[scbrown]

Add a disabled online request preview over the generic attested-write primitive: canonical curated requests, choose/Later/comment proposals, a strict native-receipt reader, durable IndexedDB custody and one-commit receipt recovery. The card renders declared text and keeps Later visible; comment leaves the request waiting.

The reader reconstructs every datum and all five expectations across request, answer and item graphs. It requires the exact native point receipt and matching fact/provenance read-back. Unknown outcomes retain the original nonce; recovery never signs or commits again. A server challenge that would outlive the curated request refuses before signing.

The build includes the default-off preview. No production transport, query registration, curator job, enrollment, graph protection or activation is selected. The contract lists remaining integration and served acceptance gates, including the native MinCount admission limitation and the strict reader control that covers malformed domain statements.

Validation on current main: just ci passes 78 tests, build and README checks. Sixteen explicit native controls pass against clean candidate 771e710d, using the actual operator CLI and linked library in disposable stores. Nine actual browser/IndexedDB controls pass with synthetic reader/signer adapters, including lost-response recovery, two-tab custody, ordinary-graph refusal, stale-item refusal and markup-like title rendering. Four injected faults fail; restored source and HOME guards pass.

Real recovery recording, screenshot and repeatable fixture bind the browser source hashes. The video plays through to the recovered final state. Native fixture results state their separate trust scope; no real device, human or production service is involved.

Rollback: revert the source proposal; preview configuration remains disabled. Actual publication and runtime safeguards remain separate.

[scbrown]

SOURCE APPROVE — exact 831b11938d1200c94c1f3e915dbdf2ad021ae744.

Independent full review of all 25 changed paths against f7d303c4, including the native fixture, shape constraints, pending custody, WebAuthn export, reader interpretation, build publication and media. No source blocker found.

Validation: just ci 78 tests passed; all 16 native controls independently reran using the pinned clean 771e710d CLI/library and a hash-matched helper copied to my own evidence directory (no new helper compilation claimed). All nine browser scenarios passed with actual IndexedDB, intercepted synthetic assets and zero nonlocal requests. An additional independent two-writer test produced one signature/commit, preserved UNKNOWN through reload, then recovered by receipt/read-back without another signature or commit. All checks had clean HOME guards: 157 paths and five UID resources.

The committed 4.6-second, 980×900 WebM decoded and played through 115 frames; its final recovered state matches the screenshot. Source asset hashes match the committed evidence. Browser adapters are synthetic; native controls use disposable local stores and in-memory software fixture keys. Neither demonstrates a hardware ceremony, HTTP/CORS admission or a production profile union.

The preview stays disabled, makes no network request, and selects no production endpoint or credential. Its manifest reader rejects the documented native-valid missing-MinCount case; loading its vocabulary is not writer authorization. Curator/adapters, served safety/performance, human acceptance and old-domain removal remain separate gates. No enrollment, activation, production publication or runtime approval.

Native review accepted as Wu: 538f65910e1d868a0d1a103afc3926649e28650ad3e84b7146290c2de359ff02, current helper ee9ab626, risk 809d429c. Tim retains normal current admission, landing and exact-main watch. This verdict is source review only.