(rel, str) or not rel or os.path.isabs(rel):
+        return None
+    p = (project / rel).resolve()
+    return p if p.is_file() and os.path.commonpath([str(p), str(project)]) == str(project) else None
+
+
+def _match_segment(cell, outline, t0):
+    """The outline id a caption or shot belongs to: by its segment cell (id, title, or a title inside it), else by time."""
+    c = plain(cell)
+    if c:
+        for o in outline:
+            if c in (o["id"], o["title"]):
+                return o["id"]
+        for o in outline:
+            if o["title"] and o["title"] in c:
+                return o["id"]
+    if t0 is not None:
+        for o in outline:
+            if o["t0"] is not None and o["t1"] is not None and o["t0"] - 1e-6 <= t0 < o["t1"] - 1e-6:
+                return o["id"]
+    return ""
+
+
+def _concept(brief):
+    fields, specifics = [], []
+    for k, v, sub in bullets(section(brief, r"^Content", r"^内容")):
+        fields.append({"k": k, "v": plain(v)})
+        if k.lower().startswith("specifics") or k.startswith("素材"):
+            specifics = [plain(x) for x in sub]
+    get = lambda *ks: next((f["v"] for f in fields for k in ks if f["k"].lower().startswith(k.lower())), "")   # noqa: E731
+    return {"fields": fields, "specifics": specifics, "line": get("Concept", "立意"), "spine": get("Spine", "故事线"),
+            "motif": get("Recurring motif", "母题"), "end": get("What the viewer", "看完")}
+
+
+def _outline(brief, clock, warnings):
+    body = section(brief, r"^Outline", r"^大纲")
+    t = first_table(body, "段落", "segment", "段")
+    if not t:
+        if body.strip():
+            warnings.append("BRIEF.md: the Outline section has no table with a 段落 / Segment column; shown as text")
+        return []
+    out = []
+    for i, r in enumerate(t.rows):
+        title, tag = plain(t.get(r, "段落", "segment", "段")), plain(t.get(r, "标签", "tag"))
+        m = re.match(r"^\d*\s*(起|承|转|合|收)\s*[·:：]\s*(.+)$", title)   # an old 'title': "承 · 发出去"
+        if m:
+            tag, title = tag or m.group(1), m.group(2).strip()
+        t0, t1 = span(t.get(r, "时间", "time"))
+        if t0 is None:
+            t0, t1 = bar_span(t.get(r, "小节", "bars"), clock)
+        out.append({"id": plain(t.get(r, "#", "id")) or str(i + 1), "title": title, "tag": tag,
+                    "stage": plain(t.get(r, "环节", "阶段", "stage")), "bars": plain(t.get(r, "小节", "bars")),
+                    "t0": t0, "t1": t1, "know": plain(t.get(r, "观众", "viewer", "takeaway", "what the viewer")),
+                    "visual": plain(t.get(r, "关键画面", "画面", "key visual", "visual"))})
+    return out
+
+
+def _script(script, outline, clock, warnings):
+    t = first_table(script, "字幕", "caption", "on-screen", "旁白", "narration", "vo")
+    if not t:
+        if script.strip():
+            warnings.append("SCRIPT.md: no table with a 字幕 / Caption or 旁白 / Narration column; shown as text")
+        return {"kind": "", "rows": []}
+    kind = "caption" if t.has("字幕", "caption", "on-screen") else "narration"
+    rows = []
+    for i, r in enumerate(t.rows):
+        text = t.get(r, "字幕", "caption", "on-screen") if kind == "caption" else t.get(r, "旁白", "narration", "vo")
+        t0, t1 = span(t.get(r, "时间", "time"))
+        if t0 is None:
+            t0, t1 = bar_span(t.get(r, "小节", "bars"), clock)
+        rows.append({"id": plain(t.get(r, "#", "id")) or str(i + 1), "part": plain(t.get(r, "段", "segment")),
+                     "seg": _match_segment(t.get(r, "段", "segment"), outline, t0), "term": plain(t.get(r, "术语", "term")),
+                     "bars": plain(t.get(r, "小节", "bars")), "t0": t0, "t1": t1, "text": plain(text),
+                     "visual": plain(t.get(r, "画面", "visual")), "facts": re.findall(r"#\d+", t.get(r, "素材", "facts", "source"))})
+    return {"kind": kind, "rows": rows}
+
+
+def _facts(notes, warnings):
+    body = section(notes, r"^素材清单", r"^Material", r"^Specifics")
+    t = first_table(body, "素材", "item", "material")
+    facts = []
+    if t:
+        for r in t.rows:
+            claim, gone, _ = struck(t.get(r, "素材", "item", "material"))
+            m = re.match(r"^[（(][^）)]*(不用|dropped|unused)[^）)]*[）)]\s*(.*)$", claim, re.I)   # "（关卡 ① 后不用）…"
+            if m:
+                claim, gone = m.group(2), True
+            fid = plain(t.get(r, "#", "id")).lstrip("#")
+            facts.append({"id": "#" + fid if fid else "", "claim": plain(claim), "dropped": gone,
+                          "kind": plain(t.get(r, "类别", "kind")), "onscreen": plain(t.get(r, "上屏", "on screen", "on-screen")),
+                          "source": plain(t.get(r, "出处", "source"))})
+    elif notes.strip():
+        warnings.append("NOTES.md: no 素材清单 / Material table; shown as text")
+    todo_body = section(notes, r"^待核实", r"^To verify", r"^Unverified")
+    todo = [{"done": d.lower() == "x", "text": plain(x)} for d, x in re.findall(r"^- \[( |x|X)\] (.+)$", todo_body, re.M)]
+    return facts, todo
+
+
+def _decisions(dec):
+    ledger = []
+    t = first_table(dec, "决定", "decision")
+    if t:
+        for r in t.rows:
+            ledger.append({"what": plain(t.get(r, "决定", "decision")), "who": plain(t.get(r, "谁拍板", "who", "owner")),
+                           "status": plain(t.get(r, "状态", "status")), "where": plain(t.get(r, "在哪看", "where"))})
+    agent, group, fence = [], "", None
+    body = section(dec, r"^agent 定的事", r"^Decided by the agent", r"^Agent decisions")
+    for line in body.split("\n"):
+        fence, inside = _fence(line, fence)
+        if inside:
+            continue
+        if line.startswith("### "):
+            group = line[4:].strip()
+            continue
+        if not line.startswith("- "):
+            continue
+        text, gone, note = struck(line[2:])
+        parts = [p.strip() for p in re.split(r"\s+—\s+", text)]
+        m = re.match(r"(\{?\d{4}-\d{2}-\d{2}\}?)\s+(.+?)\s+·\s+(.+)$", parts[0])
+        pick = lambda *ks: next((re.sub(r"^[^:：]+[:：]\s*", "", p) for p in parts[1:] for k in ks if p.lower().startswith(k)), "")   # noqa: E731
+        agent.append({"date": m.group(1) if m else "", "topic": m.group(2) if m else "", "what": plain(m.group(3) if m else parts[0]),
+                      "why": plain(pick("理由", "why")), "undo": plain(pick("翻案", "undo")), "superseded": gone,
+                      "note": plain(note), "group": group})
+    return ledger, agent
+
+
+def _history(review_md):
+    out, paused = [], False
+    for title, body in sections(review_md)[1:]:
+        if REFERENCE_SECTIONS.match(title):
+            continue
+        if re.match(r"^(暂停|Paused)", title, re.I) and not re.search(r"恢复|resumed", title, re.I):
+            paused = True
+        quotes, notes, fence, desk = [], [], None, bool(re.match(r"^(审阅台反馈|Review desk feedback)", title))
+        for line in body.split("\n"):
+            fence, inside = _fence(line, fence)
+            if inside:
+                continue
+            m = re.match(r"^- (?:原话|Verbatim)\s*(?:[（(]([^）)]*)[）)])?\s*[：:]\s*[\"“「](.+)[\"”」]\s*$", line)
+            if m:
+                quotes.append({"label": m.group(1) or "", "text": m.group(2)})
+                continue
+            m = re.match(r"^- (定了|改了|Decided|Changed)\s*[：:][ \t]*(.*)$", line)
+            if m:   # "- 定了：A　改了：B" (the template's one-line form) is two notes
+                parts = re.split(r"[ \t　]*(改了|Changed)\s*[：:]", m.group(2))
+                for k, v in [(m.group(1), parts[0])] + list(zip(parts[1::2], parts[2::2])):
+                    if v.strip(" \t　"):
+                        notes.append({"k": k, "v": plain(v.strip(" \t　"))})
+        if quotes or notes or desk:
+            out.append({"title": title, "quotes": quotes, "notes": notes, "desk": desk, "html": render_md(body)})
+    return out, paused
+
+
+def _rounds(project, warnings):
+    rdir = project / "out" / "review"
+    found = sorted(rdir.glob("gate-*.json"), key=lambda p: (p.stat().st_mtime, p.name)) if rdir.is_dir() else []
+    out = []
+    for g in found:
+        rid = g.stem[5:]
+        if not re.fullmatch(r"[A-Za-z0-9_-]{1,24}", rid):
+            continue
+        d = _json(g, warnings)
+        if not isinstance(d, dict):
+            if d is not None:
+                warnings.append(f"out/review/{g.name}: expected a JSON object")
+            continue
+        try:
+            d = R.merge_includes(project, d)
+        except ValueError as e:
+            warnings.append(f"out/review/{g.name}: {e}")
+        out.append({"id": rid, "gate": (re.match(r"^(E\d|\d)", rid) or [None, rid])[1], "data": _normalize_round(d),
+                    "page": _rel(project, g.with_suffix(".html")) if g.with_suffix(".html").exists() else ""})
+    return out
+
+
+def _normalize_round(d):
+    """The shapes tools/review.py accepts, made uniform: options and least_sure as objects, lists as lists."""
+    d = dict(d)
+    decs = []
+    for x in d.get("decisions") or []:
+        if not isinstance(x, dict):
+            continue
+        x = dict(x)
+        x["options"] = [o if isinstance(o, dict) else {"id": str(o)} for o in x.get("options") or []]
+        decs.append(x)
+    d["decisions"] = decs
+    d["least_sure"] = [x if isinstance(x, dict) else {"id": "", "note": str(x)} for x in d.get("least_sure") or []]
+    for k in ("decided", "delegated", "assets", "appendix", "listen"):
+        d[k] = d[k] if isinstance(d.get(k), list) else []
+    d["appendix"] = [dict(a, html=render_md(a["text"])) if isinstance(a, dict) and isinstance(a.get("text"), str) else a
+                     for a in d["appendix"]]
+    d["listen"] = [{"t": float(x["t"]), "note": str(x.get("note", ""))} for x in d["listen"]
+                   if isinstance(x, dict) and isinstance(x.get("t"), (int, float))]
+    return d
+
+
+def _shots(project, outline, rounds, warnings):
+    sj = _json(project / "shots.json", warnings)
+    if sj is None:
+        return {}
+    items = sj.get("shots") if isinstance(sj, dict) else sj
+    if not isinstance(items, list):
+        warnings.append("shots.json: expected a list of shots, or {\"shots\": [...]}")
+        return {}
+    shots = []
+    for s in items:
+        if not isinstance(s, dict) or "id" not in s:
+            continue
+        s = dict(s)
+        for k in ("start", "end"):
+            s[k] = float(s[k]) if isinstance(s.get(k), (int, float)) else None
+        reads = s.get("reads")
+        s["reads"] = [reads] if isinstance(reads, str) else [str(r) for r in reads] if isinstance(reads, list) else []
+        frame = s.get("frame") or f"out/check/storyboard/frames/{s['id']}.png"   # bin/vh storyboard writes these
+        s["frame"] = frame if _inside(project, frame) else ""
+        s["seg"] = _match_segment(str(s.get("segment", "")), outline, s["start"])
+        shots.append(s)
+    meta = sj if isinstance(sj, dict) else {}
+    video = meta.get("video") or next((r["data"].get("animatic") for r in reversed(rounds) if r["data"].get("animatic")), "") \
+        or next((c for c in ("out/animatic.mp4", "out/draft.mp4") if (project / c).is_file()), "")
+    return {"video": video if isinstance(video, str) else "", "note": str(meta.get("note", "")), "items": shots}
+
+
+def _music(project, rounds, warnings):
+    g = next((r["data"]["music"] for r in reversed(rounds) if isinstance(r["data"].get("music"), dict)), {})
+    bp = _inside(project, g.get("beats"))
+    if bp is None:
+        cands = sorted((project / "audio").glob("*.beats.json"), key=lambda p: (p.stat().st_mtime, p.name)) if (project / "audio").is_dir() else []
+        bp = cands[-1] if cands else None
+    beats = (_json(bp, warnings) if bp else None) or {}
+    if not isinstance(beats, dict):
+        beats = {}
+    stem = bp.name[: -len(".beats.json")] if bp and bp.name.endswith(".beats.json") else ""
+    audio = g.get("audio") if isinstance(g.get("audio"), str) else next(
+        (f"audio/{n}" for n in (f"{stem}_mix.wav", f"{stem}.wav") if stem and (project / "audio" / n).is_file()), "")
+    roll = g.get("roll") if isinstance(g.get("roll"), str) else (
+        f"audio/{stem}.roll/overview.png" if stem and (project / "audio" / f"{stem}.roll" / "overview.png").is_file() else "")
+    labels = g.get("labels") if isinstance(g.get("labels"), dict) else {}
+    if not beats and not audio:
+        return {}, None
+    hits = [{"t": h["t"], "part": str(h.get("what", "")).split(":")[0]} for h in beats.get("hits") or []
+            if isinstance(h, dict) and isinstance(h.get("t"), (int, float))]
+    if not hits:
+        hits = [{"t": n["t"], "part": str(n.get("part", ""))} for n in beats.get("notes") or []
+                if isinstance(n, dict) and isinstance(n.get("t"), (int, float))]
+    secs = [{"name": str(s.get("name", "")), "label": str(labels.get(s.get("name"), "")), "start": s["start"], "end": s["end"]}
+            for s in beats.get("sections") or [] if isinstance(s, dict) and isinstance(s.get("start"), (int, float))
+            and isinstance(s.get("end"), (int, float))]
+    music = {"bpm": beats.get("bpm"), "duration": beats.get("duration"), "sections": secs, "hits": hits[:MAX_TICKS],
+             "audio": audio or "", "roll": roll or "", "beats": _rel(project, bp) if bp else ""}
+    return music, beats
+
+
+def _feedback(project, warnings):
+    fdir = project / "out" / "review" / "feedback"
+    files = sorted(fdir.glob("*.json"), key=lambda p: (p.stat().st_mtime, p.name))[-MAX_FEEDBACK:] if fdir.is_dir() else []
+    out = []
+    for f in files:
+        j = _json(f, warnings)
+        if isinstance(j, dict):
+            out.append({"file": _rel(project, f), "round": str(j.get("round", "")), "submitted_at": str(j.get("submitted_at", "")),
+                        "decisions": j.get("decisions") if isinstance(j.get("decisions"), dict) else {},
+                        "items": [i for i in j.get("items") or [] if isinstance(i, dict)], "general": str(j.get("general", ""))})
+    return out
+
+
+def _docs(project, warnings):
+    out = []
+    for name in DOCS:
+        p = project / name
+        if not p.is_file():
+            continue
+        parts = sections(strip_comments(_read(p, warnings)))
+        out.append({"file": name, "intro": render_md(parts[0][1]),
+                    "sections": [{"title": t, "html": render_md(b)} for t, b in parts[1:]]})
+    return out
+
+
+def read_project(project):
+    """The whole desk data for a project folder (see tools/desk/README.md for every key)."""
+    project = Path(project).resolve()
+    warnings = []
+    brief, script, notes = (_read(project / n, warnings) for n in ("BRIEF.md", "SCRIPT.md", "NOTES.md"))
+    dec, review_md = _read(project / "DECISIONS.md", warnings), _read(project / "REVIEW.md", warnings)
+    brief, script, notes, dec, review_md = (strip_comments(x) for x in (brief, script, notes, dec, review_md))
+    rounds = _rounds(project, warnings)
+    music, beats = _music(project, rounds, warnings)
+    clock = bar_clock(beats or {})
+    spec = [{"k": k, "v": plain(v)} for k, v, _ in bullets(section(brief, r"^Spec", r"^规格"))]
+    outline = _outline(brief, clock, warnings)
+    captions = _script(script, outline, clock, warnings)
+    facts, todo = _facts(notes, warnings)
+    ledger, agent = _decisions(dec)
+    history, paused = _history(review_md)
+    title = (re.search(r"^#\s+BRIEF\s*[：:]\s*(.+)$", brief, re.M) or [None, ""])[1].strip() or project.name
+    effort = next((re.split(r"\s", s["v"])[0] for s in spec if s["k"].lower() == "effort"), "")
+    lang = R.review_lang(project) or next((r["data"].get("lang") for r in reversed(rounds) if r["data"].get("lang") in ("zh", "en")), "") or "zh"
+    cur = rounds[-1] if rounds else None
+    stage = STAGE_OF_GATE.get(cur["gate"], 1) if cur else 0
+    return {"version": 1, "lang": lang,
+            "project": {"slug": project.name, "title": title, "effort": effort, "paused": paused},
+            "stage": stage, "spec": spec, "concept": _concept(brief), "outline": outline, "captions": captions,
+            "facts": facts, "fact_todo": todo, "ledger": ledger, "agent_decided": agent, "history": history,
+            "rounds": rounds, "feedback": _feedback(project, warnings),
+            "shots": _shots(project, outline, rounds, warnings), "music": music,
+            "docs": _docs(project, warnings), "warnings": warnings}
+
+
+if __name__ == "__main__":
+    print(json.dumps(read_project(sys.argv[1]), ensure_ascii=False, indent=1))
diff --git a/tools/desk/server.py b/tools/desk/server.py
new file mode 100644
index 0000000..d7a638b
--- /dev/null
+++ b/tools/desk/server.py
@@ -0,0 +1,245 @@
+"""Review desk, server: one project, on 127.0.0.1 only, stdlib only.
+
+  GET  /                 the desk (static/index.html, with this run's token)
+  GET  /static/<file>    desk.js, desk.css
+  GET  /api/data         the project, read fresh from its files (reader.read_project)
+  GET  /api/status       is an agent waiting for feedback (bin/vh desk wait)?
+  POST /api/feedback     a submission: checked, saved to out/review/feedback/, copied into REVIEW.md
+  GET  /p/<path>         a file inside the project (HTTP Range, so video and audio can seek); nothing outside it,
+                         no hidden files
+
+Only requests whose Host is this server's own address are answered (no DNS rebinding); a POST also needs the token
+printed into the page, a JSON body and, when the browser sends one, a same-origin Origin. So another web page open
+in the same browser can neither read the project nor submit feedback in the reviewer's name.
+"""
+import datetime, http.server, json, mimetypes, os, re, secrets, signal, socket, sys
+from pathlib import Path
+from urllib.parse import unquote, urlsplit
+
+HERE = Path(__file__).resolve().parent
+sys.path.insert(0, str(HERE))
+import feedback as F   # noqa: E402
+import reader          # noqa: E402
+
+STATIC = {"desk.js": "text/javascript; charset=utf-8", "desk.css": "text/css; charset=utf-8"}
+DEFAULT_PORTS = range(8780, 8800)
+CSP = ("default-src 'self'; img-src 'self' data: https:; media-src 'self' https:; style-src 'self' 'unsafe-inline'; "
+       "script-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'")
+mimetypes.add_type("text/markdown", ".md")
+mimetypes.add_type("audio/wav", ".wav")
+
+
+class Desk(http.server.ThreadingHTTPServer):
+    daemon_threads = True
+
+    def __init__(self, port, project):
+        super().__init__(("127.0.0.1", port), Handler)
+        self.project = Path(project).resolve()
+        self.token = secrets.token_urlsafe(24)
+        self.port = self.server_address[1]
+        self.hosts = {f"{h}:{self.port}" for h in ("127.0.0.1", "localhost")}
+
+    @property
+    def url(self):
+        return f"http://127.0.0.1:{self.port}/"
+
+
+class Handler(http.server.BaseHTTPRequestHandler):
+    server_version = "vh-desk"
+    sys_version = ""
+
+    def log_message(self, fmt, *a):   # quiet: an agent's background log stays readable
+        pass
+
+    # ---------- responses ----------
+    def _head(self, code, ctype, length, extra=None):
+        self.send_response(code)
+        self.send_header("Content-Type", ctype)
+        self.send_header("Content-Length", str(length))
+        self.send_header("Cache-Control", "no-store")
+        self.send_header("X-Content-Type-Options", "nosniff")
+        self.send_header("Referrer-Policy", "no-referrer")
+        for k, v in (extra or {}).items():
+            self.send_header(k, v)
+        self.end_headers()
+
+    def _send(self, code, body, ctype, extra=None):
+        self._head(code, ctype, len(body), extra)
+        if self.command != "HEAD":
+            self.wfile.write(body)
+
+    def _json(self, obj, code=200):
+        self._send(code, json.dumps(obj, ensure_ascii=False).encode("utf-8"), "application/json; charset=utf-8")
+
+    def _error(self, code, msg):
+        self._json({"error": msg}, code)
+
+    def _host_ok(self):
+        if self.headers.get("Host", "") in self.server.hosts:
+            return True
+        self._error(403, "this desk only answers on its own address")
+        return False
+
+    # ---------- GET ----------
+    def do_HEAD(self):
+        self.do_GET()
+
+    def do_GET(self):
+        if not self._host_ok():
+            return
+        path = urlsplit(self.path).path
+        if path in ("/", "/index.html"):
+            page = (HERE / "static" / "index.html").read_text(encoding="utf-8").replace("{{TOKEN}}", self.server.token)
+            return self._send(200, page.encode("utf-8"), "text/html; charset=utf-8", {"Content-Security-Policy": CSP})
+        if path.startswith("/static/") and path[8:] in STATIC:
+            return self._send(200, (HERE / "static" / path[8:]).read_bytes(), STATIC[path[8:]])
+        if path == "/api/data":
+            try:
+                data = reader.read_project(self.server.project)
+            except Exception as e:   # a reader bug must not take the desk down; the page says what happened
+                return self._error(500, f"could not read the project: {type(e).__name__}: {e}")
+            return self._json(data)
+        if path == "/api/status":
+            return self._json(dict(F.listening(self.server.project), project=self.server.project.name))
+        if path.startswith("/p/"):
+            return self._file(path[3:])
+        self._error(404, "not found")
+
+    def _resolve(self, rel):
+        """A file inside the project, or None: no '..', no hidden parts (.env, .git, .listening), no *.env."""
+        rel = unquote(rel)
+        parts = [p for p in rel.split("/") if p not in ("", ".")]
+        if not parts or "\x00" in rel or any(p == ".." or p.startswith(".") or p.endswith(".env") for p in parts):
+            return None
+        root = str(self.server.project)
+        f = os.path.realpath(os.path.join(root, *parts))
+        if os.path.commonpath([f, root]) != root or not os.path.isfile(f):
+            return None
+        return f
+
+    def _file(self, rel):
+        f = self._resolve(rel)
+        if not f:
+            return self._error(404, "no such file in this project")
+        size = os.path.getsize(f)
+        ctype = mimetypes.guess_type(f)[0] or "application/octet-stream"
+        if ctype.startswith("text/") or ctype == "application/json":
+            ctype += "; charset=utf-8"
+        rng = self.headers.get("Range", "")
+        m = re.fullmatch(r"bytes=(\d*)-(\d*)", rng.strip())
+        if rng and m and (m.group(1) or m.group(2)):
+            if m.group(1):
+                start, end = int(m.group(1)), int(m.group(2)) if m.group(2) else size - 1
+            else:   # bytes=-500: the last 500
+                start, end = max(0, size - int(m.group(2))), size - 1
+            end = min(end, size - 1)
+            if start > end or start >= size:
+                return self._send(416, b"", "text/plain", {"Content-Range": f"bytes */{size}"})
+            self._head(206, ctype, end - start + 1, {"Content-Range": f"bytes {start}-{end}/{size}", "Accept-Ranges": "bytes"})
+        else:
+            start, end = 0, size - 1
+            self._head(200, ctype, size, {"Accept-Ranges": "bytes"})
+        if self.command == "HEAD":
+            return
+        try:
+            with open(f, "rb") as fh:
+                fh.seek(start)
+                left = end - start + 1
+                while left > 0:
+                    chunk = fh.read(min(1 << 16, left))
+                    if not chunk:
+                        break
+                    self.wfile.write(chunk)
+                    left -= len(chunk)
+        except (BrokenPipeError, ConnectionResetError):   # the player seeked away
+            pass
+
+    # ---------- POST ----------
+    def do_POST(self):
+        if not self._host_ok():
+            return
+        if urlsplit(self.path).path != "/api/feedback":
+            return self._error(404, "not found")
+        origin = self.headers.get("Origin")
+        if origin and urlsplit(origin).netloc not in self.server.hosts:
+            return self._error(403, "cross-origin request refused")
+        if not secrets.compare_digest(self.headers.get("X-Desk-Token", ""), self.server.token):
+            return self._error(403, "missing or wrong desk token: reload the page")
+        if not self.headers.get("Content-Type", "").startswith("application/json"):
+            return self._error(415, "send JSON")
+        try:
+            n = int(self.headers.get("Content-Length") or 0)
+        except ValueError:
+            n = 0
+        if n <= 0 or n > F.MAX_BODY:
+            return self._error(413 if n > 0 else 400, f"empty, or larger than {F.MAX_BODY // 1024} KiB")
+        try:
+            fb = F.validate(self.server.project, json.loads(self.rfile.read(n).decode("utf-8")))
+        except (ValueError, UnicodeDecodeError) as e:
+            return self._error(400, str(e))
+        path = F.save(self.server.project, fb)
+        sys.stderr.write(f"desk: feedback saved → {path} (also in REVIEW.md)\n")
+        sys.stderr.flush()
+        self._json(dict(F.listening(self.server.project), saved=os.path.relpath(path, self.server.project)))
+
+
+# ---------- start, once per project ----------
+
+def running(project):
+    """The URL of a desk already serving this project (out/review/.desk.json and it answers), else None."""
+    info_p = Path(project) / "out" / "review" / ".desk.json"
+    try:
+        info = json.loads(info_p.read_text())
+        os.kill(int(info["pid"]), 0)
+        with socket.create_connection(("127.0.0.1", int(info["port"])), timeout=1):
+            pass
+    except PermissionError:
+        return info.get("url")
+    except (OSError, ValueError, KeyError, TypeError):
+        return None
+    return info.get("url")
+
+
+def serve(project, port=None):
+    """Serve until stopped. port None: the first free of 8780–8799; 0: any free port. → exit code."""
+    project = Path(project).resolve()
+    url = running(project)
+    if url:
+        print(f"desk: already serving {project.name} at {url} (stop that process to start another)", flush=True)
+        return 0
+    srv, last = None, None
+    for p in ([port] if port is not None else DEFAULT_PORTS):
+        try:
+            srv = Desk(p, project)
+            break
+        except OSError as e:
+            last = e
+    if srv is None:
+        print(f"desk: no free port ({last}); pick one with --port N", file=sys.stderr)
+        return 2
+    info_p = project / "out" / "review" / ".desk.json"
+    info_p.parent.mkdir(parents=True, exist_ok=True)
+    info_p.write_text(json.dumps({"pid": os.getpid(), "port": srv.port, "url": srv.url,
+                                  "started": datetime.datetime.now().isoformat(timespec="seconds")}))
+
+    def stop(signum, _frame):
+        raise SystemExit(0)
+    for s in (signal.SIGTERM, signal.SIGHUP):
+        signal.signal(s, stop)
+    print(f"desk: {srv.url}  ·  {project.name}  (Ctrl-C stops it)", flush=True)
+    try:
+        srv.serve_forever(poll_interval=0.25)
+    except KeyboardInterrupt:
+        pass
+    finally:
+        srv.server_close()
+        try:
+            if json.loads(info_p.read_text()).get("pid") == os.getpid():
+                info_p.unlink()
+        except (OSError, ValueError):
+            pass
+    return 0
+
+
+if __name__ == "__main__":
+    sys.exit(serve(sys.argv[1], int(sys.argv[2]) if len(sys.argv) > 2 else None))
diff --git a/tools/desk/static/desk.css b/tools/desk/static/desk.css
new file mode 100644
index 0000000..f3e02ca
--- /dev/null
+++ b/tools/desk/static/desk.css
@@ -0,0 +1,193 @@
+/* Review desk. Light by default, dark from the system or the ◐ button; no web fonts, no CDN. */
+:root{color-scheme:light;
+  --bg:#f4f3ef;--panel:#fff;--ink:#1d1f23;--mute:#62666e;--faint:#8d929a;--line:#e4e2db;--soft:#f0eee8;
+  --acc:#2f5dd0;--acc-soft:#e8eefc;--ok:#2e7d4f;--ok-soft:#e5f3ea;--chg:#a9530a;--chg-soft:#fbeedd;
+  --ask:#6a4fc9;--ask-soft:#efeafc;--bad:#c2352b;--bad-soft:#fbe7e5;--film:#0e1630;--on-acc:#fff;
+  --shadow:0 1px 2px rgba(20,20,30,.06),0 4px 16px rgba(20,20,30,.05);
+  --seg1:#7aa2e3;--seg2:#e3a27a;--seg3:#8cc5a2;--seg4:#c49ae0;--seg5:#e3cf7a;--seg6:#9ab6c4}
+@media (prefers-color-scheme:dark){:root:not([data-theme=light]){color-scheme:dark;
+  --bg:#121316;--panel:#1a1c20;--ink:#e9eaec;--mute:#a2a8b0;--faint:#737881;--line:#2b2e34;--soft:#22252a;
+  --acc:#8aa6ff;--acc-soft:#232c45;--ok:#5fbf85;--ok-soft:#1d3127;--chg:#f0a35c;--chg-soft:#3a2a1a;
+  --ask:#b19cff;--ask-soft:#2b2540;--bad:#ff7b6e;--bad-soft:#3d2220;--on-acc:#0f1115;--shadow:none}}
+:root[data-theme=dark]{color-scheme:dark;
+  --bg:#121316;--panel:#1a1c20;--ink:#e9eaec;--mute:#a2a8b0;--faint:#737881;--line:#2b2e34;--soft:#22252a;
+  --acc:#8aa6ff;--acc-soft:#232c45;--ok:#5fbf85;--ok-soft:#1d3127;--chg:#f0a35c;--chg-soft:#3a2a1a;
+  --ask:#b19cff;--ask-soft:#2b2540;--bad:#ff7b6e;--bad-soft:#3d2220;--on-acc:#0f1115;--shadow:none}
+*{box-sizing:border-box}
+html,body{margin:0;background:var(--bg);color:var(--ink);font:15px/1.6 -apple-system,BlinkMacSystemFont,"PingFang SC","Hiragino Sans GB","Noto Sans CJK SC","Microsoft YaHei","Segoe UI",sans-serif}
+button,input,textarea{font:inherit;color:inherit}
+a{color:var(--acc)}
+.serif{font-family:"Songti SC","STSong","Noto Serif CJK SC",Georgia,serif}
+code{font:.9em ui-monospace,"SF Mono",Menlo,monospace;background:var(--soft);padding:1px 5px;border-radius:5px}
+/* top bar */
+.top{position:sticky;top:0;z-index:20;display:flex;align-items:center;gap:16px;padding:10px 18px;background:var(--panel);border-bottom:1px solid var(--line);min-height:56px}
+.brand{display:flex;align-items:baseline;gap:10px;white-space:nowrap;min-width:0;flex:0 1 auto;max-width:38%}
+.brand b{font-size:14px;letter-spacing:.06em;color:var(--mute);font-weight:600}
+.brand .proj{font-size:18px;font-weight:600;overflow:hidden;text-overflow:ellipsis}
+.pill{font-size:12px;padding:2px 8px;border-radius:99px;background:var(--soft);color:var(--mute);white-space:nowrap}
+.pill.paused{background:var(--chg-soft);color:var(--chg)}
+.rail{display:flex;align-items:center;gap:4px;margin:0 auto;padding:0;list-style:none;overflow-x:auto;flex:1 1 0;min-width:0}
+.rail li{display:flex;align-items:center;gap:4px;font-size:12.5px;color:var(--faint);white-space:nowrap}
+.rail .st{padding:3px 9px;border-radius:99px;border:1px solid var(--line)}
+.rail .done .st{color:var(--ok);border-color:transparent;background:var(--ok-soft)}
+.rail .current .st{color:var(--on-acc);background:var(--acc);border-color:var(--acc);font-weight:600}
+.rail .gate{font-size:11px;color:var(--chg);font-weight:700}
+.rail .sep{width:10px;height:1px;background:var(--line)}
+.actions{display:flex;gap:8px;white-space:nowrap;align-items:center;margin-left:auto;flex:0 0 auto}
+.live{font-size:12.5px;color:var(--faint);display:inline-flex;gap:6px;align-items:center;padding:3px 10px;border-radius:99px;background:var(--soft)}
+.live.on{color:var(--ok);background:var(--ok-soft)}
+.btn{border:1px solid var(--line);background:var(--panel);border-radius:8px;padding:6px 12px;cursor:pointer}
+.btn:hover{border-color:var(--faint)}
+.btn.primary{background:var(--acc);border-color:var(--acc);color:var(--on-acc);font-weight:600}
+.btn .n{display:inline-block;min-width:18px;padding:0 5px;border-radius:9px;background:var(--acc);color:var(--on-acc);font-size:12px;text-align:center;margin-left:4px}
+.btn.ghost{border-color:transparent;background:transparent;color:var(--mute)}
+/* layout */
+.layout{display:grid;grid-template-columns:216px minmax(0,1fr);min-height:calc(100vh - 56px)}
+.side{position:sticky;top:56px;align-self:start;height:calc(100vh - 56px);overflow:auto;padding:14px 10px;border-right:1px solid var(--line)}
+.side a{display:flex;justify-content:space-between;align-items:center;gap:8px;padding:7px 10px;border-radius:8px;color:var(--ink);text-decoration:none;font-size:14.5px}
+.side a:hover{background:var(--soft)}
+.side a.on{background:var(--acc-soft);color:var(--acc);font-weight:600}
+.side .cnt{font-size:12px;color:var(--faint);font-weight:400}
+.side .cnt b{color:var(--chg)}
+.side h6{margin:16px 10px 6px;font-size:11.5px;color:var(--faint);font-weight:600;letter-spacing:.08em}
+main{padding:22px 28px 120px;max-width:1220px;width:100%}
+h1{font-size:24px;margin:0 0 4px}
+h2{font-size:18px;margin:32px 0 10px}
+h3{font-size:15px;margin:20px 0 8px}
+.sub{color:var(--mute);margin:0 0 18px}
+.card{background:var(--panel);border:1px solid var(--line);border-radius:12px;padding:16px 18px;box-shadow:var(--shadow)}
+.grid{display:grid;gap:14px}
+.g2{grid-template-columns:repeat(2,minmax(0,1fr))}
+.g3{grid-template-columns:repeat(auto-fill,minmax(300px,1fr))}
+.muted{color:var(--mute)}.small{font-size:13px}.tiny{font-size:12px}
+.chip{display:inline-block;font-size:12px;padding:1px 7px;border-radius:6px;background:var(--soft);color:var(--mute);margin-right:4px;white-space:nowrap}
+.chip.acc{background:var(--acc-soft);color:var(--acc)}.chip.bad{background:var(--bad-soft);color:var(--bad)}.chip.ok{background:var(--ok-soft);color:var(--ok)}.chip.chg{background:var(--chg-soft);color:var(--chg)}
+.kv{display:grid;grid-template-columns:auto 1fr;gap:4px 14px;font-size:14px}
+.kv dt{color:var(--mute)}.kv dd{margin:0}
+blockquote{margin:8px 0;padding:8px 14px;border-left:3px solid var(--acc);background:var(--acc-soft);border-radius:0 8px 8px 0;font-size:14px}
+.note{margin:0 0 14px;padding:8px 12px;border-radius:8px;background:var(--chg-soft);color:var(--chg);font-size:13.5px}
+/* feedback control */
+.fb{margin-top:10px}
+.seg3{display:inline-flex;border:1px solid var(--line);border-radius:8px;overflow:hidden;background:var(--panel)}
+.seg3 button{border:0;background:transparent;padding:4px 10px;font-size:13px;cursor:pointer;color:var(--mute)}
+.seg3 button+button{border-left:1px solid var(--line)}
+.seg3 button:hover{background:var(--soft)}
+.seg3 button.on[data-st=ok]{background:var(--ok-soft);color:var(--ok);font-weight:600}
+.seg3 button.on[data-st=change]{background:var(--chg-soft);color:var(--chg);font-weight:600}
+.seg3 button.on[data-st=ask]{background:var(--ask-soft);color:var(--ask);font-weight:600}
+.fb .def{font-size:12px;color:var(--faint);margin-left:8px}
+.fb-more{margin-top:8px;display:grid;gap:6px}
+.fb-more[hidden]{display:none}
+.fb-more textarea,.fb-more input,.tray textarea{width:100%;border:1px solid var(--line);border-radius:8px;padding:7px 10px;background:var(--panel);resize:vertical;min-height:38px}
+.fb-more textarea:focus,.fb-more input:focus,.tray textarea:focus{outline:2px solid var(--acc-soft);border-color:var(--acc)}
+.marked{box-shadow:inset 3px 0 0 var(--chg)}
+.marked.st-ok{box-shadow:inset 3px 0 0 var(--ok)}.marked.st-ask{box-shadow:inset 3px 0 0 var(--ask)}
+/* decisions */
+.dec{margin-bottom:16px}
+.dec .q{font-size:17px;font-weight:600;margin:0 0 4px}
+.opts{display:grid;gap:10px;margin-top:12px}
+.opt{display:grid;grid-template-columns:24px 1fr;gap:10px;border:1px solid var(--line);border-radius:10px;padding:12px 14px;cursor:pointer;background:var(--panel)}
+.opt:hover{border-color:var(--faint)}
+.opt.on{border-color:var(--acc);background:var(--acc-soft)}
+.opt input{margin-top:4px}
+.opt .l{font-weight:600}
+.opt .pc{display:grid;grid-template-columns:1fr 1fr;gap:10px;margin-top:6px;font-size:13px}
+.opt .pc b{margin-right:4px}.opt .pc .p b{color:var(--ok)}.opt .pc .c b{color:var(--chg)}
+.media img,.media video{display:block;max-width:100%;border-radius:10px;border:1px solid var(--line);background:#000}
+.media figcaption{color:var(--mute);font-size:13px;margin-top:6px}
+.media{margin:0 0 14px}
+/* outline */
+.tbar{display:flex;height:46px;border-radius:10px;overflow:hidden;border:1px solid var(--line);margin:10px 0 6px}
+.tbar div{display:flex;align-items:center;justify-content:center;font-size:12.5px;color:#1d1f23;cursor:pointer;padding:0 6px;text-align:center;line-height:1.25;border-right:1px solid rgba(0,0,0,.08);overflow:hidden}
+.tbar div:hover{filter:brightness(1.06)}
+.tticks{display:flex;justify-content:space-between;font-size:11.5px;color:var(--faint);margin-bottom:14px}
+.segcard{display:grid;grid-template-columns:8px 1fr;gap:14px}
+.segcard .stripe{border-radius:4px}
+.segcap{font-size:13.5px;margin:2px 0;color:var(--mute)}
+.segcap .id{font:12px ui-monospace,Menlo,monospace;color:var(--faint);margin-right:6px}
+.tag{font-size:11px;color:var(--faint);border:1px solid var(--line);border-radius:5px;padding:0 5px;margin-left:6px;vertical-align:2px}
+/* script */
+.filters{display:flex;gap:8px;flex-wrap:wrap;margin:6px 0 16px}
+.filters button{border:1px solid var(--line);background:var(--panel);border-radius:99px;padding:3px 12px;font-size:13px;cursor:pointer}
+.filters button.on{background:var(--ink);color:var(--panel);border-color:var(--ink)}
+.capgroup{border:1px solid var(--line);border-radius:12px;overflow:hidden;margin-bottom:22px;box-shadow:var(--shadow)}
+.capgroup .gh{display:flex;align-items:center;gap:10px;padding:10px 16px;background:var(--soft);font-weight:600;font-size:14px}
+.capgroup .gh i{width:10px;height:10px;border-radius:3px;display:inline-block}
+.cap{display:grid;grid-template-columns:62px minmax(0,1fr) 320px;gap:16px;padding:14px 16px;border-top:1px solid var(--line);background:var(--panel)}
+.cap .id{font:12.5px ui-monospace,Menlo,monospace;color:var(--faint)}
+.cap .tm{font-size:12px;color:var(--faint)}
+.cap .txt{font-size:20px;line-height:1.45}
+.cap .vis{font-size:13px;color:var(--mute);margin-top:6px}
+.term{display:inline-block;font-size:12px;font-weight:600;letter-spacing:.06em;color:var(--acc);background:var(--acc-soft);padding:1px 8px;border-radius:6px;margin-bottom:4px}
+.meter{display:flex;align-items:center;flex-wrap:wrap;gap:8px;font-size:12px;color:var(--mute);margin-top:6px}
+.meter .bar{width:86px;height:6px;border-radius:3px;background:var(--soft);overflow:hidden}
+.meter .bar i{display:block;height:100%}
+/* storyboard and film */
+.player{position:sticky;top:62px;z-index:5;background:var(--bg);padding-bottom:10px}
+.player video{width:100%;max-height:46vh;background:#000;border-radius:12px;display:block}
+.strack{position:relative;height:30px;margin-top:8px;border-radius:8px;overflow:hidden;background:var(--soft);display:flex}
+.strack div{height:100%;border-right:2px solid var(--bg);font-size:11.5px;display:flex;align-items:center;justify-content:center;cursor:pointer;color:#1d1f23;overflow:hidden}
+.strack div.unsure{box-shadow:inset 0 0 0 2px var(--bad)}
+.playhead{position:absolute;top:0;bottom:0;width:2px;background:var(--ink);pointer-events:none}
+.shot{padding:0;overflow:hidden}
+.shot.active{outline:3px solid var(--acc);outline-offset:-1px}
+.shot .thumb{position:relative;cursor:pointer;background:var(--film);min-height:60px}
+.shot .thumb img{width:100%;display:block;aspect-ratio:16/9;object-fit:contain}
+.shot .thumb .play{position:absolute;right:10px;bottom:10px;background:rgba(0,0,0,.6);color:#fff;font-size:12px;padding:2px 8px;border-radius:6px}
+.shot .thumb .sid{position:absolute;left:10px;top:10px;background:rgba(0,0,0,.6);color:#fff;font:12px ui-monospace,Menlo,monospace;padding:2px 7px;border-radius:6px}
+.shot.unsure .thumb{box-shadow:inset 0 0 0 3px var(--bad)}
+.shot .body{padding:12px 14px}
+.shot .lab{font-weight:600}
+.shot ul{margin:6px 0 0;padding-left:18px;font-size:13.5px}
+.shot .capline{font-size:15px;margin-top:6px}
+.unsure-note{margin-top:8px;font-size:13px;color:var(--bad);background:var(--bad-soft);padding:6px 10px;border-radius:8px}
+.scrub{position:relative;height:36px;margin-top:10px;background:var(--soft);border-radius:8px;cursor:pointer}
+.scrub .fill{position:absolute;left:0;top:0;bottom:0;background:var(--acc-soft);border-radius:8px}
+.scrub .mk{position:absolute;top:4px;width:12px;height:12px;margin-left:-6px;border-radius:50%;border:2px solid var(--panel)}
+.tc{display:grid;grid-template-columns:76px 1fr auto;gap:10px;align-items:start;padding:10px 0;border-bottom:1px solid var(--line)}
+.tc .t{font:13px ui-monospace,Menlo,monospace;color:var(--acc);cursor:pointer}
+/* sound */
+.secbar{display:flex;height:34px;border-radius:8px;overflow:hidden;position:relative;margin-top:10px}
+.secbar div{display:flex;align-items:center;justify-content:center;font-size:12px;color:#1d1f23;cursor:pointer;border-right:2px solid var(--panel);overflow:hidden;white-space:nowrap}
+.hits{position:relative;height:16px;margin-top:4px}
+.hits i{position:absolute;top:0;width:2px;height:12px;border-radius:1px}
+.listen{display:grid;gap:8px}
+.listen button{text-align:left}
+img.roll{width:100%;border-radius:8px;border:1px solid var(--line)}
+/* tables */
+table.t{width:100%;border-collapse:collapse;background:var(--panel);border-radius:12px;overflow:hidden;box-shadow:var(--shadow)}
+table.t td,table.t th{border-bottom:1px solid var(--line);padding:10px 12px;text-align:left;vertical-align:top;font-size:13.5px}
+table.t th{background:var(--soft);font-size:12.5px;color:var(--mute);font-weight:600}
+table.t tr.dropped{opacity:.45}
+.led{display:grid;grid-template-columns:120px 1fr;gap:14px}
+.led .topic{font-weight:600}
+details summary{cursor:pointer;color:var(--mute)}
+/* documents (rendered markdown) */
+.md{font-size:14.5px;line-height:1.7}
+.md h1{font-size:21px}.md h2{font-size:17px;margin:22px 0 8px}.md h3{font-size:15px}
+.md .tw{overflow-x:auto;margin:10px 0}
+.md table{border-collapse:collapse;font-size:13.5px;min-width:60%}
+.md th,.md td{border:1px solid var(--line);padding:6px 9px;text-align:left;vertical-align:top}
+.md th{background:var(--soft);font-weight:600}
+.md pre{background:var(--soft);padding:10px 12px;border-radius:8px;overflow:auto;font-size:12.5px;white-space:pre-wrap}
+.md pre code{background:none;padding:0}
+.md del{color:var(--faint)}
+.docsec{margin-bottom:14px}
+.docnav{display:flex;flex-wrap:wrap;gap:8px;margin:0 0 16px}
+.docnav a{padding:3px 12px;border:1px solid var(--line);border-radius:99px;text-decoration:none;color:var(--ink);font-size:13px;background:var(--panel)}
+.docnav a.on{background:var(--ink);color:var(--panel);border-color:var(--ink)}
+/* tray */
+.tray{position:fixed;top:0;right:0;bottom:0;width:440px;max-width:100vw;background:var(--panel);border-left:1px solid var(--line);box-shadow:-8px 0 30px rgba(0,0,0,.08);transform:translateX(105%);transition:transform .2s ease;z-index:40;display:flex;flex-direction:column}
+.tray.open{transform:none}
+.tray header{display:flex;justify-content:space-between;align-items:center;padding:14px 18px;border-bottom:1px solid var(--line)}
+.tray .list{flex:1;overflow:auto;padding:10px 18px}
+.tray .it{padding:10px 0;border-bottom:1px solid var(--line);cursor:pointer}
+.tray .it:hover{background:var(--soft)}
+.tray footer{padding:14px 18px;border-top:1px solid var(--line);display:grid;gap:10px}
+pre.out{white-space:pre-wrap;background:var(--soft);padding:10px 12px;border-radius:8px;font-size:12.5px;max-height:240px;overflow:auto;margin:0}
+.toast{position:fixed;left:50%;bottom:24px;transform:translateX(-50%);background:var(--ink);color:var(--panel);padding:10px 16px;border-radius:10px;font-size:14px;z-index:60;opacity:0;transition:opacity .2s;pointer-events:none;max-width:90vw}
+.toast.show{opacity:1}
+.empty{padding:28px;text-align:center;color:var(--faint);white-space:pre-line}
+@media (max-width:900px){.layout{grid-template-columns:1fr}.side{position:static;height:auto;display:flex;flex-wrap:wrap;border-right:0;border-bottom:1px solid var(--line)}
+  .side h6{width:100%}.cap{grid-template-columns:1fr}.g2{grid-template-columns:1fr}.rail{display:none}main{padding:18px 16px 100px}.top{flex-wrap:wrap}}
+@media (prefers-reduced-motion:reduce){.tray,.toast{transition:none}}
diff --git a/tools/desk/static/desk.js b/tools/desk/static/desk.js
new file mode 100644
index 0000000..6d203da
--- /dev/null
+++ b/tools/desk/static/desk.js
@@ -0,0 +1,536 @@
+"use strict";
+/* The review desk's page. It reads /api/data (tools/desk/reader.py: the project's own files, read fresh) and posts the
+   reviewer's ticks and comments to /api/feedback. Drafts stay in this browser (localStorage) until submitted. No
+   framework, no CDN; every text from the project is escaped before it reaches the page (documents arrive as HTML that
+   reader.py has already escaped). */
+
+const STR = {
+  zh: {
+    brand: "审阅台", noServer: "读不到项目数据：请用 bin/vh desk <项目> 打开这一页。",
+    v_round: "这一轮要你看的", v_concept: "立意与大纲", v_caption: "字幕稿", v_narration: "旁白稿", v_script: "字幕 / 旁白",
+    v_board: "分镜", v_sound: "声音", v_facts: "事实核对", v_film: "小样 · 逐秒点评", v_ledger: "决定账本", v_history: "历史", v_docs: "文档",
+    side_project: "这个项目", side_pages: "静态审阅页",
+    stages: ["选路径", "立意 · 大纲", "风格", "分镜", "声音", "搭引擎", "写场景", "自评", "初版", "交付"], gate_mark: "人工关卡",
+    st_paused: "暂停", st_round: "关卡 {id} · 等你看", st_none: "进行中",
+    live_on: "agent 在等你提交", live_off: "agent 没在等", live_on_tip: "提交后 agent 会自动接着做，不用回对话",
+    live_off_tip: "提交后回到对话里说一声“看审阅台”", theme: "深色 / 浅色", lang: "EN", lang_tip: "Switch to English", reload: "重新读取项目文件",
+    my: "我的点评", submit: "提交", general: "整体意见（可选）", general_ph: "比如：整体节奏偏慢；开场很好……", preview: "会提交的内容",
+    submit_hint: "没标的条目都算通过。提交后写进项目的 out/review/feedback/，你的原话同时抄进 REVIEW.md。",
+    fb_ok: "✓ 可以", fb_change: "✎ 要改", fb_ask: "? 疑问", fb_def: "不点就算通过", ph_change: "哪里要改、为什么", ph_ask: "哪里没看懂？",
+    ph_suggest: "直接改成……（可选）", agree: "✓ 同意", overturn: "✎ 翻案", def_agree: "不点就算同意",
+    dec_ok: "✓ 就这样", dec_more: "✎ 补一句", dec_def: "不点就按上面选的", fact_ok: "✓ 对", fact_bad: "✎ 有问题", fact_unsure: "? 拿不准", fact_def: "不点 = 没看",
+    st_ok: "可以", st_change: "要改", st_ask: "疑问",
+    decision_n: "决定 {i}", recommend: "我推荐 {r}", rec_chip: "推荐", pro: "好处", con: "代价", none_to_decide: "这一轮没有要你定的事。",
+    least: "我最没把握的", delegated: "我替你定了", delegated_sub: "不同意就点“翻案”", decided: "已经定了", not_reviewed: "这一轮不审",
+    other_assets: "其他材料", appendix: "附录", prev_said: "上一轮（{r}）你在审阅台里说 · {at}", prev_ok: "另有 {n} 条点了“可以”",
+    changed: "我改了", overall: "整体", to_film: "去逐秒点评 →", no_round: "还没有审阅页（out/review/gate-<n>.json）。下面各页照样可以看、可以点评。",
+    l_least: "没把握：{x}", l_deleg: "我替你定的：{x}", l_dec: "决定：{x}",
+    concept: "立意", spine: "故事线", motif: "贯穿全片的", end: "看完以后", spec: "规格", outline: "大纲", outline_tip: "点色块跳到那一段",
+    seg_n: "第 {i} 段", know: "看完知道 / 感到", visual: "关键画面", seg_caps: "这一段的 {n} 条", to_script: "去逐条看 →", bars: "第 {b} 小节",
+    concept_sub: "一句话立意、故事线，和按时间排开的 {n} 段。", l_concept: "立意与故事线", l_seg: "大纲 第 {i} 段 {x}",
+    no_outline: "大纲还没有写成表格（BRIEF 的 Outline 一节，列名见 tools/desk/README.md），下面是 BRIEF 原文。", no_brief: "还没有 BRIEF.md。",
+    script_sub: "{n} 条，按大纲分段。读速按这一条占的时间粗算：中文 {g} 字/秒以内绿、{y} 以内黄；英文 {eg} / {ey} 字符/秒。",
+    f_all: "全部", f_mine: "我标过的", f_terms: "带术语的", f_facts: "带出处编号的", f_fast: "可能读不完的",
+    no_script: "SCRIPT.md 里没有字幕或旁白表格（列名见 tools/desk/README.md），下面是原文。", no_script_file: "还没有字幕稿或旁白稿（SCRIPT.md）。",
+    other_seg: "没对上大纲的", per_s: "/秒", chars: "{n} 字 · {s} s", none_match: "没有符合的条目。", l_cap: "字幕 {x}", l_vo: "旁白 {x}", term: "术语",
+    board_sub: "点画面播这一镜，播放时当前镜头会亮起；红框是我没把握的镜头。", no_shot_caption: "（这一镜没有字幕）", transition: "转场：", unsure: "我没把握：",
+    no_board: "还没有 shots.json（关卡 ② 才有），下面是 STORYBOARD.md。", no_board_file: "还没有分镜。", l_shot: "分镜 {x}", no_video: "（没有可播放的视频，只看关键帧）",
+    sound_sub: "agent 听不见，只能看谱面和响度；这一页请你用耳朵。{bpm} BPM，{d} s。", comment_at: "在 {t} 处点评",
+    sec_tip: "色块是乐段，点一下从那里播；刻度是落在画面动作上的音", listen: "请你听这几处", your_sound: "你的声音点评",
+    none_sound: "还没有。播到哪里觉得不对，就点上面的“在 … 处点评”。", roll: "谱面和响度（每一行是一件乐器，颜色越深越响）",
+    no_music: "还没有配乐。", sound_label: "声音 {t}", no_audio: "没有找到可以播放的音频（gate JSON 的 music.audio）。",
+    facts_sub: "上屏的说法，和它背后的原话、出处。请重点看“上屏说法”有没有简化到错。", todo: "还没核实的", th_id: "#", th_claim: "素材（原文）",
+    th_kind: "类别", th_screen: "上屏说法", th_src: "出处", th_you: "你看", dropped: "（已不用）", l_fact: "事实 {x}",
+    no_facts: "NOTES.md 里没有素材清单表格，下面是原文。", no_notes: "还没有 NOTES.md。",
+    film_sub: "播到哪里有话说，按 C 或点按钮，就在那一秒留一条。", film_list: "点评按时间排在下面",
+    film_none: "还没有逐秒点评。", no_film: "这一轮没有视频。", film_label: "小样 {t}", del: "删",
+    ledger_sub: "每件事谁拍板、现在是什么状态；我替你定的事都在下面，随时可以翻案。", th_what: "事", th_who: "谁拍板", th_status: "现在",
+    agent_n: "我替你定的（{n}）", superseded: "已经作废的（{n}）", why: "理由", undo: "翻案要花", l_led: "决定 {x}",
+    no_ledger: "DECISIONS.md 里没有决定表和“agent 定的事”，下面是原文。", no_dec: "还没有 DECISIONS.md。",
+    history_sub: "每一轮你说的原话，和之后定了、改了什么（REVIEW.md）。", desk_subs: "审阅台的提交记录", no_history: "还没有记录。",
+    docs_sub: "项目里的文档，原样排版。结构化的页面读不出来的内容，都在这里。", warnings: "这些没能按约定读出来（tools/desk/README.md）",
+    no_docs: "项目里还没有文档。", l_doc: "{f} · {s}",
+    tray_empty: "还没有点评。\n没标的条目都算通过。", sent_live: "已提交，agent 已经在接着做", sent: "已提交：{f}",
+    hint_live: "已写进 {f}，原话也抄进了 REVIEW.md。agent 在等这份反馈，已经自动接着做了，不用再回对话。",
+    hint_idle: "已写进 {f}，原话也抄进了 REVIEW.md。agent 这会儿没在等：回到对话里说一声“看审阅台”。",
+    offline: "没有连上本地服务：回复已复制，粘贴到对话里即可", offline2: "没有连上本地服务：请复制下面的内容", refused: "没有提交成功：{e}",
+    reply_head: "《{p}》{r} 的回复", by_rec: "（按推荐）", rest: "其余没标的都算通过。", round_name: "关卡 {r}", notes_round: "随手点评",
+    submitted: "这一轮已经提交过（{at}）。再提交会另存一份，REVIEW.md 里也会多一节。",
+  },
+  en: {
+    brand: "Review desk", noServer: "Can't read the project: open this page with bin/vh desk <project>.",
+    v_round: "This round", v_concept: "Concept & outline", v_caption: "Captions", v_narration: "Narration", v_script: "Captions / narration",
+    v_board: "Storyboard", v_sound: "Sound", v_facts: "Fact check", v_film: "Film · timecoded notes", v_ledger: "Decision ledger", v_history: "History", v_docs: "Documents",
+    side_project: "This project", side_pages: "Static review pages",
+    stages: ["Route", "Concept · outline", "Style", "Storyboard", "Sound", "Engine", "Scenes", "Self-review", "Draft", "Delivery"], gate_mark: "human gate",
+    st_paused: "Paused", st_round: "Gate {id} · waiting for you", st_none: "In progress",
+    live_on: "The agent is waiting", live_off: "The agent isn't waiting", live_on_tip: "Submit and the agent carries on by itself; no need to go back to the chat",
+    live_off_tip: "After submitting, tell the agent in the chat: “check the desk”", theme: "Dark / light", lang: "中", lang_tip: "切换到中文", reload: "Read the project files again",
+    my: "My notes", submit: "Submit", general: "Overall (optional)", general_ph: "e.g. the pace drags overall; the opening works…", preview: "What will be submitted",
+    submit_hint: "Anything not marked passes. Submissions go to the project's out/review/feedback/, and your words into REVIEW.md.",
+    fb_ok: "✓ OK", fb_change: "✎ Change", fb_ask: "? Question", fb_def: "untouched = approved", ph_change: "What to change, and why", ph_ask: "What's unclear?",
+    ph_suggest: "Change it to… (optional)", agree: "✓ Agree", overturn: "✎ Overturn", def_agree: "untouched = agreed",
+    dec_ok: "✓ As chosen", dec_more: "✎ Add a note", dec_def: "untouched = the option picked above", fact_ok: "✓ Right", fact_bad: "✎ Wrong", fact_unsure: "? Not sure", fact_def: "untouched = not checked",
+    st_ok: "ok", st_change: "change", st_ask: "question",
+    decision_n: "Decision {i}", recommend: "I recommend {r}", rec_chip: "recommended", pro: "Pro", con: "Cost", none_to_decide: "Nothing to decide this round.",
+    least: "Least sure about", delegated: "Decided for you", delegated_sub: "disagree? click “Overturn”", decided: "Already decided", not_reviewed: "Not reviewed here",
+    other_assets: "Other material", appendix: "Appendix", prev_said: "Last round ({r}) you said in the desk · {at}", prev_ok: "plus {n} marked “ok”",
+    changed: "What I changed", overall: "Overall", to_film: "Timecoded notes →", no_round: "No review page yet (out/review/gate-<n>.json). You can still read and comment on every view.",
+    l_least: "Unsure: {x}", l_deleg: "Decided for you: {x}", l_dec: "Decision: {x}",
+    concept: "Concept", spine: "Spine", motif: "Recurring motif", end: "At the end", spec: "Spec", outline: "Outline", outline_tip: "click a block to jump to it",
+    seg_n: "Part {i}", know: "The viewer knows / feels", visual: "Key visual", seg_caps: "{n} lines in this part", to_script: "go through them →", bars: "bars {b}",
+    concept_sub: "The concept in a line, the spine, and the {n} parts laid out in time.", l_concept: "Concept and spine", l_seg: "Outline part {i} {x}",
+    no_outline: "The outline isn't a table yet (BRIEF's Outline section; columns in tools/desk/README.md). Here is the BRIEF as written.", no_brief: "No BRIEF.md yet.",
+    script_sub: "{n} lines by outline part. Reading speed, roughly, from each line's span: Chinese up to {g} chars/s green, {y} yellow; English {eg} / {ey}.",
+    f_all: "All", f_mine: "Marked by me", f_terms: "With a term", f_facts: "With a source #", f_fast: "Maybe too fast",
+    no_script: "SCRIPT.md has no caption or narration table (columns in tools/desk/README.md). Here it is as written.", no_script_file: "No captions or narration yet (SCRIPT.md).",
+    other_seg: "Not matched to the outline", per_s: "/s", chars: "{n} chars · {s} s", none_match: "Nothing matches.", l_cap: "Caption {x}", l_vo: "Narration {x}", term: "Term",
+    board_sub: "Click a frame to play that shot; the current shot lights up while playing; red frames are shots I'm unsure about.", no_shot_caption: "(no caption in this shot)",
+    transition: "Transition: ", unsure: "Unsure: ", no_board: "No shots.json yet (it comes at gate ②). Here is STORYBOARD.md.", no_board_file: "No storyboard yet.", l_shot: "Shot {x}",
+    no_video: "(no video to play; keyframes only)",
+    sound_sub: "The agent can't hear; it reads the score and the loudness. This page is for your ears. {bpm} BPM, {d} s.", comment_at: "Comment at {t}",
+    sec_tip: "blocks are sections, click one to play from there; ticks are notes that land on actions", listen: "Please listen to these", your_sound: "Your sound notes",
+    none_sound: "None yet. When something sounds off, click “Comment at …” above.", roll: "Score and loudness (one row per instrument, darker = louder)",
+    no_music: "No music yet.", sound_label: "Sound {t}", no_audio: "No playable audio found (the gate JSON's music.audio).",
+    facts_sub: "What goes on screen, and the source behind it. Check that the on-screen wording isn't simplified into something wrong.", todo: "Not verified yet",
+    th_id: "#", th_claim: "Item (source wording)", th_kind: "Kind", th_screen: "On screen", th_src: "Source", th_you: "You", dropped: "(dropped)", l_fact: "Fact {x}",
+    no_facts: "NOTES.md has no material table. Here it is as written.", no_notes: "No NOTES.md yet.",
+    film_sub: "Wherever you have something to say, press C or the button to leave a note at that second.",
+    film_list: "notes are listed below in time order", film_none: "No timecoded notes yet.", no_film: "No video this round.", film_label: "Film {t}", del: "Delete",
+    ledger_sub: "Who decides each thing and where it stands; what I decided for you is below, and you can overturn any of it.", th_what: "Decision", th_who: "Who decides", th_status: "Now",
+    agent_n: "Decided for you ({n})", superseded: "Superseded ({n})", why: "Why", undo: "Cost to undo", l_led: "Decision {x}",
+    no_ledger: "DECISIONS.md has no ledger table and no agent decisions. Here it is as written.", no_dec: "No DECISIONS.md yet.",
+    history_sub: "Your words each round, and what was decided and changed after (REVIEW.md).", desk_subs: "Submissions from the desk", no_history: "Nothing yet.",
+    docs_sub: "The project's documents, as written. Whatever the structured views can't read is here.", warnings: "Not read by the contract (tools/desk/README.md)",
+    no_docs: "No documents in the project yet.", l_doc: "{f} · {s}",
+    tray_empty: "No notes yet.\nAnything not marked passes.", sent_live: "Submitted; the agent is on it", sent: "Submitted: {f}",
+    hint_live: "Saved to {f}; your words are in REVIEW.md too. The agent was waiting for this and has carried on; no need to go back to the chat.",
+    hint_idle: "Saved to {f}; your words are in REVIEW.md too. The agent isn't waiting right now: tell it in the chat, “check the desk”.",
+    offline: "Couldn't reach the local server: the reply is copied, paste it into the chat", offline2: "Couldn't reach the local server: copy the text below", refused: "Not submitted: {e}",
+    reply_head: "Reply to {r} of “{p}”", by_rec: " (recommended)", rest: "Everything not marked passes.", round_name: "gate {r}", notes_round: "notes",
+    submitted: "Already submitted this round ({at}). Submitting again saves another copy and adds another section to REVIEW.md.",
+  },
+};
+
+let D = null, ROUND = null, FB = null, KEY = "", VIEW = "round", DOC = "", LANG = "zh", L = STR.zh;
+let capFilter = "all", filmT = 0;
+const TOKEN = (document.querySelector('meta[name="desk-token"]') || {}).content || "";
+const $ = (s, el = document) => el.querySelector(s), $$ = (s, el = document) => [...el.querySelectorAll(s)];
+const esc = (s) => String(s == null ? "" : s).replace(/[&<>"']/g, (c) => ({ "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[c]));
+const t = (k, vars) => String(L[k] != null ? L[k] : STR.en[k] != null ? STR.en[k] : k).replace(/\{(\w+)\}/g, (_, v) => (vars && vars[v] != null ? vars[v] : ""));
+const fmt = (x) => { if (x == null || isNaN(x)) return "–"; const m = Math.floor(x / 60), s = x - m * 60; return `${m}:${s.toFixed(1).padStart(4, "0")}`; };
+const src = (p) => (/^https?:\/\//.test(p || "") ? p : "/p/" + String(p || "").split("/").map(encodeURIComponent).join("/"));
+const isVideo = (p) => /\.(mp4|webm|mov|m4v)$/i.test(p || ""), isImage = (p) => /\.(png|jpe?g|gif|webp|svg|avif)$/i.test(p || ""), isAudio = (p) => /\.(wav|mp3|m4a|ogg|flac|aac|opus)$/i.test(p || "");
+const cut = (s, n) => (String(s).length > n ? String(s).slice(0, n) + "…" : String(s));
+const store = {
+  get(k) { try { return JSON.parse(localStorage.getItem(k)); } catch (e) { return null; } },
+  set(k, v) { try { localStorage.setItem(k, JSON.stringify(v)); } catch (e) { /* private window: the draft just isn't kept */ } },
+};
+function toast(m) { const el = $("#toast"); el.textContent = m; el.classList.add("show"); clearTimeout(el._h); el._h = setTimeout(() => el.classList.remove("show"), 3200); }
+function cssVar(v) { return getComputedStyle(document.documentElement).getPropertyValue(v).trim(); }
+const SEGC = () => ["--seg1", "--seg2", "--seg3", "--seg4", "--seg5", "--seg6"].map(cssVar);
+function segColor(id) { const i = D.outline.findIndex((o) => o.id === id); const c = SEGC(); return i < 0 ? cssVar("--soft") : c[i % c.length]; }
+function partColor(part) { let h = 0; for (const ch of String(part)) h = (h * 31 + ch.charCodeAt(0)) >>> 0; return SEGC()[h % 6]; }
+try { const th = localStorage.getItem("desk:theme"); if (th) document.documentElement.dataset.theme = th; } catch (e) { /* no storage */ }
+
+const VIEWS = ["round", "concept", "script", "board", "sound", "facts", "film", "ledger", "history", "docs"];
+const KIND = { dec: "round", least: "round", deleg: "round", concept: "concept", seg: "concept", cap: "script", shot: "board", atime: "sound", fact: "facts", time: "film", led: "ledger", doc: "docs" };
+
+// ---------- load ----------
+async function load() {
+  let data = null;
+  try { const r = await fetch("/api/data", { cache: "no-store" }); if (r.ok) data = await r.json(); } catch (e) { /* server down */ }
+  if (!data) { $("#view").innerHTML = `<div class="empty">${esc(t("noServer"))}</div>`; return; }
+  D = data;
+  let pick = null; try { pick = localStorage.getItem("desk:lang"); } catch (e) { /* no storage */ }
+  setLang(pick === "zh" || pick === "en" ? pick : D.lang === "en" ? "en" : "zh");
+  ROUND = D.rounds[D.rounds.length - 1] || { id: "notes", gate: "", data: { decisions: [], least_sure: [], decided: [], delegated: [], assets: [], appendix: [], listen: [] } };
+  KEY = `desk:${D.project.slug}:${ROUND.id}`;
+  FB = store.get(KEY) || { decisions: {}, items: {}, general: "" };
+  $("#general").value = FB.general || "";
+  $("#ptitle").textContent = D.project.title;
+  renderChrome(); route();
+}
+function save() { store.set(KEY, FB); renderSide(); renderCount(); }
+function setLang(l) {
+  LANG = l; L = STR[l]; document.documentElement.lang = l === "zh" ? "zh-CN" : "en";
+  document.title = `${t("brand")}${D ? " · " + D.project.title : ""}`;
+  $("#brand").textContent = t("brand"); $("#myLabel").textContent = t("my"); $("#trayTitle").textContent = t("my");
+  $("#submitTop").textContent = t("submit"); $("#submit").textContent = t("submit"); $("#generalLabel").textContent = t("general");
+  $("#general").placeholder = t("general_ph"); $("#previewLabel").textContent = t("preview"); $("#submitHint").textContent = t("submit_hint");
+  $("#lang").textContent = t("lang"); $("#lang").title = t("lang_tip"); $("#theme").title = t("theme"); $("#reload").title = t("reload");
+}
+
+// ---------- chrome ----------
+function renderChrome() {
+  const ps = $("#pstatus");
+  ps.textContent = D.project.paused ? t("st_paused") : D.rounds.length ? t("st_round", { id: ROUND.id }) : t("st_none");
+  ps.className = "pill" + (D.project.paused ? " paused" : "");
+  const gates = { 1: "①", 3: "②", 8: "③" };
+  $("#rail").innerHTML = L.stages.map((n, i) => `${i ? '<span class="sep"></span>' : ""}<li class="${i < D.stage ? "done" : i === D.stage ? "current" : ""}"><span class="st">${i} ${esc(n)}</span>${gates[i] ? `<span class="gate" title="${esc(t("gate_mark"))}">${gates[i]}</span>` : ""}</li>`).join("");
+  pollLive();
+}
+function viewName(v) { return v === "script" ? t(D.captions.kind === "narration" ? "v_narration" : D.captions.kind === "caption" ? "v_caption" : "v_script") : t("v_" + v); }
+function marked(view) { return Object.entries(FB.items).filter(([k, v]) => KIND[k.split(":")[0]] === view && v.status && v.status !== "ok").length; }
+function renderSide() {
+  const n = { script: D.captions.rows.length, board: (D.shots.items || []).length, facts: D.facts.filter((f) => !f.dropped).length,
+    ledger: D.agent_decided.filter((a) => !a.superseded).length, history: D.history.length, docs: D.docs.length };
+  const need = (ROUND.data.decisions || []).length;
+  $("#side").innerHTML = `<h6>${esc(t("side_project"))}</h6>` + VIEWS.map((id) => {
+    const c = marked(id);
+    const extra = id === "round" && need ? `<span class="cnt">${need}${c ? ` · <b>${c} ✎</b>` : ""}</span>` : n[id] ? `<span class="cnt">${n[id]}${c ? ` · <b>${c} ✎</b>` : ""}</span>` : c ? `<span class="cnt"><b>${c} ✎</b></span>` : "";
+    return `<a href="#${id}" class="${VIEW === id ? "on" : ""}"><span>${esc(viewName(id))}</span>${extra}</a>`;
+  }).join("") + (D.rounds.some((r) => r.page) ? `<h6>${esc(t("side_pages"))}</h6>` + D.rounds.filter((r) => r.page).map((r) => `<a href="${esc(src(r.page))}" target="_blank" rel="noopener"><span>gate-${esc(r.id)}</span><span class="cnt">↗</span></a>`).join("") : "");
+}
+function renderCount() { $("#cnt").textContent = Object.values(FB.items).filter((v) => v.status).length + (FB.general ? 1 : 0); }
+function route() {
+  const h = decodeURIComponent((location.hash || "#round").slice(1)), [v, ...rest] = h.split("/");
+  VIEW = VIEWS.includes(v) ? v : "round"; DOC = VIEW === "docs" ? rest.join("/") : DOC;
+  renderSide(); renderCount(); render();
+}
+window.addEventListener("hashchange", route);
+
+// ---------- the ✓ / ✎ / ? control ----------
+function fbCtl(target, label, opt = {}) {
+  const v = FB.items[target] || {}, st = v.status || "";
+  const lab = opt.labels || [t("fb_ok"), t("fb_change"), t("fb_ask")];
+  return `<div class="fb" data-target="${esc(target)}" data-label="${esc(label)}"${opt.suggest != null ? ` data-orig="${esc(opt.suggest)}"` : ""}${opt.t != null ? ` data-t="${opt.t}"` : ""}${opt.labels ? ` data-labels="${esc(JSON.stringify(opt.labels))}"` : ""}${opt.def ? ` data-def="${esc(opt.def)}"` : ""}>
+    <span class="seg3"><button type="button" data-st="ok" class="${st === "ok" ? "on" : ""}">${esc(lab[0])}</button><button type="button" data-st="change" class="${st === "change" ? "on" : ""}">${esc(lab[1])}</button><button type="button" data-st="ask" class="${st === "ask" ? "on" : ""}">${esc(lab[2])}</button></span>
+    ${st ? "" : `<span class="def">${esc(opt.def || t("fb_def"))}</span>`}
+    <div class="fb-more" ${st === "change" || st === "ask" ? "" : "hidden"}>
+      <textarea rows="2" data-k="text" placeholder="${esc(st === "ask" ? t("ph_ask") : t("ph_change"))}">${esc(v.text || "")}</textarea>
+      ${opt.suggest != null && st === "change" ? `<input data-k="suggest" placeholder="${esc(t("ph_suggest"))}" value="${esc(v.suggest != null ? v.suggest : opt.suggest)}">` : ""}
+    </div></div>`;
+}
+document.addEventListener("click", (e) => {
+  const b = e.target.closest(".fb .seg3 button"); if (!b) return;
+  const box = b.closest(".fb"), tgt = box.dataset.target, cur = FB.items[tgt] || {};
+  const st = cur.status === b.dataset.st ? "" : b.dataset.st;
+  if (!st) delete FB.items[tgt];
+  else FB.items[tgt] = Object.assign({}, cur, { status: st, label: box.dataset.label }, box.dataset.t ? { t: +box.dataset.t } : {}, box.dataset.orig != null ? { orig: box.dataset.orig } : {});
+  save(); refreshFb(box);
+});
+document.addEventListener("input", (e) => {
+  const el = e.target.closest(".fb-more [data-k]"); if (!el) return;
+  const tgt = el.closest(".fb").dataset.target; FB.items[tgt] = Object.assign({}, FB.items[tgt] || {}, { [el.dataset.k]: el.value }); store.set(KEY, FB);
+});
+function refreshFb(box) {
+  const wrap = document.createElement("div");
+  wrap.innerHTML = fbCtl(box.dataset.target, box.dataset.label, { suggest: box.dataset.orig != null ? box.dataset.orig : null, t: box.dataset.t != null ? box.dataset.t : null,
+    labels: box.dataset.labels ? JSON.parse(box.dataset.labels) : null, def: box.dataset.def || null });
+  const nb = wrap.firstElementChild; box.replaceWith(nb);
+  const host = nb.closest("[data-mark]"); if (host) markHost(host);
+  const ta = nb.querySelector("textarea"); if (ta && !nb.querySelector(".fb-more").hidden) ta.focus();
+}
+function markHost(host) { const st = (FB.items[host.dataset.mark] || {}).status; host.classList.toggle("marked", !!st); host.classList.toggle("st-ok", st === "ok"); host.classList.toggle("st-ask", st === "ask"); }
+
+// ---------- views ----------
+const VIEWFN = { round: vRound, concept: vConcept, script: vScript, board: vBoard, sound: vSound, facts: vFacts, film: vFilm, ledger: vLedger, history: vHistory, docs: vDocs };
+const WIRE = { round: wireRound, script: wireScript, board: wireBoard, sound: wireSound, film: wireFilm, concept: wireConcept };
+function render() {
+  $("#view").innerHTML = VIEWFN[VIEW]();
+  $$("[data-mark]").forEach(markHost);
+  document.onkeydown = null;   // the film view sets its own C key
+  (WIRE[VIEW] || (() => {}))();
+  window.scrollTo(0, 0);
+}
+const COLON = () => (LANG === "zh" ? "：" : ": ");
+const atTime = (id) => esc(t("comment_at", { t: "\u0001" })).replace("\u0001", `<span id="${id}">0:00.0</span>`);   // "在 0:12.4 处点评"
+const docOf = (f) => D.docs.find((d) => d.file === f);
+function docHtml(doc, onlySection) {
+  if (!doc) return "";
+  const secs = onlySection ? doc.sections.filter((s) => onlySection.test(s.title)) : doc.sections;
+  return `<div class="md">${onlySection ? "" : doc.intro}${secs.map((s) => `<h2>${esc(s.title)}</h2>${s.html}`).join("")}</div>`;
+}
+function fallback(note, file, onlySection) {
+  const doc = docOf(file); if (!doc) return "";
+  const part = onlySection && doc.sections.some((s) => onlySection.test(s.title)) ? onlySection : null;
+  return `<p class="note">${esc(note)}</p><div class="card" data-mark="doc:${esc(file)}">${docHtml(doc, part)}${fbCtl("doc:" + file, file)}</div>`;
+}
+function media(a, opts = {}) {
+  const cap = a.caption ? `<figcaption>${esc(a.caption)}</figcaption>` : "";
+  if (isVideo(a.path)) return `<figure class="media"><video src="${esc(src(a.path))}"${a.poster ? ` poster="${esc(src(a.poster))}"` : ""} controls preload="metadata"${opts.id ? ` id="${opts.id}"` : ""}></video>${cap}</figure>`;
+  if (isImage(a.path)) return `<figure class="media"><a href="${esc(src(a.path))}" target="_blank" rel="noopener"><img src="${esc(src(a.path))}" alt="" loading="lazy"></a>${cap}</figure>`;
+  if (isAudio(a.path)) return `<figure class="media"><audio src="${esc(src(a.path))}" controls preload="metadata" style="width:100%"></audio>${cap}</figure>`;
+  return `<p class="small"><a href="${esc(src(a.path))}" target="_blank" rel="noopener">${esc(a.path)}</a>${a.caption ? " · " + esc(a.caption) : ""}</p>`;
+}
+const filmAsset = () => { const g = ROUND.data; const want = typeof g.film === "string" ? g.film : ""; return (g.assets || []).find((a) => a && (want ? a.path === want : isVideo(a.path))) || (want ? { path: want } : null); };
+
+function vRound() {
+  const g = ROUND.data, ST = { ok: [t("st_ok"), "ok"], change: [t("st_change"), "chg"], ask: [t("st_ask"), "acc"] };
+  if (!D.rounds.length) return `<h1>${esc(t("v_round"))}</h1><p class="note">${esc(t("no_round"))}</p>`;
+  const prev = [...D.feedback].reverse().find((f) => f.round !== ROUND.id);
+  const last = [...D.history].reverse().find((h) => h.notes.length);
+  const decs = (g.decisions || []).map((d, i) => {
+    const pick = FB.decisions[d.id] || d.recommend;
+    return `<div class="card dec"><div class="tiny muted">${esc(t("decision_n", { i: i + 1 }))}${d.cost ? " · " + esc(d.cost) : ""}</div><p class="q">${esc(d.question || "")}</p>
+      ${d.recommend ? `<div class="small muted">${esc(t("recommend", { r: d.recommend }))}${d.why ? COLON() + esc(d.why) : ""}</div>` : ""}
+      <div class="opts">${(d.options || []).map((o) => `<label class="opt ${pick === o.id ? "on" : ""}"><input type="radio" name="dec-${esc(d.id)}" value="${esc(o.id)}" ${pick === o.id ? "checked" : ""} data-dec="${esc(d.id)}">
+        <div><div class="l">${esc(o.id)}${o.label ? " · " + esc(o.label) : ""} ${o.id === d.recommend ? `<span class="chip acc">${esc(t("rec_chip"))}</span>` : ""}</div>
+        ${o.pro || o.con ? `<div class="pc"><div class="p"><b>${esc(t("pro"))}</b>${esc(o.pro || "")}</div><div class="c"><b>${esc(t("con"))}</b>${esc(o.con || "")}</div></div>` : ""}</div></label>`).join("")}</div>
+      ${(g.assets || []).filter((a) => a && a.for === d.id && !isVideo(a.path)).map((a) => media(a)).join("")}
+      ${fbCtl("dec:" + d.id, t("l_dec", { x: d.question || d.id }), { labels: [t("dec_ok"), t("dec_more"), t("fb_ask")], def: t("dec_def") })}</div>`;
+  }).join("");
+  const vids = (g.assets || []).filter((a) => a && isVideo(a.path));
+  const film = filmAsset();
+  const side = vids.map((a, i) => media(a) + (i === 0 && film ? `<div class="small" style="margin:-8px 0 14px"><a href="#film">${esc(t("to_film"))}</a></div>` : "")).join("");
+  const least = (g.least_sure || []).map((l, i) => { const k = "least:" + (l.id || i); return `<div class="card" data-mark="${esc(k)}"><b>${esc(l.id || "")}</b><div class="small" style="margin-top:4px">${esc(l.note || "")}</div>${fbCtl(k, t("l_least", { x: l.id || cut(l.note, 24) }))}</div>`; }).join("");
+  const deleg = (g.delegated || []).map((x, i) => `<div class="card" data-mark="deleg:${i}"><div class="small">${esc(x)}</div>${fbCtl("deleg:" + i, t("l_deleg", { x: cut(x, 28) }), { labels: [t("agree"), t("overturn"), t("fb_ask")], def: t("def_agree") })}</div>`).join("");
+  const others = (g.assets || []).filter((a) => a && !isVideo(a.path) && !(g.decisions || []).some((d) => d.id === a.for)).map((a) => media(a)).join("");
+  const appendix = (g.appendix || []).map((a) => a && (a.html ? `<details class="card" style="margin-bottom:10px"><summary>${esc(a.title || "")}</summary><div class="md">${a.html}</div></details>`
+    : a.path ? `<div class="card small" style="margin-bottom:10px">${esc(a.title || "")} · ${docOf(a.path) ? `<a href="#docs/${esc(a.path)}">${esc(a.path)}</a>` : `<a href="${esc(src(a.path))}" target="_blank" rel="noopener">${esc(a.path)}</a>`}</div>` : "")).join("");
+  const before = prev || last ? `<div class="card" style="margin-bottom:18px">
+      ${prev ? `<div class="tiny muted">${esc(t("prev_said", { r: prev.round, at: prev.submitted_at.replace("T", " ") }))}</div>
+        <div style="margin:6px 0 4px">${Object.entries(prev.decisions).map(([k, v]) => `<span class="chip acc">${esc(k)}: ${esc(v)}</span>`).join("")}</div>
+        ${prev.items.filter((i) => i.status !== "ok" || i.text).map((i) => `<div class="small" style="margin:4px 0"><span class="chip ${(ST[i.status] || ST.ok)[1]}">${esc((ST[i.status] || ST.ok)[0])}</span>${esc(i.label)}${i.text ? `${COLON()}<b style="font-weight:500">${esc(String(i.text).trim())}</b>` : ""}</div>`).join("")}
+        ${prev.general ? `<div class="small" style="margin-top:4px"><span class="chip">${esc(t("overall"))}</span>${esc(prev.general)}</div>` : ""}
+        <div class="tiny muted" style="margin-top:4px">${esc(t("prev_ok", { n: prev.items.filter((i) => i.status === "ok" && !i.text).length }))}</div>` : ""}
+      ${last ? `<div class="tiny muted" style="margin-top:10px">${esc(t("changed"))} · ${esc(last.title)}</div><ul class="small" style="margin:4px 0 0;padding-left:18px">${last.notes.map((n) => `<li>${esc(n.k)}${COLON()}${esc(n.v)}</li>`).join("")}</ul>` : ""}</div>` : "";
+  const sent = FB.submittedAt ? `<p class="note">${esc(t("submitted", { at: FB.submittedAt }))}</p>` : "";
+  return `<h1>${esc(g.title || t("st_round", { id: ROUND.id }))}</h1><p class="sub">${esc(g.summary || "")}</p>${sent}${before}
+    <div class="grid g2" style="align-items:start"><div>${decs || `<div class="card muted">${esc(t("none_to_decide"))}</div>`}</div><div>${side}</div></div>
+    ${least ? `<h2>${esc(t("least"))} <span class="tiny muted">（${(g.least_sure || []).length}）</span></h2><div class="grid g3">${least}</div>` : ""}
+    ${deleg ? `<h2>${esc(t("delegated"))} <span class="tiny muted">${esc(t("delegated_sub"))}</span></h2><div class="grid g3">${deleg}</div>` : ""}
+    ${(g.decided || []).length ? `<h2>${esc(t("decided"))}</h2><div class="card small"><ul style="margin:0;padding-left:18px">${g.decided.map((x) => `<li>${esc(x)}</li>`).join("")}</ul></div>` : ""}
+    ${g.not_reviewed ? `<p class="small muted" style="margin-top:14px">${esc(t("not_reviewed"))}${COLON()}${esc(g.not_reviewed)}</p>` : ""}
+    ${others ? `<h2>${esc(t("other_assets"))}</h2><div class="grid g3">${others}</div>` : ""}
+    ${appendix ? `<h2>${esc(t("appendix"))}</h2>${appendix}` : ""}`;
+}
+function wireRound() { $$("input[data-dec]").forEach((r) => r.addEventListener("change", () => { FB.decisions[r.dataset.dec] = r.value; save(); render(); })); }
+
+function vConcept() {
+  const c = D.concept, O = D.outline.filter((o) => o.t0 != null && o.t1 != null), total = O.length ? Math.max(...O.map((o) => o.t1)) : 0;
+  if (!docOf("BRIEF.md")) return `<h1>${esc(t("v_concept"))}</h1><div class="empty">${esc(t("no_brief"))}</div>`;
+  const specGet = (k) => (D.spec.find((s) => s.k.toLowerCase().startsWith(k)) || {}).v || "";
+  const head = `<div class="card" data-mark="concept:line"><div class="tiny muted">${esc(t("concept"))}</div><div class="serif" style="font-size:21px;line-height:1.5;margin:4px 0 10px">${esc(c.line || "—")}</div>
+    <dl class="kv">${c.spine ? `<dt>${esc(t("spine"))}</dt><dd>${esc(c.spine)}</dd>` : ""}${c.motif ? `<dt>${esc(t("motif"))}</dt><dd>${esc(c.motif)}</dd>` : ""}${c.end ? `<dt>${esc(t("end"))}</dt><dd>${esc(c.end)}</dd>` : ""}
+    <dt>${esc(t("spec"))}</dt><dd>${["output", "effort", "watch on", "review language"].map(specGet).filter(Boolean).map((x) => `<span class="chip">${esc(x.split("（")[0].split("  ")[0])}</span>`).join("")}</dd></dl>
+    ${fbCtl("concept:line", t("l_concept"))}</div>`;
+  if (!D.outline.length) return `<h1>${esc(t("v_concept"))}</h1>${head}<h2>${esc(t("outline"))}</h2>${fallback(t("no_outline"), "BRIEF.md", /^(Outline|大纲)/i)}`;
+  const bar = O.length ? `<div class="tbar">${O.map((o) => `<div data-seg="${esc(o.id)}" style="flex:${Math.max(0.1, o.t1 - o.t0).toFixed(2)};background:${segColor(o.id)}">${esc(o.title)}</div>`).join("")}</div><div class="tticks">${[0, 0.25, 0.5, 0.75, 1].map((f) => `<span>${fmt(total * f)}</span>`).join("")}</div>` : "";
+  const segs = D.outline.map((o, i) => {
+    const caps = D.captions.rows.filter((x) => x.seg === o.id);
+    const when = o.t0 != null ? `${fmt(o.t0)}–${fmt(o.t1)}${o.t1 != null ? ` · ${(o.t1 - o.t0).toFixed(0)} s` : ""}` : "";
+    return `<div class="card segcard" id="seg-${esc(o.id)}" data-mark="seg:${esc(o.id)}"><div class="stripe" style="background:${segColor(o.id)}"></div><div>
+      <div style="display:flex;justify-content:space-between;gap:10px;flex-wrap:wrap"><div><span class="tiny muted">${esc(t("seg_n", { i: o.id || i + 1 }))}</span> <b style="font-size:16px">${esc(o.title)}</b>${o.tag ? `<span class="tag">${esc(o.tag)}</span>` : ""} ${o.stage && o.stage !== "—" ? `<span class="chip acc">${esc(o.stage)}</span>` : ""}</div>
+        <span class="tiny muted">${when}${o.bars ? ` · ${esc(t("bars", { b: o.bars }))}` : ""}</span></div>
+      ${o.know ? `<div style="margin-top:6px"><span class="chip">${esc(t("know"))}</span>${esc(o.know)}</div>` : ""}
+      ${o.visual ? `<div class="small muted" style="margin-top:4px"><span class="chip">${esc(t("visual"))}</span>${esc(o.visual)}</div>` : ""}
+      ${caps.length ? `<details style="margin-top:8px"><summary class="small">${esc(t("seg_caps", { n: caps.length }))}</summary>${caps.map((x) => `<div class="segcap serif"><span class="id">${esc(x.id)}</span>${esc(x.text)}</div>`).join("")}<div class="tiny"><a href="#script">${esc(t("to_script"))}</a></div></details>` : ""}
+      ${fbCtl("seg:" + o.id, t("l_seg", { i: o.id, x: o.title }))}</div></div>`;
+  }).join("");
+  return `<h1>${esc(t("v_concept"))}</h1><p class="sub">${esc(t("concept_sub", { n: D.outline.length }))}</p>${head}
+    <h2>${esc(t("outline"))} <span class="tiny muted">${O.length ? esc(t("outline_tip")) : ""}</span></h2>${bar}<div class="grid">${segs}</div>`;
+}
+function wireConcept() { $$(".tbar [data-seg]").forEach((el) => el.addEventListener("click", () => { const s = document.getElementById("seg-" + el.dataset.seg); if (s) s.scrollIntoView({ behavior: "smooth", block: "center" }); })); }
+
+const SPEED = { zh: [6, 9], en: [15, 20] };
+function speed(x) {
+  const cjk = /[㐀-鿿]/.test(x.text), n = cjk ? (x.text.match(/[㐀-鿿A-Za-z0-9]/g) || []).length : x.text.trim().length;
+  const s = x.t0 != null && x.t1 != null ? Math.max(0.1, x.t1 - x.t0) : null, lim = SPEED[cjk ? "zh" : "en"];
+  return { n, s, r: s ? n / s : null, lim };
+}
+function vScript() {
+  const C = D.captions;
+  if (!C.rows.length) return `<h1>${esc(viewName("script"))}</h1>` + (docOf("SCRIPT.md") ? fallback(t("no_script"), "SCRIPT.md") : `<div class="empty">${esc(t("no_script_file"))}</div>`);
+  const keep = (x) => capFilter === "all" || (capFilter === "mine" && FB.items["cap:" + x.id]) || (capFilter === "terms" && x.term) || (capFilter === "facts" && x.facts.length) || (capFilter === "fast" && speed(x).r > speed(x).lim[0]);
+  const lab = C.kind === "narration" ? "l_vo" : "l_cap";
+  const row = (x) => {
+    const sp = speed(x), col = sp.r == null ? "var(--faint)" : sp.r <= sp.lim[0] ? "var(--ok)" : sp.r <= sp.lim[1] ? "var(--chg)" : "var(--bad)";
+    return `<div class="cap" id="cap-${esc(x.id)}" data-mark="cap:${esc(x.id)}"><div><div class="id">${esc(x.id)}</div><div class="tm">${x.t0 != null ? fmt(x.t0) : esc(x.bars)}</div></div>
+      <div>${x.term ? `<div class="term" title="${esc(t("term"))}">${esc(x.term)}</div><br>` : ""}<div class="txt serif">${esc(x.text)}</div>${x.visual ? `<div class="vis">${esc(t("visual"))}${COLON()}${esc(x.visual)}</div>` : ""}
+        <div class="meter">${sp.r != null ? `<span>${esc(t("chars", { n: sp.n, s: sp.s.toFixed(1) }))}</span><span class="bar"><i style="width:${Math.min(100, (sp.r / (sp.lim[1] * 1.2)) * 100)}%;background:${col}"></i></span><span style="color:${col}">${sp.r.toFixed(1)}${esc(t("per_s"))}</span>` : ""}${x.facts.map((f) => `<a class="chip acc" href="#facts">${esc(f)}</a>`).join("")}</div></div>
+      <div>${fbCtl("cap:" + x.id, t(lab, { x: x.id }), { suggest: x.text })}</div></div>`;
+  };
+  const groups = D.outline.map((o) => ({ o, rows: C.rows.filter((x) => x.seg === o.id && keep(x)) })).concat([{ o: null, rows: C.rows.filter((x) => !D.outline.some((o) => o.id === x.seg) && keep(x)) }]);
+  const html = groups.filter((g) => g.rows.length).map(({ o, rows }) => `<div class="capgroup"><div class="gh">${o ? `<i style="background:${segColor(o.id)}"></i><span>${esc(t("seg_n", { i: o.id }))} · ${esc(o.title)}</span>${o.stage && o.stage !== "—" ? `<span class="chip acc" style="font-weight:400">${esc(o.stage)}</span>` : ""}${o.t0 != null ? `<span class="tiny muted" style="font-weight:400">${fmt(o.t0)}–${fmt(o.t1)}</span>` : ""}` : `<span>${esc(t("other_seg"))}</span>`}</div>${rows.map(row).join("")}</div>`).join("");
+  const F = [["all", "f_all"], ["mine", "f_mine"], ["terms", "f_terms"], ["facts", "f_facts"], ["fast", "f_fast"]].filter(([k]) => k !== "terms" || C.rows.some((x) => x.term));
+  return `<h1>${esc(viewName("script"))}</h1><p class="sub">${esc(t("script_sub", { n: C.rows.length, g: SPEED.zh[0], y: SPEED.zh[1], eg: SPEED.en[0], ey: SPEED.en[1] }))}</p>
+    <div class="filters">${F.map(([k, n]) => `<button type="button" data-f="${k}" class="${capFilter === k ? "on" : ""}">${esc(t(n))}</button>`).join("")}</div>${html || `<div class="empty">${esc(t("none_match"))}</div>`}`;
+}
+function wireScript() { $$(".filters button").forEach((b) => b.addEventListener("click", () => { capFilter = b.dataset.f; render(); })); }
+
+function vBoard() {
+  const S = D.shots.items || [];
+  if (!S.length) return `<h1>${esc(t("v_board"))}</h1>` + (docOf("STORYBOARD.md") ? fallback(t("no_board"), "STORYBOARD.md") : `<div class="empty">${esc(t("no_board_file"))}</div>`);
+  const timed = S.filter((s) => s.start != null && s.end != null);
+  const track = timed.map((s) => `<div data-shot="${esc(s.id)}" class="${s.unsure ? "unsure" : ""}" style="flex:${Math.max(0.1, s.end - s.start).toFixed(2)};background:${segColor(s.seg)}">${esc(s.id)}</div>`).join("");
+  const cards = S.map((s) => `<div class="card shot ${s.unsure ? "unsure" : ""}" id="shot-${esc(s.id)}" data-id="${esc(s.id)}" data-mark="shot:${esc(s.id)}">
+      <div class="thumb" data-shot="${esc(s.id)}">${s.frame ? `<img src="${esc(src(s.frame))}" alt="" loading="lazy">` : ""}<span class="sid">${esc(s.id)}</span>${s.start != null ? `<span class="play">▶ ${fmt(s.start)}–${fmt(s.end)}</span>` : ""}</div>
+      <div class="body"><div class="lab">${esc(s.label || "")} <span class="tiny muted">${esc(s.segment || "")}${s.start != null && s.end != null ? ` · ${(s.end - s.start).toFixed(1)} s` : ""}</span></div>
+        ${s.caption ? `<div class="capline serif">${esc(s.caption)}</div>` : `<div class="tiny muted" style="margin-top:6px">${esc(t("no_shot_caption"))}</div>`}
+        ${s.reads.length ? `<ul>${s.reads.map((r) => `<li>${esc(r)}</li>`).join("")}</ul>` : ""}
+        ${s.transition ? `<div class="tiny muted" style="margin-top:6px">${esc(t("transition"))}${esc(s.transition)}</div>` : ""}
+        ${s.unsure ? `<div class="unsure-note">${esc(t("unsure"))}${esc(typeof s.unsure === "string" ? s.unsure : "")}</div>` : ""}
+        ${fbCtl("shot:" + s.id, t("l_shot", { x: s.id }))}</div></div>`).join("");
+  const player = D.shots.video ? `<div class="player"><video id="bv" src="${esc(src(D.shots.video))}" controls preload="metadata"></video>${track ? `<div class="strack">${track}<div class="playhead" id="bph"></div></div>` : ""}</div>` : `<p class="small muted">${esc(t("no_video"))}</p>`;
+  return `<h1>${esc(t("v_board"))}</h1><p class="sub">${esc(D.shots.note ? D.shots.note + " · " : "")}${esc(t("board_sub"))}</p>${player}<div class="grid g3">${cards}</div>`;
+}
+function wireBoard() {
+  const v = $("#bv"); if (!v) return;
+  const S = (D.shots.items || []).filter((s) => s.start != null && s.end != null), total = S.length ? Math.max(...S.map((s) => s.end)) : 1; let stopAt = null;
+  const go = (id) => { const s = S.find((x) => x.id === id); if (!s) return; v.currentTime = s.start + 0.01; stopAt = s.end; v.play(); };
+  $$("[data-shot]").forEach((el) => el.addEventListener("click", () => go(el.dataset.shot)));
+  v.addEventListener("timeupdate", () => {
+    if (stopAt != null && v.currentTime >= stopAt - 0.03) { v.pause(); stopAt = null; }
+    const ph = $("#bph"); if (ph) ph.style.left = Math.min(100, (v.currentTime / total) * 100) + "%";
+    const cur = S.find((s) => v.currentTime >= s.start && v.currentTime < s.end);
+    $$(".shot").forEach((c) => c.classList.toggle("active", !!cur && c.dataset.id === cur.id));
+  });
+}
+
+function vSound() {
+  const M = D.music;
+  if (!M || (!M.audio && !(M.sections || []).length)) return `<h1>${esc(t("v_sound"))}</h1><div class="empty">${esc(t("no_music"))}</div>`;
+  const dur = M.duration || Math.max(1, ...(M.sections || []).map((s) => s.end));
+  const secs = (M.sections || []).map((s, i) => `<div data-t="${s.start}" title="${esc(s.name)}" style="flex:${Math.max(0.05, s.end - s.start).toFixed(2)};background:${SEGC()[i % 6]}">${esc(s.label || s.name)}</div>`).join("");
+  const hits = (M.hits || []).map((h) => `<i style="left:${(h.t / dur) * 100}%;background:${partColor(h.part)}" title="${esc(h.part)} ${fmt(h.t)}"></i>`).join("");
+  const listen = (ROUND.data.listen || []).map((l) => `<button class="btn" type="button" data-seek="${l.t}">▶ ${fmt(l.t)} · ${esc(l.note)}</button>`).join("");
+  const tcs = Object.entries(FB.items).filter(([k]) => k.startsWith("atime:")).sort((a, b) => a[1].t - b[1].t);
+  return `<h1>${esc(t("v_sound"))}</h1><p class="sub">${esc(t("sound_sub", { bpm: M.bpm || "–", d: (+dur).toFixed(1) }))}</p>
+    <div class="card">${M.audio ? `<audio id="au" src="${esc(src(M.audio))}" controls preload="metadata" style="width:100%"></audio>` : `<p class="small muted">${esc(t("no_audio"))}</p>`}
+      ${secs ? `<div class="secbar" id="secbar">${secs}<div class="playhead" id="aph"></div></div><div class="hits">${hits}</div>` : ""}
+      ${M.audio ? `<div style="display:flex;gap:8px;align-items:center;margin-top:8px;flex-wrap:wrap"><button class="btn" type="button" id="atc">${atTime("atnow")}</button><span class="tiny muted">${esc(t("sec_tip"))}</span></div>` : ""}</div>
+    ${listen ? `<h2>${esc(t("listen"))}</h2><div class="listen">${listen}</div>` : ""}
+    <h2>${esc(t("your_sound"))} <span class="tiny muted">（${tcs.length}）</span></h2>
+    <div>${tcs.map(([k, v]) => `<div class="card" style="margin-bottom:10px" data-mark="${esc(k)}"><span class="chip acc" data-seek="${v.t}">${fmt(v.t)}</span>${fbCtl(k, t("sound_label", { t: fmt(v.t) }), { t: v.t })}</div>`).join("") || `<div class="muted small">${esc(t("none_sound"))}</div>`}</div>
+    ${M.roll ? `<details style="margin-top:22px"><summary>${esc(t("roll"))}</summary><img class="roll" src="${esc(src(M.roll))}" alt="" loading="lazy"></details>` : ""}`;
+}
+function wireSound() {
+  const a = $("#au"); if (!a) return;
+  const dur = D.music.duration || 1;
+  $$("[data-seek]").forEach((b) => b.addEventListener("click", () => { a.currentTime = +b.dataset.seek; a.play(); }));
+  $$("#secbar [data-t]").forEach((b) => b.addEventListener("click", () => { a.currentTime = +b.dataset.t; a.play(); }));
+  a.addEventListener("timeupdate", () => { const ph = $("#aph"); if (ph) ph.style.left = Math.min(100, (a.currentTime / (a.duration || dur)) * 100) + "%"; $("#atnow").textContent = fmt(a.currentTime); });
+  $("#atc").addEventListener("click", () => { const x = +a.currentTime.toFixed(1); a.pause(); FB.items["atime:" + x] = { status: "change", label: t("sound_label", { t: fmt(x) }), t: x, text: "" }; save(); render(); const ta = $(`[data-target="atime:${x}"] textarea`); if (ta) ta.focus(); });
+}
+
+function vFacts() {
+  if (!D.facts.length) return `<h1>${esc(t("v_facts"))}</h1>` + (docOf("NOTES.md") ? fallback(t("no_facts"), "NOTES.md") : `<div class="empty">${esc(t("no_notes"))}</div>`);
+  const rows = D.facts.map((f) => `<tr class="${f.dropped ? "dropped" : ""}" id="fact-${esc(f.id.slice(1))}" data-mark="fact:${esc(f.id)}"><td><b>${esc(f.id)}</b><div class="tiny muted">${esc(f.kind)}</div></td>
+      <td>${esc(f.claim)}${f.dropped ? `<div class="tiny">${esc(t("dropped"))}</div>` : ""}</td><td class="serif">${esc(f.onscreen)}</td><td class="small muted">${esc(f.source)}</td>
+      <td style="min-width:230px">${f.dropped || !f.id ? "" : fbCtl("fact:" + f.id, t("l_fact", { x: f.id }), { labels: [t("fact_ok"), t("fact_bad"), t("fact_unsure")], def: t("fact_def") })}</td></tr>`).join("");
+  return `<h1>${esc(t("v_facts"))}</h1><p class="sub">${esc(t("facts_sub"))}</p>
+    ${D.fact_todo.length ? `<div class="card" style="margin-bottom:16px"><b class="small">${esc(t("todo"))}</b><ul class="small" style="margin:6px 0 0;padding-left:18px">${D.fact_todo.map((x) => `<li>${x.done ? "✓ " : ""}${esc(x.text)}</li>`).join("")}</ul></div>` : ""}
+    <div style="overflow-x:auto"><table class="t"><thead><tr><th>${esc(t("th_id"))}</th><th>${esc(t("th_claim"))}</th><th>${esc(t("th_screen"))}</th><th>${esc(t("th_src"))}</th><th>${esc(t("th_you"))}</th></tr></thead><tbody>${rows}</tbody></table></div>`;
+}
+
+function vFilm() {
+  const v = filmAsset();
+  if (!v) return `<h1>${esc(t("v_film"))}</h1><div class="empty">${esc(t("no_film"))}</div>`;
+  const tcs = Object.entries(FB.items).filter(([k]) => k.startsWith("time:")).sort((a, b) => a[1].t - b[1].t);
+  return `<h1>${esc(t("v_film"))}</h1><p class="sub">${v.caption ? esc(v.caption) + " · " : ""}${esc(t("film_sub"))}</p>
+    <div class="player"><video id="fv" src="${esc(src(v.path))}"${v.poster ? ` poster="${esc(src(v.poster))}"` : ""} controls preload="metadata"></video>
+      <div class="scrub" id="scrub"><div class="fill" id="sfill"></div>${tcs.map(([, x]) => `<div class="mk" data-mt="${x.t}" style="background:${x.status === "ask" ? "var(--ask)" : x.status === "ok" ? "var(--ok)" : "var(--chg)"}" title="${fmt(x.t)}"></div>`).join("")}</div>
+      <div style="display:flex;gap:8px;align-items:center;margin-top:8px;flex-wrap:wrap"><button class="btn" type="button" id="tcadd">${atTime("tnow")} (C)</button><span class="tiny muted">${esc(t("film_list"))}</span></div></div>
+    <div>${tcs.map(([k, x]) => `<div class="tc" data-mark="${esc(k)}"><span class="t" data-seek="${x.t}">${fmt(x.t)}</span><div>${fbCtl(k, t("film_label", { t: fmt(x.t) }), { t: x.t })}</div><button class="btn ghost" type="button" data-del="${esc(k)}">${esc(t("del"))}</button></div>`).join("") || `<div class="muted small" style="margin-top:12px">${esc(t("film_none"))}</div>`}</div>`;
+}
+function wireFilm() {
+  const v = $("#fv"); if (!v) return;
+  const place = () => { const d = v.duration || 0; $$("#scrub .mk").forEach((m) => { m.style.left = d ? Math.min(100, (+m.dataset.mt / d) * 100) + "%" : "0"; m.style.display = d ? "" : "none"; }); };
+  v.addEventListener("loadedmetadata", () => { if (filmT) v.currentTime = Math.min(filmT, v.duration || filmT); place(); }, { once: true });
+  v.addEventListener("timeupdate", () => { filmT = v.currentTime; $("#tnow").textContent = fmt(v.currentTime); $("#sfill").style.width = (v.duration ? (v.currentTime / v.duration) * 100 : 0) + "%"; });
+  $("#scrub").addEventListener("click", (e) => { if (!v.duration) return; const r = e.currentTarget.getBoundingClientRect(); v.currentTime = ((e.clientX - r.left) / r.width) * v.duration; });
+  const add = () => { const x = +v.currentTime.toFixed(1); v.pause(); FB.items["time:" + x] = { status: "change", label: t("film_label", { t: fmt(x) }), t: x, text: "" }; save(); render(); const ta = $(`[data-target="time:${x}"] textarea`); if (ta) ta.focus(); };
+  $("#tcadd").addEventListener("click", add);
+  $$("[data-seek]").forEach((b) => b.addEventListener("click", () => { v.currentTime = +b.dataset.seek; v.play(); }));
+  $$("[data-del]").forEach((b) => b.addEventListener("click", () => { delete FB.items[b.dataset.del]; save(); render(); }));
+  document.onkeydown = (e) => { if (VIEW !== "film" || /TEXTAREA|INPUT/.test(document.activeElement.tagName)) return; if (e.key === "c" || e.key === "C") { e.preventDefault(); add(); } };
+  place();
+}
+
+function vLedger() {
+  if (!D.ledger.length && !D.agent_decided.length) return `<h1>${esc(t("v_ledger"))}</h1>` + (docOf("DECISIONS.md") ? fallback(t("no_ledger"), "DECISIONS.md") : `<div class="empty">${esc(t("no_dec"))}</div>`);
+  const cur = D.agent_decided.filter((a) => !a.superseded), old = D.agent_decided.filter((a) => a.superseded);
+  const card = (a, live) => { const i = D.agent_decided.indexOf(a); return `<div class="card led" data-mark="led:${i}"><div><div class="topic">${esc(a.topic || "—")}</div><div class="tiny muted">${esc(a.date)}</div></div>
+    <div><div>${esc(a.what)}</div>${a.group ? `<div class="tiny muted">${esc(a.group)}</div>` : ""}${a.why ? `<div class="small muted" style="margin-top:4px"><span class="chip">${esc(t("why"))}</span>${esc(a.why)}</div>` : ""}${a.undo ? `<div class="small muted" style="margin-top:4px"><span class="chip chg">${esc(t("undo"))}</span>${esc(a.undo)}</div>` : ""}${a.note ? `<div class="tiny muted" style="margin-top:4px">${esc(a.note)}</div>` : ""}
+    ${live ? fbCtl("led:" + i, t("l_led", { x: (a.topic ? a.topic + COLON() : "") + cut(a.what, 20) }), { labels: [t("agree"), t("overturn"), t("fb_ask")], def: t("def_agree") }) : ""}</div></div>`; };
+  return `<h1>${esc(t("v_ledger"))}</h1><p class="sub">${esc(t("ledger_sub"))}</p>
+    ${D.ledger.length ? `<div style="overflow-x:auto"><table class="t"><thead><tr><th>${esc(t("th_what"))}</th><th>${esc(t("th_who"))}</th><th>${esc(t("th_status"))}</th></tr></thead><tbody>${D.ledger.map((l) => `<tr><td><b>${esc(l.what)}</b></td><td class="small">${esc(l.who)}</td><td class="small">${esc(l.status)}</td></tr>`).join("")}</tbody></table></div>` : ""}
+    ${cur.length ? `<h2>${esc(t("agent_n", { n: cur.length }))}</h2><div class="grid">${cur.map((a) => card(a, true)).join("")}</div>` : ""}
+    ${old.length ? `<details style="margin-top:20px"><summary>${esc(t("superseded", { n: old.length }))}</summary><div class="grid" style="margin-top:10px;opacity:.6">${old.map((a) => card(a, false)).join("")}</div></details>` : ""}`;
+}
+
+function vHistory() {
+  const H = D.history.slice().reverse(), F = D.feedback.slice().reverse();
+  if (!H.length && !F.length) return `<h1>${esc(t("v_history"))}</h1>` + (docOf("REVIEW.md") ? `<div class="card">${docHtml(docOf("REVIEW.md"))}</div>` : `<div class="empty">${esc(t("no_history"))}</div>`);
+  return `<h1>${esc(t("v_history"))}</h1><p class="sub">${esc(t("history_sub"))}</p>` + H.map((h) => `<details class="card" style="margin-bottom:14px" ${h === H[0] ? "open" : ""}><summary><b>${esc(h.title)}</b></summary><div class="md">${h.html}</div></details>`).join("")
+    + (F.length ? `<h2>${esc(t("desk_subs"))}</h2><ul class="small">${F.map((f) => `<li><a href="${esc(src(f.file.replace(/\.json$/, ".md")))}" target="_blank" rel="noopener">${esc(f.round)} · ${esc(f.submitted_at.replace("T", " "))}</a> · ${f.items.length} ✎</li>`).join("")}</ul>` : "");
+}
+
+function vDocs() {
+  if (!D.docs.length) return `<h1>${esc(t("v_docs"))}</h1><div class="empty">${esc(t("no_docs"))}</div>`;
+  const doc = docOf(DOC) || D.docs[0];
+  const nav = `<div class="docnav">${D.docs.map((d) => `<a href="#docs/${esc(d.file)}" class="${d === doc ? "on" : ""}">${esc(d.file)}</a>`).join("")}</div>`;
+  const warn = D.warnings.length ? `<div class="note"><b>${esc(t("warnings"))}</b><ul style="margin:4px 0 0;padding-left:18px">${D.warnings.map((w) => `<li>${esc(w)}</li>`).join("")}</ul></div>` : "";
+  const intro = doc.intro ? `<div class="card docsec"><div class="md">${doc.intro}</div></div>` : "";
+  const secs = doc.sections.map((s) => { const k = "doc:" + doc.file + "#" + cut(s.title, 100); return `<div class="card docsec" data-mark="${esc(k)}"><div class="md"><h2 style="margin-top:0">${esc(s.title)}</h2>${s.html}</div>${fbCtl(k, t("l_doc", { f: doc.file, s: s.title }))}</div>`; }).join("");
+  return `<h1>${esc(t("v_docs"))}</h1><p class="sub">${esc(t("docs_sub"))}</p>${warn}${nav}${intro}${secs}`;
+}
+
+// ---------- tray and submit ----------
+function payload() {
+  const g = ROUND.data, decisions = {}, defaulted = [];
+  (g.decisions || []).forEach((d) => {
+    const v = FB.decisions[d.id] || d.recommend;
+    if (v && (d.options || []).some((o) => o.id === v)) { decisions[d.id] = v; if (!FB.decisions[d.id]) defaulted.push(d.id); }
+  });
+  const items = Object.entries(FB.items).filter(([, v]) => v.status).map(([k, v]) => Object.assign({ target: k, status: v.status, label: v.label || k, text: v.text || "" },
+    v.suggest && v.suggest !== v.orig ? { suggest: v.suggest } : {}, v.orig && k.startsWith("cap:") ? { orig: v.orig } : {}, v.t != null ? { t: v.t } : {}));
+  return { round: ROUND.id, lang: LANG, decisions, defaulted, items, general: ($("#general").value || "").trim() };
+}
+function summaryText(p) {
+  const st = { ok: t("st_ok"), change: t("st_change"), ask: t("st_ask") };
+  const L2 = [t("reply_head", { p: D.project.title, r: p.round === "notes" ? t("notes_round") : t("round_name", { r: p.round }) })];
+  Object.entries(p.decisions).forEach(([k, v]) => L2.push(`${k}: ${v}${p.defaulted.includes(k) ? t("by_rec") : ""}`));
+  p.items.forEach((i) => L2.push(`${i.label} · ${st[i.status]}${i.text ? COLON() + i.text : ""}${i.suggest ? ` → ${i.suggest}` : ""}`));
+  if (p.general) L2.push(`${t("overall")}${COLON()}${p.general}`);
+  L2.push(t("rest"));
+  return L2.join("\n");
+}
+function renderTray() {
+  const items = Object.entries(FB.items).filter(([, v]) => v.status), st = { ok: [t("st_ok"), "ok"], change: [t("st_change"), "chg"], ask: [t("st_ask"), "acc"] };
+  $("#trayList").innerHTML = items.length ? items.map(([k, v]) => `<div class="it" data-go="${esc(k)}"><span class="chip ${st[v.status][1]}">${esc(st[v.status][0])}</span><b class="small">${esc(v.label || k)}</b>${v.text ? `<div class="small muted">${esc(v.text)}</div>` : ""}${v.suggest && v.suggest !== v.orig ? `<div class="small serif">→ ${esc(v.suggest)}</div>` : ""}</div>`).join("") : `<div class="empty">${esc(t("tray_empty"))}</div>`;
+  $("#preview").textContent = summaryText(payload());
+  $$("#trayList [data-go]").forEach((el) => el.addEventListener("click", () => {
+    const k = el.dataset.go, kind = k.split(":")[0]; $("#tray").classList.remove("open");
+    location.hash = kind === "doc" ? "docs/" + k.slice(4).split("#")[0] : KIND[kind] || "round";
+    setTimeout(() => { const x = $(`[data-mark="${CSS.escape(k)}"]`); if (x) x.scrollIntoView({ behavior: "smooth", block: "center" }); }, 80);
+  }));
+}
+function openTray() { renderTray(); $("#tray").classList.add("open"); }
+async function submit() {
+  FB.general = $("#general").value; store.set(KEY, FB);
+  const p = payload(), text = summaryText(p);
+  let r = null;
+  try { r = await fetch("/api/feedback", { method: "POST", headers: { "Content-Type": "application/json", "X-Desk-Token": TOKEN }, body: JSON.stringify(p) }); } catch (e) { r = null; }
+  if (r && r.ok) {
+    const j = await r.json();
+    FB.submittedAt = new Date().toLocaleString(); store.set(KEY, FB);
+    toast(j.listening ? t("sent_live") : t("sent", { f: j.saved }));
+    $("#submitHint").textContent = t(j.listening ? "hint_live" : "hint_idle", { f: j.saved }); pollLive(); return;
+  }
+  if (r) { let e = r.status; try { e = (await r.json()).error || e; } catch (x) { /* not JSON */ } toast(t("refused", { e })); openTray(); return; }
+  try { await navigator.clipboard.writeText(text); toast(t("offline")); } catch (e) { toast(t("offline2")); }
+  openTray(); $("#tray details").open = true;
+}
+$("#openTray").addEventListener("click", openTray);
+$("#closeTray").addEventListener("click", () => $("#tray").classList.remove("open"));
+$("#submit").addEventListener("click", submit);
+$("#submitTop").addEventListener("click", openTray);
+$("#general").addEventListener("input", () => { FB.general = $("#general").value; store.set(KEY, FB); renderCount(); $("#preview").textContent = summaryText(payload()); });
+$("#theme").addEventListener("click", () => {
+  const d = document.documentElement, dark = d.dataset.theme ? d.dataset.theme === "dark" : matchMedia("(prefers-color-scheme: dark)").matches, n = dark ? "light" : "dark";
+  d.dataset.theme = n; try { localStorage.setItem("desk:theme", n); } catch (e) { /* no storage */ } if (D) render();
+});
+$("#lang").addEventListener("click", () => { const n = LANG === "zh" ? "en" : "zh"; try { localStorage.setItem("desk:lang", n); } catch (e) { /* no storage */ } setLang(n); renderChrome(); route(); });
+$("#reload").addEventListener("click", load);
+async function pollLive() {
+  let on = false;
+  try { const r = await fetch("/api/status", { cache: "no-store" }); on = r.ok && (await r.json()).listening; } catch (e) { on = false; }
+  $("#live").classList.toggle("on", on);
+  $("#liveTxt").textContent = on ? t("live_on") : t("live_off");
+  $("#live").title = on ? t("live_on_tip") : t("live_off_tip");
+}
+setInterval(pollLive, 4000);
+load();
diff --git a/tools/desk/static/index.html b/tools/desk/static/index.html
new file mode 100644
index 0000000..58bd29d
--- /dev/null
+++ b/tools/desk/static/index.html
@@ -0,0 +1,41 @@
+<!doctype html>
+<html lang="zh-CN">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width,initial-scale=1">
+<meta name="desk-token" content="{{TOKEN}}">
+<title>审阅台 · Review desk</title>
+<link rel="stylesheet" href="/static/desk.css">
+</head>
+<body>
+<header class="top">
+  <div class="brand"><b id="brand">审阅台</b><span class="proj" id="ptitle">…</span><span class="pill" id="pstatus"></span></div>
+  <ol class="rail" id="rail"></ol>
+  <div class="actions">
+    <span class="live" id="live"><span>●</span><span id="liveTxt">…</span></span>
+    <button class="btn ghost" id="reload" type="button">↻</button>
+    <button class="btn ghost" id="lang" type="button">EN</button>
+    <button class="btn ghost" id="theme" type="button">◐</button>
+    <button class="btn" id="openTray" type="button"><span id="myLabel">我的点评</span><span class="n" id="cnt">0</span></button>
+    <button class="btn primary" id="submitTop" type="button">提交</button>
+  </div>
+</header>
+<div class="layout">
+  <nav class="side" id="side"></nav>
+  <main id="view"><div class="empty">…</div></main>
+</div>
+<aside class="tray" id="tray">
+  <header><b id="trayTitle">我的点评</b><button class="btn ghost" id="closeTray" type="button">×</button></header>
+  <div class="list" id="trayList"></div>
+  <footer>
+    <label class="small muted" id="generalLabel" for="general"></label>
+    <textarea id="general" rows="3"></textarea>
+    <details><summary class="small" id="previewLabel"></summary><pre class="out" id="preview"></pre></details>
+    <button class="btn primary" id="submit" type="button"></button>
+    <div class="tiny muted" id="submitHint"></div>
+  </footer>
+</aside>
+<div class="toast" id="toast" role="status" aria-live="polite"></div>
+<script src="/static/desk.js"></script>
+</body>
+</html>
diff --git a/tools/review.py b/tools/review.py
index 6b0d3f1..b896726 100644
--- a/tools/review.py
+++ b/tools/review.py
@@ -13,8 +13,10 @@
   summary, decisions[{id, question, options[{id, label, pro, con} | "id"], recommend, why, cost, reply}],
   assets[{path, caption, for, t0, t1, poster}], least_sure[{id, note} | "note"], animatic,
   segments[{id, title, t0, t1, note, shots[{id, t0, t1, frame, see, vo, note}]}], appendix[{title, text, path}]
-  optional: gate, title, lang (zh | en), decided[], delegated[], not_reviewed, include (a JSON file, or a list of them,
-  whose keys fill in what this file does not set: bin/vh storyboard writes out/check/storyboard/review.json for gate ②)
+  optional: gate, title, lang (zh | en; default: the BRIEF's "Review language" line, else zh), decided[], delegated[],
+  not_reviewed, include (a JSON file, or a list of them, whose keys fill in what this file does not set: bin/vh storyboard
+  writes out/check/storyboard/review.json for gate ②). The review desk (bin/vh desk, tools/desk/README.md) reads the
+  same file and a few more optional keys (listen, music, film); this page ignores them.
 
 Paths are relative to the project and linked relatively, so the page opens straight from disk (images, GIF, mp4 and
 audio play in the browser); http(s) URLs pass through, other schemes are refused. Every text is HTML-escaped; appendix
@@ -287,7 +289,7 @@ def __init__(self, project: Path, src: Path, data: dict, gate: str):
         self.project, self.src, self.d, self.gate = project, src, data, gate
         self.out = project / "out" / "review"
         lang = data.get("lang")
-        self.lang = lang if isinstance(lang, str) and lang in T else "zh"
+        self.lang = lang if isinstance(lang, str) and lang in T else (review_lang(project) if lang is None else None) or "zh"
         self.t = T[self.lang]
         self.errors, self.warnings = [], []
         self.shot_ids = set()
@@ -737,6 +739,18 @@ def chat(self, page_path):
         return "\n".join(lines)
 
 
+def review_lang(project):
+    """The project's review language, from the BRIEF's Spec line "- Review language: zh | en" (bin/vh new --lang writes
+    it; the agent sets it from the language of the user's first request). None when the line is missing or unclear."""
+    try:
+        s = (Path(project) / "BRIEF.md").read_text(encoding="utf-8-sig", errors="replace")
+    except OSError:
+        return None
+    m = re.search(r"^- Review language:[ \t]*([^\s<]+)", s, re.M)
+    v = m.group(1).lower() if m else ""
+    return "en" if v.startswith("en") else "zh" if v.startswith("zh") or v.startswith("中") else None
+
+
 def find_project(arg):
     """The same lookup as bin/vh new, storyboard and style apply: a folder, or a name under $OVH_PROJECTS or
     <harness>/projects, the date prefix optional. None (with the reason on stderr) when nothing, or more than one, matches."""
diff --git a/video-types/02-knowledge-short.md b/video-types/02-knowledge-short.md
index 6f93a68..645c0a3 100644
--- a/video-types/02-knowledge-short.md
+++ b/video-types/02-knowledge-short.md
@@ -48,6 +48,7 @@
    - 不要永远固定在下三分之一，每 30 秒打破一次节奏；
    - 强调的分布大致是：70% 平常，20% 轻强调，8% 完全强调，2% 高潮；
    - 选一种主风格【综合】：逐句（讲解的默认）；关键词强调（大多数知识片）；逐词高亮（只给高潮段，约 2% 的时长）；大字报（1–3 个词占满画面，只给钩子和转折，130–170 px）；对话条（问答）；双语（主语言大、副语言小，适合横屏，竖屏宽度不够）；
+   - **术语卡**（可选）：默认不上专业词；人想保留真实的术语时（一位用户的原话："信道编码、调制 这几个基础的通信概念是可以保留的"），每到一个环节，先亮一张小卡写这一关的名字（"信道编码"），紧跟一句大白话字幕解释它（"再添上一些多出来的 0 和 1：路上丢几个，也补得回来"）。术语卡是独立的一层，字号按"在哪看"的次要文字下限，整层去掉也不影响字幕；英文缩写（QAM、LDPC）默认也不上屏，人要了再加。写在 SCRIPT 字幕表的"术语"列；
    - 静音可读，有声更好。信息流里静音观看是常态：Meta 测过，加字幕的视频广告平均多看 12% [S16a]；美国的调查里 69% 的人在公共场合静音看视频，英国 18–24 岁的人有 80% 看电视时部分或全部时间开着字幕【二手】[S17a][S17b]；
    - 但无声观看更累：一项 161 人的眼动实验里，认知负荷明显升高、沉浸和愉悦下降，理解只略低（81% 对 78%）[S17c]；TikTok 也说自己是开声音的平台 [S2]。所以静音交付时同屏信息量减少，画面文字在 `playbook/03-motion-design.md` §2 的最少停留时间上再留 0.5–1 s（加多少没有数据【推测】）；
    - 竖屏短视频多数人静音看，旁白照常逐句上字幕。只有学习目标强、以有声观看为主的讲解（横屏的课程、B站长讲解），字幕才可以只留关键词和短句（Mayer 的冗余原则，见 `playbook/09-narrative.md` 第 4.2 节）【综合】；

From ec8f27cfe1cd5dab782c0c47d4ee54567e98c872 Mon Sep 17 00:00:00 2001
From: zhanglinghao <zhangczssx@gmail.com>
Date: Sun, 4 Oct 2026 03:26:44 +0800
Subject: [PATCH 2/5] desk: skip the reverse DNS lookup at bind; CI waits up to
 30 s and says why a start failed

On GitHub's macOS runner the desk server never printed its address within the
test's 10 s wait, so CI killed it and reported an empty reason. The server was
stuck in http.server.HTTPServer.server_bind, which calls
socket.getfqdn("127.0.0.1"), a reverse DNS lookup that can stall there. The
desk only answers on 127.0.0.1, so Desk.server_bind now binds and sets the
server name directly (a bind takes no time).

tools/ci.sh: the startup wait polls for up to 30 s and stops early if the
server exits; on failure it says whether the server was still running or
exited (with its code) and prints its output, or "(none)".
---
 tools/ci.sh          | 10 ++++++++--
 tools/desk/server.py |  8 +++++++-
 2 files changed, 15 insertions(+), 3 deletions(-)

diff --git a/tools/ci.sh b/tools/ci.sh
index 3c778c1..2e44cdb 100755
--- a/tools/ci.sh
+++ b/tools/ci.sh
@@ -433,8 +433,14 @@ PY
   # a server on a free port, on a copy (a submission writes into the project)
   cp -R tools/desk/fixtures/zh "$t/p" && printf '<img src=x onerror=alert(1)>\n' >> "$t/p/STORYBOARD.md"
   "$VH_BASH" "$ROOT/bin/vh" desk "$t/p" --port 0 > "$t/srv.log" 2>&1 & pid=$!   # bin/vh execs python: $! is the server
-  url=""; for i in $(seq 50); do url=$(sed -n 's#^desk: \(http://127\.0\.0\.1:[0-9]*/\).*#\1#p' "$t/srv.log"); [ -n "$url" ] && break; sleep 0.2; done
-  if [ -z "$url" ]; then bad "desk server did not start: $(head -3 "$t/srv.log")"; kill "$pid" 2>/dev/null; rm -rf "$t"; return; fi
+  url=""; for i in $(seq 150); do   # up to 30 s; stop early if the server exits
+    url=$(sed -n 's#^desk: \(http://127\.0\.0\.1:[0-9]*/\).*#\1#p' "$t/srv.log"); [ -n "$url" ] && break
+    kill -0 "$pid" 2>/dev/null || break; sleep 0.2; done
+  if [ -z "$url" ]; then
+    if kill -0 "$pid" 2>/dev/null; then a="no address after 30 s, still running"; kill "$pid" 2>/dev/null; wait "$pid" 2>/dev/null
+    else wait "$pid"; a="exited with $?"; fi
+    bad "desk server did not start ($a); its output: $(tr '\n' ' ' < "$t/srv.log" | head -c 800)$([ -s "$t/srv.log" ] || echo '(none)')"
+    rm -rf "$t"; return; fi
   cat > "$t/client.py" <<'PY'
 import http.client, json, sys, urllib.parse
 u = urllib.parse.urlsplit(sys.argv[1]); proj = sys.argv[2]; what = sys.argv[3]
diff --git a/tools/desk/server.py b/tools/desk/server.py
index d7a638b..2ba4649 100644
--- a/tools/desk/server.py
+++ b/tools/desk/server.py
@@ -12,7 +12,7 @@
 printed into the page, a JSON body and, when the browser sends one, a same-origin Origin. So another web page open
 in the same browser can neither read the project nor submit feedback in the reviewer's name.
 """
-import datetime, http.server, json, mimetypes, os, re, secrets, signal, socket, sys
+import datetime, http.server, json, mimetypes, os, re, secrets, signal, socket, socketserver, sys
 from pathlib import Path
 from urllib.parse import unquote, urlsplit
 
@@ -39,6 +39,12 @@ def __init__(self, port, project):
         self.port = self.server_address[1]
         self.hosts = {f"{h}:{self.port}" for h in ("127.0.0.1", "localhost")}
 
+    def server_bind(self):
+        # HTTPServer.server_bind asks socket.getfqdn("127.0.0.1"), a reverse DNS lookup that can stall for many seconds
+        # (it did on GitHub's macOS runners, before the server printed its address); the desk only answers on 127.0.0.1
+        socketserver.TCPServer.server_bind(self)
+        self.server_name, self.server_port = "127.0.0.1", self.server_address[1]
+
     @property
     def url(self):
         return f"http://127.0.0.1:{self.port}/"

From 20bb7c9122173d2d6a44178481d08cac61822774 Mon Sep 17 00:00:00 2001
From: zhanglinghao <zhangczssx@gmail.com>
Date: Sun, 4 Oct 2026 03:47:22 +0800
Subject: [PATCH 3/5] desk: fixes from the independent review (sandboxed
 project files, round order, hand-over, copies, bad requests)

- /p/ serves every project file with "Content-Security-Policy: sandbox
  allow-scripts allow-popups" (no allow-same-origin). A script SVG or HTML in
  the project, opened from the desk, could read "/" for the token and post a
  forged "verbatim" line into REVIEW.md; in an opaque origin it can't (checked
  in a browser: origin=null, the fetch fails, nothing written).
- Hidden files and *.env are refused on the resolved path too, ignoring case
  (a symlink to .env, keys.ENV).
- "This round" is the last gate page in review order (1, E0, E1, 2, E2, E3,
  E4, 3, E5, then 1 < 1b < 1c), not the newest file, so cp -R or touching an
  old gate JSON can't make a rejected page current again.
- bin/vh desk wait hands over at once a submission for the current page that
  came in before it was armed (after a timeout) and was never handed over;
  what wait or desk feedback printed is recorded in feedback/.consumed.
- .desk.json and .listening record the project's real path; a copied project
  starts its own server, and a .listening from elsewhere (the prototype's)
  doesn't make the desk say an agent is waiting.
- Malformed submissions get a 400 instead of a dropped connection
  (defaulted / lang of the wrong type, deep nesting, a body shorter than its
  Content-Length); the token is compared as bytes (a non-ASCII one is a 403);
  a 30 s socket timeout frees a stalled thread.
- render_md: inline patterns stop at their delimiter (linear), lines over
  5,000 characters skip inline markup, quotes nest at most 8 deep.
- One language rule for the desk and bin/vh review: the page's gate JSON lang,
  else the BRIEF's Review language, else zh.
- latest() orders -2 before -10 within one second.
- The night-palette note leaves playbook/03's default ban list and becomes a
  look-dev line in playbook/01: offer at least one non-night variant.

tools/ci.sh covers each: the sandbox header on /p/ (an SVG too), the symlink
and upper-case .ENV, the round order after a touch, the language rule in both
tools, long and deeply nested markdown in bounded time, -10 after -2, the
malformed bodies and token, a submission made before wait, desk feedback
consuming, and a copied project with a foreign .listening.
---
 CHANGELOG.md                 |   8 +--
 playbook/01-pipeline.md      |   5 +-
 playbook/03-motion-design.md |   1 -
 tools/ci.sh                  | 120 ++++++++++++++++++++++++++++++-----
 tools/desk/README.md         |  18 ++++--
 tools/desk/desk.py           |   7 +-
 tools/desk/feedback.py       | 116 +++++++++++++++++++++++++--------
 tools/desk/reader.py         |  51 +++++++++++----
 tools/desk/server.py         |  50 ++++++++++-----
 tools/review.py              |   5 +-
 10 files changed, 292 insertions(+), 89 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2d85b53..17b79a1 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,18 +5,18 @@
 **The review desk: tick, comment and submit in a page, and the agent carries on by itself (`bin/vh desk`)**
 - Why: reviewing a film's first gate through the static pages, the maintainer found the outline, captions and stages hard to read (some were raw `.md` links), had no way to tick or comment in place, had to reply in chat with codes like "1 S1", and got a new one-off page every time. A prototype desk fixed that, and after two real rounds in it: "返回还是要手动给你触发，我觉得可以加一个监控", the outline should be split by content, not by 起承转合, reuse needs a basic infrastructure, and the desk belongs to `studio`, in Chinese or English by the first request.
 - `tools/desk/` (stdlib Python, offline, no CDN, light and dark): `bin/vh desk <project> [--port N]` serves one project on 127.0.0.1 (the first free port of 8780–8799; a second start prints the running one's address). Ten views read fresh from the project's own files: this round (decisions with options, least sure, decided for you), concept and outline (a time bar by segment), captions or narration (grouped by segment, term chips, a rough reading speed), the storyboard synced to its video, sound (sections named from the gate JSON, listen prompts, timecoded notes), fact check, the film with timecoded notes (C key), the decision ledger, history, and every doc rendered as text. Any item can be marked ok / change / question with a line and a "change to"; a tray collects them and submits once.
-- A submission is checked (a real gate page, its decisions and options, sizes) and written as `out/review/feedback/<round>-<time>.md`, then into `REVIEW.md` verbatim as a dated, fenced section before the template's reference sections (CLAUDE.md asks for the human's words word for word), then the `.json`. `bin/vh desk wait <project> [--timeout s]` blocks until that file appears, prints it and exits 0 (3 on timeout), so an agent that armed it in the background is woken; the page shows whether one is waiting. `bin/vh desk feedback` prints the latest submission, `bin/vh desk data` what the desk read. Only requests addressed to the server's own host are answered, a submission needs the page's per-run token and JSON from the same origin, and `/p/` serves only ordinary files inside the project.
+- A submission is checked (a real gate page, its decisions and options, sizes) and written as `out/review/feedback/<round>-<time>.md`, then into `REVIEW.md` verbatim as a dated, fenced section before the template's reference sections (CLAUDE.md asks for the human's words word for word), then the `.json`. `bin/vh desk wait <project> [--timeout s]` blocks until that file appears, prints it and exits 0 (3 on timeout), so an agent that armed it in the background is woken; a submission for the current page that arrived before it was armed (after a timeout, say) and was never handed over (`out/review/feedback/.consumed`) is printed at once. The page shows whether an agent is waiting. `bin/vh desk feedback` prints the latest submission and counts it as handed over, `bin/vh desk data` what the desk read. "This round" is the last page in review order (stop, then page), not the newest file, so copying or touching a project can't bring an old page back. Only requests addressed to the server's own host are answered; a submission needs the page's per-run token, JSON and the same origin; `/p/` serves only ordinary files inside the project (hidden files and `*.env` refused on the resolved path, any case) and sandboxes every one of them without `allow-same-origin`, so an HTML or SVG in the project can't read the token; `.desk.json` and `.listening` name their project folder, so copies don't count; malformed requests get a 400 and idle sockets time out.
 - The data contract is written down in `tools/desk/README.md`: which BRIEF sections and tables (a new Outline table whose segment names say what happens, with an optional tag column for 起承转合), the SCRIPT caption or narration table with an optional 术语 column, the NOTES 素材清单 (an optional 上屏说法 column; struck rows are dropped), the DECISIONS ledger and its strikethrough for superseded entries, REVIEW's quotes, `shots.json`, the gate JSON plus three optional keys (`listen`, `music` with section labels, `film`), the feedback JSON, and English header equivalents. Whatever it can't parse is shown as formatted text with a warning, never hidden; older projects without the tables still show every document.
-- Language: a BRIEF Spec line `Review language: zh | en`, set from the user's first request (`bin/vh new … --lang en`, default zh); the desk's UI and `bin/vh review` (when the gate JSON has no `lang`) follow it, and the desk can switch. Captions and data stay in the project's language.
+- Language: a BRIEF Spec line `Review language: zh | en`, set from the user's first request (`bin/vh new … --lang en`, default zh). One rule for the desk and `bin/vh review`: the page's gate JSON `lang`, else the BRIEF line, else zh; the desk can also switch in the page. Captions and data stay in the project's language.
 - Effort: CLAUDE.md's effort table gets a 在哪审 row (quick: no gates; standard: the static page, the desk when wanted; studio: the desk, the watcher armed after each stop, chat as the fallback for agents without background wake-ups), and step 5, director mode, `playbook/01-pipeline.md` (a new 审阅台 section) and `bin/vh new`'s next-step line say the same. Templates: BRIEF (the Review language line, the Outline table), SCRIPT (the caption table and 术语), DECISIONS (strike through what a gate superseded), NOTES (上屏说法).
-- CI: the reader on two committed fixtures (`tools/desk/fixtures/zh`, `en`; `.gitignore` lets their `out/` in), a server on a free port (data with markup escaped, a 206 range, each refusal), a submission that wakes `desk wait` and lands in REVIEW.md, the timeout, `new --lang`, and `bin/vh review`'s language default. `bin/vh desk -h` is covered by the dispatcher's `-h` check.
+- CI: the reader on two committed fixtures (`tools/desk/fixtures/zh`, `en`; `.gitignore` lets their `out/` in), the round order after a touch, the language rule, long and deeply nested markdown in bounded time; a server on a free port (data with markup escaped, a 206 range, the `/p/` sandbox, each refusal including a symlink to `.env` and `keys.ENV`, malformed bodies and tokens answered with 400/403); a submission that wakes `desk wait` and lands in REVIEW.md; a submission made before `wait` is handed over at once and only once; copied `.desk.json` and `.listening` files don't count; the timeout, `new --lang`, and `bin/vh review`'s language default. `bin/vh desk -h` is covered by the dispatcher's `-h` check.
 
 **Docs: what one film's gates taught**
 - Outlines are named by content or stage ("按下发送 / 信道编码与调制 / 基站接住"); 起承转合 is at most a small tag (`playbook/09-narrative.md` §3 and §9, `playbook/01-pipeline.md`'s director table, the BRIEF template).
 - A concept serves the focus the user named: a seventh check in `playbook/12-ideation.md` §5, and a plain, direct card among the 2–3 when the user names the focus (the "two constellations" pun was rejected as "太刻意").
 - Endings that lift the theme without a slogan: answer the hook's question again at a human level (`playbook/09-narrative.md` §3).
 - An optional 术语卡 for short explainers when the user wants real terms: a small label, then a plain-language caption; still no English abbreviations unless asked (`video-types/02-knowledge-short.md`).
-- Look-dev doesn't default to dark or night palettes; at least one light option (`playbook/03-motion-design.md` §0).
+- When look-dev varies the look, at least one variant isn't a night palette (`playbook/01-pipeline.md`, look-dev).
 - After a gate changes the concept, sweep DECISIONS and NOTES' 上屏说法 for stale lines and strike them through (`playbook/01-pipeline.md`, the DECISIONS and NOTES templates).
 
 **The installer downloads less: a shallow clone**
diff --git a/playbook/01-pipeline.md b/playbook/01-pipeline.md
index b1d8836..74ff38e 100644
--- a/playbook/01-pipeline.md
+++ b/playbook/01-pipeline.md
@@ -154,11 +154,11 @@ projects/2026-10-01-leo-doppler/
 静态审阅页只能看，回复还得回聊天里打"1 S1"。审阅台（`bin/vh desk`）是一个本地网页：同一份 gate JSON 之外，它把立意和大纲、字幕或旁白稿、分镜（跟着视频走）、声音、事实核对、小样的逐秒点评、决定账本和历史都排出来，每一条都能点"可以 / 要改 / 疑问"、写一句、写"改成"，最后一次提交。agent 在后台等着，人一提交就接着做，不用回聊天。
 
 - **什么时候用**：`studio` 默认用它；`standard` 默认还是静态审阅页，人想逐条点评时也可以开审阅台；`quick` 不设关卡，导演模式要停的那几处在聊天里问或用静态页。
-- **语言**：界面语言取 BRIEF 的 `Review language`（`zh` / `en`），按用户第一句话的语言定，建项目时用 `bin/vh new … --lang en`；页面右上角也能切换。字幕和项目文档照旧用项目自己的语言。
+- **语言**：界面语言取 BRIEF 的 `Review language`（`zh` / `en`），按用户第一句话的语言定，建项目时用 `bin/vh new … --lang en`；这一轮的 gate JSON 写了 `lang` 时以它为准（和静态审阅页同一条规则）；页面右上角也能切换。字幕和项目文档照旧用项目自己的语言。
 - **每次停，agent 这样做**：
   1. 写 `out/review/gate-<n>.json`，运行 `bin/vh review <project> <n>`：检查 JSON、生成静态页当备份、打印聊天消息；
   2. 在后台运行 `bin/vh desk <project>` 起服务（只听 127.0.0.1；已经在跑就只打印地址）；
-  3. 在后台运行 `bin/vh desk wait <project>`，人一提交它就打印反馈、退出，agent 随之被唤醒。Claude Code 用后台命令，超时给到上限（`timeout` 7200000 ms，`wait` 默认等 7100 s）；服务也一样，超时被停掉了，下一次停时再起一遍；
+  3. 在后台运行 `bin/vh desk wait <project>`，人一提交它就打印反馈、退出，agent 随之被唤醒；`wait` 超时以后人才提交的，下一次 `wait` 一启动就交出来。Claude Code 用后台命令，超时给到上限（`timeout` 7200000 ms，`wait` 默认等 7100 s）；服务也一样，超时被停掉了，下一次停时再起一遍；
   4. 聊天里发 `bin/vh review` 打印的几行，加上审阅台的地址，然后停下；
   5. 被唤醒后，读它打印的反馈（`bin/vh desk feedback <project>` 随时可以再看）。人的原话审阅台已经原样抄进了 `REVIEW.md` 的一节，agent 在那一节下补"定了 / 改了"；替人定的事照常记进 `DECISIONS.md`。没标的条目都算通过。
 - **没有后台唤醒的 agent**（或者 `wait` 超时了）：人提交后回聊天说一声"看审阅台"，agent 用 `bin/vh desk feedback <project>` 读。页面顶上会写 agent 这会儿有没有在等。服务没起来时，页面把回复复制到剪贴板，人直接贴进聊天。
@@ -180,6 +180,7 @@ animatic 是整片长度的灰盒预演，属于阶段 3，放进关卡 ② 的
 - 挑最能代表全片的一段，10–20 s；
 - 只用一个预设变量切出 2–3 个变体，例如 HyperFrames 的 composition 变量 `fx` = A / B / C，渲染时用 `--variables '{"fx":"B"}'` 切换；同一段音频，其他都不变；
 - 附一张对照联系表：每行一个变体，每列是同一个时刻；
+- 变的是外观时，几个变体别都是夜色：至少放一个不是夜色的。一次关卡里人要"换个清新画风"，否掉的正是夜色方案；
 - 人挑一个方向，再按选中的那档做全片。
 
 变体之间只差一个变量，人挑的是方向，不用描述细节。本仓库介绍片的 v3 就是这样做的：先用 `fx` = A / B / C 渲了一版 22.7 s 的 look-dev（12 s 片中段落加 10.7 s 新做的产品信息图），选定 B 档之后才重构全片。
diff --git a/playbook/03-motion-design.md b/playbook/03-motion-design.md
index b24fb19..48a338a 100644
--- a/playbook/03-motion-design.md
+++ b/playbook/03-motion-design.md
@@ -15,7 +15,6 @@
 - 前 25% 把全部内容倒上屏，然后画面冻结；
 - 场景之间一律 crossfade；
 - 紫青渐变、玻璃拟态、Inter 字体、暗底光球；
-- 画面默认往深色、夜色上靠。提外观方案时至少放一个浅色的：一次关卡里人要"换个清新画风"，否掉的正是夜色方案；
 - 字号按网页尺寸来，太小；
 - 画面里满是标签、说明文字、写着剧情的牌子；
 - 所有元素一个速度、一个缓动、同时入场；
diff --git a/tools/ci.sh b/tools/ci.sh
index 2e44cdb..0066225 100755
--- a/tools/ci.sh
+++ b/tools/ci.sh
@@ -389,6 +389,17 @@ SH
 # whose table is missing, which must come back as text), a server on a free port (the page, the data, a 206 range, and
 # what it refuses), a submission that wakes bin/vh desk wait and lands verbatim in REVIEW.md, the watcher's timeout,
 # bin/vh new --lang, and bin/vh review's language default
+desk_start() { # desk_start <project> <log>: bin/vh desk on a free port in the background; sets desk_pid and desk_url
+  local i a; desk_url=""
+  "$VH_BASH" "$ROOT/bin/vh" desk "$1" --port 0 > "$2" 2>&1 & desk_pid=$!   # bin/vh execs python: $! is the server
+  for i in $(seq 150); do   # up to 30 s; stop early if the server exits
+    desk_url=$(sed -n 's#^desk: \(http://127\.0\.0\.1:[0-9]*/\).*#\1#p' "$2"); [ -n "$desk_url" ] && return 0
+    kill -0 "$desk_pid" 2>/dev/null || break; sleep 0.2; done
+  if kill -0 "$desk_pid" 2>/dev/null; then a="no address after 30 s, still running"; kill "$desk_pid" 2>/dev/null; wait "$desk_pid" 2>/dev/null
+  else wait "$desk_pid"; a="exited with $?"; fi
+  bad "desk server for $(basename "$1") did not start ($a); its output: $(tr '\n' ' ' < "$2" | head -c 800)$([ -s "$2" ] || echo '(none)')"
+  return 1
+}
 desk_checks() {
   local t pid wpid url i rc a
   t=$(mktemp -d "${TMPDIR:-/tmp}/vh-ci.XXXXXX")
@@ -430,19 +441,56 @@ sys.exit(1 if bad else 0)
 PY
   then ok "desk reads the zh and en fixtures (outline, captions and terms, bars, facts, ledger, history, gate extras), and a doc without its table as text"
   else bad "desk reader on tools/desk/fixtures"; fi
-  # a server on a free port, on a copy (a submission writes into the project)
+  # this round is the last page in review order, not the newest file; one language rule; markdown in bounded time;
+  # the newest submission within one second is the highest -n. (A file, not a heredoc inside $(…): bash 3.2 counts the
+  # parentheses in the heredoc's body.)
+  cat > "$t/order.py" <<'PY'
+import json, os, shutil, sys, time
+sys.path.insert(0, "tools/desk")
+import feedback, reader
+bad = []
+def want(cond, what):
+    if not cond: bad.append(what)
+t0 = time.time()
+for s in ("*a " * 20000, "[" * 60000, "**a " * 15000, "~~a " * 15000, "`" * 30000, "a](b " * 12000):
+    reader.render_md(s)
+want(time.time() - t0 < 3, f"long lines took {time.time() - t0:.1f} s")
+try:
+    h = reader.render_md(">" * 3000 + " x")
+    want(h.count("<blockquote>") <= reader.MAX_QUOTE_DEPTH + 1 and h.endswith("x</p>" + "</blockquote>" * h.count("<blockquote>")), "3000 nested quotes")
+except RecursionError:
+    bad.append("3000 nested quotes: RecursionError")
+want(reader.render_md("a *b* c") == "<p>a <em>b</em> c</p>" and reader.render_md("**b** ~~c~~") == "<p><strong>b</strong> <del>c</del></p>", "inline markup")
+d = os.path.join(sys.argv[1], "order")
+shutil.copytree("tools/desk/fixtures/zh", d)
+g = os.path.join(d, "out", "review")
+shutil.copy(os.path.join(g, "gate-1.json"), os.path.join(g, "gate-1b.json"))
+os.utime(os.path.join(g, "gate-1.json"), (time.time() + 60, time.time() + 60))   # the earlier page touched later
+r = reader.read_project(d)
+want([x["id"] for x in r["rounds"]] == ["1", "1b"] and r["lang"] == "zh", f"order after a touch: {[x['id'] for x in r['rounds']]}, lang {r['lang']}")
+j = json.load(open(os.path.join(g, "gate-1b.json"), encoding="utf-8"))
+json.dump(dict(j, lang="en"), open(os.path.join(g, "gate-1b.json"), "w", encoding="utf-8"))
+want(reader.read_project(d)["lang"] == "en", "this round's gate JSON lang should override the BRIEF")
+fd = os.path.join(g, "feedback")
+os.makedirs(fd)
+for n in ("1b-20261004-030440", "1b-20261004-030440-2", "1b-20261004-030440-10"):
+    json.dump({"round": "1b", "submitted_at": "2026-10-04T03:04:40", "n": n}, open(os.path.join(fd, n + ".json"), "w"))
+want(feedback.latest(d)[1]["n"] == "1b-20261004-030440-10", f"latest within one second: {feedback.latest(d)[1]}")
+if bad:
+    print("; ".join(bad))
+sys.exit(1 if bad else 0)
+PY
+  if a=$(python3 "$t/order.py" "$t"); then ok "desk: this round is the last page in review order (a touched file doesn't win), the gate JSON's lang overrides the BRIEF, long and deeply nested markdown in bounded time, -10 after -2"
+  else bad "desk order / lang / markdown / latest: $a"; fi
+  # a server on a free port, on a copy (a submission writes into the project); a hidden file, a link to it, an upper-case
+  # .ENV and an SVG with a script in it: none may be served same-origin
   cp -R tools/desk/fixtures/zh "$t/p" && printf '<img src=x onerror=alert(1)>\n' >> "$t/p/STORYBOARD.md"
-  "$VH_BASH" "$ROOT/bin/vh" desk "$t/p" --port 0 > "$t/srv.log" 2>&1 & pid=$!   # bin/vh execs python: $! is the server
-  url=""; for i in $(seq 150); do   # up to 30 s; stop early if the server exits
-    url=$(sed -n 's#^desk: \(http://127\.0\.0\.1:[0-9]*/\).*#\1#p' "$t/srv.log"); [ -n "$url" ] && break
-    kill -0 "$pid" 2>/dev/null || break; sleep 0.2; done
-  if [ -z "$url" ]; then
-    if kill -0 "$pid" 2>/dev/null; then a="no address after 30 s, still running"; kill "$pid" 2>/dev/null; wait "$pid" 2>/dev/null
-    else wait "$pid"; a="exited with $?"; fi
-    bad "desk server did not start ($a); its output: $(tr '\n' ' ' < "$t/srv.log" | head -c 800)$([ -s "$t/srv.log" ] || echo '(none)')"
-    rm -rf "$t"; return; fi
+  printf 'KEY=secret\n' > "$t/p/.env" && ln -s .env "$t/p/visible.txt" && printf 'KEY=secret\n' > "$t/p/keys.ENV"
+  printf '<svg xmlns="http://www.w3.org/2000/svg"><script>fetch("/")</script></svg>\n' > "$t/p/ref.svg"
+  if ! desk_start "$t/p" "$t/srv.log"; then rm -rf "$t"; return; fi
+  pid=$desk_pid; url=$desk_url
   cat > "$t/client.py" <<'PY'
-import http.client, json, sys, urllib.parse
+import http.client, json, socket, sys, urllib.parse
 u = urllib.parse.urlsplit(sys.argv[1]); proj = sys.argv[2]; what = sys.argv[3]
 def req(method, path, body=None, headers=None):
     c = http.client.HTTPConnection(u.hostname, u.port, timeout=10)
@@ -470,8 +518,23 @@ if what == "serve":
     want(s == 206 and h["Content-Range"] == f"bytes 2-9/{len(raw)}" and body == raw[2:10], f"Range: {s} {h.get('Content-Range')}")
     s, h, body = req("GET", "/p/NOTES.md")
     want(s == 200 and body == raw and h["Accept-Ranges"] == "bytes", f"whole file: {s}")
-    for p in ("/p/%2e%2e/BRIEF.md", "/p/..%2f..%2fetc/passwd", "/p/out/review/.desk.json", "/p/nope.md", "/BRIEF.md"):
+    for p in ("/p/NOTES.md", "/p/ref.svg"):   # opened in the browser, a project page runs in an opaque origin
+        csp = req("GET", p)[1].get("Content-Security-Policy", "")
+        want(csp.startswith("sandbox") and "allow-same-origin" not in csp, f"{p} not sandboxed: {csp!r}")
+    for p in ("/p/%2e%2e/BRIEF.md", "/p/..%2f..%2fetc/passwd", "/p/out/review/.desk.json", "/p/nope.md", "/BRIEF.md",
+              "/p/.env", "/p/visible.txt", "/p/keys.ENV", "/p/keys.env"):
         want(req("GET", p)[0] == 404, f"{p} served")
+    want(req("POST", "/api/feedback", fb(defaulted=5), H)[0] == 400, "defaulted: 5")
+    want(req("POST", "/api/feedback", fb(lang=[1]), H)[0] == 400, "lang: [1]")
+    want(req("POST", "/api/feedback", b"[" * 200000, H)[0] == 400, "200,000 nested arrays")
+    want(req("POST", "/api/feedback", fb(), dict(H, **{"X-Desk-Token": "tök€n".encode("utf-8")}))[0] == 403, "a non-ASCII token")
+    sk = socket.create_connection((u.hostname, u.port), timeout=10)   # a body shorter than its Content-Length
+    sk.sendall(f"POST /api/feedback HTTP/1.1\r\nHost: 127.0.0.1:{u.port}\r\nContent-Type: application/json\r\n"
+               f"X-Desk-Token: {token}\r\nContent-Length: 100\r\n\r\n".encode() + b'{"round": "1"}')
+    sk.shutdown(socket.SHUT_WR)
+    resp = sk.recv(200)
+    sk.close()
+    want(resp.split(b" ")[1:2] == [b"400"], f"a short body: {resp[:40]!r}")
     want(req("GET", "/api/data", headers={"Host": "evil.test"})[0] == 403, "another Host answered")
     want(req("POST", "/api/feedback", fb(), {"Content-Type": "application/json"})[0] == 403, "a post without the token")
     want(req("POST", "/api/feedback", fb(), dict(H, Origin="http://evil.test"))[0] == 403, "a post from another origin")
@@ -480,14 +543,20 @@ if what == "serve":
     want(req("POST", "/api/feedback", fb(decisions={"look": "L9"}), H)[0] == 400, "an option the gate page doesn't have")
     want(req("POST", "/api/feedback", fb(items=[{"target": "x", "status": "ok"}]), H)[0] == 400, "a bad target")
     want(json.loads(req("GET", "/api/status")[2])["listening"] is False, "listening before the watcher")
+elif what == "status":
+    print(json.loads(req("GET", "/api/status")[2])["listening"])
+elif what == "post":   # no watcher: argv[4] is the comment
+    s, _, d = req("POST", "/api/feedback", fb(items=[{"target": "seg:2", "status": "change", "label": "大纲 第 2 段", "text": sys.argv[4]}]), H)
+    want(s == 200, f"post: {s} {d[:200]}")
 else:
     want(json.loads(req("GET", "/api/status")[2])["listening"] is True, "the page doesn't see the watcher")
     s, _, d = req("POST", "/api/feedback", fb(), H)
     want(s == 200 and json.loads(d)["listening"] is True and json.loads(d)["saved"].startswith("out/review/feedback/1-"), f"submit: {s} {d[:200]}")
-print("\n".join(bad))
+if bad:
+    print("\n".join(bad))
 sys.exit(1 if bad else 0)
 PY
-  if a=$(python3 "$t/client.py" "$url" "$t/p" serve); then ok "desk server: page, data with markup escaped, a 206 range; refuses other hosts, paths out of the project, hidden files, posts without the token, from another origin or not JSON, an unknown round, option or target"
+  if a=$(python3 "$t/client.py" "$url" "$t/p" serve); then ok "desk server: page, data with markup escaped, a 206 range, project files sandboxed; refuses other hosts, paths out of the project, hidden files (also through a link, any case), posts without the token, from another origin or not JSON, an unknown round, option or target; malformed bodies and tokens get 400/403"
   else bad "desk server: $a"; fi
   "$VH_BASH" "$ROOT/bin/vh" desk wait "$t/p" --timeout 30 > "$t/wait.out" 2>&1 & wpid=$!
   for i in $(seq 50); do [ -f "$t/p/out/review/feedback/.listening" ] && break; sleep 0.2; done
@@ -506,6 +575,22 @@ PY
   a=$(vh desk feedback "$t/p" --round 1) && case "$a" in *"第 0 帧就要有水声"*"json: "*) true ;; *) false ;; esac \
     && vh desk feedback "$t/p" --json | python3 -c "import json, sys; d = json.load(sys.stdin); sys.exit(0 if d['decisions'] == {'look': 'L2'} and d['project'] == 'p' else 1)" \
     && ok "desk feedback prints the latest submission (text and --json)" || bad "desk feedback: $a"
+  # a submission made while no watcher runs (after a timeout, say) is handed over by the next wait at once, and only once;
+  # what desk feedback printed counts as handed over too
+  a=$(python3 "$t/client.py" "$url" "$t/p" post "提前到的一条" && vh desk wait "$t/p" --timeout 20 2>&1); rc=$?
+  vh desk wait "$t/p" --timeout 1 >/dev/null 2>&1; i=$?
+  case "$rc:$i:$a" in 0:3:*"提前到的一条"*) ok "desk wait hands over a submission made before it was armed, at once and only once" ;;
+    *) bad "desk wait with a submission already there: rc $rc, then $i: $(printf '%s' "$a" | head -c 300)" ;; esac
+  a=$(python3 "$t/client.py" "$url" "$t/p" post "第三条" && vh desk feedback "$t/p")
+  vh desk wait "$t/p" --timeout 1 >/dev/null 2>&1; rc=$?
+  case "$rc:$a" in 3:*"第三条"*) ok "desk feedback counts what it printed as handed over" ;; *) bad "desk feedback then wait: rc $rc: $(printf '%s' "$a" | head -c 300)" ;; esac
+  # a copy of the project carries the running server's .desk.json and a .listening that names another folder: neither counts
+  cp -R "$t/p" "$t/p2" && printf '{"pid": %s, "since": 0, "until": 99999999999, "project": "%s"}\n' "$$" "$t/p" > "$t/p2/out/review/feedback/.listening"
+  if desk_start "$t/p2" "$t/srv2.log"; then
+    a=$(python3 "$t/client.py" "$desk_url" "$t/p2" status)
+    [ "$a" = False ] && ok "desk: a copied project starts its own server, and a .listening from another folder doesn't count" || bad "desk on a copy: listening said '$a'"
+    kill "$desk_pid"; wait "$desk_pid" 2>/dev/null
+  fi
   a=$(vh desk "$t/p" --port 0 2>&1); case "$a" in *"already serving p"*) ok "desk: a second start points to the running server" ;; *) bad "desk second start: $a" ;; esac
   kill "$pid"; wait "$pid" 2>/dev/null
   [ ! -e "$t/p/out/review/.desk.json" ] && ok "desk: stopping the server removes out/review/.desk.json" || bad "desk left .desk.json behind"
@@ -516,8 +601,11 @@ PY
     vh new math ci-x --lang fr >/dev/null 2>&1; rc=$?; [ $rc = 1 ] && ok "new --lang writes Review language (default zh) and rejects fr" || bad "new --lang fr exited $rc"
   else bad "new --lang: Review language not written"; fi
   cp -R tools/desk/fixtures/zh "$t/rz" && cp -R tools/desk/fixtures/zh "$t/re" && sed 's/^- Review language: zh /- Review language: en /' tools/desk/fixtures/zh/BRIEF.md > "$t/re/BRIEF.md"
-  if vh review "$t/rz" 1 >/dev/null 2>&1 && vh review "$t/re" 1 >/dev/null 2>&1 && grep -q '<html lang="zh-CN">' "$t/rz/out/review/gate-1.html" && grep -q '<html lang="en">' "$t/re/out/review/gate-1.html"
-  then ok "review: a gate JSON without lang takes the BRIEF's Review language, and the desk's extra keys pass"; else bad "review language from the BRIEF"; fi
+  sed 's/^{/{"lang": "en",/' tools/desk/fixtures/zh/out/review/gate-1.json > "$t/rz/out/review/gate-1b.json"
+  if vh review "$t/rz" 1 >/dev/null 2>&1 && vh review "$t/re" 1 >/dev/null 2>&1 && vh review "$t/rz" 1b >/dev/null 2>&1 \
+    && grep -q '<html lang="zh-CN">' "$t/rz/out/review/gate-1.html" && grep -q '<html lang="en">' "$t/re/out/review/gate-1.html" \
+    && grep -q '<html lang="en">' "$t/rz/out/review/gate-1b.html"
+  then ok "review: the gate JSON's lang, else the BRIEF's Review language (the desk's rule), and the desk's extra keys pass"; else bad "review language rule"; fi
   rm -rf "$t"
 }
 
diff --git a/tools/desk/README.md b/tools/desk/README.md
index 5bc13b7..9851e31 100644
--- a/tools/desk/README.md
+++ b/tools/desk/README.md
@@ -9,7 +9,7 @@
 ```bash
 bin/vh desk <项目> [--port N]                  # 起服务，只听 127.0.0.1；默认 8780–8799 里第一个空闲端口；这个项目已经有一个在跑，就只打印它的地址
 bin/vh desk wait <项目> [--timeout 秒]          # 等人提交：打印反馈，退出码 0；超时退出码 3（默认 7100 s）
-bin/vh desk feedback <项目> [--round 1b] [--json]   # 打印最近一次提交
+bin/vh desk feedback <项目> [--round 1b] [--json]   # 打印最近一次提交，并记为"已交给 agent"
 bin/vh desk data <项目>                        # 审阅台从项目里读出了什么（JSON），排查"为什么这一页是空的"时用
 ```
 
@@ -24,7 +24,7 @@ bin/vh desk data <项目>                        # 审阅台从项目里读出
 | 位置 | 读什么 | 英文项目 |
 |---|---|---|
 | 第一行 `# BRIEF：片名` | 片名 | `# BRIEF: title` |
-| `## Spec` 的 `- 键: 值` | 全部列出；`Effort`、`Review language`（`zh` / `en`，界面语言）、`Output`、`Watch on` 放在立意卡上 | 同左 |
+| `## Spec` 的 `- 键: 值` | 全部列出；`Effort`、`Review language`（`zh` / `en`，界面语言；这一轮的 gate JSON 写了 `lang` 时以它为准，和 `bin/vh review` 同一条规则）、`Output`、`Watch on` 放在立意卡上 | 同左 |
 | `## Content` 的 `- 键: 值` | `Concept (one line)`、`Spine (one line)`、`Recurring motif`、`What the viewer should know/feel at the end`；`Specifics` 下面缩进的几条 | 同左 |
 | `## Outline`（或 `## 大纲`）里的表 | 每段一行，见下 | `## Outline` |
 
@@ -77,7 +77,7 @@ bin/vh desk data <项目>                        # 审阅台从项目里读出
 
 ### out/review/gate-<n>.json
 
-和 `bin/vh review` 是同一份文件，字段见 `playbook/01-pipeline.md` 的"审阅页"（`include` 照样生效）。最新的一份（按修改时间）是"这一轮"。审阅台另外认几个可选字段，`bin/vh review` 不管它们：
+和 `bin/vh review` 是同一份文件，字段见 `playbook/01-pipeline.md` 的"审阅页"（`include` 照样生效）。"这一轮"是按流程排在最后的那一页：先按站（1、E0、E1、2、E2、E3、E4、3、E5），同一站再按页（1、1b、1c……）；不合这个写法的页名排在最前，彼此之间才看修改时间。所以复制项目、碰一下旧文件，都不会让已经过去的一页变回"这一轮"。审阅台另外认几个可选字段，`bin/vh review` 不管它们：
 
 ```json
 {
@@ -100,7 +100,9 @@ bin/vh desk data <项目>                        # 审阅台从项目里读出
 
 1. `out/review/feedback/<轮>-<YYYYMMDD-HHMMSS>.md`：一条一行的文字版，人的话原样不动；
 2. `REVIEW.md`：插一节 `## 审阅台反馈 · 关卡 <轮> · <日期 时间>`，把上面的文字整段原样放进代码块，下面留一行"定了：　改了："给 agent 填；插在模板的"授权跳过怎么记"之前，没有这一节就接在文末；
-3. `out/review/feedback/<轮>-<YYYYMMDD-HHMMSS>.json`：最后写，原子替换。`bin/vh desk wait` 等的就是它。
+3. `out/review/feedback/<轮>-<YYYYMMDD-HHMMSS>.json`：最后写，原子替换。`bin/vh desk wait` 等的就是它。同一秒里的第二份、第三份加 `-2`、`-3`，按数字排。
+
+交给 agent 的提交记在 `out/review/feedback/.consumed`：`bin/vh desk wait` 打印过的、`bin/vh desk feedback` 打印过的，都算交过了。`wait` 一启动，先看这一轮有没有还没交过、又晚于这一页 gate JSON 的提交（比如上一次 `wait` 超时之后人才提交），有就立刻打印、退出 0；没有才开始等新的。`.listening`（有 agent 在等）和 `.desk.json`（服务在跑）里都记着项目目录的完整路径，从别的项目拷来的这两个文件不算数。
 
 JSON 的格式：
 
@@ -122,14 +124,16 @@ JSON 的格式：
 - `items[].target` 的前缀说明点评的是什么：`dec:` 决定、`least:` 没把握的、`deleg:` 替人定的（gate JSON `delegated` 的序号）、`concept:line` 立意、`seg:` 大纲段、`cap:` 字幕或旁白条、`shot:` 镜头、`fact:` 素材、`time:` 小样的某一秒、`atime:` 音轨的某一秒、`led:` DECISIONS 里 agent 定的事（序号）、`doc:<文件>#<小节>` 文档的某一节。
 - `suggest` 是人直接写的"改成"，`orig` 是原句。
 
-服务会检查：轮次对得上一份 `gate-<轮>.json`（还没有审阅页时用 `notes`），决定和选项都在那一页里，状态和 target 合法，单条文字不超过 4000 字、整份不超过 256 KiB。
+服务会检查：轮次对得上一份 `gate-<轮>.json`（还没有审阅页时用 `notes`），决定和选项都在那一页里，每个字段的类型、状态和 target 合法，单条文字不超过 4000 字、整份不超过 256 KiB，正文和 Content-Length 对得上；不合的回 400，不会断开连接。
 
 ## 安全
 
 - 只绑定 127.0.0.1，只回答 Host 是自己的请求（挡住 DNS rebinding）。
 - 提交要带页面里那一次启动生成的令牌、JSON 格式，浏览器带了 Origin 时必须是同源；所以同一个浏览器里别的网页既读不到项目，也没法冒充人提交反馈。
-- `/p/` 只给项目目录里的普通文件：不出目录、不跟着符号链接出去、不给隐藏文件和 `*.env`。
+- `/p/` 下的每个文件都带 `Content-Security-Policy: sandbox allow-scripts allow-popups`（没有 `allow-same-origin`）：项目里的 HTML、SVG（HyperFrames 的 `index.html`、`node_modules` 里的页面、下载来的参考图）在浏览器里打开时是一个不透明的源，脚本照样能跑，但读不到审阅台的页面和令牌，也没法替人提交。
+- `/p/` 只给项目目录里的普通文件：不出目录、不跟着符号链接出去；隐藏文件和 `*.env` 不给，按请求的名字和解析后的真实文件各查一遍，不分大小写（指向 `.env` 的链接、`keys.ENV` 都不给）。
+- 每个连接 30 s 不动就断开，发了一半的请求不会一直占着线程。
 
 ## 测试
 
-`tools/ci.sh` 用 `tools/desk/fixtures/` 里的两个小项目（中文、英文）测读取（包括读不出表格时退回原文），在空闲端口起一个服务测 `/api/data`、206 Range、提交到临时副本、REVIEW.md 的追加，测 `wait` 在有提交时退出 0，以及 `bin/vh desk -h`。
+`tools/ci.sh` 用 `tools/desk/fixtures/` 里的两个小项目（中文、英文）测读取（包括读不出表格时退回原文、"这一轮"的顺序、语言规则、超长和深层嵌套的 markdown），在空闲端口起一个服务测 `/api/data`、206 Range、`/p/` 的 sandbox、各种拒绝和坏请求、提交到临时副本、REVIEW.md 的追加，测 `wait` 在有提交时退出 0、启动前就到的提交立刻交出、交过的不再交，拷来的 `.desk.json` 和 `.listening` 不算数，以及 `bin/vh desk -h`。
diff --git a/tools/desk/desk.py b/tools/desk/desk.py
index 564346e..75c4703 100644
--- a/tools/desk/desk.py
+++ b/tools/desk/desk.py
@@ -4,8 +4,10 @@
                                                 --port 0: any free port). Already serving this project: print its URL.
   bin/vh desk wait <project> [--timeout s]      block until the reviewer submits, print the feedback, exit 0 (3 on
                                                 timeout; default 7100 s). An agent runs it in the background after each
-                                                stop: its exit is the wake-up call.
-  bin/vh desk feedback <project> [--round r] [--json]   print the latest submission (exit 1 when there is none)
+                                                stop: its exit is the wake-up call. A submission for the current page that
+                                                came in before it was armed, and was never handed over, is printed at once.
+  bin/vh desk feedback <project> [--round r] [--json]   print the latest submission (exit 1 when there is none); it then
+                                                counts as handed over (out/review/feedback/.consumed)
   bin/vh desk data <project>                    print the data the desk shows, as JSON (what reader.py makes of the files)
 
 The desk reads the same out/review/gate-<n>.json as bin/vh review, plus the project's markdown (the contract is in
@@ -61,6 +63,7 @@ def main(argv):
             print(json.dumps(rec, ensure_ascii=False, indent=1))
         else:
             F.show(path, rec)
+        F.mark_consumed(project, [path])   # handed over: a later bin/vh desk wait doesn't print it again
         return 0
     import reader
     print(json.dumps(reader.read_project(project), ensure_ascii=False, indent=1))
diff --git a/tools/desk/feedback.py b/tools/desk/feedback.py
index 70832a3..8ed91ed 100644
--- a/tools/desk/feedback.py
+++ b/tools/desk/feedback.py
@@ -7,6 +7,8 @@
 import datetime, json, os, re, signal, sys, threading, time
 from pathlib import Path
 
+sys.path.insert(0, str(Path(__file__).resolve().parent))   # reader.py, for the current gate page
+
 MAX_BODY = 256 * 1024
 MAX_ITEMS, MAX_DECISIONS = 400, 20
 LIMIT = {"text": 4000, "suggest": 2000, "orig": 2000, "label": 300, "general": 8000}
@@ -50,8 +52,10 @@ def gate_options(project, rid):
         d = json.loads(p.read_text(encoding="utf-8-sig"))
     except (OSError, ValueError):
         return None
+    if not isinstance(d, dict):
+        return None
     out = {}
-    for x in (d.get("decisions") or []) if isinstance(d, dict) else []:
+    for x in d.get("decisions") if isinstance(d.get("decisions"), list) else []:
         if isinstance(x, dict) and isinstance(x.get("id"), str):
             out[x["id"]] = [o.get("id") if isinstance(o, dict) else str(o) for o in x.get("options") or []]
     return out
@@ -75,7 +79,10 @@ def validate(project, fb):
         if not isinstance(v, str) or k not in (opts or {}) or (opts[k] and v not in opts[k]):
             raise ValueError(f"decisions: {k!r} → {v!r} is not a decision and option of gate-{rid}.json")
         decisions[k] = v
-    for k in fb.get("defaulted") or []:
+    dflt = fb.get("defaulted") or []
+    if not isinstance(dflt, list):
+        raise ValueError("defaulted: a list of decision ids")
+    for k in dflt:
         if isinstance(k, str) and k in decisions:
             defaulted.append(k)
     items = fb.get("items") or []
@@ -102,14 +109,21 @@ def validate(project, fb):
                 raise ValueError(f"{w}.t: seconds")
             c["t"] = round(float(t), 2)
         clean.append(c)
-    lang = fb.get("lang") if fb.get("lang") in WORDS else "zh"
+    lang = fb.get("lang") or "zh"
+    if not isinstance(lang, str) or lang not in WORDS:
+        raise ValueError("lang: zh or en")
     return {"round": rid, "lang": lang, "decisions": decisions, "defaulted": defaulted, "items": clean,
             "general": _text(fb.get("general"), "general", "general").strip()}
 
 
+def _words(fb):
+    lang = fb.get("lang")
+    return WORDS[lang if isinstance(lang, str) and lang in WORDS else "zh"]
+
+
 def to_markdown(fb):
     """The .md copy: what the reviewer marked and wrote, one line each, their words untouched."""
-    w = WORDS[fb.get("lang") if fb.get("lang") in WORDS else "zh"]
+    w = _words(fb)
     lines = [w["title"].format(round=fb["round"], at=fb.get("submitted_at", "")), ""]
     for k, v in fb["decisions"].items():
         lines.append("- " + w["decision"].format(id=k, v=v) + (w["default"] if k in fb.get("defaulted", []) else ""))
@@ -137,7 +151,7 @@ def _write(p, text):
 def append_review(project, fb, md, json_rel):
     """Copy the submission into REVIEW.md as a dated section, before the template's reference sections
     (授权跳过怎么记 / 给人看的提示) when they are there, else at the end. The agent adds 定了 / 改了 under it."""
-    w = WORDS[fb.get("lang") if fb.get("lang") in WORDS else "zh"]
+    w = _words(fb)
     p = Path(project) / "REVIEW.md"
     old = p.read_text(encoding="utf-8") if p.exists() else ("# REVIEW：人的原话\n" if fb.get("lang") != "en" else "# REVIEW: the human's words\n")
     run = max([len(x) for x in re.findall(r"`+", md)] + [2])
@@ -172,35 +186,72 @@ def save(project, fb, now=None):
 
 
 def listening(project):
-    """Is an agent waiting for this project's feedback (bin/vh desk wait running)? {listening, since, until}."""
+    """Is an agent waiting for this project's feedback (bin/vh desk wait running)? {listening, since, until}.
+    The flag must name this very folder: one copied from another project (or left by an older tool) doesn't count."""
     flag = Path(project) / "out" / "review" / "feedback" / ".listening"
     try:
         info = json.loads(flag.read_text())
+        if info.get("project") != os.path.realpath(str(project)):
+            return {"listening": False}
         os.kill(int(info["pid"]), 0)
     except PermissionError:   # alive, someone else's process
         pass
-    except (OSError, ValueError, KeyError, TypeError):
+    except (OSError, ValueError, KeyError, TypeError, AttributeError):
         return {"listening": False}
     if float(info.get("until") or 0) < time.time():
         return {"listening": False}
     return {"listening": True, "since": info.get("since"), "until": info.get("until")}
 
 
-def latest(project, rid=None):
-    """The newest submission (for one round when rid is given): (json path, record) or (None, None)."""
+def _order(f, j):
+    """Sort key of a submission: its time, then the -2, -10 … suffix save() adds within one second, numerically."""
+    m = re.search(r"-(\d+)\.json$", f.name) if re.search(r"-\d{8}-\d{6}-\d+\.json$", f.name) else None
+    return (str(j.get("submitted_at", "")), int(m.group(1)) if m else 1, f.name)
+
+
+def _records(project):
     fdir = Path(project) / "out" / "review" / "feedback"
-    best = (None, None, "")
     for f in fdir.glob("*.json") if fdir.is_dir() else []:
         try:
             j = json.loads(f.read_text(encoding="utf-8"))
         except (OSError, ValueError):
             continue
-        if not isinstance(j, dict) or (rid and j.get("round") != rid):
-            continue
-        key = f"{j.get('submitted_at', '')}|{f.name}"
-        if key > best[2]:
-            best = (f, j, key)
-    return best[0], best[1]
+        if isinstance(j, dict):
+            yield f, j
+
+
+def latest(project, rid=None):
+    """The newest submission (for one round when rid is given): (json path, record) or (None, None)."""
+    best = max(((f, j) for f, j in _records(project) if not rid or j.get("round") == rid), key=lambda x: _order(*x), default=None)
+    return best if best else (None, None)
+
+
+def consumed(project):
+    """Names of the submissions an agent has already been handed (feedback/.consumed)."""
+    try:
+        names = json.loads((Path(project) / "out" / "review" / "feedback" / ".consumed").read_text()).get("files", [])
+        return {n for n in names if isinstance(n, str)}
+    except (OSError, ValueError, AttributeError):
+        return set()
+
+
+def mark_consumed(project, paths):
+    fdir = Path(project) / "out" / "review" / "feedback"
+    with _lock:
+        names = consumed(project) | {Path(p).name for p in paths}
+        fdir.mkdir(parents=True, exist_ok=True)
+        _write(fdir / ".consumed", json.dumps({"files": sorted(names)}, ensure_ascii=False) + "\n")
+
+
+def pending(project):
+    """Submissions for the current gate page, made after that page was written, that no agent has been handed yet
+    (oldest first). The current page is the one the desk shows as this round (reader.gate_pages)."""
+    import reader
+    pages = [p for p in reader.gate_pages(project) if gate_options(project, p.stem[5:]) is not None]   # readable ones, as the desk
+    rid, since = (pages[-1].stem[5:], pages[-1].stat().st_mtime) if pages else (NO_ROUND, 0)
+    done = consumed(project)
+    out = [(f, j) for f, j in _records(project) if f.name not in done and j.get("round") == rid and f.stat().st_mtime >= since]
+    return sorted(out, key=lambda x: _order(*x))
 
 
 def show(path, record, out=sys.stdout):
@@ -214,14 +265,28 @@ def show(path, record, out=sys.stdout):
     out.flush()
 
 
+HANDED = ("The reviewer's words are also in REVIEW.md (a dated section): add what you decided and changed under it. "
+          "Items not marked pass by default.\n")
+
+
 def wait(project, timeout, poll=1.0, out=sys.stdout):
-    """Block until a new feedback file appears, print it, return 0; 3 on timeout. Keeps feedback/.listening
-    ({pid, since, until}) while waiting, so the desk can say an agent is waiting; files already there are ignored."""
+    """Hand the agent the reviewer's submission: print it, mark it consumed, return 0; 3 on timeout.
+    A submission for the current page that arrived before the watcher was armed (say, while it was re-armed after a
+    timeout) and that no agent has been handed yet is printed at once. Otherwise it waits for a new one, keeping
+    feedback/.listening ({pid, since, until, project}) so the desk can say an agent is waiting."""
     fdir = Path(project) / "out" / "review" / "feedback"
     fdir.mkdir(parents=True, exist_ok=True)
+    early = pending(project)
+    if early:
+        for f, j in early:
+            show(f, j, out)
+        mark_consumed(project, [f for f, _ in early])
+        out.write(HANDED)
+        out.flush()
+        return 0
     flag, start = fdir / ".listening", time.time()
     seen = {p.name for p in fdir.glob("*.json")}
-    _write(flag, json.dumps({"pid": os.getpid(), "since": start, "until": start + timeout}))
+    _write(flag, json.dumps({"pid": os.getpid(), "since": start, "until": start + timeout, "project": os.path.realpath(str(project))}))
 
     def done(code):
         try:
@@ -236,15 +301,12 @@ def stop(signum, _frame):
     for s in (signal.SIGTERM, signal.SIGINT, signal.SIGHUP):
         signal.signal(s, stop)
     while time.time() - start < timeout:
-        new = sorted(p for p in fdir.glob("*.json") if p.name not in seen)
+        new = sorted(((f, j) for f, j in _records(project) if f.name not in seen), key=lambda x: _order(*x))
         if new:
-            for p in new:
-                try:
-                    show(p, json.loads(p.read_text(encoding="utf-8")), out)
-                except (OSError, ValueError):
-                    continue
-            out.write("The reviewer's words are also in REVIEW.md (a dated section): add what you decided and changed "
-                      "under it. Items not marked pass by default.\n")
+            for f, j in new:
+                show(f, j, out)
+            mark_consumed(project, [f for f, _ in new])
+            out.write(HANDED)
             out.flush()
             return done(0)
         time.sleep(poll)
diff --git a/tools/desk/reader.py b/tools/desk/reader.py
index 89bd417..42481dd 100644
--- a/tools/desk/reader.py
+++ b/tools/desk/reader.py
@@ -201,18 +201,24 @@ def _link(m):
     return text
 
 
+MAX_INLINE = 5000   # characters: a longer line is shown escaped, without inline markup, so no pattern can run long
+
+
 def inline(s):
-    """One line of markdown → HTML. Everything is escaped; code spans stay literal."""
+    """One line of markdown → HTML. Everything is escaped; code spans stay literal. The patterns stop at the next
+    delimiter (no '.+?' across the line), so each runs in linear time."""
+    if len(s) > MAX_INLINE:
+        return html.escape(s, quote=False)
     out = []
     for i, part in enumerate(re.split(r"(`[^`]+`)", s)):
         if i % 2:
             out.append("<code>" + html.escape(part[1:-1]) + "</code>")
             continue
         p = html.escape(part, quote=False)
-        p = re.sub(r"\[([^\]]+)\]\(([^)\s]+)\)", _link, p)
-        p = re.sub(r"\*\*(.+?)\*\*", r"<strong>\1</strong>", p)
-        p = re.sub(r"~~(.+?)~~", r"<del>\1</del>", p)
-        p = re.sub(r"(?<![*\w])\*(?![\s*])(.+?)(?<![\s*])\*(?![*\w])", r"<em>\1</em>", p)
+        p = re.sub(r"\[([^\[\]]+)\]\(([^()\s]+)\)", _link, p)
+        p = re.sub(r"\*\*([^*]+)\*\*", r"<strong>\1</strong>", p)
+        p = re.sub(r"~~([^~]+)~~", r"<del>\1</del>", p)
+        p = re.sub(r"(?<![*\w])\*([^\s*](?:[^*]*[^\s*])?)\*(?![*\w])", r"<em>\1</em>", p)
         out.append(p)
     return "".join(out)
 
@@ -242,7 +248,10 @@ def _starts_block(lines, i):
             or (s.startswith("|") and i + 1 < len(lines) and SEP.match(lines[i + 1]) is not None))
 
 
-def render_md(text):
+MAX_QUOTE_DEPTH = 8
+
+
+def render_md(text, depth=0):
     """Markdown → HTML for display. Everything is escaped first; only a small subset becomes markup: headings,
     paragraphs, lists (nested by indent, task boxes), pipe tables, fenced code, blockquotes, rules, **bold**, *italic*,
     `code`, ~~strike~~, and links to http(s) or to a project file (/p/…). HTML comments are dropped."""
@@ -287,7 +296,9 @@ def render_md(text):
             while i < len(lines) and lines[i].strip().startswith(">"):
                 buf.append(re.sub(r"^\s*>\s?", "", lines[i]))
                 i += 1
-            out.append("<blockquote>" + render_md("\n".join(buf)) + "</blockquote>")
+            inner = render_md("\n".join(buf), depth + 1) if depth < MAX_QUOTE_DEPTH else \
+                "<p>" + "<br>".join(inline(b) for b in buf) + "</p>"   # deeper quotes stay flat: no runaway recursion
+            out.append("<blockquote>" + inner + "</blockquote>")
             continue
         if LIST.match(line):
             items = []
@@ -494,14 +505,26 @@ def _history(review_md):
     return out, paused
 
 
+GATE_ORDER = {"1": 1, "E0": 2, "E1": 3, "2": 4, "E2": 5, "E3": 6, "E4": 7, "3": 8, "E5": 9}
+
+
+def gate_pages(project):
+    """out/review/gate-*.json in review order; the last is this round. Order: the stop (1, E0, E1, 2, E2, E3, E4, 3,
+    E5), then the page within it (1, 1b, 1c …). Modification time only breaks ties between page names outside that
+    pattern (they come first), so copying or touching a file never makes an earlier page current again."""
+    rdir = Path(project) / "out" / "review"
+
+    def key(p):
+        m = re.fullmatch(r"(E\d|\d)([a-z]*)", p.stem[5:])
+        return (GATE_ORDER.get(m.group(1), 0), len(m.group(2)), m.group(2), 0, p.name) if m else (0, 0, "", p.stat().st_mtime, p.name)
+    pages = [p for p in rdir.glob("gate-*.json") if re.fullmatch(r"[A-Za-z0-9_-]{1,24}", p.stem[5:])] if rdir.is_dir() else []
+    return sorted(pages, key=key)
+
+
 def _rounds(project, warnings):
-    rdir = project / "out" / "review"
-    found = sorted(rdir.glob("gate-*.json"), key=lambda p: (p.stat().st_mtime, p.name)) if rdir.is_dir() else []
     out = []
-    for g in found:
+    for g in gate_pages(project):
         rid = g.stem[5:]
-        if not re.fullmatch(r"[A-Za-z0-9_-]{1,24}", rid):
-            continue
         d = _json(g, warnings)
         if not isinstance(d, dict):
             if d is not None:
@@ -637,8 +660,10 @@ def read_project(project):
     history, paused = _history(review_md)
     title = (re.search(r"^#\s+BRIEF\s*[：:]\s*(.+)$", brief, re.M) or [None, ""])[1].strip() or project.name
     effort = next((re.split(r"\s", s["v"])[0] for s in spec if s["k"].lower() == "effort"), "")
-    lang = R.review_lang(project) or next((r["data"].get("lang") for r in reversed(rounds) if r["data"].get("lang") in ("zh", "en")), "") or "zh"
     cur = rounds[-1] if rounds else None
+    # one rule with bin/vh review: this round's gate JSON lang, else the BRIEF's Review language, else zh
+    page_lang = cur["data"].get("lang") if cur else None
+    lang = page_lang if isinstance(page_lang, str) and page_lang in ("zh", "en") else (R.review_lang(project) or "zh")
     stage = STAGE_OF_GATE.get(cur["gate"], 1) if cur else 0
     return {"version": 1, "lang": lang,
             "project": {"slug": project.name, "title": title, "effort": effort, "paused": paused},
diff --git a/tools/desk/server.py b/tools/desk/server.py
index 2ba4649..310e063 100644
--- a/tools/desk/server.py
+++ b/tools/desk/server.py
@@ -25,6 +25,10 @@
 DEFAULT_PORTS = range(8780, 8800)
 CSP = ("default-src 'self'; img-src 'self' data: https:; media-src 'self' https:; style-src 'self' 'unsafe-inline'; "
        "script-src 'self'; connect-src 'self'; frame-ancestors 'none'; base-uri 'none'; form-action 'none'")
+# every project file is served sandboxed without allow-same-origin: an HTML or SVG in the project (a HyperFrames
+# index.html, node_modules, a downloaded reference) opened from the desk runs in an opaque origin, so it can neither
+# read the page's token nor post feedback in the reviewer's name
+P_CSP = "sandbox allow-scripts allow-popups"
 mimetypes.add_type("text/markdown", ".md")
 mimetypes.add_type("audio/wav", ".wav")
 
@@ -53,6 +57,7 @@ def url(self):
 class Handler(http.server.BaseHTTPRequestHandler):
     server_version = "vh-desk"
     sys_version = ""
+    timeout = 30   # a socket that stops sending (a body shorter than its Content-Length) frees its thread
 
     def log_message(self, fmt, *a):   # quiet: an agent's background log stays readable
         pass
@@ -112,14 +117,16 @@ def do_GET(self):
         self._error(404, "not found")
 
     def _resolve(self, rel):
-        """A file inside the project, or None: no '..', no hidden parts (.env, .git, .listening), no *.env."""
+        """A file inside the project, or None: no '..', no hidden parts (.env, .git, .listening), no *.env, checked
+        on the name asked for and on the file it resolves to (a symlink to .env is refused too), ignoring case."""
         rel = unquote(rel)
         parts = [p for p in rel.split("/") if p not in ("", ".")]
-        if not parts or "\x00" in rel or any(p == ".." or p.startswith(".") or p.endswith(".env") for p in parts):
+        hidden = lambda ps: any(p == ".." or p.startswith(".") or p.lower().endswith(".env") for p in ps)   # noqa: E731
+        if not parts or "\x00" in rel or hidden(parts):
             return None
-        root = str(self.server.project)
+        root = os.path.realpath(str(self.server.project))
         f = os.path.realpath(os.path.join(root, *parts))
-        if os.path.commonpath([f, root]) != root or not os.path.isfile(f):
+        if os.path.commonpath([f, root]) != root or not os.path.isfile(f) or hidden(os.path.relpath(f, root).split(os.sep)):
             return None
         return f
 
@@ -133,6 +140,7 @@ def _file(self, rel):
             ctype += "; charset=utf-8"
         rng = self.headers.get("Range", "")
         m = re.fullmatch(r"bytes=(\d*)-(\d*)", rng.strip())
+        sandbox = {"Content-Security-Policy": P_CSP}
         if rng and m and (m.group(1) or m.group(2)):
             if m.group(1):
                 start, end = int(m.group(1)), int(m.group(2)) if m.group(2) else size - 1
@@ -140,11 +148,11 @@ def _file(self, rel):
                 start, end = max(0, size - int(m.group(2))), size - 1
             end = min(end, size - 1)
             if start > end or start >= size:
-                return self._send(416, b"", "text/plain", {"Content-Range": f"bytes */{size}"})
-            self._head(206, ctype, end - start + 1, {"Content-Range": f"bytes {start}-{end}/{size}", "Accept-Ranges": "bytes"})
+                return self._send(416, b"", "text/plain", dict(sandbox, **{"Content-Range": f"bytes */{size}"}))
+            self._head(206, ctype, end - start + 1, dict(sandbox, **{"Content-Range": f"bytes {start}-{end}/{size}", "Accept-Ranges": "bytes"}))
         else:
             start, end = 0, size - 1
-            self._head(200, ctype, size, {"Accept-Ranges": "bytes"})
+            self._head(200, ctype, size, dict(sandbox, **{"Accept-Ranges": "bytes"}))
         if self.command == "HEAD":
             return
         try:
@@ -157,8 +165,8 @@ def _file(self, rel):
                         break
                     self.wfile.write(chunk)
                     left -= len(chunk)
-        except (BrokenPipeError, ConnectionResetError):   # the player seeked away
-            pass
+        except OSError:   # the player seeked away, or stopped reading until the socket timed out
+            self.close_connection = True
 
     # ---------- POST ----------
     def do_POST(self):
@@ -169,7 +177,8 @@ def do_POST(self):
         origin = self.headers.get("Origin")
         if origin and urlsplit(origin).netloc not in self.server.hosts:
             return self._error(403, "cross-origin request refused")
-        if not secrets.compare_digest(self.headers.get("X-Desk-Token", ""), self.server.token):
+        given = self.headers.get("X-Desk-Token", "").encode("utf-8", "replace")   # bytes: a non-ASCII str would raise
+        if not secrets.compare_digest(given, self.server.token.encode("ascii")):
             return self._error(403, "missing or wrong desk token: reload the page")
         if not self.headers.get("Content-Type", "").startswith("application/json"):
             return self._error(415, "send JSON")
@@ -180,9 +189,17 @@ def do_POST(self):
         if n <= 0 or n > F.MAX_BODY:
             return self._error(413 if n > 0 else 400, f"empty, or larger than {F.MAX_BODY // 1024} KiB")
         try:
-            fb = F.validate(self.server.project, json.loads(self.rfile.read(n).decode("utf-8")))
-        except (ValueError, UnicodeDecodeError) as e:
-            return self._error(400, str(e))
+            body = self.rfile.read(n)
+        except OSError:   # timed out waiting for the rest of the body
+            self.close_connection = True
+            return self._error(408, "the request body did not arrive")
+        if len(body) < n:
+            self.close_connection = True
+            return self._error(400, f"the body is {len(body)} bytes, not the {n} its Content-Length says")
+        try:
+            fb = F.validate(self.server.project, json.loads(body.decode("utf-8")))
+        except (ValueError, TypeError, AttributeError, RecursionError) as e:   # UnicodeDecodeError is a ValueError
+            return self._error(400, str(e) or type(e).__name__)
         path = F.save(self.server.project, fb)
         sys.stderr.write(f"desk: feedback saved → {path} (also in REVIEW.md)\n")
         sys.stderr.flush()
@@ -192,10 +209,13 @@ def do_POST(self):
 # ---------- start, once per project ----------
 
 def running(project):
-    """The URL of a desk already serving this project (out/review/.desk.json and it answers), else None."""
+    """The URL of a desk already serving this project (out/review/.desk.json names this very folder, its process is
+    alive and its port answers), else None. A copied project carries the original's file; the path tells them apart."""
     info_p = Path(project) / "out" / "review" / ".desk.json"
     try:
         info = json.loads(info_p.read_text())
+        if info.get("project") != os.path.realpath(str(project)):
+            return None
         os.kill(int(info["pid"]), 0)
         with socket.create_connection(("127.0.0.1", int(info["port"])), timeout=1):
             pass
@@ -225,7 +245,7 @@ def serve(project, port=None):
         return 2
     info_p = project / "out" / "review" / ".desk.json"
     info_p.parent.mkdir(parents=True, exist_ok=True)
-    info_p.write_text(json.dumps({"pid": os.getpid(), "port": srv.port, "url": srv.url,
+    info_p.write_text(json.dumps({"pid": os.getpid(), "port": srv.port, "url": srv.url, "project": os.path.realpath(str(project)),
                                   "started": datetime.datetime.now().isoformat(timespec="seconds")}))
 
     def stop(signum, _frame):
diff --git a/tools/review.py b/tools/review.py
index b896726..8e74254 100644
--- a/tools/review.py
+++ b/tools/review.py
@@ -289,14 +289,15 @@ def __init__(self, project: Path, src: Path, data: dict, gate: str):
         self.project, self.src, self.d, self.gate = project, src, data, gate
         self.out = project / "out" / "review"
         lang = data.get("lang")
-        self.lang = lang if isinstance(lang, str) and lang in T else (review_lang(project) if lang is None else None) or "zh"
+        # the same rule as the review desk: this page's lang, else the BRIEF's Review language, else zh
+        self.lang = lang if isinstance(lang, str) and lang in T else (review_lang(project) or "zh")
         self.t = T[self.lang]
         self.errors, self.warnings = [], []
         self.shot_ids = set()
         self.flagged = {}      # shot id → least-sure note
         self.bad_paths = set() # each missing or refused path is reported once, however many places use it
         if lang is not None and self.lang != lang:
-            self.warn(f"lang {lang!r} is not zh or en; using zh")
+            self.warn(f"lang {lang!r} is not zh or en; using {self.lang}")
 
     def err(self, msg):
         if msg not in self.errors:   # a missing animatic used by six segments is reported once

From 6ad0c0bdbb25494ece4166f4b966b5c6cd56a770 Mon Sep 17 00:00:00 2001
From: zhanglinghao <zhangczssx@gmail.com>
Date: Sun, 4 Oct 2026 04:06:15 +0800
Subject: [PATCH 4/5] desk: this round is the page bin/vh review made last
 (.current); the watcher snapshots before the hand-over

Review order alone picked the wrong page when work went back a stop: gate 2
then a new concept page 1b stayed on 2, gate 3 then a voice page E3b stayed on
3, and an upper-case 2B or a custom name like "final" sorted first and could
never be current; pending() then filtered on the wrong round too.

- bin/vh review <project> <n> writes <n> to out/review/.current. The desk and
  bin/vh desk wait read it first; review order (gate_pages, page letters now
  compared case-insensitively) is only the fallback when .current is missing
  or names a page that is gone.
- bin/vh desk wait takes its snapshot of existing submissions before the
  early hand-over check, so one landing between the two is no longer lost.
- tools/desk/README.md: the .current rule, and a limits section (a stale tab
  submits to its own round; the .consumed lock is per process, so a race can
  hand a submission over twice but never drops one). playbook/01 and the
  CHANGELOG follow.
- CI: 2 -> 1b, 3 -> E3b, "final" and "2B" become current after bin/vh review;
  pending() follows .current; a removed .current page falls back to review
  order.
---
 CHANGELOG.md            |  4 ++--
 playbook/01-pipeline.md |  2 +-
 tools/ci.sh             | 25 ++++++++++++++++++++++---
 tools/desk/README.md    |  9 +++++++--
 tools/desk/feedback.py  |  2 +-
 tools/desk/reader.py    | 27 ++++++++++++++++++++-------
 tools/review.py         |  6 +++++-
 7 files changed, 58 insertions(+), 17 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 17b79a1..ff67628 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,11 +5,11 @@
 **The review desk: tick, comment and submit in a page, and the agent carries on by itself (`bin/vh desk`)**
 - Why: reviewing a film's first gate through the static pages, the maintainer found the outline, captions and stages hard to read (some were raw `.md` links), had no way to tick or comment in place, had to reply in chat with codes like "1 S1", and got a new one-off page every time. A prototype desk fixed that, and after two real rounds in it: "返回还是要手动给你触发，我觉得可以加一个监控", the outline should be split by content, not by 起承转合, reuse needs a basic infrastructure, and the desk belongs to `studio`, in Chinese or English by the first request.
 - `tools/desk/` (stdlib Python, offline, no CDN, light and dark): `bin/vh desk <project> [--port N]` serves one project on 127.0.0.1 (the first free port of 8780–8799; a second start prints the running one's address). Ten views read fresh from the project's own files: this round (decisions with options, least sure, decided for you), concept and outline (a time bar by segment), captions or narration (grouped by segment, term chips, a rough reading speed), the storyboard synced to its video, sound (sections named from the gate JSON, listen prompts, timecoded notes), fact check, the film with timecoded notes (C key), the decision ledger, history, and every doc rendered as text. Any item can be marked ok / change / question with a line and a "change to"; a tray collects them and submits once.
-- A submission is checked (a real gate page, its decisions and options, sizes) and written as `out/review/feedback/<round>-<time>.md`, then into `REVIEW.md` verbatim as a dated, fenced section before the template's reference sections (CLAUDE.md asks for the human's words word for word), then the `.json`. `bin/vh desk wait <project> [--timeout s]` blocks until that file appears, prints it and exits 0 (3 on timeout), so an agent that armed it in the background is woken; a submission for the current page that arrived before it was armed (after a timeout, say) and was never handed over (`out/review/feedback/.consumed`) is printed at once. The page shows whether an agent is waiting. `bin/vh desk feedback` prints the latest submission and counts it as handed over, `bin/vh desk data` what the desk read. "This round" is the last page in review order (stop, then page), not the newest file, so copying or touching a project can't bring an old page back. Only requests addressed to the server's own host are answered; a submission needs the page's per-run token, JSON and the same origin; `/p/` serves only ordinary files inside the project (hidden files and `*.env` refused on the resolved path, any case) and sandboxes every one of them without `allow-same-origin`, so an HTML or SVG in the project can't read the token; `.desk.json` and `.listening` name their project folder, so copies don't count; malformed requests get a 400 and idle sockets time out.
+- A submission is checked (a real gate page, its decisions and options, sizes) and written as `out/review/feedback/<round>-<time>.md`, then into `REVIEW.md` verbatim as a dated, fenced section before the template's reference sections (CLAUDE.md asks for the human's words word for word), then the `.json`. `bin/vh desk wait <project> [--timeout s]` blocks until that file appears, prints it and exits 0 (3 on timeout), so an agent that armed it in the background is woken; a submission for the current page that arrived before it was armed (after a timeout, say) and was never handed over (`out/review/feedback/.consumed`) is printed at once. The page shows whether an agent is waiting. `bin/vh desk feedback` prints the latest submission and counts it as handed over, `bin/vh desk data` what the desk read. "This round" is the page `bin/vh review` made last, which it now notes in `out/review/.current` (so a concept page `1b` after gate 2, `E3b` after gate 3, or a page called `final` becomes current); only without it does the review order (stop, then page) decide, and never the newest file, so copying or touching a project can't bring an old page back. Only requests addressed to the server's own host are answered; a submission needs the page's per-run token, JSON and the same origin; `/p/` serves only ordinary files inside the project (hidden files and `*.env` refused on the resolved path, any case) and sandboxes every one of them without `allow-same-origin`, so an HTML or SVG in the project can't read the token; `.desk.json` and `.listening` name their project folder, so copies don't count; malformed requests get a 400 and idle sockets time out.
 - The data contract is written down in `tools/desk/README.md`: which BRIEF sections and tables (a new Outline table whose segment names say what happens, with an optional tag column for 起承转合), the SCRIPT caption or narration table with an optional 术语 column, the NOTES 素材清单 (an optional 上屏说法 column; struck rows are dropped), the DECISIONS ledger and its strikethrough for superseded entries, REVIEW's quotes, `shots.json`, the gate JSON plus three optional keys (`listen`, `music` with section labels, `film`), the feedback JSON, and English header equivalents. Whatever it can't parse is shown as formatted text with a warning, never hidden; older projects without the tables still show every document.
 - Language: a BRIEF Spec line `Review language: zh | en`, set from the user's first request (`bin/vh new … --lang en`, default zh). One rule for the desk and `bin/vh review`: the page's gate JSON `lang`, else the BRIEF line, else zh; the desk can also switch in the page. Captions and data stay in the project's language.
 - Effort: CLAUDE.md's effort table gets a 在哪审 row (quick: no gates; standard: the static page, the desk when wanted; studio: the desk, the watcher armed after each stop, chat as the fallback for agents without background wake-ups), and step 5, director mode, `playbook/01-pipeline.md` (a new 审阅台 section) and `bin/vh new`'s next-step line say the same. Templates: BRIEF (the Review language line, the Outline table), SCRIPT (the caption table and 术语), DECISIONS (strike through what a gate superseded), NOTES (上屏说法).
-- CI: the reader on two committed fixtures (`tools/desk/fixtures/zh`, `en`; `.gitignore` lets their `out/` in), the round order after a touch, the language rule, long and deeply nested markdown in bounded time; a server on a free port (data with markup escaped, a 206 range, the `/p/` sandbox, each refusal including a symlink to `.env` and `keys.ENV`, malformed bodies and tokens answered with 400/403); a submission that wakes `desk wait` and lands in REVIEW.md; a submission made before `wait` is handed over at once and only once; copied `.desk.json` and `.listening` files don't count; the timeout, `new --lang`, and `bin/vh review`'s language default. `bin/vh desk -h` is covered by the dispatcher's `-h` check.
+- CI: the reader on two committed fixtures (`tools/desk/fixtures/zh`, `en`; `.gitignore` lets their `out/` in), this round after `bin/vh review` (2 → 1b, 3 → E3b, a custom name) and the review-order fallback (a touched file, a removed `.current` page), the language rule, long and deeply nested markdown in bounded time; a server on a free port (data with markup escaped, a 206 range, the `/p/` sandbox, each refusal including a symlink to `.env` and `keys.ENV`, malformed bodies and tokens answered with 400/403); a submission that wakes `desk wait` and lands in REVIEW.md; a submission made before `wait` is handed over at once and only once; copied `.desk.json` and `.listening` files don't count; the timeout, `new --lang`, and `bin/vh review`'s language default. `bin/vh desk -h` is covered by the dispatcher's `-h` check.
 
 **Docs: what one film's gates taught**
 - Outlines are named by content or stage ("按下发送 / 信道编码与调制 / 基站接住"); 起承转合 is at most a small tag (`playbook/09-narrative.md` §3 and §9, `playbook/01-pipeline.md`'s director table, the BRIEF template).
diff --git a/playbook/01-pipeline.md b/playbook/01-pipeline.md
index 74ff38e..33accd1 100644
--- a/playbook/01-pipeline.md
+++ b/playbook/01-pipeline.md
@@ -156,7 +156,7 @@ projects/2026-10-01-leo-doppler/
 - **什么时候用**：`studio` 默认用它；`standard` 默认还是静态审阅页，人想逐条点评时也可以开审阅台；`quick` 不设关卡，导演模式要停的那几处在聊天里问或用静态页。
 - **语言**：界面语言取 BRIEF 的 `Review language`（`zh` / `en`），按用户第一句话的语言定，建项目时用 `bin/vh new … --lang en`；这一轮的 gate JSON 写了 `lang` 时以它为准（和静态审阅页同一条规则）；页面右上角也能切换。字幕和项目文档照旧用项目自己的语言。
 - **每次停，agent 这样做**：
-  1. 写 `out/review/gate-<n>.json`，运行 `bin/vh review <project> <n>`：检查 JSON、生成静态页当备份、打印聊天消息；
+  1. 写 `out/review/gate-<n>.json`，运行 `bin/vh review <project> <n>`：检查 JSON、生成静态页当备份、打印聊天消息，并把这一页记成审阅台的"这一轮"（`out/review/.current`）；
   2. 在后台运行 `bin/vh desk <project>` 起服务（只听 127.0.0.1；已经在跑就只打印地址）；
   3. 在后台运行 `bin/vh desk wait <project>`，人一提交它就打印反馈、退出，agent 随之被唤醒；`wait` 超时以后人才提交的，下一次 `wait` 一启动就交出来。Claude Code 用后台命令，超时给到上限（`timeout` 7200000 ms，`wait` 默认等 7100 s）；服务也一样，超时被停掉了，下一次停时再起一遍；
   4. 聊天里发 `bin/vh review` 打印的几行，加上审阅台的地址，然后停下；
diff --git a/tools/ci.sh b/tools/ci.sh
index 0066225..92ed2d7 100755
--- a/tools/ci.sh
+++ b/tools/ci.sh
@@ -441,11 +441,12 @@ sys.exit(1 if bad else 0)
 PY
   then ok "desk reads the zh and en fixtures (outline, captions and terms, bars, facts, ledger, history, gate extras), and a doc without its table as text"
   else bad "desk reader on tools/desk/fixtures"; fi
-  # this round is the last page in review order, not the newest file; one language rule; markdown in bounded time;
+  # this round is the page bin/vh review made last (.current), else the last in review order, never the newest file;
+  # one language rule; markdown in bounded time;
   # the newest submission within one second is the highest -n. (A file, not a heredoc inside $(…): bash 3.2 counts the
   # parentheses in the heredoc's body.)
   cat > "$t/order.py" <<'PY'
-import json, os, shutil, sys, time
+import json, os, shutil, subprocess, sys, time
 sys.path.insert(0, "tools/desk")
 import feedback, reader
 bad = []
@@ -476,11 +477,29 @@ os.makedirs(fd)
 for n in ("1b-20261004-030440", "1b-20261004-030440-2", "1b-20261004-030440-10"):
     json.dump({"round": "1b", "submitted_at": "2026-10-04T03:04:40", "n": n}, open(os.path.join(fd, n + ".json"), "w"))
 want(feedback.latest(d)[1]["n"] == "1b-20261004-030440-10", f"latest within one second: {feedback.latest(d)[1]}")
+# the page bin/vh review made last is this round (out/review/.current), whatever the stop order or its name
+c = os.path.join(sys.argv[1], "current")
+shutil.copytree("tools/desk/fixtures/zh", c)
+cg = os.path.join(c, "out", "review")
+def publish(n):
+    shutil.copy(os.path.join(cg, "gate-1.json"), os.path.join(cg, f"gate-{n}.json"))
+    return subprocess.run([sys.executable, "tools/review.py", c, n], capture_output=True, text=True).returncode
+cur = lambda: reader.read_project(c)["rounds"][-1]["id"]   # noqa: E731
+for seq, page in ((["2", "1b"], "1b"), (["3", "E3b"], "E3b"), (["final"], "final"), (["2B"], "2B")):
+    rcs = [publish(n) for n in seq]
+    want(rcs == [0] * len(seq) and cur() == page, f"published {seq} (exit {rcs}): this round is {cur()}, not {page}")
+fd2 = os.path.join(cg, "feedback")
+os.makedirs(fd2)
+for rid in ("2B", "E3b"):
+    json.dump({"round": rid, "submitted_at": "2026-10-04T12:00:00"}, open(os.path.join(fd2, f"{rid}-20261004-120000.json"), "w"))
+want([f.name for f, _ in feedback.pending(c)] == ["2B-20261004-120000.json"], f"pending follows .current: {[f.name for f, _ in feedback.pending(c)]}")
+os.remove(os.path.join(cg, "gate-2B.json"))   # .current names a page that is gone: the review order decides
+want(cur() == "3", f"with .current pointing at a removed page: {cur()}")
 if bad:
     print("; ".join(bad))
 sys.exit(1 if bad else 0)
 PY
-  if a=$(python3 "$t/order.py" "$t"); then ok "desk: this round is the last page in review order (a touched file doesn't win), the gate JSON's lang overrides the BRIEF, long and deeply nested markdown in bounded time, -10 after -2"
+  if a=$(python3 "$t/order.py" "$t"); then ok "desk: this round is the page bin/vh review made last (1b after 2, E3b after 3, final, 2B; pending follows it), else review order (a touched file doesn't win); the gate JSON's lang overrides the BRIEF; long and deeply nested markdown in bounded time; -10 after -2"
   else bad "desk order / lang / markdown / latest: $a"; fi
   # a server on a free port, on a copy (a submission writes into the project); a hidden file, a link to it, an upper-case
   # .ENV and an SVG with a script in it: none may be served same-origin
diff --git a/tools/desk/README.md b/tools/desk/README.md
index 9851e31..7e08d83 100644
--- a/tools/desk/README.md
+++ b/tools/desk/README.md
@@ -77,7 +77,7 @@ bin/vh desk data <项目>                        # 审阅台从项目里读出
 
 ### out/review/gate-<n>.json
 
-和 `bin/vh review` 是同一份文件，字段见 `playbook/01-pipeline.md` 的"审阅页"（`include` 照样生效）。"这一轮"是按流程排在最后的那一页：先按站（1、E0、E1、2、E2、E3、E4、3、E5），同一站再按页（1、1b、1c……）；不合这个写法的页名排在最前，彼此之间才看修改时间。所以复制项目、碰一下旧文件，都不会让已经过去的一页变回"这一轮"。审阅台另外认几个可选字段，`bin/vh review` 不管它们：
+和 `bin/vh review` 是同一份文件，字段见 `playbook/01-pipeline.md` 的"审阅页"（`include` 照样生效）。"这一轮"是 `bin/vh review <项目> <n>` 最后做的那一页：它每次把页名写进 `out/review/.current`，审阅台和 `bin/vh desk wait` 都先读它。所以关卡 ② 之后回头出一页立意 `1b`、关卡 ③ 之后重定配音出 `E3b`、自己起名的 `final`，都会是"这一轮"。`.current` 没有，或者它指的那一页已经删了，才按流程顺序取最后一页：先按站（1、E0、E1、2、E2、E3、E4、3、E5），同一站再按页（1、1b、1c……，不分大小写）；不合这个写法的页名排在最前，彼此之间看修改时间。复制项目、碰一下旧文件，都不会改变哪一页是"这一轮"。审阅台另外认几个可选字段，`bin/vh review` 不管它们：
 
 ```json
 {
@@ -134,6 +134,11 @@ JSON 的格式：
 - `/p/` 只给项目目录里的普通文件：不出目录、不跟着符号链接出去；隐藏文件和 `*.env` 不给，按请求的名字和解析后的真实文件各查一遍，不分大小写（指向 `.env` 的链接、`keys.ENV` 都不给）。
 - 每个连接 30 s 不动就断开，发了一半的请求不会一直占着线程。
 
+## 限制
+
+- 开着的旧页面不会自己换轮：agent 出了新的一页，人在之前打开、没刷新的标签页里提交，反馈记在旧的那一轮（那一页的 gate JSON 还在，服务照收）。页面右上角的 ↻ 重新读取。
+- `.consumed` 的锁只在一个进程里有效：两个进程同时写它（比如同时跑两个 `bin/vh desk wait`），可能丢一条"已交过"的记录，结果是那份反馈被再交一次，不会丢反馈。
+
 ## 测试
 
-`tools/ci.sh` 用 `tools/desk/fixtures/` 里的两个小项目（中文、英文）测读取（包括读不出表格时退回原文、"这一轮"的顺序、语言规则、超长和深层嵌套的 markdown），在空闲端口起一个服务测 `/api/data`、206 Range、`/p/` 的 sandbox、各种拒绝和坏请求、提交到临时副本、REVIEW.md 的追加，测 `wait` 在有提交时退出 0、启动前就到的提交立刻交出、交过的不再交，拷来的 `.desk.json` 和 `.listening` 不算数，以及 `bin/vh desk -h`。
+`tools/ci.sh` 用 `tools/desk/fixtures/` 里的两个小项目（中文、英文）测读取（包括读不出表格时退回原文、"这一轮"取 `.current`（2 之后的 1b、3 之后的 E3b、自起的页名，`.current` 指向已删的页时退回流程顺序）、语言规则、超长和深层嵌套的 markdown），在空闲端口起一个服务测 `/api/data`、206 Range、`/p/` 的 sandbox、各种拒绝和坏请求、提交到临时副本、REVIEW.md 的追加，测 `wait` 在有提交时退出 0、启动前就到的提交立刻交出、交过的不再交，拷来的 `.desk.json` 和 `.listening` 不算数，以及 `bin/vh desk -h`。
diff --git a/tools/desk/feedback.py b/tools/desk/feedback.py
index 8ed91ed..f4e2741 100644
--- a/tools/desk/feedback.py
+++ b/tools/desk/feedback.py
@@ -276,6 +276,7 @@ def wait(project, timeout, poll=1.0, out=sys.stdout):
     feedback/.listening ({pid, since, until, project}) so the desk can say an agent is waiting."""
     fdir = Path(project) / "out" / "review" / "feedback"
     fdir.mkdir(parents=True, exist_ok=True)
+    seen = {p.name for p in fdir.glob("*.json")}   # first: a submission landing after this is either pending or new
     early = pending(project)
     if early:
         for f, j in early:
@@ -285,7 +286,6 @@ def wait(project, timeout, poll=1.0, out=sys.stdout):
         out.flush()
         return 0
     flag, start = fdir / ".listening", time.time()
-    seen = {p.name for p in fdir.glob("*.json")}
     _write(flag, json.dumps({"pid": os.getpid(), "since": start, "until": start + timeout, "project": os.path.realpath(str(project))}))
 
     def done(code):
diff --git a/tools/desk/reader.py b/tools/desk/reader.py
index 42481dd..f8f5867 100644
--- a/tools/desk/reader.py
+++ b/tools/desk/reader.py
@@ -508,17 +508,30 @@ def _history(review_md):
 GATE_ORDER = {"1": 1, "E0": 2, "E1": 3, "2": 4, "E2": 5, "E3": 6, "E4": 7, "3": 8, "E5": 9}
 
 
+def current_page(project):
+    """The page bin/vh review made last (out/review/.current), if its gate JSON still exists; else None."""
+    rdir = Path(project) / "out" / "review"
+    try:
+        rid = (rdir / ".current").read_text(encoding="utf-8").strip()
+    except (OSError, UnicodeDecodeError):
+        return None
+    return rid if re.fullmatch(r"[A-Za-z0-9_-]{1,24}", rid) and (rdir / f"gate-{rid}.json").is_file() else None
+
+
 def gate_pages(project):
-    """out/review/gate-*.json in review order; the last is this round. Order: the stop (1, E0, E1, 2, E2, E3, E4, 3,
-    E5), then the page within it (1, 1b, 1c …). Modification time only breaks ties between page names outside that
-    pattern (they come first), so copying or touching a file never makes an earlier page current again."""
+    """out/review/gate-*.json in order; the last is this round. This round is the page bin/vh review made last
+    (out/review/.current), whatever its name: a concept page 1b after gate 2, a page E3b after gate 3, "final".
+    Without it (or when it names a page that is gone), the review order decides: the stop (1, E0, E1, 2, E2, E3, E4,
+    3, E5), then the page within it (1, 1b, 1c …, any case); other names come first, ordered by modification time.
+    Copying or touching a file never changes which page is current."""
     rdir = Path(project) / "out" / "review"
 
     def key(p):
-        m = re.fullmatch(r"(E\d|\d)([a-z]*)", p.stem[5:])
-        return (GATE_ORDER.get(m.group(1), 0), len(m.group(2)), m.group(2), 0, p.name) if m else (0, 0, "", p.stat().st_mtime, p.name)
-    pages = [p for p in rdir.glob("gate-*.json") if re.fullmatch(r"[A-Za-z0-9_-]{1,24}", p.stem[5:])] if rdir.is_dir() else []
-    return sorted(pages, key=key)
+        m = re.fullmatch(r"(E\d|\d)([A-Za-z]*)", p.stem[5:])
+        return (GATE_ORDER.get(m.group(1), 0), len(m.group(2)), m.group(2).lower(), 0, p.name) if m else (0, 0, "", p.stat().st_mtime, p.name)
+    pages = sorted([p for p in rdir.glob("gate-*.json") if re.fullmatch(r"[A-Za-z0-9_-]{1,24}", p.stem[5:])] if rdir.is_dir() else [], key=key)
+    cur = current_page(project)
+    return [p for p in pages if p.stem[5:] != cur] + [p for p in pages if p.stem[5:] == cur]
 
 
 def _rounds(project, warnings):
diff --git a/tools/review.py b/tools/review.py
index 8e74254..2a5abd0 100644
--- a/tools/review.py
+++ b/tools/review.py
@@ -5,7 +5,8 @@
   [gate]     1 | 2 | 3 | E0-E5 | 2b ... (gate-2 and gate-2.json work too); default: the newest out/review/gate-*.json
 
 The file name sets the gate: gate-2b.json is page 2 of gate ②, whatever its "gate" field says (a mismatch is a
-warning). Writes out/review/gate-<n>.html, and the same page as out/review/index.html (always the latest page), then
+warning). Writes out/review/gate-<n>.html, and the same page as out/review/index.html (always the latest page), notes
+<n> in out/review/.current (the review desk's "this round"), then
 prints the chat message: the decisions, the reply that takes every recommendation, the least-sure shots, and the path
 of gate-<n>.html, which a later page does not overwrite. playbook/01-pipeline.md ("审阅页") explains the page and
 every field:
@@ -834,6 +835,9 @@ def main():
     try:
         for p in (page_path, rdir / "index.html"):
             p.write_text(doc, encoding="utf-8")
+        # the page just made is "this round" for the review desk and its watcher, whatever its name or the order of
+        # the stops (a concept page 1b after gate 2, a voice page E3b after gate 3, a page called "final")
+        (rdir / ".current").write_text(gate + "\n", encoding="utf-8")
     except OSError as e:
         print(f"can't write {rdir}: {e.strerror or e}", file=sys.stderr)
         return 2

From 17321033de6e2f036b1b85b8e49736e50c8c55fa Mon Sep 17 00:00:00 2001
From: zhanglinghao <zhangczssx@gmail.com>
Date: Sun, 4 Oct 2026 04:16:32 +0800
Subject: [PATCH 5/5] desk: unique temp files and a locked .consumed; bin/vh
 review uses the page's on-disk name, this round by default, valid ids

- feedback._write used a fixed "<file>.part" temp name: two bin/vh desk
  processes writing .consumed (or two waits writing .listening) at once made
  the slower os.replace raise FileNotFoundError and exit 1 after printing the
  feedback. Each write now gets its own mkstemp file (keeping the target's
  mode, so REVIEW.md stays 0644), and .consumed's read-modify-write holds an
  flock on .consumed.lock. Worst case is a duplicate hand-over, never a crash.
- bin/vh review <project> 1D on APFS found gate-1d.json but wrote .current
  "1D" and a separate gate-1D.html, which the desk then ignored. The page id
  now comes from the file found on disk (exact match first, then the single
  case-insensitive one) for both .current and the html.
- bin/vh review <project> with no page renders this round (.current, else the
  last in review order) instead of the newest file, and says when a gate file
  is newer than it.
- Page ids are checked with the desk's rule (1-24 letters, digits, - or _);
  anything else stops with a message.
- Gate files whose real path is outside the project are skipped. The gate
  page helpers (current_page, gate_pages) move to tools/review.py, which owns
  the gate files and .current; the reader reuses them.
- tools/desk/README.md: limits and the naming rule; CHANGELOG follows.
- CI: 8 processes writing .listening and .consumed at once all exit 0 with all
  320 names kept and no temp files left (the old _write fails 7 of 8); 1D
  renders as 1d; no gate renders this round and names a newer file; a
  25-character id and a gate symlink out of the project are refused.
---
 CHANGELOG.md           |  2 +-
 tools/ci.sh            | 31 +++++++++++++++++-
 tools/desk/README.md   |  4 +--
 tools/desk/feedback.py | 39 ++++++++++++++++++-----
 tools/desk/reader.py   | 28 +---------------
 tools/review.py        | 72 ++++++++++++++++++++++++++++++++++++------
 6 files changed, 128 insertions(+), 48 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index ff67628..b88cb0b 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -5,7 +5,7 @@
 **The review desk: tick, comment and submit in a page, and the agent carries on by itself (`bin/vh desk`)**
 - Why: reviewing a film's first gate through the static pages, the maintainer found the outline, captions and stages hard to read (some were raw `.md` links), had no way to tick or comment in place, had to reply in chat with codes like "1 S1", and got a new one-off page every time. A prototype desk fixed that, and after two real rounds in it: "返回还是要手动给你触发，我觉得可以加一个监控", the outline should be split by content, not by 起承转合, reuse needs a basic infrastructure, and the desk belongs to `studio`, in Chinese or English by the first request.
 - `tools/desk/` (stdlib Python, offline, no CDN, light and dark): `bin/vh desk <project> [--port N]` serves one project on 127.0.0.1 (the first free port of 8780–8799; a second start prints the running one's address). Ten views read fresh from the project's own files: this round (decisions with options, least sure, decided for you), concept and outline (a time bar by segment), captions or narration (grouped by segment, term chips, a rough reading speed), the storyboard synced to its video, sound (sections named from the gate JSON, listen prompts, timecoded notes), fact check, the film with timecoded notes (C key), the decision ledger, history, and every doc rendered as text. Any item can be marked ok / change / question with a line and a "change to"; a tray collects them and submits once.
-- A submission is checked (a real gate page, its decisions and options, sizes) and written as `out/review/feedback/<round>-<time>.md`, then into `REVIEW.md` verbatim as a dated, fenced section before the template's reference sections (CLAUDE.md asks for the human's words word for word), then the `.json`. `bin/vh desk wait <project> [--timeout s]` blocks until that file appears, prints it and exits 0 (3 on timeout), so an agent that armed it in the background is woken; a submission for the current page that arrived before it was armed (after a timeout, say) and was never handed over (`out/review/feedback/.consumed`) is printed at once. The page shows whether an agent is waiting. `bin/vh desk feedback` prints the latest submission and counts it as handed over, `bin/vh desk data` what the desk read. "This round" is the page `bin/vh review` made last, which it now notes in `out/review/.current` (so a concept page `1b` after gate 2, `E3b` after gate 3, or a page called `final` becomes current); only without it does the review order (stop, then page) decide, and never the newest file, so copying or touching a project can't bring an old page back. Only requests addressed to the server's own host are answered; a submission needs the page's per-run token, JSON and the same origin; `/p/` serves only ordinary files inside the project (hidden files and `*.env` refused on the resolved path, any case) and sandboxes every one of them without `allow-same-origin`, so an HTML or SVG in the project can't read the token; `.desk.json` and `.listening` name their project folder, so copies don't count; malformed requests get a 400 and idle sockets time out.
+- A submission is checked (a real gate page, its decisions and options, sizes) and written as `out/review/feedback/<round>-<time>.md`, then into `REVIEW.md` verbatim as a dated, fenced section before the template's reference sections (CLAUDE.md asks for the human's words word for word), then the `.json`. `bin/vh desk wait <project> [--timeout s]` blocks until that file appears, prints it and exits 0 (3 on timeout), so an agent that armed it in the background is woken; a submission for the current page that arrived before it was armed (after a timeout, say) and was never handed over (`out/review/feedback/.consumed`) is printed at once. The page shows whether an agent is waiting. `bin/vh desk feedback` prints the latest submission and counts it as handed over, `bin/vh desk data` what the desk read. "This round" is the page `bin/vh review` made last, which it now notes in `out/review/.current` (so a concept page `1b` after gate 2, `E3b` after gate 3, or a page called `final` becomes current); only without it does the review order (stop, then page) decide, and never the newest file, so copying or touching a project can't bring an old page back. `bin/vh review <project>` without a page name now renders this round too (and says when a gate file is newer), takes a page's name as spelled on disk (`1D` on APFS renders `gate-1d.json` as `1d`), refuses ids that aren't 1–24 letters, digits, `-` or `_`, and skips gate files that link out of the project. Every file the desk writes goes through its own temp file, and `.consumed` is updated under an flock, so several `bin/vh desk` processes at once can at worst hand one submission over twice, never crash. Only requests addressed to the server's own host are answered; a submission needs the page's per-run token, JSON and the same origin; `/p/` serves only ordinary files inside the project (hidden files and `*.env` refused on the resolved path, any case) and sandboxes every one of them without `allow-same-origin`, so an HTML or SVG in the project can't read the token; `.desk.json` and `.listening` name their project folder, so copies don't count; malformed requests get a 400 and idle sockets time out.
 - The data contract is written down in `tools/desk/README.md`: which BRIEF sections and tables (a new Outline table whose segment names say what happens, with an optional tag column for 起承转合), the SCRIPT caption or narration table with an optional 术语 column, the NOTES 素材清单 (an optional 上屏说法 column; struck rows are dropped), the DECISIONS ledger and its strikethrough for superseded entries, REVIEW's quotes, `shots.json`, the gate JSON plus three optional keys (`listen`, `music` with section labels, `film`), the feedback JSON, and English header equivalents. Whatever it can't parse is shown as formatted text with a warning, never hidden; older projects without the tables still show every document.
 - Language: a BRIEF Spec line `Review language: zh | en`, set from the user's first request (`bin/vh new … --lang en`, default zh). One rule for the desk and `bin/vh review`: the page's gate JSON `lang`, else the BRIEF line, else zh; the desk can also switch in the page. Captions and data stay in the project's language.
 - Effort: CLAUDE.md's effort table gets a 在哪审 row (quick: no gates; standard: the static page, the desk when wanted; studio: the desk, the watcher armed after each stop, chat as the fallback for agents without background wake-ups), and step 5, director mode, `playbook/01-pipeline.md` (a new 审阅台 section) and `bin/vh new`'s next-step line say the same. Templates: BRIEF (the Review language line, the Outline table), SCRIPT (the caption table and 术语), DECISIONS (strike through what a gate superseded), NOTES (上屏说法).
diff --git a/tools/ci.sh b/tools/ci.sh
index 92ed2d7..bb0278f 100755
--- a/tools/ci.sh
+++ b/tools/ci.sh
@@ -495,12 +495,41 @@ for rid in ("2B", "E3b"):
 want([f.name for f, _ in feedback.pending(c)] == ["2B-20261004-120000.json"], f"pending follows .current: {[f.name for f, _ in feedback.pending(c)]}")
 os.remove(os.path.join(cg, "gate-2B.json"))   # .current names a page that is gone: the review order decides
 want(cur() == "3", f"with .current pointing at a removed page: {cur()}")
+# bin/vh review: the page as spelled on disk (APFS finds gate-1d.json for 1D); no gate: this round, not the newest
+# file; ids of 1-24 characters; a gate file that links out of the project is not read
+shutil.copy(os.path.join(cg, "gate-1.json"), os.path.join(cg, "gate-1d.json"))
+rv = lambda *a: subprocess.run([sys.executable, "tools/review.py", c, *a], capture_output=True, text=True)   # noqa: E731
+r = rv("1D")
+names = os.listdir(cg)
+want(r.returncode == 0 and open(os.path.join(cg, ".current")).read().strip() == "1d" and "gate-1d.html" in names and "gate-1D.html" not in names,
+     f"review 1D for gate-1d.json: exit {r.returncode}, .current {open(os.path.join(cg, '.current')).read().strip()!r}, {sorted(n for n in names if n.endswith('.html'))}")
+publish("E3b")
+os.utime(os.path.join(cg, "gate-3.json"), (time.time() + 60, time.time() + 60))
+r = rv()
+want(r.returncode == 0 and "gate-E3b.html" in r.stderr and "gate-3.json is newer" in r.stderr, f"review with no gate: {r.returncode} {r.stderr[-300:]}")
+r = rv("a" * 25)
+want(r.returncode == 2 and "1 to 24" in r.stderr, f"a 25-character id: {r.returncode} {r.stderr}")
+shutil.copy(os.path.join(cg, "gate-1.json"), os.path.join(sys.argv[1], "outside.json"))
+os.symlink(os.path.join(sys.argv[1], "outside.json"), os.path.join(cg, "gate-9.json"))
+want("9" not in [x["id"] for x in reader.read_project(c)["rounds"]] and rv("9").returncode == 2, "a gate file linking out of the project was read")
+# writers in several processes at once: each _write has its own temp file, .consumed's read-modify-write is locked
+code = ("import sys; sys.path.insert(0, 'tools/desk'); import feedback; from pathlib import Path\n"
+        "d, k = sys.argv[1], sys.argv[2]\n"
+        "for i in range(40):\n"
+        "    feedback._write(Path(d) / 'out' / 'review' / 'feedback' / '.listening', k)\n"
+        "    feedback.mark_consumed(d, [f'{k}-{i}.json'])\n")
+procs = [subprocess.Popen([sys.executable, "-c", code, c, f"w{k}"], stderr=subprocess.PIPE, text=True) for k in range(8)]
+errs = [(p.wait(), p.stderr.read()) for p in procs]
+parts = [n for n in os.listdir(fd2) if n.endswith(".part")]
+want(all(rc == 0 for rc, _ in errs) and len([n for n in feedback.consumed(c) if n.startswith("w")]) == 320 and not parts,
+     f"8 concurrent writers: exits {[rc for rc, _ in errs]}, {len(feedback.consumed(c))} names, leftovers {parts}, {[e[-200:] for _, e in errs if e][:1]}")
 if bad:
     print("; ".join(bad))
 sys.exit(1 if bad else 0)
 PY
   if a=$(python3 "$t/order.py" "$t"); then ok "desk: this round is the page bin/vh review made last (1b after 2, E3b after 3, final, 2B; pending follows it), else review order (a touched file doesn't win); the gate JSON's lang overrides the BRIEF; long and deeply nested markdown in bounded time; -10 after -2"
-  else bad "desk order / lang / markdown / latest: $a"; fi
+    ok "review: 1D renders gate-1d.json as 1d; no gate renders this round (and names a newer file); ids over 24 characters and gate links out of the project are refused; 8 concurrent writers all exit 0 with every name kept"
+  else bad "desk order / lang / markdown / latest / review ids / concurrent writers: $a"; fi
   # a server on a free port, on a copy (a submission writes into the project); a hidden file, a link to it, an upper-case
   # .ENV and an SVG with a script in it: none may be served same-origin
   cp -R tools/desk/fixtures/zh "$t/p" && printf '<img src=x onerror=alert(1)>\n' >> "$t/p/STORYBOARD.md"
diff --git a/tools/desk/README.md b/tools/desk/README.md
index 7e08d83..7f70a10 100644
--- a/tools/desk/README.md
+++ b/tools/desk/README.md
@@ -77,7 +77,7 @@ bin/vh desk data <项目>                        # 审阅台从项目里读出
 
 ### out/review/gate-<n>.json
 
-和 `bin/vh review` 是同一份文件，字段见 `playbook/01-pipeline.md` 的"审阅页"（`include` 照样生效）。"这一轮"是 `bin/vh review <项目> <n>` 最后做的那一页：它每次把页名写进 `out/review/.current`，审阅台和 `bin/vh desk wait` 都先读它。所以关卡 ② 之后回头出一页立意 `1b`、关卡 ③ 之后重定配音出 `E3b`、自己起名的 `final`，都会是"这一轮"。`.current` 没有，或者它指的那一页已经删了，才按流程顺序取最后一页：先按站（1、E0、E1、2、E2、E3、E4、3、E5），同一站再按页（1、1b、1c……，不分大小写）；不合这个写法的页名排在最前，彼此之间看修改时间。复制项目、碰一下旧文件，都不会改变哪一页是"这一轮"。审阅台另外认几个可选字段，`bin/vh review` 不管它们：
+和 `bin/vh review` 是同一份文件，字段见 `playbook/01-pipeline.md` 的"审阅页"（`include` 照样生效）。"这一轮"是 `bin/vh review <项目> <n>` 最后做的那一页：它每次把页名写进 `out/review/.current`，审阅台和 `bin/vh desk wait` 都先读它。所以关卡 ② 之后回头出一页立意 `1b`、关卡 ③ 之后重定配音出 `E3b`、自己起名的 `final`，都会是"这一轮"。`.current` 没有，或者它指的那一页已经删了，才按流程顺序取最后一页：先按站（1、E0、E1、2、E2、E3、E4、3、E5），同一站再按页（1、1b、1c……，不分大小写）；不合这个写法的页名排在最前，彼此之间看修改时间。复制项目、碰一下旧文件，都不会改变哪一页是"这一轮"。`bin/vh review <项目>` 不写页名时，渲染的也是这一轮；要出新的一页，写上它的名字。页名是 1–24 个字母、数字、`-` 或 `_`，按磁盘上文件本来的写法算（APFS 不分大小写：写 `1D` 找到的是 `gate-1d.json`，这一页就叫 `1d`）；链接到项目外面的 gate 文件不读。审阅台另外认几个可选字段，`bin/vh review` 不管它们：
 
 ```json
 {
@@ -137,7 +137,7 @@ JSON 的格式：
 ## 限制
 
 - 开着的旧页面不会自己换轮：agent 出了新的一页，人在之前打开、没刷新的标签页里提交，反馈记在旧的那一轮（那一页的 gate JSON 还在，服务照收）。页面右上角的 ↻ 重新读取。
-- `.consumed` 的锁只在一个进程里有效：两个进程同时写它（比如同时跑两个 `bin/vh desk wait`），可能丢一条"已交过"的记录，结果是那份反馈被再交一次，不会丢反馈。
+- 几个 `bin/vh desk` 进程同时动手（比如两个 `bin/vh desk wait` 一起启动，或者一边 `wait` 一边 `desk feedback`），最坏是同一份反馈交出去两次：它们各自先看到这份反馈还没交过，各打印一遍。不会崩，也不会丢反馈：每次写文件都用自己的临时文件再原子替换，`.consumed` 的读改写在 `.consumed.lock` 上加了文件锁（flock），谁都不会把别人记下的名字冲掉。
 
 ## 测试
 
diff --git a/tools/desk/feedback.py b/tools/desk/feedback.py
index f4e2741..edff921 100644
--- a/tools/desk/feedback.py
+++ b/tools/desk/feedback.py
@@ -4,7 +4,7 @@
 reads; the same .md text goes into REVIEW.md verbatim, as a dated section (CLAUDE.md: the human's words are recorded
 word for word). The .json is written last, atomically: it is what the watcher (wait) waits for.
 """
-import datetime, json, os, re, signal, sys, threading, time
+import datetime, fcntl, json, os, re, signal, sys, tempfile, threading, time
 from pathlib import Path
 
 sys.path.insert(0, str(Path(__file__).resolve().parent))   # reader.py, for the current gate page
@@ -32,6 +32,8 @@
                said="- Verbatim (written item by item in the desk):", after="- Decided:　Changed:"),
 }
 _lock = threading.Lock()
+_UMASK = os.umask(0)   # read once, at import (single-threaded), and put back
+os.umask(_UMASK)
 
 
 def _text(x, key, where):
@@ -143,9 +145,24 @@ def to_markdown(fb):
 
 
 def _write(p, text):
-    tmp = p.with_name(p.name + ".part")
-    tmp.write_text(text, encoding="utf-8")
-    os.replace(tmp, p)
+    """Write p atomically: a temp file of its own (two processes writing p at once each have theirs, so neither
+    replace fails), then os.replace. The temp name ends in .part, never .json, so the watcher doesn't see it."""
+    fd, tmp = tempfile.mkstemp(dir=str(p.parent), prefix=p.name + ".", suffix=".part")
+    try:
+        with os.fdopen(fd, "w", encoding="utf-8") as f:
+            try:   # mkstemp makes 0600: keep the file's own mode (REVIEW.md), or the usual one for a new file
+                mode = os.stat(p).st_mode & 0o777
+            except FileNotFoundError:
+                mode = 0o666 & ~_UMASK
+            os.fchmod(f.fileno(), mode)
+            f.write(text)
+        os.replace(tmp, p)
+    except BaseException:
+        try:
+            os.unlink(tmp)
+        except OSError:
+            pass
+        raise
 
 
 def append_review(project, fb, md, json_rel):
@@ -236,11 +253,17 @@ def consumed(project):
 
 
 def mark_consumed(project, paths):
+    """Add these submissions to feedback/.consumed. The read-modify-write holds an flock on feedback/.consumed.lock,
+    so two bin/vh desk processes doing it at once both get their names in."""
     fdir = Path(project) / "out" / "review" / "feedback"
-    with _lock:
-        names = consumed(project) | {Path(p).name for p in paths}
-        fdir.mkdir(parents=True, exist_ok=True)
-        _write(fdir / ".consumed", json.dumps({"files": sorted(names)}, ensure_ascii=False) + "\n")
+    fdir.mkdir(parents=True, exist_ok=True)
+    with _lock, open(fdir / ".consumed.lock", "a") as lk:
+        fcntl.flock(lk.fileno(), fcntl.LOCK_EX)
+        try:
+            names = consumed(project) | {Path(p).name for p in paths}
+            _write(fdir / ".consumed", json.dumps({"files": sorted(names)}, ensure_ascii=False) + "\n")
+        finally:
+            fcntl.flock(lk.fileno(), fcntl.LOCK_UN)
 
 
 def pending(project):
diff --git a/tools/desk/reader.py b/tools/desk/reader.py
index f8f5867..c25d769 100644
--- a/tools/desk/reader.py
+++ b/tools/desk/reader.py
@@ -505,33 +505,7 @@ def _history(review_md):
     return out, paused
 
 
-GATE_ORDER = {"1": 1, "E0": 2, "E1": 3, "2": 4, "E2": 5, "E3": 6, "E4": 7, "3": 8, "E5": 9}
-
-
-def current_page(project):
-    """The page bin/vh review made last (out/review/.current), if its gate JSON still exists; else None."""
-    rdir = Path(project) / "out" / "review"
-    try:
-        rid = (rdir / ".current").read_text(encoding="utf-8").strip()
-    except (OSError, UnicodeDecodeError):
-        return None
-    return rid if re.fullmatch(r"[A-Za-z0-9_-]{1,24}", rid) and (rdir / f"gate-{rid}.json").is_file() else None
-
-
-def gate_pages(project):
-    """out/review/gate-*.json in order; the last is this round. This round is the page bin/vh review made last
-    (out/review/.current), whatever its name: a concept page 1b after gate 2, a page E3b after gate 3, "final".
-    Without it (or when it names a page that is gone), the review order decides: the stop (1, E0, E1, 2, E2, E3, E4,
-    3, E5), then the page within it (1, 1b, 1c …, any case); other names come first, ordered by modification time.
-    Copying or touching a file never changes which page is current."""
-    rdir = Path(project) / "out" / "review"
-
-    def key(p):
-        m = re.fullmatch(r"(E\d|\d)([A-Za-z]*)", p.stem[5:])
-        return (GATE_ORDER.get(m.group(1), 0), len(m.group(2)), m.group(2).lower(), 0, p.name) if m else (0, 0, "", p.stat().st_mtime, p.name)
-    pages = sorted([p for p in rdir.glob("gate-*.json") if re.fullmatch(r"[A-Za-z0-9_-]{1,24}", p.stem[5:])] if rdir.is_dir() else [], key=key)
-    cur = current_page(project)
-    return [p for p in pages if p.stem[5:] != cur] + [p for p in pages if p.stem[5:] == cur]
+gate_pages, current_page = R.gate_pages, R.current_page   # this round: tools/review.py owns the gate files and .current
 
 
 def _rounds(project, warnings):
diff --git a/tools/review.py b/tools/review.py
index 2a5abd0..a2effab 100644
--- a/tools/review.py
+++ b/tools/review.py
@@ -2,7 +2,8 @@
 
 usage: python3 tools/review.py <project> [gate]
   <project>  the project directory, or its name under $OVH_PROJECTS / projects/ (the date prefix may be left out)
-  [gate]     1 | 2 | 3 | E0-E5 | 2b ... (gate-2 and gate-2.json work too); default: the newest out/review/gate-*.json
+  [gate]     1 | 2 | 3 | E0-E5 | 2b ... (gate-2 and gate-2.json work too; 1 to 24 letters, digits, - or _);
+             default: this round, i.e. out/review/.current, else the last page in review order (name a new page)
 
 The file name sets the gate: gate-2b.json is page 2 of gate ②, whatever its "gate" field says (a mismatch is a
 warning). Writes out/review/gate-<n>.html, and the same page as out/review/index.html (always the latest page), notes
@@ -741,6 +742,52 @@ def chat(self, page_path):
         return "\n".join(lines)
 
 
+GATE_ID = re.compile(r"[A-Za-z0-9_-]{1,24}")   # a page name: gate-<id>.json (the review desk uses the same rule)
+GATE_ORDER = {"1": 1, "E0": 2, "E1": 3, "2": 4, "E2": 5, "E3": 6, "E4": 7, "3": 8, "E5": 9}
+
+
+def _pages_on_disk(project):
+    """out/review/gate-<id>.json files with a valid id whose real path stays inside the project (a symlink that
+    leads out of it is skipped)."""
+    rdir = Path(project) / "out" / "review"
+    root = os.path.realpath(str(project))
+    return [p for p in (rdir.glob("gate-*.json") if rdir.is_dir() else [])
+            if GATE_ID.fullmatch(p.stem[5:]) and os.path.commonpath([os.path.realpath(str(p)), root]) == root]
+
+
+def _on_disk(pages, rid):
+    """The page whose id is rid, spelled as on disk: an exact match, else the one that matches ignoring case (APFS
+    finds gate-1d.json for 1D, and the file's own name is what counts)."""
+    exact = [p for p in pages if p.stem[5:] == rid]
+    loose = [p for p in pages if p.stem[5:].lower() == rid.lower()]
+    return exact[0] if exact else loose[0] if len(loose) == 1 else None
+
+
+def current_page(project):
+    """The id of the page bin/vh review made last (out/review/.current), as spelled on disk, if that page still
+    exists; else None."""
+    try:
+        rid = (Path(project) / "out" / "review" / ".current").read_text(encoding="utf-8").strip()
+    except (OSError, UnicodeDecodeError):
+        return None
+    p = _on_disk(_pages_on_disk(project), rid) if GATE_ID.fullmatch(rid) else None
+    return p.stem[5:] if p else None
+
+
+def gate_pages(project):
+    """out/review/gate-*.json in order; the last is this round. This round is the page bin/vh review made last
+    (out/review/.current), whatever its name: a concept page 1b after gate 2, a page E3b after gate 3, "final".
+    Without it (or when it names a page that is gone), the review order decides: the stop (1, E0, E1, 2, E2, E3, E4,
+    3, E5), then the page within it (1, 1b, 1c …, any case); other names come first, ordered by modification time.
+    Copying or touching a file never changes which page is current."""
+    def key(p):
+        m = re.fullmatch(r"(E\d|\d)([A-Za-z]*)", p.stem[5:])
+        return (GATE_ORDER.get(m.group(1), 0), len(m.group(2)), m.group(2).lower(), 0, p.name) if m else (0, 0, "", p.stat().st_mtime, p.name)
+    pages = sorted(_pages_on_disk(project), key=key)
+    cur = current_page(project)
+    return [p for p in pages if p.stem[5:] != cur] + [p for p in pages if p.stem[5:] == cur]
+
+
 def review_lang(project):
     """The project's review language, from the BRIEF's Spec line "- Review language: zh | en" (bin/vh new --lang writes
     it; the agent sets it from the language of the user's first request). None when the line is missing or unclear."""
@@ -793,25 +840,32 @@ def merge_includes(project, data):
 def main():
     ap = argparse.ArgumentParser(description="Build the decision-first review page from out/review/gate-<n>.json")
     ap.add_argument("project", help="project directory, or its folder name under projects/")
-    ap.add_argument("gate", nargs="?", help="1 | 2 | 3 | E0–E5 | 2b … (gate-2, gate-2.json too); default: the newest gate-*.json")
+    ap.add_argument("gate", nargs="?", help="1 | 2 | 3 | E0–E5 | 2b … (gate-2, gate-2.json too); default: this round "
+                                            "(out/review/.current, else the last page in review order)")
     a = ap.parse_args()
     project = find_project(a.project)
     if not project:   # find_project said why
         return 2
     rdir = project / "out" / "review"
+    pages = _pages_on_disk(project)
     if a.gate:
         g = re.sub(r"\.json$", "", re.sub(r"^gate-", "", a.gate.strip()))
-        if not re.fullmatch(r"[A-Za-z0-9_-]+", g):
-            print(f"not a gate name: {a.gate!r} (1, 2, 3, E0–E5, 2b …)", file=sys.stderr)
+        if not GATE_ID.fullmatch(g):
+            print(f"not a gate name: {a.gate!r} (1 to 24 letters, digits, - or _: 1, 2, 3, E0–E5, 2b …)", file=sys.stderr)
             return 2
-        found = [rdir / f"gate-{g}.json"]
+        src = _on_disk(pages, g)   # spelled as on disk: on APFS "1D" finds gate-1d.json, and the page is 1d
+        where = rdir / f"gate-{g}.json"
     else:
-        found = sorted(rdir.glob("gate-*.json"), key=lambda p: p.stat().st_mtime)
-    if not found or not os.path.exists(found[-1]):
-        where = found[-1] if found else rdir / "gate-<n>.json"
+        ordered = gate_pages(project)
+        src = ordered[-1] if ordered else None
+        where = rdir / "gate-<n>.json"
+        newer = [p for p in pages if src and p.stat().st_mtime > src.stat().st_mtime]
+        if newer:
+            print(f"! rendering this round, {src.stem[5:]}; {', '.join(sorted(p.name for p in newer))} is newer: to render "
+                  f"a new page, name it (bin/vh review {a.project} <n>)", file=sys.stderr)
+    if src is None or not src.is_file():
         print(f"no review pack at {where}: write one first (playbook/01-pipeline.md, 审阅页)", file=sys.stderr)
         return 2
-    src = found[-1]
     gate = src.stem[5:]
     try:
         data = json.loads(src.read_text(encoding="utf-8-sig"))   # a BOM from a Windows editor is fine