unaltraweb 0.7.0 → 0.7.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 2ed24da568933de15be12350ea7b867a6aa7e14abac71ec303755f5b808e1837
-  data.tar.gz: a4176d255c14de252144d7669db6479bc43ee033342332cd596870eea1ddf71b
+  metadata.gz: acaf4cf39c6e712f16e9815d41d137e94972a0224fb685d19fe36c3f82a7a195
+  data.tar.gz: fc287067a780f72c8d51ec287a889767cdce5420557733aff7a5e988fa17e45a
 SHA512:
-  metadata.gz: 768943c9b012a7e165ab9136d364783203c35caaaae62c2715f95361107f63377dbac30e45252ebeff78b0707d71dd14eb0481cecca18f52b15688c82f4c8c10
-  data.tar.gz: 49edeb75312f6d45e53db50a55a65f25ddb81f7ad8cc8438c9568ada3c9d699c9c00f0a329ea9b8cc2fb5812b5e48acd254e0e967b659d16650a0ea8612dad16
+  metadata.gz: 98a42d39c19df577bb5c69b08d2b20abdfa283d38e18dbbd45239cd7a887f0c43615b3d5a5d614f77f37f309b92aaaed666a5b90863a23595ff1e03f91e15de4
+  data.tar.gz: 765b280a1315f2be24e6bfc6894d5dc9f394ce201ccce86d7a994a6643e518bc45aceec473fea77d2e5cd3bf647031ca1a4943a72c9470b8d6607c53f0843bb9

data/Makefile

@@ -1,9 +1,9 @@
 PYTHON ?= python3
 override PROJECT := $${MCP_CONSUMER_WORKSPACE:?MCP_CONSUMER_WORKSPACE is required}
 override PROJECT_ROOT := $(PROJECT)
-MCP_RUNTIME_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb:0.7.0
-MCP_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.7.0
-MCP_RELEASE_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-mcp@sha256:736c4ddd0a543454e3edaeac2e9cfd97a1279ce472923ac54e326c1281b2ba05
+MCP_RUNTIME_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb:0.7.2
+MCP_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.7.2
+MCP_RELEASE_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-mcp@sha256:6aa20cff86c3891a876e37ba0548fa36f3c5633c9f22ba672e9f50123d677cf6
 MCP_DOCKER_BUILD_NETWORK ?= default
 INIT_SITE_PROFILE ?= unaltreselfie
 NEW_WEB_PROFILE ?= unaltreselfie
@@ -40,14 +40,26 @@ WEB_CAPTURE_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-web-capture@sha256:0bf1b
 WEB_CAPTURE_DEV_IMAGE ?= unaltraweb-web-capture:dev
 WEB_CAPTURE_DOCKER_BUILD_NETWORK ?= default
 VEGAVISUALS_CLI ?=
-DOCKER_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb:0.7.0
-MANUAL_PDF_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:0ba267cb87f53ebaca4e31805fe00610cd61fdf97a8d2c3692f4655700dceaed
+DOCKER_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb:0.7.2
+MANUAL_PDF_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b
 MANUAL_PDF_DEV_IMAGE ?= unaltraweb-manual-pdf:dev
 MCP_SMOKE_MANUAL_PDF_IMAGE ?= $(MANUAL_PDF_IMAGE)
 MCP_SMOKE_PROJECT ?=
 override MCP_SMOKE_PROJECT := $(value MCP_SMOKE_PROJECT)
 export MCP_SMOKE_PROJECT
 MANUAL_PDF_LANG ?=
+PRACTICE_SOURCE ?=
+PRACTICE_VERSION ?=
+PRACTICE_RUN ?=
+PRACTICE_DRY_RUN ?= 0
+override PRACTICE_SOURCE := $(value PRACTICE_SOURCE)
+override PRACTICE_VERSION := $(value PRACTICE_VERSION)
+override PRACTICE_RUN := $(value PRACTICE_RUN)
+override PRACTICE_DRY_RUN := $(value PRACTICE_DRY_RUN)
+export PRACTICE_SOURCE PRACTICE_VERSION PRACTICE_RUN PRACTICE_DRY_RUN
+PRACTICE_EDITION_CONFIG ?=
+override PRACTICE_EDITION_CONFIG := $(value PRACTICE_EDITION_CONFIG)
+export PRACTICE_EDITION_CONFIG
 MANUAL_PDF_PUBLISH_DRY_RUN ?= 1
 MANUAL_PDF_CONFIRM_PUBLISH ?= 0
 MANUAL_PDF_PUBLICATION_INTENT_SHA256 ?=
@@ -97,6 +109,8 @@ SCIMAGO_ARGS += --input "$(SCIMAGO_INPUT)"
 endif
 
 .PHONY: distribution-check distribution-release-check distribution-doctor workflow-check wheel-check gem-check reproducible-site-check docs-build docs-serve docs-publish docs-down metrics-scimago-fetch metrics-update metrics-update-all metrics-check manual-pdf-image manual-pdf-image-dev manual-pdf-preflight manual-pdf-status manual-pdf-check manual-pdf-build manual-pdf-publish manual-pdf-publish-worker manual-pdf-sync manual-release-status manual-release-check manual-release-prepare manual-compute-status manual-compute-check manual-compute-render manual-compute-render-figures manual-compute-image-python manual-compute-image-r manual-compute-images manual-compute-rstudio compute-base-image-python compute-base-image-r web-capture-status web-capture-check web-capture-render web-capture-image visualization-status visualization-check visualization-render
+.PHONY: manual-practice-pdf-build
+.PHONY: manual-practice-compose
 .PHONY: mcp-runtime-image mcp-image mcp-build mcp-check mcp-smoke mcp-smoke-prebuilt mcp-stdio mcp-down mcp-down-all mcp-list-tools mcp-starter-templates mcp-new-web mcp-initialize-site mcp-site-context mcp-profile-check mcp-manual-source-quality-check mcp-manual-editorial-quality-check mcp-manual-authoring-capabilities mcp-manual-computation-status mcp-manual-computation-check mcp-manual-computation-render mcp-manual-computation-render-figures mcp-web-capture-status mcp-web-capture-check mcp-web-capture-render mcp-manual-pdf-status mcp-manual-pdf-build mcp-manual-pdf-preview-prepare mcp-manual-pdf-preview-clean mcp-manual-pdf-publish mcp-manual-release-status mcp-manual-release-check mcp-manual-release-prepare mcp-profile-prune-plan mcp-profile-prune mcp-content-inventory mcp-language-policy mcp-content-approval-inventory mcp-translation-plan mcp-bibliography-inventory mcp-bibliometrics-check mcp-build-health
 
 REPOSITORY_CONTEXT_TARGETS := distribution-doctor manual-compute-status manual-compute-check manual-compute-render manual-compute-render-figures manual-compute-image-python manual-compute-image-r manual-compute-images manual-compute-rstudio web-capture-status web-capture-check web-capture-render visualization-status visualization-check visualization-render manual-pdf-preflight manual-pdf-status manual-pdf-check manual-pdf-build manual-pdf-publish manual-pdf-sync manual-release-status manual-release-check manual-release-prepare metrics-scimago-fetch metrics-update metrics-update-all metrics-check
@@ -230,6 +244,14 @@ mcp-manual-pdf-status: ## Inspect manual PDF state for PROJECT
 mcp-manual-pdf-build: ## Build the manual PDF for PROJECT
 	@PYTHONPATH="$(CURDIR)/src" $(PYTHON) -m unaltraweb_mcp.cli --project "$(PROJECT)" mcp manual-pdf-build --language "$(MANUAL_PDF_LANG)"
 
+manual-practice-compose: export MANUAL_PDF_IMAGE := $(value MANUAL_PDF_IMAGE)
+manual-practice-compose: ## Compose private recipient ZIPs from a consumer edition configuration
+	@PYTHONPATH="$(CURDIR)/src" python3 -m unaltraweb_mcp.cli mcp manual-practice-compose --config "$${PRACTICE_EDITION_CONFIG}" $(if $(filter 1 true TRUE yes YES,$(PRACTICE_DRY_RUN)),--dry-run,)
+
+manual-practice-pdf-build: export MANUAL_PDF_IMAGE := $(value MANUAL_PDF_IMAGE)
+manual-practice-pdf-build: ## Build one private practice reading in a retained sandbox job
+	@PYTHONPATH="$(CURDIR)/src" $(PYTHON) "$(CURDIR)/scripts/manual/practice_pdf.py" --project "$(PROJECT)"
+
 mcp-manual-pdf-preview-prepare: ## Stage ignored PDF and cover copies for local Jekyll review
 	@PYTHONPATH="$(CURDIR)/src" $(PYTHON) -m unaltraweb_mcp.cli --project "$(PROJECT)" mcp manual-pdf-preview-prepare
 

data/docs/_documentation/en/33-reusable-workflows.md

@@ -45,9 +45,34 @@ For `unaltremanual`, the `latest` channel is a manual-only deployment from the r
 
 Clean package scaffolds include a manual GitHub Pages wrapper pinned to a reviewed workflow revision. It has no push deployment trigger: a maintainer runs it only after local checks/renders and human review. The optional integration template retains additional local publishing experiments, but generated sites do not publish from local validation targets.
 
-The `consumer_integration` object in `src/unaltraweb_mcp/component-contract.json` is the single source for the reviewed core revision, workflow path, attested manual PDF image digest, and Vega renderer revision. The scaffold renders that tuple atomically into `Gemfile`, `Gemfile.lock`, and the packaged caller. The caller passes the existing `reviewed_sha` input through to the provider, so the reviewed `main` source is checked independently at both caller and provider boundaries.
-
-This pin-only integration follows the required M -> D -> B order: D was built from M's permanent identity before the caller recorded either value. Repeat that order for future provider updates; never use `@main` or substitute a mutable/version-tagged image for D.
+The `consumer_integration` object in `src/unaltraweb_mcp/component-contract.json` is the single source for the reviewed core revision, workflow path and revision, attested manual PDF image digest, and Vega renderer revision. The scaffold renders that tuple atomically into `Gemfile`, `Gemfile.lock`, and the packaged caller. From 0.7.1, `site_deploy_workflow_sha` is independent of `core_sha`; older records default to their core pin. The caller passes the existing `reviewed_sha` input through to the provider, so the reviewed `main` source is checked independently at both caller and provider boundaries.
+
+The 0.7.1 deployment workflow reads the exact accepted PDF digest and its producer
+commit from the defining provider revision's `deployment_contract` in the BOM.
+It fetches bounded JSON from that immutable provider commit, independently of
+the consumer checkout. It checks the pulled image's revision label against that record, rather
+than assuming the worker and a later workflow revision share a commit. Unknown
+digests fail before Docker access. The reviewed records cover PDF workers 0.5.0
+and 0.6.0; extending them requires a provider review and published-worker tests.
+The records are data in the contract, rather than a release list embedded in the
+workflow program. Release readiness checks the selected workflow's code and own
+records; CI generates a caller and executes the workflow it actually references.
+
+A reviewed deployment-only workflow fix can therefore be pinned independently
+of the site's Gem/core revision while retaining an already-accepted PDF worker.
+Update the caller's `uses:` to the immutable corrected workflow commit, review
+that consumer change, and dispatch with the resulting reviewed `main` SHA. The
+existing Gem, PDF and Vega selections need not change for this workflow repair.
+Such a local caller override remains subject to normal scaffold-update conflict
+review. A later package release can incorporate its own reviewed integration tuple.
+Never use `@main` or a mutable/version-tagged image as a substitute for these pins.
+
+The 0.7.1 update plan recognizes the exact reviewed one-line issue-86 caller fix
+by both its original baseline hash and current content hash. It lists this as a
+`migrations` entry and requires the normal reviewed plan/atomic apply. Additional
+local edits still produce a conflict; authored content and unrelated files are
+preserved. This lets a known provider repair converge to the next managed tuple
+without treating arbitrary custom workflow code as package-owned.
 
 ## Stable manual releases
 

data/docs/_documentation/en/40-distribution.md

@@ -25,18 +25,56 @@ The template is the better place to validate gem consumption, centralized styles
 
 ## Component Contract
 
-### 0.7.0 D0 runtime increment
-
-The next containing runtime adds [live instance identity and session-scoped
+### Published 0.7.1 release
+
+[**0.7.1**](https://github.com/dosquartsdedocs/unaltraweb/releases/tag/v0.7.1)
+consolidates deployment compatibility into the package contract. Core and workflow
+pins are independent; the workflow reads its own revision's approved PDF producer
+records. CI exercises the caller generated by the package and checks that the
+selected core, controller and PDF agree on retained-document verifier bytes.
+
+The reviewed issue-86 one-line caller fix can migrate through the normal atomic
+scaffold update plan when its exact baseline and current hashes match. Additional
+author edits retain conflict review. Final installed-byte tests cover fresh and
+upgraded manuals, Carta relocation/PDF, live lifecycle and populated Bundler state.
+
+Artifact source: `ae5dab1d99804e7f73da82930199c1e2f3c08f61`.
+Core/workflow selection: `3332e0b93933f12317e05f1ce8d38ce80046feab`.
+Checkout MCP pin:
+`sha256:6aa20cff86c3891a876e37ba0548fa36f3c5633c9f22ba672e9f50123d677cf6`.
+The selected PDF 0.7.1 is
+`sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b`.
+Public downloads match the receipt. The
+[delivery report](https://github.com/dosquartsdedocs/unaltraweb/blob/main/docs/agents/owner-closeout-93.md)
+records the source/signing/publication chain and consumer acceptance scope.
+
+### Previous 0.7.0 release
+
+[**0.7.0**](https://github.com/dosquartsdedocs/unaltraweb/releases/tag/v0.7.0)
+adds [live instance identity and session-scoped
 resource control]({{ '/live-runtime/' | relative_url }}). Preparation is explicit,
 launch is pull-never, and startup identity remains distinct from current disk
 metadata. The owner-tested rendering closure selects Diavisuals 0.5.0 and Vega
 0.5.1 with exact artifacts; old 0.4.0 static receipts remain integrity-checked.
-Diavisuals' separate live-process identity correction still gates the full
-managed coordinator closure. Publication and activation evidence belong to the
-[D0 owner record](https://github.com/dosquartsdedocs/unaltraweb/blob/main/docs/agents/d0-runtime-identity.md).
-
-### Published 0.6.0 release
+The selected Diavisuals 0.5.0 lacks full live-process identity. The provider's
+[0.6.0 correction](https://github.com/dosquartsdedocs/diavisuals/releases/tag/v0.6.0)
+is published, but remains outside this tested Web combination. Full managed
+coordinator acceptance requires composing-owner validation and a new reviewed
+helper selection.
+
+Gem, wheel, base runtime and MCP were produced from
+`b44818c67eecef159f7aa0f825b0416cd511bc43`; receipt integration and tag target
+`9fc84ac7fd01c78c6fe15fe862beb6a5d1633a9e` bind the same-source candidates.
+That release's post-release checkout launcher selected
+`sha256:b84cdb404ba7bab5ff0b14fa8a7ee93d7293e829cf32e28ff0dacaa8afff4677`.
+Signed-byte D0 acceptance, the retained-letter relocation/rebuild and all four
+populated Bundler roundtrips passed. Public downloads match the receipt.
+The [delivery report](https://github.com/dosquartsdedocs/unaltraweb/blob/main/docs/agents/owner-closeout-85.md)
+records exact identities and the remaining gates; the
+[D0 owner contract](https://github.com/dosquartsdedocs/unaltraweb/blob/main/docs/agents/d0-runtime-identity.md)
+defines the native API and lifecycle scopes.
+
+### Previous 0.6.0 release
 
 [**0.6.0**](https://github.com/dosquartsdedocs/unaltraweb/releases/tag/v0.6.0)
 delivers native [retained-letter import]({{ '/retained-documents/' | relative_url }}).
@@ -51,7 +89,7 @@ The PDF worker changes to include complete retained documents and the same
 integrity checkers used by its controller. Computation, capture and visual
 companions retain their tested 0.4.0 selections.
 
-The post-release checkout launcher selects published MCP digest
+That release's post-release checkout launcher selected MCP digest
 `sha256:736c4ddd0a543454e3edaeac2e9cfd97a1279ce472923ac54e326c1281b2ba05`.
 Signed candidates, protected CI, strict receipt/ancestry gates, registry promotion
 and Trusted Publishing passed. Anonymous downloads match the receipt. The
@@ -106,25 +144,25 @@ candidate, receipt, tag and package evidence.
 
 The BOM is an interoperability contract, not a bundle. The wheel contains its Python control/inspection modules, schema/BOM, clean package-owned scaffolds and a small host Docker launcher, described below. It does not include Ruby theme assets, Docker image layers, the factory's build/worker implementations, TeX, Chromium, computation environments, `diavisuals`, or `vegavisuals`.
 
-The selected public core release is `0.6.0`; earlier distributions remain immutable. Its BOM reuses immutable PDF, compute and web-capture worker digests and selects published `diavisuals v0.4.0` and `vegavisuals v0.4.0` through SHA-256-pinned wheel URLs. Companion references can describe either a provider/release-matching Git reference or a provider/release/version-matching wheel with its content hash. The wheel boundary remains external. The scaffold's Vega revision is the published `68c0b231402ae9485cc34ce530dc5239cb0ec194` commit. `distribution-check` validates structural integrity for normal CI. `distribution-release-check` blocks coordinated publication while any component is `pending` or `unavailable`; reviewed source authorized to produce final same-commit candidates is `ready`, while an already-published component is `released`. Final receipt values remain immutable after publication.
+The selected public core release is `0.7.1`; earlier distributions remain immutable. Its BOM selects the verified PDF 0.7.1 specialization, reuses immutable compute and web-capture worker digests and selects published `diavisuals v0.5.0` and `vegavisuals v0.5.1` through SHA-256-pinned wheel URLs. Companion references can describe either a provider/release-matching Git reference or a provider/release/version-matching wheel with its content hash. The wheel boundary remains external. The scaffold's Vega revision is the published `a448cc50a5f511743a6fcfc213baeb9be80f4a27` commit. `distribution-check` validates structural integrity for normal CI. `distribution-release-check` blocks coordinated publication while any component is `pending` or `unavailable`; reviewed source authorized to produce final same-commit candidates is `ready`, while an already-published component is `released`. Final receipt values remain immutable after publication.
 
 ## Docker-First Hybrid Policy
 
-### 0.6.0 component selection
+### 0.7.1 component selection
 
-The coordinated core identity is **0.6.0**: gem, wheel, base runtime and MCP
+The coordinated core identity is **0.7.1**: gem, wheel, base runtime and MCP
 images were published together. The installed host launcher and runtime-aware
 generated Bundler state are included. The PDF worker uses its reviewed, signed
-0.6.0 digest, alongside the 0.4.0 computation/capture workers and visual
-companions. A released PDF can be reused only by full digest; new/pending workers
-still require the coordinated version. The historical 0.5.0 receipt remains
-unchanged. Signed image/package evidence is recorded in the 0.6.0 receipt;
+0.7.1 digest, alongside the 0.4.0 computation/capture workers and the accepted
+Diavisuals 0.5.0 / Vega 0.5.1 rendering combination. A released PDF can be reused
+only by full digest; new/pending workers still require the coordinated version.
+Earlier receipts remain unchanged. Signed image/package evidence is recorded in the 0.7.1 receipt;
 promotion and anonymous-download checks passed before the post-release launcher
 pin was advanced.
 
 ### Local delivery
 
-GHCR is the canonical delivery channel for normal local use. The released package scaffold selects `ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.6.0`; existing sites can remain on their immutable previous release until deliberately updated. Its `make build`, `make serve` and `make test` targets mount the thin child site and run inside that image. The image contains both the installed Python control plane and the reviewed factory source at `/opt/unaltraweb`, so those targets load the theme as a path gem without downloading PyPI or RubyGems packages.
+GHCR is the canonical delivery channel for normal local use. The released package scaffold selects `ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.7.1`; existing sites can remain on their immutable previous release until deliberately updated. Its `make build`, `make serve` and `make test` targets mount the thin child site and run inside that image. The image contains both the installed Python control plane and the reviewed factory source at `/opt/unaltraweb`, so those targets load the theme as a path gem without downloading PyPI or RubyGems packages.
 
 Factory registration uses a stricter pin. gContExt runs `mcp-build`, which inspects or pulls the full `MCP_RELEASE_IMAGE` digest, and `mcp-stdio` launches that exact image. Checkout builds use local `:dev` names by default through `mcp-image`, `mcp-check` and `mcp-smoke`, so they do not shadow public semver references unless a maintainer explicitly overrides them. The digest is advanced in a separate post-release change after each new receipt exists; candidate source continues to select the last completed release instead of attempting to embed an unknown self-digest.
 
@@ -154,7 +192,7 @@ unaltraweb-mcp-docker serve --project /absolute/consumer
 ```
 
 The installed default selects its package's full MCP release image, currently
-`ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.6.0`. It resolves that selection to the
+`ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.7.1`. It resolves that selection to the
 local immutable image ID before executing. The checkout's `MCP_RELEASE_IMAGE`
 is a separate digest pin advanced only after publication; it is not the installed
 wheel's default. This avoids sending a new package back to an older MCP while
@@ -299,7 +337,7 @@ For that reason:
 
 ## Docker Runtime
 
-Release `0.6.0` publishes the selected base/MCP runtime and packages while pinning the verified PDF worker and reusing unchanged specialized workers. Local maintainers continue to use explicit development names such as `unaltraweb:dev`; generated sites select the reviewed semver MCP image rather than `main` or `latest`.
+Release `0.7.1` publishes the selected base/MCP runtime and packages while pinning the verified PDF worker and reusing unchanged specialized workers. Local maintainers continue to use explicit development names such as `unaltraweb:dev`; generated sites select the reviewed semver MCP image rather than `main` or `latest`.
 
 The base runtime owns Ruby, Jekyll and system dependencies. The MCP image builds on its exact candidate digest and adds the full reviewed factory plus the Python package. Specialized workers remain separate. This keeps each layer focused without adding Chromium, TeX or computation stacks to every site; the coordinated core-image workflow still rebuilds and verifies runtime, MCP and manual PDF candidates together.
 

data/docs/_documentation/en/43-workspace-path-policies.md

@@ -43,6 +43,9 @@ which is not evidence that a future Git repository is compliant.
 | --- | --- | --- | --- | --- |
 | `_site` | directory | jekyll-build-output | ignored | disposable |
 | `tmp` | directory | build-staging-and-local-release-evidence | ignored | explicit |
+| `practiques` | directory | private-practice-sources | versioned | never |
+| `sandbox/practiques` | directory | retained-private-practice-jobs | ignored | explicit |
+| `dist/practiques` | directory | private-practice-deliveries | ignored | explicit |
 | `.cache/scimago` | directory | external-bibliometrics-input-cache | ignored | explicit |
 | `.cache/unaltraweb/manual-pdf-publication-intent.json` | file | pdf-publication-recovery-intent | ignored | explicit |
 | `.cache/unaltraweb/manual-pdf-publication.json` | file | pdf-publication-provenance | ignored | explicit |
@@ -84,6 +87,16 @@ identity; it is generated metadata, not a disposable execution lock. Consumers
 usually version it with generated Markdown/figures, but this rollout does not
 force that choice.
 
+Practice source control and web exclusion are separate checks. A manual using
+`practiques/` must exclude `practiques/`, `sandbox/` and `dist/` from Jekyll;
+`profile_check` rejects missing exclusions and conflicting explicit includes.
+New manual scaffolds provide these exclusions. Existing sites retain their
+configuration during scaffold synchronization, so review this small configuration
+addition in the consumer workspace. The shared ignore template covers
+`sandbox/` and `dist/practiques/`; local conflicts still stop synchronization.
+Retained practice jobs and deliveries require explicit preservation decisions,
+even when they can be regenerated.
+
 ## PDF Recovery Is Not Disposable Cache
 
 `src/unaltraweb_mcp/manual_pdf_preview.py` owns the five fixed PDF-state paths:

data/docs/_documentation/en/46-live-runtime.md

@@ -14,7 +14,8 @@ permalink: /live-runtime/
 nav_title: Live Runtime
 ---
 
-The 0.7.0 runtime increment distinguishes the process serving a connection from
+The [published 0.7.0 runtime](https://github.com/dosquartsdedocs/unaltraweb/releases/tag/v0.7.0)
+distinguishes the process serving a connection from
 the installed package, source checkout and rendering workers. Call
 `runtime_identity` or read `web://runtime-identity` through that live MCP
 connection. Both report the same backend instance and startup information.
@@ -83,7 +84,9 @@ observations without running a renderer.
 Visual helpers are separate MCP processes. Their versions and immutable package
 selections describe the accepted rendering closure, not their current live
 instances. The composing controller must obtain each helper's own live identity.
-The selected Diavisuals 0.5.0 still requires its separately tracked D0 identity
-correction before the entire coordinator closure can be marked managed-ready.
+The selected Diavisuals 0.5.0 lacks full live-process identity. Diavisuals 0.6.0
+publishes the provider correction, but is outside unaltraweb 0.7.0's tested helper
+combination. Composing-owner compatibility validation and a new reviewed selection
+are required before accepting that corrected helper in the managed closure.
 Existing 0.4.0 static provider receipts remain subject to full integrity checks
 and do not force regeneration of authored figures during an upgrade.

data/docs/_documentation/en/47-private-practice-pdfs.md

@@ -0,0 +1,130 @@
+---
+title: Private Practice PDFs
+description: Build landscape practice readings with shared manual typography, course metadata and retained private outputs.
+lang: en
+ref: private_practice_pdfs
+profiles:
+- unaltredocs
+documentation_profiles:
+- core-developers
+section: Core Development
+weight: 665
+permalink: "/private-practice-pdfs/"
+nav_title: Practice PDFs
+---
+
+The `manual_practice_pdf_build` tool creates a private A4-landscape reading from
+one Markdown source. It uses the manual's typography and site metadata, including
+the course name, degree, instructors and configured logos. The first page includes
+the course codes in parentheses beside the subject and the practice version.
+The academic year is omitted. Logos appear only on the first page.
+
+## Prepare a reading
+
+Keep editable sources in the manual repository:
+
+```text
+practiques/accessibility/ca/alumnat/LLEGIU-ME.md
+practiques/accessibility/ca/docent/LLEGIU-ME.md
+```
+
+Use `LEEME.md` for Spanish and `README.md` for English. The language must be
+enabled in the site configuration. `alumnat` and `docent` identify separate
+readings; the tool does not infer or produce a teacher solution.
+
+```markdown
+---
+title: Compare two routes
+lang: en
+content_status: draft
+---
+
+# Open the project
+
+1. Open the prepared project.
+2. Compare the routes between the same origin and destination.
+
+![The two routes on the same map](assets/img/routes.png "Open and closed crossing scenarios")
+
+| Scenario | Crossing |
+| --- | --- |
+| Open | Available |
+| Closed | Unavailable |
+
+Table: Conditions used in each scenario.
+```
+
+The initial reading format supports ordinary Pandoc Markdown, links, maths,
+fenced code, captioned tables and standalone PNG, JPEG or PDF images. Image paths
+are project-relative, with a fallback to the source directory. Absolute paths,
+parent traversal, symlinks and remote images are rejected. Render other visual
+formats through their owning provider and select a printable output first.
+Liquid, manual-only component wrappers and automatic bibliography assembly are
+not part of this standalone reading format.
+
+Figures keep their original proportions and fit the usable page automatically.
+Their captions are measured before allocating image height. A complete figure
+moves to the next page when it cannot fit; it is not reduced to fill a small
+space at the bottom. Tables are centred, with repeated headers and captions on
+continued pages. Review long tables and dense screenshots at the intended size.
+
+## Keep the material private
+
+Merge these entries into the existing `exclude` list in `_config.yml`:
+
+```yaml
+exclude:
+  - practiques/
+  - sandbox/
+  - dist/
+```
+
+Keep the existing exclusions. Add `sandbox/practiques/` and `dist/practiques/`
+to `.gitignore` if broader rules do not already cover them. Version the editable
+practice sources. Git ignore rules do not exclude files from Jekyll by themselves.
+The profile check rejects missing web exclusions when practice sources exist.
+
+## Build with MCP or the CLI
+
+Use a runtime whose tool inventory advertises `manual_practice_pdf_build`.
+Existing connections keep their loaded code until the client reconnects to an
+updated runtime. Prepare the selected PDF image explicitly before the first run.
+
+```text
+manual_practice_pdf_build(
+  source="practiques/accessibility/en/alumnat/README.md",
+  version="2026-10-r1"
+)
+```
+
+The equivalent factory-backed CLI command is:
+
+```bash
+unaltraweb-mcp --project "$PWD" mcp manual-practice-pdf-build \
+  --source practiques/accessibility/en/alumnat/README.md \
+  --version 2026-10-r1
+```
+
+Use `--dry-run` for a read-only plan. `--run review-2` selects a named review or
+retry while retaining an earlier attempt. The result gives the PDF, first-page
+preview, receipt and job paths under `sandbox/practiques/<slug>/`.
+
+For a maintainer testing a core checkout, the corresponding factory target is:
+
+```bash
+MCP_CONSUMER_WORKSPACE="$PWD" make -C /path/to/unaltraweb \
+  manual-practice-pdf-build \
+  PRACTICE_SOURCE=practiques/accessibility/en/alumnat/README.md \
+  PRACTICE_VERSION=2026-10-r1
+```
+
+The worker runs without network access, with a read-only input snapshot and one
+writable output directory. A repeated request verifies and reuses an unchanged
+sealed job. Changed inputs produce another job; edited or incomplete attempts
+are retained. Updating only the MCP package version does not invalidate a reading
+whose effective inputs and rendering controls are unchanged.
+
+The command returns `publishes: false`. Review the PDF before distributing it.
+Practice versions are independent of the manual's `latest` or stable release
+selectors. Compiling a reading does not analyse GIS data, assemble Moodle ZIPs,
+upload files or publish material on the website.

data/docs/agents/consolidation-0.7.2.md

@@ -0,0 +1,97 @@
+# Web #98 / gaContExt #32 — 0.7.2 source checkpoint
+
+This is a draft consolidation, not a published release or an installed 0.7.2
+cohort. It includes private reading/PDF composition, portable bindings and author
+resources, independent PDF/ZIP delivery, the host reaper correction, the shared
+source-CI control, and preparation of runtime archives for the existing hub loader.
+Earlier candidate reports describe their historical checkpoints; their source
+snapshots, images, wheels, receipts and retained evidence remain unchanged.
+
+**Current private-runtime decision:** QGIS 0.6.0 is released but private. The earlier
+wheel-install plan below is superseded by [native private-runtime delegation](private-practice-verifier-98.md).
+Public Web builds now contain only the Web bridge/metadata; the hub prepares the
+private QGIS controller. No published/private wheel is downloaded into Web.
+The three independent review P2 findings are reproduced and corrected in this
+source delta; a new source review and independent runtime check are still required
+on its committed HEAD. The H2 contract declares the private producer's hash-bound
+`release.json` externally; public runtime archives contain only Web-only and PDF
+images. Local acceptance and the external receipt are documented in the linked
+bridge and archive contracts.
+
+## Blockers recorded at the original draft checkpoint
+
+The first two entries describe the superseded installer plan at `88dd2518`, not
+current requirements to make QGIS public or embed its wheel:
+
+- The final **published QGIS wheel URL and SHA-256 are still missing**. The owner
+  reports prepared source `a660dfa54ea6bc6cf5d3d3fbeb12593f62c726e1` and wheel
+  `dde653f7a719d8dbb20b4471e3cdb7f9c99cbdfcb116647caba5a08e710c7b76`
+  pending re-review. This is not an accepted published pin and is not installed
+  or inserted into the BOM by this checkpoint.
+- `Dockerfile.mcp` deliberately refuses its verifier installation until that
+  released owner component is declared. Docker CI may stop at this gate; no
+  check, job or refusal is disabled to manufacture a green result.
+- Select the new permanent reviewed core commit after integration. The current
+  `consumer_integration.core_sha` remains the previous reviewed `3332e0b…`
+  point during this draft, not a claim that it already contains the new tools.
+- Final same-source package/image candidates, their acceptance and a new
+  receipt-only release checkpoint remain pending. `release-candidates.json`
+  still belongs to published 0.7.1 and is not a 0.7.2 authorization.
+
+The coordinated gem/wheel/runtime/MCP declarations now name **0.7.2**. Nothing
+re-emits 0.7.1 with new bytes. The checkout launcher and source-checker lane keep
+their previously published MCP digest until a new published digest is reviewed.
+
+## Preserved tuple
+
+- Workflow: `3332e0b93933f12317e05f1ce8d38ce80046feab`.
+- PDF 0.7.1:
+  `ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b`.
+- Actual PDF producer: `b7ec1d7a139c65b3b0b88699cdbeb19080f13be1`.
+- PDF configuration ID:
+  `sha256:618163d3f924439792b2306617bd9612f566c5881166102fa544b4e782d569fa`.
+- All nine retained-document checkers remain byte-identical to the reviewed
+  core/PDF point. Diavisuals/Vega compatibility is not widened.
+
+## Reproducibility and retained evidence
+
+The publishable wheel carries the source-CI runner, policy schema, common workflow
+template and native private-runtime bridge/descriptor. The normal MCP image runs
+the factory-owned compositor/scripts and delegates verification to the prepared
+private QGIS controller. Neither public entrypoint requires consumers to copy
+generic code or inspect a mutable provider checkout.
+
+`prepare_practice_candidate.py`, `prepare_practice_editions_candidate.py` and
+their pinned rc fixture defaults are historical acceptance/preparation tools.
+They do not replace the normal release pipeline, and their old local candidates
+must not be regenerated or relabelled as the final release. Archived source and
+image hashes identify those exact historical bytes.
+
+Source-CI/composition tests and synthetic fixture recipes are versioned here.
+Datasets, rendered PDFs/ZIPs, Docker-save archives and retained job outputs stay
+outside Git. Detailed evidence and transfer hashes are recorded in:
+
+- [Practice editions and bindings](practice-editions-98.md).
+- [Runtime archives and independent PDF producer identity](practice-runtime-archives-98.md).
+- [Shared public-source CI](source-ci-98.md).
+- [Installable practice-PDF acceptance](practice-pdf-installable-98.md).
+
+The source validation before this version declaration passed 706 tests
+(679 passed / 27 optional skips), fresh-wheel installation, source/workflow
+checks and native bounded source-checker execution. After declaring 0.7.2,
+the suite passes 706 cases (678 passed / 28 skips): the additional skipped
+Docker mount-parser test requires the not-yet-prepared 0.7.2 MCP image. It was
+not redirected to an older image to claim a new-runtime pass. A fresh 0.7.2 wheel
+build/install and distribution/workflow/whitespace checks passed at that original
+checkpoint; its publication readiness was false because the QGIS pin was absent.
+
+The later private-runtime/P2 checkpoint passes **720 tests (692 passed / 28
+skips)** and fresh-wheel installation. Native local evidence verifies Web package
+absence, v1/v2 delegation, sealed PDF/ZIP pairs, selected-resource-only engine
+mounts and exact teardown. Distribution metadata is now structurally ready while
+private checks remain explicitly `not_run` in public CI. The final source's hosted
+CI and independent re-review are tracked on PR #104; local evidence is not
+relabeled as those gates. The receipt-only H2 addition leaves executable bytes and
+selected image/schema identities unchanged, so retained native renders are reused.
+None of this publishes or approves the manuals' draft teaching content. W1 draft
+PR #103 is outside this consolidation.

data/docs/agents/d0-runtime-identity.md

@@ -6,6 +6,11 @@ Requirements: gaContExt
 Owner issue: [85](https://github.com/dosquartsdedocs/unaltraweb/issues/85).
 Coordination: [gaContExt 15](https://github.com/dosquartsdedocs/gacontext/issues/15).
 
+Delivery: [0.7.0 is published](https://github.com/dosquartsdedocs/unaltraweb/releases/tag/v0.7.0).
+The [signed-byte delivery report](owner-closeout-85.md) supersedes the chronological
+development/candidate state below. It retains the full managed-closure blocker and
+the partial legacy identity gate; publication alone does not close them.
+
 ## Native API mapping
 
 The containing 0.7.0 increment adds `runtime_identity` and
@@ -82,6 +87,14 @@ does not authorize removal. `reap-session` preserves a live backend or running
 job, and recovers only that retired session's idle resources. Occupied or foreign
 networks fail closed. No fresh-helper PID is presented as the backend's PID.
 
+Exited-resource recovery compares complete Docker observations while canonicalizing
+only the order of mount records. Every mount field, field type and duplicate record
+remains significant; a real identity/state/mount change still refuses removal.
+Removal failure or timeout is reported separately from observation drift, and
+the exact container ID must be absent before release is confirmed. This recovery
+code runs in the installed host adapter: selecting a controller image does not
+update an already installed adapter.
+
 The legacy `down` / `make mcp-down` is an explicit **workspace-wide** shutdown;
 `mcp-down-all` is maintainer/factory-wide. Neither is the hub's per-client toggle
 operation. The managed sequence is live drain, close this transport, inspect its
@@ -96,7 +109,7 @@ release while a job continues.
 
 ## Accepted visual-helper points and remaining closure blocker
 
-The candidate selects the published Diavisuals 0.5.0 and Vega 0.5.1 packages:
+Release 0.7.0 selects the published Diavisuals 0.5.0 and Vega 0.5.1 packages:
 
 | Helper | Wheel SHA-256 | Renderer configuration ID |
 | --- | --- | --- |
@@ -118,10 +131,14 @@ by this source change.
 
 The coordinator does not claim to observe another MCP's serving process. Its live
 identity returns the helper selections and requires their independent connection
-observations. **Diavisuals 0.5.0 still lacks the full live-instance identity**;
-[Diavisuals 14](https://github.com/dosquartsdedocs/diavisuals/issues/14) is therefore
-an external D0 managed-closure blocker. Rendering compatibility alone does not
-close that gate or make the whole coordinator dependency graph managed-ready.
+observations. **Selected Diavisuals 0.5.0 lacks the full live-instance identity**.
+[Diavisuals 14](https://github.com/dosquartsdedocs/diavisuals/issues/14#issuecomment-5987114002)
+already records the provider correction in published **0.6.0**; the issue remains
+open for intake. That newer provider is outside unaltraweb 0.7.0's tested helper
+point. The remaining gate is composing-owner compatibility acceptance and a new
+reviewed selection of the corrected helper, followed by independent live
+observations. It is not an unpublished provider implementation. Rendering
+compatibility alone does not make the coordinator dependency graph managed-ready.
 
 ## Acceptance and delivery state