From 28e6c791241d63a7844f6687591f72174aa30e67 Mon Sep 17 00:00:00 2001
From: "prompt.ac/@jeffrey" <mail@aesthetic.computer>
Date: Tue, 15 Sep 2026 18:05:04 -0700
Subject: [PATCH] boot: restore the three boot.mjs hunks a70ab40520 reverted by
 mistake

a70ab40520 was committed from a working-tree boot.mjs that was behind HEAD
(a foreign in-progress easel merge held a stale copy in the shared index),
so it silently undid: the Easel draft-code redirect (#~<code>), the
nopaint-navigation session seed for acSTARTING_PIECE, and the
login-survives-expired-session fix (acLOGIN installed before the restore
flow, session-aesthetic cleared on explicit login). This puts boot.mjs
back to b5ec0a4e33 plus only the two empty-boot guard lines. Never
deployed in between.
---
 system/public/aesthetic.computer/boot.mjs | 33 ++++++++++++++++-------
 1 file changed, 23 insertions(+), 10 deletions(-)

diff --git a/system/public/aesthetic.computer/boot.mjs b/system/public/aesthetic.computer/boot.mjs
index c26109744a..fcb00502ca 100644
--- a/system/public/aesthetic.computer/boot.mjs
+++ b/system/public/aesthetic.computer/boot.mjs
@@ -1,5 +1,14 @@
+import { NOPAINT_SESSION_SEED_KEY, noPaintStartingPiece } from "./lib/nopaint-navigation.mjs";
+
 // `aesthetic.computer` Bootstrap, 23.02.16.19.23
 
+// Temporary Easel draft codes open the current live artifact.
+const draftCode = /^#~([a-f0-9]{12})$/i.exec(window.location.hash);
+if (draftCode) {
+  window.location.replace(`https://aesthetic.computer/watch/?code=${draftCode[1].toLowerCase()}`);
+  await new Promise(() => {});
+}
+
 // Painting permalinks belong to Aesthetic Computer. Fragments never reach the
 // server, so branded Laklok hosts must hand them off before booting the piece.
 const laklokHost =
@@ -1146,7 +1155,11 @@ if (
   location.hostname === "nopaint.art" ||
   location.hostname === "www.nopaint.art"
 ) {
-  window.acSTARTING_PIECE = "nopaint";
+  window.acSTARTING_PIECE = noPaintStartingPiece(
+    new URL(location.href),
+    performance.getEntriesByType("navigation")[0]?.type,
+    safeSessionStorageGet(NOPAINT_SESSION_SEED_KEY),
+  );
 }
 if (
   location.hostname === "oskiewar.com" ||
@@ -1454,8 +1467,9 @@ if (!sandboxed && !localStorageBlocked) {
 // If noauth mode OR no Auth0 cache found, skip auth entirely
 const skipAuth = window.acNOAUTH || (!likelyLoggedIn && !sandboxed && !location.search.includes('code=') && !location.search.includes('state='));
 
-// Define login/logout functions when skipping initial auth, for on-demand login
-if (skipAuth && !sandboxed && !window.acNOAUTH) {
+// Login must survive a failed or expired saved session, including early returns
+// from the restore flow below. Install it before attempting authentication.
+if (!sandboxed && !window.acNOAUTH) {
   window.acLOGIN = async (mode) => {
     // Lazy-load Auth0 if not already loaded
     if (!window.auth0Client) {
@@ -1465,9 +1479,14 @@ if (skipAuth && !sandboxed && !window.acNOAUTH) {
     }
     const opts = { prompt: "login" };
     if (mode === "signup") opts.screen_hint = mode;
-    window.auth0Client.loginWithRedirect({ authorizationParams: opts });
+    // An explicit login replaces any session supplied by an embedding host.
+    // Otherwise an expired session-aesthetic masks the fresh Auth0 callback.
+    safeLocalStorageRemove("session-aesthetic");
+    return window.auth0Client.loginWithRedirect({ authorizationParams: opts });
   };
+}
 
+if (skipAuth && !sandboxed && !window.acNOAUTH) {
   window.acLOGOUT = () => {
     console.log("⚠️ Not logged in, nothing to log out from.");
   };
@@ -1695,12 +1714,6 @@ if (!sandboxed && !skipAuth) {
         }
       }
 
-      window.acLOGIN = async (mode) => {
-        const opts = { prompt: "login" }; // Never skip the login screen.
-        if (mode === "signup") opts.screen_hint = mode;
-        auth0Client.loginWithRedirect({ authorizationParams: opts });
-      };
-
       if (location.pathname === "/hi") window.acLOGIN();
 
       // Redirect to signup with a query parameter.
-- 
2.51.2