collavre 0.22.0 → 0.24.0

data/app/models/collavre/channel.rb

@@ -5,6 +5,22 @@ module Collavre
 
     self.table_name = "channels"
 
+    include Collavre::IndexedJsonColumns
+
+    # Denormalized columns that mirror same-named keys in `config`. They exist
+    # so the channels UNIQUE indexes are plain-column indexes (which dump
+    # identically to schema.rb on SQLite and PostgreSQL) instead of JSON
+    # expression indexes (json_extract vs config->>), which serialize
+    # per-adapter and crash `db:schema:load` on PostgreSQL. `config` stays the
+    # source of truth; these columns are re-derived on every save. Declared
+    # here beside the table whose unique indexes are defined in this engine's
+    # migration, so subtype engines need not know about the denormalization.
+    indexed_json_columns json: :config, columns: {
+      repo_full_name: "repo_full_name",
+      pr_number: "pr_number",
+      worktree_id: "worktree_id"
+    }
+
     belongs_to :topic, class_name: "Collavre::Topic"
 
     enum :state, { active: 0, detached: 1 }, default: :active

data/app/models/collavre/comment/approvable.rb

@@ -3,6 +3,22 @@ module Collavre
     module Approvable
       extend ActiveSupport::Concern
 
+      # A message that renders an approval button (pending) or an
+      # approved/denied status label (decided) in the chat list — i.e. it
+      # carries an `action` JSON payload. Both the `has_pending_action`
+      # button (action.present? && action_executed_at.blank?) and the
+      # ✅ approved / 🚫 denied label (action_executed_at.present?, which implies
+      # action.present?) roll up to this single condition.
+      #
+      # Such a message is a HUMAN decision surface and must never be dispatched
+      # to an AI agent — regardless of who authored it or whether it has already
+      # been decided. This is the single source of truth for that invariant,
+      # enforced at every dispatch seam (Comment#dispatch_to_orchestration and
+      # AiAgent::A2aDispatcher#dispatch).
+      def approval_action?
+        action.present?
+      end
+
       def can_be_approved_by?(user)
         approval_status(user) == :ok
       end

data/app/models/collavre/comment/broadcastable.rb

@@ -3,6 +3,9 @@ module Collavre
     module Broadcastable
       extend ActiveSupport::Concern
 
+      # The desktop and mobile inbox badge DOM ids kept in sync in real time.
+      INBOX_BADGE_TARGETS = %w[desktop-inbox-badge mobile-inbox-badge].freeze
+
       included do
         after_create_commit :broadcast_create
         after_update_commit :broadcast_update
@@ -112,21 +115,57 @@ module Collavre
         def broadcast_inbox_badge(inbox_creative, owner, count: nil)
           return unless inbox_creative && owner
 
-          count ||= Collavre::Inbox::BadgeComponent.new(user: owner, creative: inbox_creative).count
+          count ||= inbox_badge_count(inbox_creative, owner)
 
-          %w[desktop-inbox-badge mobile-inbox-badge].each do |target_id|
+          INBOX_BADGE_TARGETS.each do |target_id|
             Turbo::StreamsChannel.broadcast_replace_to(
               [ "inbox", owner ],
               target: target_id,
               partial: "inbox/badge_component/count",
-              locals: {
-                count: count,
-                badge_id: target_id,
-                show_zero: false
-              }
+              locals: inbox_badge_locals(count, target_id)
             )
           end
         end
+
+        # Render the same inbox badge replacements as a Turbo Stream string so a
+        # channel can transmit them straight to its own confirmed subscriber
+        # (see InboxBadgeChannel), instead of re-broadcasting to the sibling
+        # ["inbox", user] stream and risking a reconnect race. Returns nil when
+        # there is nothing to render.
+        def inbox_badge_turbo_stream(inbox_creative, owner, count: nil)
+          return unless inbox_creative && owner
+
+          count ||= inbox_badge_count(inbox_creative, owner)
+
+          INBOX_BADGE_TARGETS.map do |target_id|
+            Turbo::StreamsChannel.turbo_stream_action_tag(
+              :replace,
+              target: target_id,
+              template: ApplicationController.render(
+                partial: "inbox/badge_component/count",
+                formats: [ :html ],
+                locals: inbox_badge_locals(count, target_id)
+              )
+            )
+          end.join.html_safe
+        end
+
+        private
+
+        # Inbox badge count when no caller-supplied count is available (e.g. the
+        # reconnect snapshot in InboxBadgeChannel). Mirrors broadcast_badge's
+        # suppression: a user actively viewing the inbox (present in
+        # CommentPresenceStore) sees 0, so a reconnect can't repaint unread items
+        # over the suppressed badge.
+        def inbox_badge_count(inbox_creative, owner)
+          return 0 if CommentPresenceStore.list(inbox_creative.id).include?(owner.id)
+
+          Collavre::Inbox::BadgeComponent.new(user: owner, creative: inbox_creative).count
+        end
+
+        def inbox_badge_locals(count, target_id)
+          { count: count, badge_id: target_id, show_zero: false }
+        end
       end
 
       private

data/app/models/collavre/comment/notifiable.rb

@@ -118,7 +118,7 @@ module Collavre
       def notify_write_users
         return if private? || !user
         return if streaming_placeholder?
-        return if creative&.inbox? # Don't notify about inbox comments
+        return if suppress_inbox_notification? # only the System topic is the alarm stream
         notification_recipients.each do |recipient|
           create_inbox_comment(
             recipient,
@@ -131,7 +131,7 @@ module Collavre
       def notify_mentions
         return if private?
         return if streaming_placeholder?
-        return if creative&.inbox? # Don't notify about inbox comments
+        return if suppress_inbox_notification? # only the System topic is the alarm stream
         notify_mentioned_users
       end
 
@@ -146,7 +146,7 @@ module Collavre
       end
 
       def notify_ai_write_users
-        return if creative&.inbox? # Don't notify about inbox comments
+        return if suppress_inbox_notification? # only the System topic is the alarm stream
         notification_recipients.each do |recipient|
           create_inbox_comment(
             recipient,
@@ -157,12 +157,22 @@ module Collavre
       end
 
       def notify_ai_mentions
-        return if creative&.inbox? # Don't notify about inbox comments
+        return if suppress_inbox_notification? # only the System topic is the alarm stream
         notify_mentioned_users
       end
 
+      # #1301 made every inbox topic EXCEPT System dispatch like a normal topic;
+      # the alarm stream follows suit. Suppress notifications ONLY for the System
+      # topic itself (its system-authored notices must not cascade into more
+      # notices — a loop). Inbox#Main and other inbox topics notify normally, so
+      # an agent reply there reaches the absent owner. Mirrors the dispatch gate
+      # in Comment#dispatch_to_orchestration.
+      def suppress_inbox_notification?
+        creative&.inbox? && inbox_system_topic?
+      end
+
       def notify_approver
-        return unless approver.present? && action.present?
+        return unless approver.present? && approval_action?
         return if approver == user
         return if creative&.inbox? # Don't notify about inbox comments
 

data/app/models/collavre/comment.rb

@@ -3,13 +3,55 @@ module Collavre
     self.table_name = "comments"
 
     STREAMING_PLACEHOLDER_CONTENT = "..."
+    # Authorless "⏳" waiting-notice system messages posted when an agent is
+    # deferred for topic concurrency. AgentOrchestrator.cleanup_waiting_notices!
+    # matches the same prefix to remove them once the waiter is dequeued.
+    WAITING_NOTICE_PREFIX = "⏳"
 
     # Use non-namespaced partial path for backward compatibility
     def to_partial_path
       "comments/comment"
     end
 
-    belongs_to :creative, class_name: "Collavre::Creative"
+    # A system "⏳" waiting notice (no author) telling a user their agent is
+    # deferred because another task holds the topic's running slot.
+    def waiting_notice?
+      user_id.nil? && content.to_s.start_with?(WAITING_NOTICE_PREFIX)
+    end
+
+    # The task holding this topic's concurrency slot — the blocker this waiting
+    # notice is about. Lets the notice render a stop button that cancels the
+    # blocker (freeing the topic so the deferred waiter proceeds) instead of
+    # being an anonymous dead end. Resolved at render time rather than stored on
+    # task_id, which Task#reply_comment keys on (a shared task_id would make the
+    # blocker's reply_comment ambiguous).
+    #
+    # Two gates keep the button honest:
+    #   1. Only THIS notice's own topic-concurrency defer qualifies. The same "⏳"
+    #      notice is also posted for :delayed decisions (busy / rate_limited),
+    #      which schedule a delayed job WITHOUT queuing a topic waiter —
+    #      cancelling some unrelated running task would not unblock them.
+    #      topic_concurrency_defer is set only on the :deferred path, so a
+    #      :delayed notice never shows the button even when an unrelated queued
+    #      waiter happens to share the topic. The queued_for_topic check then
+    #      confirms a waiter is still actually pending on the slot.
+    #   2. Resolve the blocker over occupying_topic_slot, not just running/
+    #      delegated: a holder paused on pending_approval still occupies the slot
+    #      and is cancellable, so the button must stay visible for it.
+    # Returns nil once no slot holder remains — at which point the notice itself
+    # is cleaned up.
+    def topic_blocking_task
+      return @topic_blocking_task if defined?(@topic_blocking_task)
+
+      @topic_blocking_task =
+        if topic_concurrency_defer? && topic_id &&
+           Collavre::Task.queued_for_topic(topic_id, creative_id).exists?
+          Collavre::Task.occupying_topic_slot(topic_id, creative_id)
+                        .includes(:agent).order(:created_at).first
+        end
+    end
+
+    belongs_to :creative, class_name: "Collavre::Creative", counter_cache: true
     belongs_to :user, class_name: Collavre.configuration.user_class_name, optional: true
     belongs_to :approver, class_name: Collavre.configuration.user_class_name, optional: true
     belongs_to :action_executed_by, class_name: Collavre.configuration.user_class_name, optional: true
@@ -19,6 +61,11 @@ module Collavre
 
     scope :public_only, -> { where(private: false) }
 
+    # SQL inverse of Comment#approval_action? (action.present?). Approval-surface
+    # messages must never reach an AI agent — not only at the dispatch seams but
+    # also as chat-history/trigger context — so agent-context queries exclude them.
+    scope :without_approval_action, -> { where("action IS NULL OR action = ''") }
+
     scope :visible_to, ->(user) {
       where(
         "comments.private = ? OR comments.user_id = ? OR comments.approver_id = ?",
@@ -50,6 +97,10 @@ module Collavre
 
     attribute :skip_default_user, :boolean, default: false
     attribute :skip_dispatch, :boolean, default: false
+    # Set by AgentOrchestrator.cleanup_waiting_notices! so destroying a notice as
+    # part of *promoting* a waiter does not run the user-delete cancel cascade
+    # (which would cancel other still-queued waiters in the same topic).
+    attribute :suppress_waiter_cancellation, :boolean, default: false
 
     before_validation :use_origin_creative
     before_validation :assign_default_user, on: :create
@@ -142,12 +193,18 @@ module Collavre
         Collavre::Orchestration::AgentOrchestrator.dequeue_next_for_topic(task.topic_id, task.creative_id)
       end
 
-      # Cancel queued tasks when their waiting notice (system comment) is deleted
-      cancel_queued_tasks_for_waiting_notice if waiting_notice?
-    end
-
-    def waiting_notice?
-      user_id.nil? && content&.start_with?("⏳")
+      # Cancel queued tasks when a user DELETES their waiting notice. Gated to
+      # topic_concurrency_defer notices: only the :deferred path queues a topic
+      # waiter, so a :delayed (busy / rate_limited) "⏳" notice — which shares the
+      # prefix but has no waiter of its own — must not cancel an unrelated queued
+      # waiter that happens to share the topic. Also skipped when the notice is
+      # removed by promotion cleanup (suppress_waiter_cancellation): there the
+      # waiter is being advanced, not abandoned, and cancelling other still-queued
+      # waiters would drop their work (multi-slot orphan recovery must not cancel
+      # the rest).
+      if waiting_notice? && topic_concurrency_defer? && !suppress_waiter_cancellation
+        cancel_queued_tasks_for_waiting_notice
+      end
     end
 
     def cancel_queued_tasks_for_waiting_notice
@@ -161,21 +218,25 @@ module Collavre
       return if private?
       return if skip_default_user  # system notices should not trigger AI
       return if skip_dispatch      # explicit opt-out (e.g., command processor responses)
+      return if approval_action?   # approval button / approved message: human decision surface, never dispatch to an agent
       return unless user_id        # nil user = system message
       return if user&.ai_user?     # AI replies use A2aDispatcher, not this callback
       return unless creative
-      # Inbox creatives hold the user's notifications/DMs and normally must not
-      # trigger AI orchestration. Exception: a Claude Channel agent session
-      # registers its topic *inside* the inbox (Creative.inbox_for) and depends
-      # on the orchestration pipeline (Matcher → Arbiter → AiAgentService) to
-      # deliver comments to the running session. Scope the exception to actual
-      # Claude Channel session topics (primary_agent is a claude_channel_agent?).
-      # An inbox topic can be given any ai_user as primary_agent via
-      # TopicsController#set_primary_agent; gating on mere primary_agent presence
-      # would leak ordinary inbox DMs to the live Claude session, which holds
-      # inbox-wide :feedback + routing_expression="true" and would be selected by
-      # the Matcher for any dispatched inbox comment.
-      return if creative.inbox? && !claude_channel_session_topic?
+      # Inbox creatives hold the user's notifications AND ordinary conversations.
+      # Only the System topic is special: it carries alarms/notifications (stuck
+      # recovery, share notices, …) and must never trigger AI. Every OTHER inbox
+      # topic — Main, Content, user threads, Claude Channel session topics — is an
+      # ordinary conversation surface and dispatches exactly like a normal
+      # (non-inbox) topic.
+      #
+      # A live Claude Channel session holds inbox-wide :feedback +
+      # routing_expression="true", so it would otherwise be selected by the
+      # Matcher for *every* dispatched inbox comment (leaking ordinary inbox
+      # threads into the live session). That confinement now lives in
+      # Orchestration::Matcher, which scopes a Claude session agent to its own
+      # registered session topic — keeping non-System topics truly identical to a
+      # normal topic whether or not a session is live.
+      return if creative.inbox? && inbox_system_topic?
 
       # A Claude Channel session suspended on a native tool-permission prompt
       # parks its in-flight dispatch as a `delegated` task carrying a
@@ -200,19 +261,12 @@ module Collavre
       raise  # re-raise so calling jobs (e.g. DropTriggerJob) can retry
     end
 
-    # True only when this comment's topic is an actual Claude Channel session
-    # topic — it carries the registration marker (session_id) AND its
-    # primary_agent is a claude_channel_agent? (llm_model "claude-code"). Used to
-    # scope the inbox dispatch exception so ordinary inbox threads stay local.
-    #
-    # session_id is required, not just the Claude primary_agent: a Claude
-    # channel ai_user can be assigned as primary_agent on an ordinary inbox
-    # topic via TopicsController#set_primary_agent without ever registering a
-    # session. Gating on the agent alone would dispatch that ordinary thread and
-    # leak it to the live Claude session. session_id is exactly what
-    # ClaudeChannelAdapter#session_topic? keys on, so the two stay consistent.
-    def claude_channel_session_topic?
-      topic&.session_id.present? && topic&.primary_agent&.claude_channel_agent?
+    # The inbox System topic is the alarm/notification stream and must never
+    # trigger AI orchestration. Matched by name (Creative::SYSTEM_TOPIC_NAME),
+    # the same topic Creative#system_topic finds/creates and that stuck-recovery
+    # and share notices post into.
+    def inbox_system_topic?
+      topic&.name == Creative::SYSTEM_TOPIC_NAME
     end
 
     def assign_default_user
@@ -225,6 +279,7 @@ module Collavre
     def resume_trigger_loop_if_awaiting
       return unless user_id                # must have a user (not system)
       return if user&.ai_user?             # must be a human, not an AI agent
+      return if approval_action?           # approval surface is not a user-resume signal; the resumed @agent turn would otherwise carry it into history
       return unless creative
 
       # Use pessimistic lock to prevent duplicate resume from concurrent comments

data/app/models/collavre/comment_version.rb

@@ -4,7 +4,7 @@ module Collavre
   class CommentVersion < ApplicationRecord
     self.table_name = "comment_versions"
 
-    belongs_to :comment, class_name: "Collavre::Comment"
+    belongs_to :comment, class_name: "Collavre::Comment", counter_cache: true
     belongs_to :review_comment, class_name: "Collavre::Comment", optional: true
 
     validates :content, presence: true

data/app/models/collavre/creative/describable.rb

@@ -5,6 +5,11 @@ module Collavre
 
       included do
         attr_accessor :content_type_input
+        # Which editing surface authored this Markdown: "rich" (Lexical) reopens
+        # in the rich editor, "source" (or absent/legacy) reopens in the advanced
+        # textarea. Stored in data["editor"]; decoupled from the storage format
+        # (content_type), which is now Markdown for both surfaces.
+        attr_accessor :markdown_editor
         attr_reader :markdown_source
 
         def markdown_source=(value)
@@ -13,7 +18,7 @@ module Collavre
 
         validates :description, presence: true, unless: -> { origin_id.present? }
         validate :description_cannot_change_if_has_origin, on: :update
-        validate :description_cannot_change_if_github_source, on: :update
+        validate :description_cannot_change_if_read_only_source, on: :update
 
         before_validation :convert_markdown_to_html
         before_save :sanitize_description_html
@@ -24,7 +29,13 @@ module Collavre
       # Linked Creative의 description을 안전하게 반환
       def effective_description(variation_id = nil, html = true)
         if variation_id.present?
-          variation_tag = tags.find_by(label_id: variation_id)
+          # `find_by` on a loaded association still round-trips; the browse tree
+          # preloads tags per level and reaches here once per node.
+          variation_tag = if tags.loaded?
+            tags.find { |tag| tag.label_id.to_s == variation_id.to_s }
+          else
+            tags.find_by(label_id: variation_id)
+          end
           return variation_tag.value if variation_tag&.value.present?
         end
         description_val = origin_id.nil? ? description : origin.description
@@ -39,11 +50,11 @@ module Collavre
         CGI.unescapeHTML(ActionController::Base.helpers.strip_tags(effective_origin.description || "")).truncate(24, omission: "...")
       end
 
-      # GitHub-synced creatives reject any description change
-      # (description_cannot_change_if_github_source), so embedding would raise
+      # Read-only-source creatives reject any description change
+      # (description_cannot_change_if_read_only_source), so embedding would raise
       # and orphan the blob. Callers MUST check this before creating the blob.
       def attachments_embeddable?
-        !effective_origin.github_markdown?
+        !effective_origin.read_only_source?
       end
 
       # Append an attachment node and save; after_save reconcile attaches the
@@ -128,6 +139,9 @@ module Collavre
           prev_source = data["markdown_source"].to_s
           prev_type = data["content_type"]
           self.data["content_type"] = "markdown"
+          # Remember which surface authored this. Absent param (MCP/tool writes)
+          # keeps the prior choice, defaulting to the advanced textarea.
+          self.data["editor"] = markdown_editor.presence || data["editor"] || "source"
           if new_source != prev_source || prev_type != "markdown"
             # Rewrite inline data-URI images to freshly-uploaded blob paths
             # FIRST, then persist the rewritten source. Subsequent edits
@@ -149,6 +163,7 @@ module Collavre
           self.data ||= {}
           self.data.delete("content_type")
           self.data.delete("markdown_source")
+          self.data.delete("editor")
         elsif !new_record? && description_changed? && data&.dig("content_type") == "markdown"
           # Description was rewritten through a non-markdown path (tool/MCP
           # update, direct base.update(description: ...), etc.) on a creative
@@ -158,6 +173,7 @@ module Collavre
           # Demote to HTML mode so the persisted source matches description.
           self.data.delete("content_type")
           self.data.delete("markdown_source")
+          self.data.delete("editor")
         end
       end
 
@@ -181,21 +197,67 @@ module Collavre
           end
         end
 
+        # The Lexical editor stores text color / background as inline <span
+        # style="...">. Tighten every style attribute to ONLY validated color /
+        # background-color declarations BEFORE sanitization, so allowing `style`
+        # in the safelist can't smuggle layout/position/url() payloads.
+        scrub_inline_color_styles(scrubbed)
+
         self.description = ActionController::Base.helpers.sanitize(
           scrubbed.to_html,
           tags: Rails::HTML5::SafeListSanitizer.allowed_tags.to_a + table_tags + media_tags + %w[input],
-          attributes: Rails::HTML5::SafeListSanitizer.allowed_attributes.to_a + table_attrs + attachment_attrs + task_list_attrs + media_attrs + %w[data-lexical]
+          attributes: Rails::HTML5::SafeListSanitizer.allowed_attributes.to_a + table_attrs + attachment_attrs + task_list_attrs + media_attrs + %w[data-lexical style]
         )
       end
 
-      # Sync creative.files to exactly the blobs referenced in the description
-      # HTML (attach new, detach removed). Must never raise during save —
-      # malformed HTML yields [] and a no-op.
+      # Only these CSS color values may appear in a stored inline style — mirrors
+      # the JS markdown serializer's allowlist (markdown_serialize.js). Blocks
+      # url(), expression(), javascript:, and angle brackets.
+      SAFE_COLOR_VALUE = /\A(#[0-9a-fA-F]{3,8}|rgba?\([0-9.,%\s]+\)|hsla?\([0-9.,%\s]+\)|var\(--[a-zA-Z0-9\-_]+\)|[a-zA-Z]+)\z/
+
+      def scrub_inline_color_styles(fragment)
+        fragment.css("[style]").each do |node|
+          declarations = node["style"].to_s.split(";").filter_map do |decl|
+            key, value = decl.split(":", 2)
+            next if key.nil? || value.nil?
+
+            key = key.strip.downcase
+            value = value.strip
+            next unless %w[color background-color].include?(key)
+            next if value =~ /url\(|expression|javascript:|@import|[<>]/i
+            next unless value =~ SAFE_COLOR_VALUE
+
+            "#{key}: #{value}"
+          end
+
+          if declarations.any?
+            node["style"] = declarations.join("; ")
+          else
+            node.remove_attribute("style")
+          end
+        end
+      end
+
+      # Sync creative.files to the blobs referenced in the description HTML
+      # (attach new, detach removed). Must never raise during save — malformed
+      # HTML yields [] and a no-op.
+      #
+      # The rich (Lexical) editor is now Markdown-canonical and serializes
+      # inserted images/videos/files as raw blob-URL tags inside markdown_source,
+      # which markdown_to_html renders into `description`. So reconcile must run
+      # for markdown mode too, otherwise rich-editor uploads never reach
+      # creative.files (and the attachment list/remove services miss them).
       #
-      # Markdown-mode creatives manage their own blobs via MarkdownConverter;
-      # the embed paths demote markdown -> html first, so uploads still reconcile.
+      # Markdown detach is narrowed (not skipped): markdown creatives may carry
+      # legacy blobs attached directly but never embedded in the derived
+      # description (AttachmentBackfill skips markdown, so reconcile is their only
+      # touch point) — those must survive. But media the user actually removed
+      # in-editor WAS referenced in the prior description and no longer is; that
+      # must detach, or creative.files keeps listing a deleted file (the editor's
+      # purge DELETE can't compensate while the attachment still exists). So for
+      # markdown we detach only blobs that were previously referenced. HTML keeps
+      # full detach (backfill embeds its orphans, so none should linger).
       def reconcile_description_attachments
-        return if data&.dig("content_type") == "markdown"
         # Linked creatives don't own their description (it lives on the origin)
         # and their own column is blank, so reconcile would treat every legacy
         # attachment as an orphan and purge it on the next save (e.g. a
@@ -212,8 +274,16 @@ module Collavre
         current = files.includes(:blob).to_a
         current_blob_ids = current.map(&:blob_id).to_set
 
+        markdown = data&.dig("content_type") == "markdown"
         to_attach = referenced.reject { |b| current_blob_ids.include?(b.id) }
-        to_detach = current.reject { |a| referenced_ids.include?(a.blob_id) }
+        unreferenced = current.reject { |a| referenced_ids.include?(a.blob_id) }
+        to_detach =
+          if markdown
+            prev_referenced_ids = blob_ids_referenced_in(description_before_last_save)
+            unreferenced.select { |a| prev_referenced_ids.include?(a.blob_id) }
+          else
+            unreferenced
+          end
         return if to_attach.empty? && to_detach.empty?
 
         to_attach.each { |blob| files.attach(blob) }
@@ -266,9 +336,13 @@ module Collavre
       end
 
       def extract_signed_ids_from_description
-        return [] if description.blank?
+        extract_signed_ids_from(description)
+      end
 
-        html = description.to_s
+      def extract_signed_ids_from(html)
+        return [] if html.blank?
+
+        html = html.to_s
 
         ids = html.scan(%r{/rails/active_storage/blobs/(?:redirect|proxy)/([^/?#]+)}).flatten
         ids += html.scan(%r{/rails/active_storage/blobs/([^/?#]+)}).flatten
@@ -277,18 +351,29 @@ module Collavre
         ids.uniq
       end
 
+      # Blob ids that `html` references, resolving each signed id to its blob.
+      # Used to tell user-removed media (was referenced, now gone) apart from
+      # legacy orphans (never referenced) during markdown reconcile.
+      def blob_ids_referenced_in(html)
+        extract_signed_ids_from(html).filter_map do |sid|
+          ActiveStorage::Blob.find_signed(sid)&.id
+        rescue ActiveSupport::MessageVerifier::InvalidSignature, ActiveRecord::RecordNotFound
+          nil
+        end.to_set
+      end
+
       def description_cannot_change_if_has_origin
         if origin_id.present? && will_save_change_to_description?
           errors.add(:description, "cannot be changed directly when linked to an origin")
         end
       end
 
-      def description_cannot_change_if_github_source
+      def description_cannot_change_if_read_only_source
         return unless will_save_change_to_description?
-        return unless github_markdown?
-        return if @skip_github_validation
+        return unless read_only_source?
+        return if skip_read_only_source_validation
 
-        errors.add(:description, "cannot be changed directly for GitHub synced content")
+        errors.add(:description, I18n.t("collavre.creatives.errors.description_read_only_source"))
       end
     end
   end

data/app/models/collavre/creative/linkable.rb

@@ -7,6 +7,15 @@ module Collavre
         belongs_to :origin, class_name: "Collavre::Creative", optional: true
         has_many :linked_creatives, class_name: "Collavre::Creative", foreign_key: :origin_id, dependent: :destroy
 
+        # origin_id is immutable once a record is persisted. Permission
+        # resolution (PermissionChecker / PermissionFilter) treats a linked
+        # creative as its origin, and the permission cache has no invalidation
+        # path for a moved origin link. Promote the "origin_id is immutable"
+        # invariant from controller param-stripping to a model-level guard so
+        # no mutation path (mass-assignment, console, future controllers) can
+        # silently repoint a link and desync permissions.
+        attr_readonly :origin_id
+
         validate :origin_cannot_be_self
         before_validation :redirect_parent_to_origin
       end