coulomb-social/docs/usecases/sharing-portability-review.md

# Prepared review — UC-003 through UC-006

Review on `https://app.coulomb.social`, using a disposable page in an intended
space and a second destination space. Use an explicitly chosen reader and an
ungranted same-tenant member; keep their identities and real notes private.
Current product image is the accepted weekly-call image; storage/content
hardening from October 11 is not yet deployed. Record the actual release/date
with each verdict. Automated checks do not supply these verdicts.

| Journey | Review steps | Expected result |
| --- | --- | --- |
| UC-003: authoring | Create a disposable page with title, abstract, visual and body. Save/reopen; edit and reopen again. Open two edit tabs, save in one, then submit the older tab. | Content remains recognizable. Stale submission preserves your text and asks you to reopen/merge. Verify representative custom Markdown/raw HTML/assets separately; sanitization differences need an explicit verdict. |
| UC-004: copy/move | Copy that page to the second space. Edit the copy; reopen the source. Move another disposable page, then follow its old address as both an authorized reader and an outsider. | Copy is independent. Moved content/assets remain intact; old address still requires destination permission. No overwrite or access grant follows from moving. |
| UC-005: sharing | As owner, use Share space to grant the chosen reader access. Reader opens page and visual, then tries edit/copy/move directly. Ungranted member tries those same page/image URLs. Revoke the reader and retry. | Reader can read but cannot modify. Outsider receives no private content. Revoked reader loses page and image access. Review which existing grants/creator access remain. |
| UC-006: portability | Open Your app data/export. Inspect the private account-local JSON export and leaving/ownership explanation. Use a disposable app-local member for any actual exit test. | Export has the intended local identity/grant scope. Shared content remains with a named successor; sole owner must resolve succession first. App-local exit leaves platform identity under its own owner. Do not delete the productive owner to review the screen. |

For each journey reply `accepted`, `gap` or `deferred`, with a short explanation.
An observed gap becomes a live task before that journey is accepted. Weekly-call
acceptance remains UC-008 only. A source-date check for newly migrated pages and
all their chunks is also required under the user's October 27 migration instruction.

## Private corpus rendering cards — 2026-10-28

`scripts/audit-bubble-rendering.py` now prepares private source/product cards and
an index using the actual product renderer. The current capture has 244 article
records: 241 bodies render and three bodies are missing. Six records change
markup under sanitization (three removed custom tags and 17 removed attributes
in total); no extracted-text change was observed between intermediate Markdown
HTML and sanitized HTML. These counts do not compare with Bubble's own rendering
and do not supply an acceptance verdict. Source text/bytes remain preserved.

In the private index, review the six markup-change cards first. Each shows the
exact captured source beside the current product rendering and provides an
explicit link to the original Bubble view. Compare the same record there:
meaning and placeholders, line breaks, lists/tables, Visual and any body-linked
resources. Record `accepted`, `gap` or `deferred` per record, keeping its private
source ID in the private report. Open gaps remain WP-0013-T02; resolve or explicitly
accept intended differences before marking the corresponding cohort transferred.
Review the body-missing records as source exceptions; never substitute an empty
page. Card samples disable resource loading and interaction, so image/resource
fidelity needs the separate authorized asset review. Then apply UC-003–006 above
to disposable pages on the exact intended release.