coulomb-social/docs/usecases/sharing-portability-review.md

Prepared review — UC-003 through UC-006

Review on https://app.coulomb.social, using a disposable page in an intended space and a second destination space. Use an explicitly chosen reader and an ungranted same-tenant member; keep their identities and real notes private. The last independently verified application release is Helm revision 19, image 522bcd7fce92436765a60c1e4afa2598f3cc40913352153ff1c4319a99ca92ed (source 23ffe2c). See the release return. Record the actual release/date with each verdict. Later source changes, including the attachment interruption fix below, are not implicitly part of that image. Automated checks do not supply these verdicts.

Journey	Review steps	Expected result
UC-003: authoring	Create a disposable page with title, abstract, visual and body. Save/reopen; edit and reopen again. Open two edit tabs, save in one, then submit the older tab.	Content remains recognizable. Stale submission preserves your text and asks you to reopen/merge. Verify representative custom Markdown/raw HTML/assets separately; sanitization differences need an explicit verdict.
UC-004: copy/move	Copy that page to the second space. Edit the copy; reopen the source. Move another disposable page, then follow its old address as both an authorized reader and an outsider.	Copy is independent. Moved content/assets remain intact; old address still requires destination permission. No overwrite or access grant follows from moving.
UC-005: sharing	As owner, use Share space to grant the chosen reader access. Reader opens page and visual, then tries edit/copy/move directly. Ungranted member tries those same page/image URLs. Revoke the reader and retry.	Reader can read but cannot modify. Outsider receives no private content. Revoked reader loses page and image access. Review which existing grants/creator access remain.
UC-006: portability	Open Your app data/export. Inspect the private account-local JSON export and leaving/ownership explanation. Use a disposable app-local member for any actual exit test.	Export has the intended local identity/grant scope. Shared content remains with a named successor; sole owner must resolve succession first. App-local exit leaves platform identity under its own owner. Do not delete the productive owner to review the screen.

For each journey reply accepted, gap or deferred, with a short explanation. An observed gap becomes a live task before that journey is accepted. Weekly-call acceptance remains UC-008 only. A source-date check for newly migrated pages and all their chunks is also required under the user's October 27 migration instruction.

Private corpus rendering cards — refreshed 2026-10-31

scripts/audit-bubble-rendering.py now prepares private source/product cards and an index using the actual product renderer. The current capture has 245 article records: 242 bodies render and three bodies are missing. Six records change markup under sanitization (three removed custom tags and 17 removed attributes in total); no extracted-text change was observed between intermediate Markdown HTML and sanitized HTML. These counts do not compare with Bubble's own rendering and do not supply an acceptance verdict. Source text/bytes remain preserved.

Current private index: ~/.config/coulomb-social/auth/exports/rendering-review-20261031/index.html. Source exceptions, including the unassigned record, have a separate private index: ~/.config/coulomb-social/auth/exports/source-exception-review-20261031/index.html.

In the private index, review the six markup-change cards first. Each shows the exact captured source beside the current product rendering and provides an explicit link to the original Bubble view. Compare the same record there: meaning and placeholders, line breaks, lists/tables, Visual and any body-linked resources. Record accepted, gap or deferred per record, keeping its private source ID in the private report. Open gaps remain WP-0013-T02; resolve or explicitly accept intended differences before marking the corresponding cohort transferred. Review the body-missing records as source exceptions; never substitute an empty page. Card samples disable resource loading and interaction, so image/resource fidelity needs the separate authorized asset review. Then apply UC-003–006 above to disposable pages on the exact intended release.

Revision and interrupted-operation lifecycle — WP-0013-T05

Policy accepted by Bernd on 2026-10-31 (decision c3a191f2-ce06-483f-82d7-ef8c54ea0d5e): retain every page revision by default. There is no scheduled revision purge. A separately reviewed manual purge may remove only inactive revisions older than an explicit timezone-aware cutoff. Keep current page bytes and all retained revisions of deleted pages. Validate every revision hash before deleting any candidate. Backup copies have their own T04 retention obligations; purging a local revision does not remove it from a backup. Policy acceptance and any concrete deletion authorization are separate decisions.

Policy acceptance is recorded. No cutoff has been selected and no productive purge has run. Local history/retention does not replace independent paired recovery or the requirement to preserve original source creation dates.

Source investigation reproduced a process-crash gap in attachment copy/move: partial attachment bytes could exist before their name entered the recovery journal. The corrected source records the intended new attachment before exclusive creation, after refusing any existing entry, under the existing content writer lock. Attachment bytes and directory entries are flushed before publishing the destination page. Recovery discards unconfirmed destinations or finishes a confirmed move, preserving the source unless a matching destination is confirmed. It never grants destination access through an old address. All application/import writers must use the same content lock; raw concurrent filesystem edits are outside that serialization model.

Synthetic subprocesses terminate abruptly at 14 copy/move interruption points, including first/second partial attachments, page publication, alias publication and source deletion. Eight collision cases preserve existing files, directories and symlinks. Existing retention/incoming-address permission tests remain required. Evidence: ../release/content-lifecycle-validation-2026-10-31.json. This is source and isolated-fixture evidence; the fix still needs release delivery and productive review. Do not kill or mutate the productive application to perform this review.

Prepared lifecycle image release — follows inactive backup installation

The owner packet is railiance-apps/release/coulomb-content-lifecycle-f306dbf.json, proposal sha256:c9c3231620721ef3ea9b2bf22fc6c62fe3ed8efb91386cf7ec96acc6959dae08. It upgrades the verified revision19/image522bcd7f to candidate d3f2f5bb, with no new migration, resource, authorization grant or content rewrite. The only packaged application change is attachment journal ordering/durability in pageops.py.

Current full preflight refuses the missing inactive-installation receipt. The order is: existing historical custody repairfa2763d1 and recurring route4d848106, then inactive source installation8f442bf0, then this image release, then native recurring-backup proof and schedule activation. The installer pins the current snapshot helper; deploying this image first would invalidate its reviewed preimage. The image controller enforces the completed installer receipt and inactive/disabled backup units before creating an execution journal. Do not bypass that dependency.

After the existing prerequisites have their independently verified returns, run this read-only check from the workstation:

python3 /home/worsch/railiance-apps/tools/coulomb-image-release.py \
  --plan /home/worsch/railiance-apps/release/coulomb-content-lifecycle-f306dbf.json \
  --preflight \
  --expect-digest sha256:c9c3231620721ef3ea9b2bf22fc6c62fe3ed8efb91386cf7ec96acc6959dae08

Only a live_release_preflight_verified return at that exact digest makes the packet ready for attended execution. A changed baseline needs a revised review. The founder execution command then replaces --preflight with --execute; its terminal prompt requires DEPLOY followed by that full digest. The supervision rule is recorded in the-custodian/docs/agent-autonomy-decision.md: “The supervisor approves that proposal or performs it through the privileged execution path.” This release has not been executed or approved through the retention-policy answer.

Execution creates a fresh immutable paired primary backup/readback before Helm, checks the current complete data and migration fingerprints, performs an atomic image-only upgrade, verifies owner/outsider/public endpoints and refreshes the snapshot image pin. A failure restores revision19 and the recognized previous pin without restoring old data or downgrading schema. Inspect the durable receipt before any retry. Expected receipt status is image_candidate_deployed_verified under /var/lib/coulomb-social-backup/releases/c9c3231620721ef3ea9b2bf22fc6c62fe3ed8efb91386cf7ec96acc6959dae08/receipt.json.

The current observation binds93business rows/86files. The retained07:13 recovery point has92business rows: the differences are sessions and login timestamps, with identical content and migration history. Candidate/rollback rehearsals preserve all13tables/86files, verify85export files and40owner/40outsider views on that point. They do not establish recovery of the newer session; independent retrieval/restore of the fresh execution point remains part of the release return.

There are no new infrastructure reservations. The action adds one encrypted primary backup object and temporary local scratch under the admitted capacity bounds. Incremental provider cost is unpriced; no EUR autopilot budget is claimed. Application writes pause during paired capture and the Recreate rollout. Evidence: ../release/content-lifecycle-release-preparation-2026-10-31.json, its proposal, native target/preflight/row-drift receipts, and the candidate recovery receipt.

October31 Visual preservation follow-through

A new private ~/.config/coulomb-social/auth/exports/visual-bundle-20261031 retains 242Visual references as90distinct local images and populates236draft article Visuals plus67space indexes. The original rendering cards and source capture are unchanged. Offline image decoding and exact body/date preservation pass; neither proves appearance fidelity to Bubble. Use these retained local assets for the source/product comparison after each mapping is ready. Graph exceptions, grants, 18body links and one attachment flag remain explicit. No productive import or user verdict is inferred. Evidence: ../release/bubble-visual-preparation-2026-10-31.json.

October31 body-resource follow-through

The later offline check verifies exact destination preservation for all 18 body-link entries and 28 occurrences through the product renderer. It does not contact those destinations or accept original appearance. Four deferred scrap relation fields are now explicitly unresolved alongside the separate attachment flag; they were present in raw source but omitted from the prior review flags. They must be captured or given an explicit disposition before migration can be accepted. Private supplemental report: ~/.config/coulomb-social/auth/exports/body-resources-20261031.json. Public proof: ../release/bubble-body-resources-2026-10-31.json.