coulomb-social/docs/usecases/sharing-portability-review.md

Prepared review — UC-003 through UC-006

Review on https://app.coulomb.social, using a disposable page in an intended space and a second destination space. Use an explicitly chosen reader and an ungranted Coulomb member; keep their identities and real notes private. The final independently verified application release for this review is Helm22, image85378d10/source61c154f. All UC-003/004/005/006 verdicts are accepted as of 2026-11-01; see the productive session and closure receipt. The detailed earlier preparation notes below are historical. No new review or rerun of an archived deployment command is required for these accepted journeys.

October31 closure update: the reviewed backup route is now executed and independently verified at revision6. The inactive installer is also founder-executed and independently verified, including its local capacity profile. A newly identified ordered-list numbering correction must accompany the attachment fix in a refreshed content release; the historical lifecycle-only packet below remains evidence, not the final combined proposal. The combined candidate also includes the user's requested attachment menu, with author upload/removal and authenticated reader downloads. Uploads are limited to 16 MiB per file. Removal detaches the current association; retained revisions and their bytes remain. Copies/moves carry independent files with destination access.

Journey	Review steps	Expected result
UC-003: authoring	Create a disposable page with title, abstract, visual and body. Save/reopen; edit and reopen again. Open two edit tabs, save in one, then submit the older tab.	Content remains recognizable. Stale submission preserves your text and asks you to reopen/merge. Verify representative custom Markdown/raw HTML/assets separately; sanitization differences need an explicit verdict.
UC-004: copy/move	Copy that page to the second space. Edit the copy; reopen the source. Move another disposable page, then follow its old address as both an authorized reader and an outsider.	Copy is independent. Moved content/assets remain intact; old address still requires destination permission. No overwrite or access grant follows from moving.
UC-005: sharing	As owner, use Share space to grant the chosen reader access. Reader opens page and visual, then tries edit/copy/move directly. Ungranted member tries those same page/image URLs. Revoke the reader and retry.	Reader can read but cannot modify. Outsider receives no private content. Revoked reader loses page and image access. Review which existing grants/creator access remain.
UC-006: portability	Open Your app data/export. Inspect the private account-local JSON export and leaving/ownership explanation. Use a disposable app-local member for any actual exit test.	Export has the intended local identity/grant scope. Shared content remains with a named successor; sole owner must resolve succession first. App-local exit leaves platform identity under its own owner. Do not delete the productive owner to review the screen.

For each journey reply accepted, gap or deferred, with a short explanation. An observed gap becomes a live task before that journey is accepted. Weekly-call acceptance remains UC-008 only. A source-date check for newly migrated pages and all their chunks is also required under the user's October 27 migration instruction.

Private corpus rendering cards — refreshed 2026-10-31

scripts/audit-bubble-rendering.py now prepares private source/product cards and an index using the actual product renderer. The current capture has 245 article records: 242 bodies render and three bodies are missing. Six records change markup under sanitization (three removed custom tags and 17 removed attributes in total); no extracted-text change was observed between intermediate Markdown HTML and sanitized HTML. These counts do not compare with Bubble's own rendering and do not supply an acceptance verdict. Source text/bytes remain preserved.

Current private index: ~/.config/coulomb-social/auth/exports/rendering-review-20261031/index.html. Source exceptions, including the unassigned record, have a separate private index: ~/.config/coulomb-social/auth/exports/source-exception-review-20261031/index.html.

The refreshed source-candidate review is now ~/.config/coulomb-social/auth/exports/rendering-review-20261031-numbering/index.html. It restores15ordered-list starting numbers across4records, with all242source bodies unchanged. Three custom-topic markup cases remain, as do the three missing bodies and separate resource questions. The original six-case review above remains unchanged and describes the previous renderer. Neither index establishes original Bubble fidelity or the deployed image's acceptance. Source proof: ../release/ordered-list-fidelity-2026-10-31.json.

Bernd accepted the three remaining custom-topic cases as “fine for now” on October31 (decision69ec9380-e5f6-41aa-af88-f697fc1c8a66). This is a rendering disposition only; missing bodies and unresolved resources remain explicit.

For other fidelity checks, each card shows the exact captured source beside the current product rendering and provides an explicit link to the original Bubble view. Compare the same record there: meaning and placeholders, line breaks, lists/tables, Visual and any body-linked resources. Record accepted, gap or deferred per record, keeping its private source ID in the private report. Open gaps remain WP-0013-T02; resolve or explicitly accept intended differences before marking the corresponding cohort transferred. Review the body-missing records as source exceptions; never substitute an empty page. Card samples disable resource loading and interaction, so image/resource fidelity needs the separate authorized asset review. Then apply UC-003–006 above to disposable pages on the exact intended release. Include attachment upload, download and removal, independent copy/move files, and reader/outsider/revoked download checks. The new menu has synthetic source/image evidence; its productive verdict remains CSOC-WP-0013-T06.

Revision and interrupted-operation lifecycle — WP-0013-T05

Policy accepted by Bernd on 2026-10-31 (decision c3a191f2-ce06-483f-82d7-ef8c54ea0d5e): retain every page revision by default. There is no scheduled revision purge. A separately reviewed manual purge may remove only inactive revisions older than an explicit timezone-aware cutoff. Keep current page bytes and all retained revisions of deleted pages. Validate every revision hash before deleting any candidate. Backup copies have their own T04 retention obligations; purging a local revision does not remove it from a backup. Policy acceptance and any concrete deletion authorization are separate decisions.

Policy acceptance is recorded. No cutoff has been selected and no productive purge has run. Local history/retention does not replace independent paired recovery or the requirement to preserve original source creation dates.

Source investigation reproduced a process-crash gap in attachment copy/move: partial attachment bytes could exist before their name entered the recovery journal. The corrected source records the intended new attachment before exclusive creation, after refusing any existing entry, under the existing content writer lock. Attachment bytes and directory entries are flushed before publishing the destination page. Recovery discards unconfirmed destinations or finishes a confirmed move, preserving the source unless a matching destination is confirmed. It never grants destination access through an old address. All application/import writers must use the same content lock; raw concurrent filesystem edits are outside that serialization model.

Synthetic subprocesses terminate abruptly at 14 copy/move interruption points, including first/second partial attachments, page publication, alias publication and source deletion. Eight collision cases preserve existing files, directories and symlinks. Existing retention/incoming-address permission tests remain required. Evidence: ../release/content-lifecycle-validation-2026-10-31.json. This is source and isolated-fixture evidence; the fix still needs release delivery and productive review. Do not kill or mutate the productive application to perform this review.

Historical lifecycle-only packet — superseded by combined release

The owner packet is railiance-apps/release/coulomb-content-lifecycle-f306dbf.json, proposal sha256:c9c3231620721ef3ea9b2bf22fc6c62fe3ed8efb91386cf7ec96acc6959dae08. It upgrades the verified revision19/image522bcd7f to candidate d3f2f5bb, with no new migration, resource, authorization grant or content rewrite. The only packaged application change is attachment journal ordering/durability in pageops.py.

Historical preflight refused the then-missing inactive-installation receipt. That prerequisite is now complete. Do not execute this older lifecycle-only packet; use the combined release review. The order is: existing historical custody repairfa2763d1 and recurring route4d848106, then inactive source installation8f442bf0, then this image release, then native recurring-backup proof and schedule activation. The installer pins the current snapshot helper; deploying this image first would invalidate its reviewed preimage. The image controller enforces the completed installer receipt and inactive/disabled backup units before creating an execution journal. Do not bypass that dependency.

After the existing prerequisites have their independently verified returns, run this read-only check from the workstation:

python3 /home/worsch/railiance-apps/tools/coulomb-image-release.py \
  --plan /home/worsch/railiance-apps/release/coulomb-content-lifecycle-f306dbf.json \
  --preflight \
  --expect-digest sha256:c9c3231620721ef3ea9b2bf22fc6c62fe3ed8efb91386cf7ec96acc6959dae08

Only a live_release_preflight_verified return at that exact digest makes the packet ready for attended execution. A changed baseline needs a revised review. For that historical packet, the founder execution command replaced --preflight with --execute; its terminal prompt requires DEPLOY followed by that full digest. The supervision rule is recorded in the-custodian/docs/agent-autonomy-decision.md: “The supervisor approves that proposal or performs it through the privileged execution path.” This release has not been executed or approved through the retention-policy answer.

Execution creates a fresh immutable paired primary backup/readback before Helm, checks the current complete data and migration fingerprints, performs an atomic image-only upgrade, verifies owner/outsider/public endpoints and refreshes the snapshot image pin. A failure restores revision19 and the recognized previous pin without restoring old data or downgrading schema. Inspect the durable receipt before any retry. Expected receipt status is image_candidate_deployed_verified under /var/lib/coulomb-social-backup/releases/c9c3231620721ef3ea9b2bf22fc6c62fe3ed8efb91386cf7ec96acc6959dae08/receipt.json.

The current observation binds93business rows/86files. The retained07:13 recovery point has92business rows: the differences are sessions and login timestamps, with identical content and migration history. Candidate/rollback rehearsals preserve all13tables/86files, verify85export files and40owner/40outsider views on that point. They do not establish recovery of the newer session; independent retrieval/restore of the fresh execution point remains part of the release return.

There are no new infrastructure reservations. The action adds one encrypted primary backup object and temporary local scratch under the admitted capacity bounds. Incremental provider cost is unpriced; no EUR autopilot budget is claimed. Application writes pause during paired capture and the Recreate rollout. Evidence: ../release/content-lifecycle-release-preparation-2026-10-31.json, its proposal, native target/preflight/row-drift receipts, and the candidate recovery receipt.

October31 Visual preservation follow-through

A new private ~/.config/coulomb-social/auth/exports/visual-bundle-20261031 retains 242Visual references as90distinct local images and populates236draft article Visuals plus67space indexes. The original rendering cards and source capture are unchanged. Offline image decoding and exact body/date preservation pass; neither proves appearance fidelity to Bubble. Use these retained local assets for the source/product comparison after each mapping is ready. Graph exceptions, grants, 18body links and one attachment flag remain explicit. No productive import or user verdict is inferred. Evidence: ../release/bubble-visual-preparation-2026-10-31.json.

October31 body-resource follow-through

The later offline check verifies exact destination preservation for all 18 body-link entries and 28 occurrences through the product renderer. It does not contact those destinations or accept original appearance. Four deferred scrap relation fields are now explicitly unresolved alongside the separate attachment flag; they were present in raw source but omitted from the prior review flags. They must be captured or given an explicit disposition before migration can be accepted. Private supplemental report: ~/.config/coulomb-social/auth/exports/body-resources-20261031.json. Public proof: ../release/bubble-body-resources-2026-10-31.json.

Confirmed attachment modal and recovered files

The user clarified that Bubble’s Add attachment image opens the modal used for both adding and downloading files. The bounded read used only that opener and Open file. Two files are retained, with exact matches between UI downloads and independent CDN fetches. Original file-child creation/modification dates and relations are retained; the existing matched draft includes its attachment and provenance without changing its body or existing dates. The example outside the original capture remains separately retained for reconciliation.

Private review/downloads: ~/.config/coulomb-social/auth/exports/attachment-bundle-20261031/attachments-index.html. The four separate scrap relations remain unresolved. Empty attachment modals do not establish absence of scraps. No production import or productive acceptance is inferred. Evidence: ../release/bubble-attachment-recovery-2026-10-31.json.

The four unresolved scrap cases now have a focused private review: ~/.config/coulomb-social/auth/exports/scrap-review-20261031/index.html. Their navigator and attachment-modal reads do not expose scrap records. Keep raw references and existing page bodies/dates until original evidence or an explicit per-case disposition arrives (decision6db14274-4450-4ae2-b77a-cd4c88369eaa).

Accepted disposition of the four scrap cases

Bernd explicitly confirmed that all four reviewed scrap cases are obsolete legacy relicts and no longer needed. Decision6db14274-4450-4ae2-b77a-cd4c88369eaa is resolved: omit those four scrap references from migration/content acceptance requirements. No further scrap capture or user verdict is needed. Their original raw evidence, page bodies and source dates remain retained; recovered attachments remain in scope. The preceding unresolved-scrap notes describe the earlier investigation. This specific disposition does not waive other source exceptions or productive review. Evidence: ../release/bubble-scrap-disposition-2026-10-31.json.

Space sharing rule approved 2026-11-01

A space owner can grant Viewer, Member or Owner access to any active Coulomb member, regardless of the platform tenant in their signed identity. Platform groups and tenant membership alone grant no space access. The user approved this rule after the productive test exposed a mismatch between the owner's platform context and the participant's Coulomb context (decision1d5ab659).

Explicit grants govern navigation, pages, files, mutations and incoming addresses. Revocation applies across those paths. Personal export and ownership succession include grants across platform tenants. Operator client exports retain their existing tenant-based content selection and include related membership records with ID-only references to external members/spaces; they never expand to other clients' profiles or content. Those references require explicit reconciliation when importing elsewhere and do not grant platform authority.

Refined application organisation/admission controls are deferred to a live intake. Productive acceptance of this correction remains pending deployment and retest.