[liamt8d]

No version change: the notes are under [Unreleased]. No new slash command (no deploy-commands.js needed). This PR changes the database (a new table dm_reports, created by schema.sql on start): back up the database before deploying. Set these environment variables (see "To configure" below).

1. send and the permission checks

A normal member was seen making Petto talk with send. The routes could not be made to post for a plain member in the tests, so this hardens every place where a missing or unreadable permission could be read as "allowed", makes the refusals private and adds a test that tries every route as a plain member.

• send (src/commands/config/send.js): the check is the first thing execute does. The member must be a real guild member with Manage Messages in the server (strict has(...) === true; anything unreadable is a no), then View, Send and Manage Messages in the target channel (permissionsFor null is a no). Every refusal is private (the defer is ephemeral too) and names the permission.
• Prefix (checkDefaultPermission): a member whose permissions cannot be read used to make it throw silently; now it denies with a card. Umbrellas (checkPermission, autocomplete): strict has(needed) === true.
• New scripts/check-send-permissions.js (real PermissionsBitField, channel overwrites, the real prefix and slash pipelines): !send, petto send, @Petto send, !message send, !msen, /message send... for eight kinds of member, 7173 command words, 783 umbrella subcommands and 1654 slash subcommands; it fails on the old code. check-member-access.js has an honest permissionsFor fake now.
• To know: /message is open at Discord (a whole command is gated, never one subcommand), so /message send is listed to every member and refuses them privately; a prefix refusal is a public reply; standalone slash commands (/honeypot add, /partnerconfig welcome, /logs add, /verify setup, /webhook create, /channel lock|unlock|topic) rely on Discord's default_member_permissions and run for everybody only if a server opens them in Integrations; custom commands (including the say template) run before !restrictcommand, !disablecommand and permission levels.

2. Every DM from Petto says who it is from, and can be reported to the Petto team

• One helper (src/utils/dmOrigin.js, sendDm) for every DM sent to a user (sanctions, join DM, form results, tickets, appeals, giveaways, verification, levels, backups, confessions, setup and team notices; User#send and GuildMember#send are also wrapped as a net). A test fails if a raw DM send appears outside the helper.
• Each DM starts with a grey -# From <server> line and ends with three small icon buttons: info (public facts about the server and why the DM was sent, and how to stop it where there is a real setting), delete (deletes that DM) and report. It works for plain text, embeds and Components V2 messages, and never drops the message to make room.
• Report opens a form (category, 20 to 1000 characters of details, "Delete this DM after reporting") and goes only to the Petto team, never to the server's moderators: a card in the team's channel with defanged text, the server, the kind of DM, the reporter and a "Mark handled" button; it is always stored in the new table dm_reports. 3 reports an hour per person, one per message. Only the DM's recipient can use the buttons and they refuse inside a server.

3. Priority error log and self-healing tickets

• Two logs. The existing log channel is now the general log (warnings, rate limits, Redis, expected Discord errors). New priority channel: PETTO_PRIORITY_ERRORS_CHANNEL_ID; it pings PETTO_PRIORITY_PING_USER_IDS (default: the first developer id) and optionally PETTO_PRIORITY_PING_ROLE_ID, at most once per fingerprint per 30 minutes and 5 pings an hour; nothing else can be pinged. Repeats of the same error edit one card (a count) instead of posting again.
• Triage (src/utils/errorTriage.js, a tested table with an English explanation per code): expected errors (10062 Unknown interaction, 10003 Unknown Channel, 10008, 10007, 40060, 50001/50013 from a server's setup, 50007, 429, 5xx, network and Redis timeouts, database connection loss) go to the general log as warnings; everything else (bugs, database errors, unknown codes, "Petto sent something wrong") is priority. The priority card has what it probably means, server/channel/user, command, count, the top stack frames, secrets redacted, and a "Copy this to investigate" block to paste when asking for help.
• Tickets fix themselves (src/utils/safeTicketAction.js, used by every ticket button, menu, form and rating handler): acknowledge first, a channel or message that is already gone counts as done and the bookkeeping is finished, a late interaction is a warning and the work still completes, one retry on transient failures, a friendly message on a final failure plus a priority error, and a ticket is never left half deleted (transcript first, then close, then delete). The ticket job also heals open tickets whose channel is gone and panels whose message is gone.

4. Pinterest posted an empty card again and again

The public RSS of a board can contain a ghost pin (empty title, empty picture, invalid date) whose id changes on every read, so it was new every 15 minutes. Dateless items are no longer "fresh for ever" (reddit, rss, pinterest, mastodon, tumblr, letterboxd), what was seen is marked before sending (a failure after a send cannot repost), a pin without a picture asks Pinterest's public pin info for numeric ids and is not posted as an empty card if there is still none (one warning per feed per hour, no content), and at most 3 new items per feed per pass are posted.

To configure

• PETTO_DM_REPORTS_CHANNEL_ID: the team's channel for DM reports (without it they are only stored in dm_reports and a warning is logged).
• PETTO_PRIORITY_ERRORS_CHANNEL_ID, PETTO_PRIORITY_PING_USER_IDS, optional PETTO_PRIORITY_PING_ROLE_ID (the old error channel variable is unchanged and is now the general log).
• Check that pe_info and pe_delete exist as application emojis (the ids come from the voicemaster buttons).

Checks

New: check-send-permissions.js, check-dm-origin.js, check-error-triage.js; extended: check-feeds.js (the real engine twice over real-shaped Pinterest data), check-member-access.js, check-error-log.js, check-send.js and others. npm run check and npm run types:check pass. Nothing was run against real Discord, Pinterest or a production database: the look of the grey line and buttons in DMs, the modal checkbox, V2 priority cards, real button clicks in DMs and the live pin info endpoint are unverified.