Record tested attachment release and request exact founder execution

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a192e9-c28b-7533-bf25-e2341364c22a

docs/release/attachment-menu-validation-2026-10-31.json

@@ -0,0 +1,32 @@
+{
+  "schema": "coulomb.attachment-menu-source-validation.v1",
+  "product_decision": "78175c34-58e1-4ad6-944d-0662c0462ae6",
+  "full_main_gate": {
+    "command": "TMPDIR=/var/tmp make check",
+    "passed": 670,
+    "failures": 0,
+    "errors": 0,
+    "skipped": 0,
+    "log_sha256": "357547d34f7d73f750721338cff3e07439e8c710d0f1cf838541c1b175268335"
+  },
+  "isolated_release_gate": {
+    "source": "1139a6d30eee4f75317b46bd45120a15d818455f",
+    "command": "make check",
+    "passed": 568,
+    "failures": 0,
+    "errors": 0,
+    "skipped": 0,
+    "log_sha256": "d9a9c8883f0d4021918c8600f9b5055cac24ca6b9943ee89db067f55d65ccdb1"
+  },
+  "checks": [
+    "Author upload/remove; authorized reader download; foreign-tenant, outsider, revoked, archived and anonymous denial",
+    "Stale page and CSRF refusal; immutable file names; 16 MiB limit; traversal and symlink denial",
+    "Retained body/source dates and associations through edit/rename; removal keeps historical revision bytes",
+    "Independent copy/move associations and managed files through 14 abrupt process deaths",
+    "Upload recovery at partial bytes, complete bytes, stored revision and published page",
+    "Real loopback browser upload/download/copy/move/remove and permission checks; no external requests"
+  ],
+  "synthetic_fixtures_only": true,
+  "production_deployed": false,
+  "productive_user_acceptance": false
+}

docs/release/bubble-resource-hover-2026-10-31.json

@@ -0,0 +1,14 @@
+{
+  "schema": "coulomb.bubble-resource-hover-observation.v1",
+  "completed_at": "2026-10-31T18:35:54.302241+00:00",
+  "source_articles_sha256": "f33967c79c0f8a60a7d504f5d5e4082f8bc9e3c34f6a3160cb200fd380831d62",
+  "private_observation_sha256": "79d9fcae0a894a04ffbba73d91b1080dcfa745fd0d9a9eb9c89e63908d00a412",
+  "articles_visited": 5,
+  "all_source_routes_matched": true,
+  "visible_images_hovered": 42,
+  "typed_resources_found": 0,
+  "visual_overlay_download_points_to_already_retained_visual": true,
+  "ui_controls_activated": false,
+  "resource_completeness_verified": false,
+  "production_changes": false
+}

docs/release/content-acceptance-build-2026-10-31.json

@@ -0,0 +1,45 @@
+{
+  "schema": "coulomb.content-acceptance-build.v1",
+  "completed_at": "2026-10-31T18:38:08.525103+00:00",
+  "source": "1139a6d30eee4f75317b46bd45120a15d818455f",
+  "image": "forgejo.coulomb.social/coulomb/coulomb-social@sha256:7906f461bc8d2d5204fd4fde67a251850f725b914452a66172919d6853672ed5",
+  "build_context": "clean restricted git archive",
+  "source_full_gate_tests": 568,
+  "runtime_packages_and_python_unchanged": true,
+  "runtime": {
+    "python": "3.12.16",
+    "distributions": {
+      "h11": "0.16.0",
+      "httpcore": "1.0.9",
+      "psycopg": "3.3.4",
+      "joserfc": "1.7.4",
+      "anyio": "4.14.2",
+      "cryptography": "50.0.0",
+      "idna": "3.18",
+      "certifi": "2026.7.22",
+      "packaging": "26.3",
+      "python-decouple": "3.8",
+      "psycopg-binary": "3.3.4",
+      "sqlparse": "0.5.5",
+      "whitenoise": "6.12.0",
+      "cffi": "2.1.1",
+      "markdown": "3.10.3",
+      "webencodings": "0.5.1",
+      "pycparser": "3.0",
+      "bleach": "6.4.0",
+      "authlib": "1.7.2",
+      "django": "6.1",
+      "typing_extensions": "4.16.0",
+      "gunicorn": "26.0.0",
+      "asgiref": "3.12.1",
+      "httpx": "0.28.1",
+      "dj-database-url": "3.1.2"
+    }
+  },
+  "django_checks": {
+    "check": "System check identified no issues (0 silenced).",
+    "makemigrations": "No changes detected"
+  },
+  "new_database_migrations": false,
+  "production_deployed": false
+}

docs/release/content-acceptance-preflight-2026-10-31.json

@@ -0,0 +1,25 @@
+{
+  "schema": "coulomb.guarded-image-release.v1",
+  "proposal_digest": "sha256:e96752ecfa7adef2fd1d9da48902c8e63de124ccfd272fe20ba79b758b3ca4a3",
+  "started_at": "2026-10-31T18:41:21.634253+00:00",
+  "status": "live_release_preflight_verified",
+  "production_data_restored": false,
+  "timers_activated": false,
+  "node_request_percent": {
+    "cpu": 68,
+    "memory": 76
+  },
+  "preflight": {
+    "business_tables": 12,
+    "migration_rows_sha256": "43471516387c0e2a3d35971033ed6af330e2963efe4da93293d97633825d04af",
+    "business_rows": 93,
+    "business_rows_sha256": "7953b37b02b80d89ca6869dab6b2b0b996541de20ca0dd1b294a5f25572fb2ca",
+    "content_files": 86,
+    "content_files_sha256": "ed535246f4e8f46fcd7ce01f936127996aff873c6936b297f7272194b594aeda",
+    "global_slug_constraint": true,
+    "tenant_slug_constraint": true,
+    "migration_0003_applied": true,
+    "duplicate_slug_groups": 0
+  },
+  "live_changes": false
+}

docs/release/content-acceptance-provenance-2026-10-31.json

@@ -0,0 +1,11 @@
+{
+  "schema": "coulomb.packaged-source-provenance.v1",
+  "image": "forgejo.coulomb.social/coulomb/coulomb-social@sha256:7906f461bc8d2d5204fd4fde67a251850f725b914452a66172919d6853672ed5",
+  "source": "1139a6d30eee4f75317b46bd45120a15d818455f",
+  "packaged_file_count": 79,
+  "all_packaged_source_bytes_match": true,
+  "source_revision_label_verified": true,
+  "registry_digest_resolves": true,
+  "application_source_overlay": false,
+  "manifest_sha256": "2eca0618df5bdf35928869c3b848be36190065a4cca8f855bba372df6c516556"
+}

docs/release/content-acceptance-recovery-2026-10-31.json

@@ -0,0 +1,67 @@
+{
+  "schema": "coulomb.packaged-content-acceptance-recovery.v1",
+  "status": "packaged_recovered_export_and_views_verified",
+  "source": "1139a6d30eee4f75317b46bd45120a15d818455f",
+  "image": "forgejo.coulomb.social/coulomb/coulomb-social@sha256:7906f461bc8d2d5204fd4fde67a251850f725b914452a66172919d6853672ed5",
+  "restore_receipt_sha256": "3d6fe0b5d7426c9fb39ba22f18770319e0c89ba1981c61db171199d3b4e68524",
+  "retained_point_captured_at": "2026-10-31T07:13:52Z",
+  "candidate_application": {
+    "business_tables": 12,
+    "migration_rows_sha256": "43471516387c0e2a3d35971033ed6af330e2963efe4da93293d97633825d04af",
+    "business_rows": 92,
+    "business_rows_sha256": "6243955479f7861fcdcd79b62f7f1e9f9a27c05a17bd2c17b792ebc98b2fa7b6",
+    "content_files": 86,
+    "content_files_sha256": "ed535246f4e8f46fcd7ce01f936127996aff873c6936b297f7272194b594aeda",
+    "global_slug_constraint": true,
+    "tenant_slug_constraint": true,
+    "migration_0003_applied": true,
+    "duplicate_slug_groups": 0,
+    "actual_owner_pages_rendered": 40,
+    "unsaved_outsider_page_denials": 40,
+    "production_identity_or_grant_created": false
+  },
+  "previous_image_application": {
+    "business_tables": 12,
+    "migration_rows_sha256": "43471516387c0e2a3d35971033ed6af330e2963efe4da93293d97633825d04af",
+    "business_rows": 92,
+    "business_rows_sha256": "6243955479f7861fcdcd79b62f7f1e9f9a27c05a17bd2c17b792ebc98b2fa7b6",
+    "content_files": 86,
+    "content_files_sha256": "ed535246f4e8f46fcd7ce01f936127996aff873c6936b297f7272194b594aeda",
+    "global_slug_constraint": true,
+    "tenant_slug_constraint": true,
+    "migration_0003_applied": true,
+    "duplicate_slug_groups": 0,
+    "actual_owner_pages_rendered": 40,
+    "unsaved_outsider_page_denials": 40,
+    "production_identity_or_grant_created": false
+  },
+  "client_export": {
+    "status": "recovered_client_export_verified",
+    "schema": "coulomb.client-dataset-export.v1",
+    "content_files": 85,
+    "records": {
+      "members.user": 1,
+      "members.member": 1,
+      "spaces.space": 1,
+      "spaces.spacemembership": 1
+    },
+    "admin_events": 0,
+    "archive_sha256": "eb982edcdb94c976ab3d4e9797e4c34eb72a3ee3886a37e64508744ac172a8a8",
+    "offboarding_complete": false,
+    "all_source_tables_compared": 13,
+    "all_source_files_compared": 86,
+    "archive_member_hashes_verified": true,
+    "selected_client_content_complete_locally": true,
+    "source_sql_and_content_unchanged": true,
+    "external_bindings_require_review": 0,
+    "sessions_and_credentials_excluded": true
+  },
+  "source_content_files_unchanged": 86,
+  "all_tables_unchanged": true,
+  "application_source_overlay": false,
+  "network_internal": true,
+  "published_ports": 0,
+  "production_access": false,
+  "production_restore": false,
+  "driver_sha256": "da85e5f7d5cf68f599a897a932d51399340bdd026a7cddf9603bef4aeb40909a"
+}

docs/release/content-acceptance-review-2026-10-31.md

@@ -0,0 +1,83 @@
+# Combined content release for WP-0013
+
+The candidate adds the requested attachment action menu, including author uploads
+and removal, authenticated downloads, and independent attachments on copies and
+moves. It also restores ordered-list starting numbers and fixes interrupted
+copy/move asset recovery. Removal detaches the current association; earlier
+revisions retain the file. Existing body links and visuals remain editable in the
+page editor. The upload limit is16 MiB per file and100 associations per page.
+
+Source: `1139a6d30eee4f75317b46bd45120a15d818455f` on
+`csoc-wp0013-content-release`. Immutable image:
+`sha256:7906f461bc8d2d5204fd4fde67a251850f725b914452a66172919d6853672ed5`.
+The working repository passes670tests; the isolated release branch passes568;
+the actual image passes110focused checks without application-source overlays.
+Every packaged source file matches that commit. Runtime dependencies/Python and
+database migrations are unchanged. Historical release packets remain unchanged.
+
+Both the candidate and previous image render40owner pages and deny40outsiders on
+the retained independently restored07:13point. The packaged client export verifies
+85files while all13SQL tables/86source files remain unchanged. The temporary
+recovery database was returned to its previously stopped state. This retained
+point has92business rows; current production has93. Session/login-only drift was
+previously reviewed and its fingerprints are unchanged. Execution creates and
+reads back a fresh paired backup before Helm; independent recovery of that new
+point is still required afterward.
+
+The route and inactive installation prerequisites are independently verified.
+Full recurring backup/service acceptance remains WP-0012. This proposal does not
+activate timers, purge retained data, restore production data or send email.
+
+## Exact attended action
+
+Plan: `/home/worsch/railiance-apps/release/coulomb-content-acceptance-1139a6d.json`.
+Proposal: `sha256:e96752ecfa7adef2fd1d9da48902c8e63de124ccfd272fe20ba79b758b3ca4a3`.
+Baseline: revision19/image522bcd7f,93business rows/86files. The controller checks
+complete data/spec fingerprints, creates the paired recovery point, performs the
+atomic image-only Helm upgrade, verifies live views/data and refreshes the
+snapshot image pin. Rollback restores the prior image/pin while preserving writes.
+An older image retains the new attachment metadata/files but lacks the new menu.
+
+Full native preflight reports `live_release_preflight_verified` at this exact
+digest (receipt: content-acceptance-preflight-2026-10-31.json). Pending execution
+decision: d9b70cc5-e035-40ae-8d0d-020190581202. Run:
+
+```bash
+python3 /home/worsch/railiance-apps/tools/coulomb-image-release.py \
+  --plan /home/worsch/railiance-apps/release/coulomb-content-acceptance-1139a6d.json \
+  --execute \
+  --expect-digest sha256:e96752ecfa7adef2fd1d9da48902c8e63de124ccfd272fe20ba79b758b3ca4a3
+```
+
+At its prompt:
+
+```text
+DEPLOY sha256:e96752ecfa7adef2fd1d9da48902c8e63de124ccfd272fe20ba79b758b3ca4a3
+```
+
+Founder-terminal execution is required by the source-bound launcher and the
+standing supervised execution contract in
+`the-custodian/docs/agent-autonomy-decision.md`: “The supervisor approves that
+proposal or performs it through the privileged execution path.” The already
+completed route/installer approvals do not approve this different proposal.
+
+The action pauses writes during backup capture and the Recreate rollout. It adds
+one encrypted primary backup object and temporary scratch within the admitted
+capacity limits; provider cost is unpriced and no autopilot budget is claimed.
+Check the durable receipt before any retry. Required final status:
+`image_candidate_deployed_verified`. Receipt path:
+`/var/lib/coulomb-social-backup/releases/e96752ecfa7adef2fd1d9da48902c8e63de124ccfd272fe20ba79b758b3ca4a3/receipt.json`.
+
+## Productive review after verified deployment
+
+Use the prepared UC-003–006 steps in
+[sharing-portability-review.md](../usecases/sharing-portability-review.md).
+On a disposable page, open Attachments, add a file, download it as an authorized
+reader, duplicate/move the page, and remove the copied association. Verify that
+the original remains independent and revoked/outsider access is denied. Record
+attachment, authoring, copy/move, sharing and portability verdicts separately.
+
+The three custom-topic rendering cases are accepted for now under decision
+69ec9380. Three source-body exceptions and five resource flags remain explicit
+source/migration obligations; the new menu does not resolve or waive them.
+No productive acceptance or WP-0013 completion is inferred from these tests.

docs/release/content-acceptance-target-2026-10-31.json

@@ -0,0 +1,21 @@
+{
+  "baseline_revision": 19,
+  "baseline_helm_manifest_sha256": "93cb277abd1aea0657be482e458dcfb268fe0bfbd45d90aa1faedcc7f5bce499",
+  "deployment_uid": "2dbe661a-d232-4477-bbd1-833813077fbe",
+  "baseline_spec_sha256": "42e091e52d5dae3c1f986e4898c62057fa80846adfce049a75d8fbd4681180ea",
+  "candidate_spec_sha256": "8d79c64cff4bd2c62f03494e80847dc99b965ddabf35645da67e8d1020220798",
+  "old_image": "forgejo.coulomb.social/coulomb/coulomb-social@sha256:522bcd7fce92436765a60c1e4afa2598f3cc40913352153ff1c4319a99ca92ed",
+  "expected_data": {
+    "business_tables": 12,
+    "migration_rows_sha256": "43471516387c0e2a3d35971033ed6af330e2963efe4da93293d97633825d04af",
+    "business_rows": 93,
+    "business_rows_sha256": "7953b37b02b80d89ca6869dab6b2b0b996541de20ca0dd1b294a5f25572fb2ca",
+    "content_files": 86,
+    "content_files_sha256": "ed535246f4e8f46fcd7ce01f936127996aff873c6936b297f7272194b594aeda",
+    "global_slug_constraint": true,
+    "tenant_slug_constraint": true,
+    "migration_0003_applied": true,
+    "duplicate_slug_groups": 0
+  },
+  "image_only_server_preview": true
+}

docs/release/content-acceptance-tests-2026-10-31.json

@@ -0,0 +1,13 @@
+{
+  "schema": "coulomb.packaged-content-acceptance-tests.v1",
+  "image": "forgejo.coulomb.social/coulomb/coulomb-social@sha256:7906f461bc8d2d5204fd4fde67a251850f725b914452a66172919d6853672ed5",
+  "source": "1139a6d30eee4f75317b46bd45120a15d818455f",
+  "tests": 110,
+  "failures": 0,
+  "errors": 0,
+  "skipped": 0,
+  "network": "none",
+  "read_only_root": true,
+  "application_source_overlay": false,
+  "synthetic_fixtures_only": true
+}

docs/usecases/sharing-portability-review.md

@@ -15,6 +15,10 @@ independently verified at revision6. The inactive installer is also founder-exec
 and independently verified, including its local capacity profile. A newly identified ordered-list numbering correction
 must accompany the attachment fix in a refreshed content release; the historical
 lifecycle-only packet below remains evidence, not the final combined proposal.
+The combined candidate also includes the user's requested attachment menu, with
+author upload/removal and authenticated reader downloads. Uploads are limited to
+16 MiB per file. Removal detaches the current association; retained revisions and
+their bytes remain. Copies/moves carry independent files with destination access.
 
 | Journey | Review steps | Expected result |
 | --- | --- | --- |
@@ -52,7 +56,11 @@ above remains unchanged and describes the previous renderer. Neither index
 establishes original Bubble fidelity or the deployed image's acceptance. Source
 proof: `../release/ordered-list-fidelity-2026-10-31.json`.
 
-In the private index, review the six markup-change cards first. Each shows the
+Bernd accepted the three remaining custom-topic cases as “fine for now” on
+October31 (decision69ec9380-e5f6-41aa-af88-f697fc1c8a66). This is a rendering
+disposition only; missing bodies and unresolved resources remain explicit.
+
+For other fidelity checks, each card shows the
 exact captured source beside the current product rendering and provides an
 explicit link to the original Bubble view. Compare the same record there:
 meaning and placeholders, line breaks, lists/tables, Visual and any body-linked
@@ -62,7 +70,10 @@ accept intended differences before marking the corresponding cohort transferred.
 Review the body-missing records as source exceptions; never substitute an empty
 page. Card samples disable resource loading and interaction, so image/resource
 fidelity needs the separate authorized asset review. Then apply UC-003–006 above
-to disposable pages on the exact intended release.
+to disposable pages on the exact intended release. Include attachment upload,
+download and removal, independent copy/move files, and reader/outsider/revoked
+download checks. The new menu has synthetic source/image evidence; its productive
+verdict remains CSOC-WP-0013-T06.
 
 ## Revision and interrupted-operation lifecycle — WP-0013-T05
 
@@ -96,7 +107,7 @@ Evidence: `../release/content-lifecycle-validation-2026-10-31.json`. This is sou
 and isolated-fixture evidence; the fix still needs release delivery and productive
 review. Do not kill or mutate the productive application to perform this review.
 
-## Prepared lifecycle image release — follows inactive backup installation
+## Historical lifecycle-only packet — superseded by combined release
 
 The owner packet is `railiance-apps/release/coulomb-content-lifecycle-f306dbf.json`,
 proposal `sha256:c9c3231620721ef3ea9b2bf22fc6c62fe3ed8efb91386cf7ec96acc6959dae08`.
@@ -104,7 +115,9 @@ It upgrades the verified revision19/image522bcd7f to candidate d3f2f5bb, with no
 migration, resource, authorization grant or content rewrite. The only packaged
 application change is attachment journal ordering/durability in pageops.py.
 
-**Current full preflight refuses the missing inactive-installation receipt.**
+**Historical preflight refused the then-missing inactive-installation receipt.**
+That prerequisite is now complete. Do not execute this older lifecycle-only packet;
+use the [combined release review](../release/content-acceptance-review-2026-10-31.md).
 The order is: existing historical custody repairfa2763d1 and recurring route4d848106,
 then inactive source installation8f442bf0, then this image release, then native
 recurring-backup proof and schedule activation. The installer pins the current
@@ -124,7 +137,7 @@ python3 /home/worsch/railiance-apps/tools/coulomb-image-release.py \
 
 Only a `live_release_preflight_verified` return at that exact digest makes the
 packet ready for attended execution. A changed baseline needs a revised review.
-The founder execution command then replaces `--preflight` with `--execute`; its
+For that historical packet, the founder execution command replaced `--preflight` with `--execute`; its
 terminal prompt requires `DEPLOY` followed by that full digest. The supervision
 rule is recorded in the-custodian/docs/agent-autonomy-decision.md: “The supervisor
 approves that proposal or performs it through the privileged execution path.”