2026-10-21 10:40:21 +00:00
2 changed files with 10 additions and 7 deletions
@@ -1,6 +1,6 @@
 ---
 layer: to-be
-status: proposed
+status: designed
 code: [mesh-catalog]
 updated: 2026-10-21
 decisions:
@@ -11,10 +11,10 @@ decisions:

 # 61 — The print and scan page

-**A web page where the people the operator names sign in with Keycloak, print a document and scan from the glass,
+**A web page where the people the operator names sign in with Keycloak, print a PDF or a photo and scan from the glass,
 and where only the operator manages the printer. It is a module of its own, `print-and-scan`, that
 knows only the seats `printer`, `scanner` and `object-store`, so any module holding the printer and scanner seats
-works with it unchanged.** (ADR 0479, proposed and not in force.)
+works with it unchanged.** (ADR 0479, accepted 2026-10-21.)

 **Acceptance.** A person named in `users`, on a phone that is not a machine of the mesh, signs in, uploads a PDF
 and finds it printed, and scans the glass and downloads the PDF; that person is refused the printer's settings and
@@ -51,8 +51,10 @@ differs from the mail web client, whose route is internal only (ADR 0479 §3).

 A document goes from the browser to the page over HTTPS, and from the page into its own bucket by a link the object
 store signs; it never crosses the bus, the page keeps none on its disk, an upload is bounded at 100 MiB (refused by its declared length, or cut at the bound, which stores nothing), and a signed link never reaches a browser, because the links name the store's
-internal name (ADR 0468 §3, ADR 0479 §4). To print, the page names its own bucket and the key; its bucket shares
-reading with the printer seat (ADR 0479 §5). A scan is read from the scanner's bucket, which shares reading with the
+internal name (ADR 0468 §3, ADR 0479 §4). The page takes PDF and JPEG only, judged by their first bytes; any other
+type is refused before anything is stored, and converting other types waits on issue 1650 (ADR 0479 §4). To print,
+the page names its own bucket and the key; its bucket shares reading with the printer seat, and the printer's holder
+asks the object store for the link itself, a process of the holder matching the seat (ADR 0479 §5). A scan is read from the scanner's bucket, which shares reading with the
 page, and streamed to the browser as a download; the page offers the feeder and both sides only once a decision in
 force gives them to the scanner seat's scan (ADR 0479 §6).

@@ -68,5 +70,6 @@ which is accepted and built before the page (ADR 0479 §9).

 - **Several printers.** The page serves the seats' one holder; issue 1602 asks for the decision that lets a second
  printer join, after which the page lets the user choose (ADR 0479 §8).
+- **Other types.** A Word, spreadsheet or web document waits on issue 1650's decision (ADR 0479 §4).
 - **Order.** The page is built after design 60's milestones F1 to F3 and after ADR 0474 is accepted and built
  (ADR 0479 §9).
@@ -59,8 +59,8 @@ document is written and this one's status becomes `implemented`.
 | [`57-building-config-and-provisioning.md`](57-building-config-and-provisioning.md) | **Designed.** The work of ADR 0348 and ADR 0349 as 37 packages, each an issue with its proof: foundations, template files, config in its own module, the provisioner and its client, secrets in the vault, bindings from providers, collections, a module's runtime readers, and removing the old forms; at most five worked at once | ADR 0348, ADR 0349 |
 | [`58-agent-work-as-the-meshs-own.md`](58-agent-work-as-the-meshs-own.md) | **Designed.** Agent work as the mesh's own: a thread seat keeps every thread whole on the bus; a thread handler runs the harness headless in a sandbox per session, the workspace on the thread's own forge branch; a workspace toolkit and named tools, no general command runner; one identity seat for persons, agents and modules, roles of grants, every tool an effect, signed bus logins, and the switch to them one identity at a time | ADR 0383, ADR 0384, ADR 0385, ADR 0386, ADR 0387, ADR 0388, ADR 0389, ADR 0390 |
 | [`59-the-mail-web-client.md`](59-the-mail-web-client.md) | **In progress.** The operator's mail, every account, in a browser on the mesh's own machines: a module of its own, `mesh-mail-web`, holds `mail-webclient`, renders pages on the server and reads and sends only through `mail-store`'s verbs under a caller granted per account; its route reaches the private network only, the operator signs in with Keycloak, and a mail goes out only on the operator's Approve; then Betterbird is removed | ADR 0440, ADR 0378, ADR 0379 |
-| [`60-the-brother-module.md`](60-the-brother-module.md) | **Proposed.** One module, `brother`, holds the `scanner` and `printer` seats for the Brother multifunction device: scans from the glass (cropped) or the feeder (one PDF), keeps each scan in its bucket and announces it, prints in one call, reads the admin pages and changes settings on those where a mistake cannot lock the operator out, each change recorded and told; only its device process holds the credentials | ADR 0467, ADR 0464, ADR 0468, ADR 0474 |
-| [`61-the-print-and-scan-page.md`](61-the-print-and-scan-page.md) | **Proposed.** A web page, behind a Keycloak sign-in and on a public name, where the people the operator names print and scan, and only managers manage the printer: a module of its own, `print-and-scan`, that calls only the printer, scanner and object-store seats, so any holder of those seats works with it; documents go from the browser to the page and by signed links to the store, never over the bus | ADR 0479, ADR 0468, ADR 0440 |
+| [`60-the-brother-module.md`](60-the-brother-module.md) | **In progress.** One module, `brother`, holds the `scanner` and `printer` seats for the Brother multifunction device: scans from the glass (cropped) or the feeder (one PDF), keeps each scan in its bucket and announces it, prints in one call, reads the admin pages and changes settings on those where a mistake cannot lock the operator out, each change recorded and told; only its device process holds the credentials | ADR 0467, ADR 0464, ADR 0468, ADR 0474 |
+| [`61-the-print-and-scan-page.md`](61-the-print-and-scan-page.md) | **Designed.** A web page, behind a Keycloak sign-in and on a public name, where the people the operator names print a PDF or a photo and scan the glass, and only managers manage the printer: a module of its own, `print-and-scan`, that calls only the printer, scanner and object-store seats, so any holder of those seats works with it; documents go from the browser to the page and by signed links to the store, never over the bus | ADR 0479, ADR 0468, ADR 0440 |
 | [`62-the-bookkeeping-portal.md`](62-the-bookkeeping-portal.md) | **Proposed.** A web page on the private network, behind the operator's Keycloak sign-in, showing the business's income, expenses and to-do as the bookkeeping service holds them now; `okioki` moves whole to the home server and the page `okioki-web` runs beside it, calling only the `bookkeeping` seat; nothing the accountant reviewed or submitted is ever changed | ADR 0481, ADR 0440, ADR 0479 |

 ## Not yet written