unaltraweb 0.7.1 → 0.7.3

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5697f730a670b00edc9d6cda6bb653552470c6c58667d27557e33309203f552c
-  data.tar.gz: 1fb32fa043262eca9724aed6dc0184246bc6012f2a6261037f03203ef1265945
+  metadata.gz: c5280a9154aff314292e2929ee157d6a2ebc7b2ab2b292cf9f7d995f3f147922
+  data.tar.gz: ad96a399ed437469d747634a7b5d69aa2958794e5f38395511b811ca99befd40
 SHA512:
-  metadata.gz: d43c24786b83d17e9cf8cc238eb12227a3d46581fbc550468c95549f9061cd60b6eb4681021855e646929ca41f6b51de850e2db183d956dfd72876b6e48a8a2e
-  data.tar.gz: 15c574473f3c71b81b624b08bf4767902deebfc5f0164abc668f43dae6f33f9a0eb8c4a45e1d734a03bd4540b42b81d4e0a77aa8f42ae46566e7cd81cf7af19f
+  metadata.gz: bfe3e85558161e19ae69988d40d78179a18ea418d6d932597dfeadb82bbfbfaab5d9d3c8847b0b6245f05ef26bd732dd548dc459e46f674556f10ffa1d977bd1
+  data.tar.gz: 6d1fc3cb0ba53b7c6e780bc43f7a93c2c1ca55b3ffa9bab9da773d20f9c56410dedd12f49cb9cfd6e2c529088b76c79a74bf94dbd30abb1dd2982a45ee4866a1

data/Makefile

@@ -1,9 +1,9 @@
 PYTHON ?= python3
 override PROJECT := $${MCP_CONSUMER_WORKSPACE:?MCP_CONSUMER_WORKSPACE is required}
 override PROJECT_ROOT := $(PROJECT)
-MCP_RUNTIME_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb:0.7.1
-MCP_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.7.1
-MCP_RELEASE_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-mcp@sha256:b84cdb404ba7bab5ff0b14fa8a7ee93d7293e829cf32e28ff0dacaa8afff4677
+MCP_RUNTIME_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb:0.7.3
+MCP_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.7.3
+MCP_RELEASE_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-mcp@sha256:6aa20cff86c3891a876e37ba0548fa36f3c5633c9f22ba672e9f50123d677cf6
 MCP_DOCKER_BUILD_NETWORK ?= default
 INIT_SITE_PROFILE ?= unaltreselfie
 NEW_WEB_PROFILE ?= unaltreselfie
@@ -40,7 +40,7 @@ WEB_CAPTURE_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-web-capture@sha256:0bf1b
 WEB_CAPTURE_DEV_IMAGE ?= unaltraweb-web-capture:dev
 WEB_CAPTURE_DOCKER_BUILD_NETWORK ?= default
 VEGAVISUALS_CLI ?=
-DOCKER_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb:0.7.1
+DOCKER_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb:0.7.3
 MANUAL_PDF_IMAGE ?= ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b
 MANUAL_PDF_DEV_IMAGE ?= unaltraweb-manual-pdf:dev
 MCP_SMOKE_MANUAL_PDF_IMAGE ?= $(MANUAL_PDF_IMAGE)
@@ -48,6 +48,18 @@ MCP_SMOKE_PROJECT ?=
 override MCP_SMOKE_PROJECT := $(value MCP_SMOKE_PROJECT)
 export MCP_SMOKE_PROJECT
 MANUAL_PDF_LANG ?=
+PRACTICE_SOURCE ?=
+PRACTICE_VERSION ?=
+PRACTICE_RUN ?=
+PRACTICE_DRY_RUN ?= 0
+override PRACTICE_SOURCE := $(value PRACTICE_SOURCE)
+override PRACTICE_VERSION := $(value PRACTICE_VERSION)
+override PRACTICE_RUN := $(value PRACTICE_RUN)
+override PRACTICE_DRY_RUN := $(value PRACTICE_DRY_RUN)
+export PRACTICE_SOURCE PRACTICE_VERSION PRACTICE_RUN PRACTICE_DRY_RUN
+PRACTICE_EDITION_CONFIG ?=
+override PRACTICE_EDITION_CONFIG := $(value PRACTICE_EDITION_CONFIG)
+export PRACTICE_EDITION_CONFIG
 MANUAL_PDF_PUBLISH_DRY_RUN ?= 1
 MANUAL_PDF_CONFIRM_PUBLISH ?= 0
 MANUAL_PDF_PUBLICATION_INTENT_SHA256 ?=
@@ -97,6 +109,8 @@ SCIMAGO_ARGS += --input "$(SCIMAGO_INPUT)"
 endif
 
 .PHONY: distribution-check distribution-release-check distribution-doctor workflow-check wheel-check gem-check reproducible-site-check docs-build docs-serve docs-publish docs-down metrics-scimago-fetch metrics-update metrics-update-all metrics-check manual-pdf-image manual-pdf-image-dev manual-pdf-preflight manual-pdf-status manual-pdf-check manual-pdf-build manual-pdf-publish manual-pdf-publish-worker manual-pdf-sync manual-release-status manual-release-check manual-release-prepare manual-compute-status manual-compute-check manual-compute-render manual-compute-render-figures manual-compute-image-python manual-compute-image-r manual-compute-images manual-compute-rstudio compute-base-image-python compute-base-image-r web-capture-status web-capture-check web-capture-render web-capture-image visualization-status visualization-check visualization-render
+.PHONY: manual-practice-pdf-build
+.PHONY: manual-practice-compose
 .PHONY: mcp-runtime-image mcp-image mcp-build mcp-check mcp-smoke mcp-smoke-prebuilt mcp-stdio mcp-down mcp-down-all mcp-list-tools mcp-starter-templates mcp-new-web mcp-initialize-site mcp-site-context mcp-profile-check mcp-manual-source-quality-check mcp-manual-editorial-quality-check mcp-manual-authoring-capabilities mcp-manual-computation-status mcp-manual-computation-check mcp-manual-computation-render mcp-manual-computation-render-figures mcp-web-capture-status mcp-web-capture-check mcp-web-capture-render mcp-manual-pdf-status mcp-manual-pdf-build mcp-manual-pdf-preview-prepare mcp-manual-pdf-preview-clean mcp-manual-pdf-publish mcp-manual-release-status mcp-manual-release-check mcp-manual-release-prepare mcp-profile-prune-plan mcp-profile-prune mcp-content-inventory mcp-language-policy mcp-content-approval-inventory mcp-translation-plan mcp-bibliography-inventory mcp-bibliometrics-check mcp-build-health
 
 REPOSITORY_CONTEXT_TARGETS := distribution-doctor manual-compute-status manual-compute-check manual-compute-render manual-compute-render-figures manual-compute-image-python manual-compute-image-r manual-compute-images manual-compute-rstudio web-capture-status web-capture-check web-capture-render visualization-status visualization-check visualization-render manual-pdf-preflight manual-pdf-status manual-pdf-check manual-pdf-build manual-pdf-publish manual-pdf-sync manual-release-status manual-release-check manual-release-prepare metrics-scimago-fetch metrics-update metrics-update-all metrics-check
@@ -230,6 +244,14 @@ mcp-manual-pdf-status: ## Inspect manual PDF state for PROJECT
 mcp-manual-pdf-build: ## Build the manual PDF for PROJECT
 	@PYTHONPATH="$(CURDIR)/src" $(PYTHON) -m unaltraweb_mcp.cli --project "$(PROJECT)" mcp manual-pdf-build --language "$(MANUAL_PDF_LANG)"
 
+manual-practice-compose: export MANUAL_PDF_IMAGE := $(value MANUAL_PDF_IMAGE)
+manual-practice-compose: ## Compose private recipient ZIPs from a consumer edition configuration
+	@PYTHONPATH="$(CURDIR)/src" python3 -m unaltraweb_mcp.cli mcp manual-practice-compose --config "$${PRACTICE_EDITION_CONFIG}" $(if $(filter 1 true TRUE yes YES,$(PRACTICE_DRY_RUN)),--dry-run,)
+
+manual-practice-pdf-build: export MANUAL_PDF_IMAGE := $(value MANUAL_PDF_IMAGE)
+manual-practice-pdf-build: ## Build one private practice reading in a retained sandbox job
+	@PYTHONPATH="$(CURDIR)/src" $(PYTHON) "$(CURDIR)/scripts/manual/practice_pdf.py" --project "$(PROJECT)"
+
 mcp-manual-pdf-preview-prepare: ## Stage ignored PDF and cover copies for local Jekyll review
 	@PYTHONPATH="$(CURDIR)/src" $(PYTHON) -m unaltraweb_mcp.cli --project "$(PROJECT)" mcp manual-pdf-preview-prepare
 

data/docs/_documentation/en/40-distribution.md

@@ -25,7 +25,30 @@ The template is the better place to validate gem consumption, centralized styles
 
 ## Component Contract
 
-### Published 0.7.0 release
+### Published 0.7.1 release
+
+[**0.7.1**](https://github.com/dosquartsdedocs/unaltraweb/releases/tag/v0.7.1)
+consolidates deployment compatibility into the package contract. Core and workflow
+pins are independent; the workflow reads its own revision's approved PDF producer
+records. CI exercises the caller generated by the package and checks that the
+selected core, controller and PDF agree on retained-document verifier bytes.
+
+The reviewed issue-86 one-line caller fix can migrate through the normal atomic
+scaffold update plan when its exact baseline and current hashes match. Additional
+author edits retain conflict review. Final installed-byte tests cover fresh and
+upgraded manuals, Carta relocation/PDF, live lifecycle and populated Bundler state.
+
+Artifact source: `ae5dab1d99804e7f73da82930199c1e2f3c08f61`.
+Core/workflow selection: `3332e0b93933f12317e05f1ce8d38ce80046feab`.
+Checkout MCP pin:
+`sha256:6aa20cff86c3891a876e37ba0548fa36f3c5633c9f22ba672e9f50123d677cf6`.
+The selected PDF 0.7.1 is
+`sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b`.
+Public downloads match the receipt. The
+[delivery report](https://github.com/dosquartsdedocs/unaltraweb/blob/main/docs/agents/owner-closeout-93.md)
+records the source/signing/publication chain and consumer acceptance scope.
+
+### Previous 0.7.0 release
 
 [**0.7.0**](https://github.com/dosquartsdedocs/unaltraweb/releases/tag/v0.7.0)
 adds [live instance identity and session-scoped
@@ -42,7 +65,7 @@ helper selection.
 Gem, wheel, base runtime and MCP were produced from
 `b44818c67eecef159f7aa0f825b0416cd511bc43`; receipt integration and tag target
 `9fc84ac7fd01c78c6fe15fe862beb6a5d1633a9e` bind the same-source candidates.
-The post-release checkout launcher selects
+That release's post-release checkout launcher selected
 `sha256:b84cdb404ba7bab5ff0b14fa8a7ee93d7293e829cf32e28ff0dacaa8afff4677`.
 Signed-byte D0 acceptance, the retained-letter relocation/rebuild and all four
 populated Bundler roundtrips passed. Public downloads match the receipt.
@@ -121,25 +144,25 @@ candidate, receipt, tag and package evidence.
 
 The BOM is an interoperability contract, not a bundle. The wheel contains its Python control/inspection modules, schema/BOM, clean package-owned scaffolds and a small host Docker launcher, described below. It does not include Ruby theme assets, Docker image layers, the factory's build/worker implementations, TeX, Chromium, computation environments, `diavisuals`, or `vegavisuals`.
 
-The selected public core release is `0.7.0`; earlier distributions remain immutable. Its BOM reuses immutable PDF, compute and web-capture worker digests and selects published `diavisuals v0.5.0` and `vegavisuals v0.5.1` through SHA-256-pinned wheel URLs. Companion references can describe either a provider/release-matching Git reference or a provider/release/version-matching wheel with its content hash. The wheel boundary remains external. The scaffold's Vega revision is the published `a448cc50a5f511743a6fcfc213baeb9be80f4a27` commit. `distribution-check` validates structural integrity for normal CI. `distribution-release-check` blocks coordinated publication while any component is `pending` or `unavailable`; reviewed source authorized to produce final same-commit candidates is `ready`, while an already-published component is `released`. Final receipt values remain immutable after publication.
+The selected public core release is `0.7.1`; earlier distributions remain immutable. Its BOM selects the verified PDF 0.7.1 specialization, reuses immutable compute and web-capture worker digests and selects published `diavisuals v0.5.0` and `vegavisuals v0.5.1` through SHA-256-pinned wheel URLs. Companion references can describe either a provider/release-matching Git reference or a provider/release/version-matching wheel with its content hash. The wheel boundary remains external. The scaffold's Vega revision is the published `a448cc50a5f511743a6fcfc213baeb9be80f4a27` commit. `distribution-check` validates structural integrity for normal CI. `distribution-release-check` blocks coordinated publication while any component is `pending` or `unavailable`; reviewed source authorized to produce final same-commit candidates is `ready`, while an already-published component is `released`. Final receipt values remain immutable after publication.
 
 ## Docker-First Hybrid Policy
 
-### 0.7.0 component selection
+### 0.7.1 component selection
 
-The coordinated core identity is **0.7.0**: gem, wheel, base runtime and MCP
+The coordinated core identity is **0.7.1**: gem, wheel, base runtime and MCP
 images were published together. The installed host launcher and runtime-aware
 generated Bundler state are included. The PDF worker uses its reviewed, signed
-0.6.0 digest, alongside the 0.4.0 computation/capture workers and the accepted
+0.7.1 digest, alongside the 0.4.0 computation/capture workers and the accepted
 Diavisuals 0.5.0 / Vega 0.5.1 rendering combination. A released PDF can be reused
 only by full digest; new/pending workers still require the coordinated version.
-Earlier receipts remain unchanged. Signed image/package evidence is recorded in the 0.7.0 receipt;
+Earlier receipts remain unchanged. Signed image/package evidence is recorded in the 0.7.1 receipt;
 promotion and anonymous-download checks passed before the post-release launcher
 pin was advanced.
 
 ### Local delivery
 
-GHCR is the canonical delivery channel for normal local use. The released package scaffold selects `ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.7.0`; existing sites can remain on their immutable previous release until deliberately updated. Its `make build`, `make serve` and `make test` targets mount the thin child site and run inside that image. The image contains both the installed Python control plane and the reviewed factory source at `/opt/unaltraweb`, so those targets load the theme as a path gem without downloading PyPI or RubyGems packages.
+GHCR is the canonical delivery channel for normal local use. The released package scaffold selects `ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.7.1`; existing sites can remain on their immutable previous release until deliberately updated. Its `make build`, `make serve` and `make test` targets mount the thin child site and run inside that image. The image contains both the installed Python control plane and the reviewed factory source at `/opt/unaltraweb`, so those targets load the theme as a path gem without downloading PyPI or RubyGems packages.
 
 Factory registration uses a stricter pin. gContExt runs `mcp-build`, which inspects or pulls the full `MCP_RELEASE_IMAGE` digest, and `mcp-stdio` launches that exact image. Checkout builds use local `:dev` names by default through `mcp-image`, `mcp-check` and `mcp-smoke`, so they do not shadow public semver references unless a maintainer explicitly overrides them. The digest is advanced in a separate post-release change after each new receipt exists; candidate source continues to select the last completed release instead of attempting to embed an unknown self-digest.
 
@@ -169,7 +192,7 @@ unaltraweb-mcp-docker serve --project /absolute/consumer
 ```
 
 The installed default selects its package's full MCP release image, currently
-`ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.7.0`. It resolves that selection to the
+`ghcr.io/dosquartsdedocs/unaltraweb-mcp:0.7.1`. It resolves that selection to the
 local immutable image ID before executing. The checkout's `MCP_RELEASE_IMAGE`
 is a separate digest pin advanced only after publication; it is not the installed
 wheel's default. This avoids sending a new package back to an older MCP while
@@ -314,7 +337,7 @@ For that reason:
 
 ## Docker Runtime
 
-Release `0.7.0` publishes the selected base/MCP runtime and packages while pinning the verified PDF worker and reusing unchanged specialized workers. Local maintainers continue to use explicit development names such as `unaltraweb:dev`; generated sites select the reviewed semver MCP image rather than `main` or `latest`.
+Release `0.7.1` publishes the selected base/MCP runtime and packages while pinning the verified PDF worker and reusing unchanged specialized workers. Local maintainers continue to use explicit development names such as `unaltraweb:dev`; generated sites select the reviewed semver MCP image rather than `main` or `latest`.
 
 The base runtime owns Ruby, Jekyll and system dependencies. The MCP image builds on its exact candidate digest and adds the full reviewed factory plus the Python package. Specialized workers remain separate. This keeps each layer focused without adding Chromium, TeX or computation stacks to every site; the coordinated core-image workflow still rebuilds and verifies runtime, MCP and manual PDF candidates together.
 

data/docs/_documentation/en/43-workspace-path-policies.md

@@ -43,6 +43,9 @@ which is not evidence that a future Git repository is compliant.
 | --- | --- | --- | --- | --- |
 | `_site` | directory | jekyll-build-output | ignored | disposable |
 | `tmp` | directory | build-staging-and-local-release-evidence | ignored | explicit |
+| `practiques` | directory | private-practice-sources | versioned | never |
+| `sandbox/practiques` | directory | retained-private-practice-jobs | ignored | explicit |
+| `dist/practiques` | directory | private-practice-deliveries | ignored | explicit |
 | `.cache/scimago` | directory | external-bibliometrics-input-cache | ignored | explicit |
 | `.cache/unaltraweb/manual-pdf-publication-intent.json` | file | pdf-publication-recovery-intent | ignored | explicit |
 | `.cache/unaltraweb/manual-pdf-publication.json` | file | pdf-publication-provenance | ignored | explicit |
@@ -84,6 +87,16 @@ identity; it is generated metadata, not a disposable execution lock. Consumers
 usually version it with generated Markdown/figures, but this rollout does not
 force that choice.
 
+Practice source control and web exclusion are separate checks. A manual using
+`practiques/` must exclude `practiques/`, `sandbox/` and `dist/` from Jekyll;
+`profile_check` rejects missing exclusions and conflicting explicit includes.
+New manual scaffolds provide these exclusions. Existing sites retain their
+configuration during scaffold synchronization, so review this small configuration
+addition in the consumer workspace. The shared ignore template covers
+`sandbox/` and `dist/practiques/`; local conflicts still stop synchronization.
+Retained practice jobs and deliveries require explicit preservation decisions,
+even when they can be regenerated.
+
 ## PDF Recovery Is Not Disposable Cache
 
 `src/unaltraweb_mcp/manual_pdf_preview.py` owns the five fixed PDF-state paths:

data/docs/_documentation/en/47-private-practice-pdfs.md

@@ -0,0 +1,130 @@
+---
+title: Private Practice PDFs
+description: Build landscape practice readings with shared manual typography, course metadata and retained private outputs.
+lang: en
+ref: private_practice_pdfs
+profiles:
+- unaltredocs
+documentation_profiles:
+- core-developers
+section: Core Development
+weight: 665
+permalink: "/private-practice-pdfs/"
+nav_title: Practice PDFs
+---
+
+The `manual_practice_pdf_build` tool creates a private A4-landscape reading from
+one Markdown source. It uses the manual's typography and site metadata, including
+the course name, degree, instructors and configured logos. The first page includes
+the course codes in parentheses beside the subject and the practice version.
+The academic year is omitted. Logos appear only on the first page.
+
+## Prepare a reading
+
+Keep editable sources in the manual repository:
+
+```text
+practiques/accessibility/ca/alumnat/LLEGIU-ME.md
+practiques/accessibility/ca/docent/LLEGIU-ME.md
+```
+
+Use `LEEME.md` for Spanish and `README.md` for English. The language must be
+enabled in the site configuration. `alumnat` and `docent` identify separate
+readings; the tool does not infer or produce a teacher solution.
+
+```markdown
+---
+title: Compare two routes
+lang: en
+content_status: draft
+---
+
+# Open the project
+
+1. Open the prepared project.
+2. Compare the routes between the same origin and destination.
+
+![The two routes on the same map](assets/img/routes.png "Open and closed crossing scenarios")
+
+| Scenario | Crossing |
+| --- | --- |
+| Open | Available |
+| Closed | Unavailable |
+
+Table: Conditions used in each scenario.
+```
+
+The initial reading format supports ordinary Pandoc Markdown, links, maths,
+fenced code, captioned tables and standalone PNG, JPEG or PDF images. Image paths
+are project-relative, with a fallback to the source directory. Absolute paths,
+parent traversal, symlinks and remote images are rejected. Render other visual
+formats through their owning provider and select a printable output first.
+Liquid, manual-only component wrappers and automatic bibliography assembly are
+not part of this standalone reading format.
+
+Figures keep their original proportions and fit the usable page automatically.
+Their captions are measured before allocating image height. A complete figure
+moves to the next page when it cannot fit; it is not reduced to fill a small
+space at the bottom. Tables are centred, with repeated headers and captions on
+continued pages. Review long tables and dense screenshots at the intended size.
+
+## Keep the material private
+
+Merge these entries into the existing `exclude` list in `_config.yml`:
+
+```yaml
+exclude:
+  - practiques/
+  - sandbox/
+  - dist/
+```
+
+Keep the existing exclusions. Add `sandbox/practiques/` and `dist/practiques/`
+to `.gitignore` if broader rules do not already cover them. Version the editable
+practice sources. Git ignore rules do not exclude files from Jekyll by themselves.
+The profile check rejects missing web exclusions when practice sources exist.
+
+## Build with MCP or the CLI
+
+Use a runtime whose tool inventory advertises `manual_practice_pdf_build`.
+Existing connections keep their loaded code until the client reconnects to an
+updated runtime. Prepare the selected PDF image explicitly before the first run.
+
+```text
+manual_practice_pdf_build(
+  source="practiques/accessibility/en/alumnat/README.md",
+  version="2026-10-r1"
+)
+```
+
+The equivalent factory-backed CLI command is:
+
+```bash
+unaltraweb-mcp --project "$PWD" mcp manual-practice-pdf-build \
+  --source practiques/accessibility/en/alumnat/README.md \
+  --version 2026-10-r1
+```
+
+Use `--dry-run` for a read-only plan. `--run review-2` selects a named review or
+retry while retaining an earlier attempt. The result gives the PDF, first-page
+preview, receipt and job paths under `sandbox/practiques/<slug>/`.
+
+For a maintainer testing a core checkout, the corresponding factory target is:
+
+```bash
+MCP_CONSUMER_WORKSPACE="$PWD" make -C /path/to/unaltraweb \
+  manual-practice-pdf-build \
+  PRACTICE_SOURCE=practiques/accessibility/en/alumnat/README.md \
+  PRACTICE_VERSION=2026-10-r1
+```
+
+The worker runs without network access, with a read-only input snapshot and one
+writable output directory. A repeated request verifies and reuses an unchanged
+sealed job. Changed inputs produce another job; edited or incomplete attempts
+are retained. Updating only the MCP package version does not invalidate a reading
+whose effective inputs and rendering controls are unchanged.
+
+The command returns `publishes: false`. Review the PDF before distributing it.
+Practice versions are independent of the manual's `latest` or stable release
+selectors. Compiling a reading does not analyse GIS data, assemble Moodle ZIPs,
+upload files or publish material on the website.

data/docs/agents/consolidation-0.7.2.md

@@ -0,0 +1,97 @@
+# Web #98 / gaContExt #32 — 0.7.2 source checkpoint
+
+This is a draft consolidation, not a published release or an installed 0.7.2
+cohort. It includes private reading/PDF composition, portable bindings and author
+resources, independent PDF/ZIP delivery, the host reaper correction, the shared
+source-CI control, and preparation of runtime archives for the existing hub loader.
+Earlier candidate reports describe their historical checkpoints; their source
+snapshots, images, wheels, receipts and retained evidence remain unchanged.
+
+**Current private-runtime decision:** QGIS 0.6.0 is released but private. The earlier
+wheel-install plan below is superseded by [native private-runtime delegation](private-practice-verifier-98.md).
+Public Web builds now contain only the Web bridge/metadata; the hub prepares the
+private QGIS controller. No published/private wheel is downloaded into Web.
+The three independent review P2 findings are reproduced and corrected in this
+source delta; a new source review and independent runtime check are still required
+on its committed HEAD. The H2 contract declares the private producer's hash-bound
+`release.json` externally; public runtime archives contain only Web-only and PDF
+images. Local acceptance and the external receipt are documented in the linked
+bridge and archive contracts.
+
+## Blockers recorded at the original draft checkpoint
+
+The first two entries describe the superseded installer plan at `88dd2518`, not
+current requirements to make QGIS public or embed its wheel:
+
+- The final **published QGIS wheel URL and SHA-256 are still missing**. The owner
+  reports prepared source `a660dfa54ea6bc6cf5d3d3fbeb12593f62c726e1` and wheel
+  `dde653f7a719d8dbb20b4471e3cdb7f9c99cbdfcb116647caba5a08e710c7b76`
+  pending re-review. This is not an accepted published pin and is not installed
+  or inserted into the BOM by this checkpoint.
+- `Dockerfile.mcp` deliberately refuses its verifier installation until that
+  released owner component is declared. Docker CI may stop at this gate; no
+  check, job or refusal is disabled to manufacture a green result.
+- Select the new permanent reviewed core commit after integration. The current
+  `consumer_integration.core_sha` remains the previous reviewed `3332e0b…`
+  point during this draft, not a claim that it already contains the new tools.
+- Final same-source package/image candidates, their acceptance and a new
+  receipt-only release checkpoint remain pending. `release-candidates.json`
+  still belongs to published 0.7.1 and is not a 0.7.2 authorization.
+
+The coordinated gem/wheel/runtime/MCP declarations now name **0.7.2**. Nothing
+re-emits 0.7.1 with new bytes. The checkout launcher and source-checker lane keep
+their previously published MCP digest until a new published digest is reviewed.
+
+## Preserved tuple
+
+- Workflow: `3332e0b93933f12317e05f1ce8d38ce80046feab`.
+- PDF 0.7.1:
+  `ghcr.io/dosquartsdedocs/unaltraweb-manual-pdf@sha256:1bb3f2dafd741e96c28639ec1cc8ccaeb81cbaa73e649f787c0b4ef59997bd4b`.
+- Actual PDF producer: `b7ec1d7a139c65b3b0b88699cdbeb19080f13be1`.
+- PDF configuration ID:
+  `sha256:618163d3f924439792b2306617bd9612f566c5881166102fa544b4e782d569fa`.
+- All nine retained-document checkers remain byte-identical to the reviewed
+  core/PDF point. Diavisuals/Vega compatibility is not widened.
+
+## Reproducibility and retained evidence
+
+The publishable wheel carries the source-CI runner, policy schema, common workflow
+template and native private-runtime bridge/descriptor. The normal MCP image runs
+the factory-owned compositor/scripts and delegates verification to the prepared
+private QGIS controller. Neither public entrypoint requires consumers to copy
+generic code or inspect a mutable provider checkout.
+
+`prepare_practice_candidate.py`, `prepare_practice_editions_candidate.py` and
+their pinned rc fixture defaults are historical acceptance/preparation tools.
+They do not replace the normal release pipeline, and their old local candidates
+must not be regenerated or relabelled as the final release. Archived source and
+image hashes identify those exact historical bytes.
+
+Source-CI/composition tests and synthetic fixture recipes are versioned here.
+Datasets, rendered PDFs/ZIPs, Docker-save archives and retained job outputs stay
+outside Git. Detailed evidence and transfer hashes are recorded in:
+
+- [Practice editions and bindings](practice-editions-98.md).
+- [Runtime archives and independent PDF producer identity](practice-runtime-archives-98.md).
+- [Shared public-source CI](source-ci-98.md).
+- [Installable practice-PDF acceptance](practice-pdf-installable-98.md).
+
+The source validation before this version declaration passed 706 tests
+(679 passed / 27 optional skips), fresh-wheel installation, source/workflow
+checks and native bounded source-checker execution. After declaring 0.7.2,
+the suite passes 706 cases (678 passed / 28 skips): the additional skipped
+Docker mount-parser test requires the not-yet-prepared 0.7.2 MCP image. It was
+not redirected to an older image to claim a new-runtime pass. A fresh 0.7.2 wheel
+build/install and distribution/workflow/whitespace checks passed at that original
+checkpoint; its publication readiness was false because the QGIS pin was absent.
+
+The later private-runtime/P2 checkpoint passes **720 tests (692 passed / 28
+skips)** and fresh-wheel installation. Native local evidence verifies Web package
+absence, v1/v2 delegation, sealed PDF/ZIP pairs, selected-resource-only engine
+mounts and exact teardown. Distribution metadata is now structurally ready while
+private checks remain explicitly `not_run` in public CI. The final source's hosted
+CI and independent re-review are tracked on PR #104; local evidence is not
+relabeled as those gates. The receipt-only H2 addition leaves executable bytes and
+selected image/schema identities unchanged, so retained native renders are reused.
+None of this publishes or approves the manuals' draft teaching content. W1 draft
+PR #103 is outside this consolidation.

data/docs/agents/d0-runtime-identity.md

@@ -87,6 +87,14 @@ does not authorize removal. `reap-session` preserves a live backend or running
 job, and recovers only that retired session's idle resources. Occupied or foreign
 networks fail closed. No fresh-helper PID is presented as the backend's PID.
 
+Exited-resource recovery compares complete Docker observations while canonicalizing
+only the order of mount records. Every mount field, field type and duplicate record
+remains significant; a real identity/state/mount change still refuses removal.
+Removal failure or timeout is reported separately from observation drift, and
+the exact container ID must be absent before release is confirmed. This recovery
+code runs in the installed host adapter: selecting a controller image does not
+update an already installed adapter.
+
 The legacy `down` / `make mcp-down` is an explicit **workspace-wide** shutdown;
 `mcp-down-all` is maintainer/factory-wide. Neither is the hub's per-client toggle
 operation. The managed sequence is live drain, close this transport, inspect its

data/docs/agents/deployment-integration-0.7.1.md

@@ -1,5 +1,9 @@
 # Consolidated deployment integration — 0.7.1
 
+Published [v0.7.1](https://github.com/dosquartsdedocs/unaltraweb/releases/tag/v0.7.1)
+on 2026-10-07. The [final delivery report](owner-closeout-93.md) supersedes the
+chronological preparation states below and binds the accepted published bytes.
+
 Owner: [issue 93](https://github.com/dosquartsdedocs/unaltraweb/issues/93), following
 the workflow-only [issue 86 correction](deploy-provenance-86.md). The owner
 authorized implementation, review/integration and gated 0.7.1 publication.

data/docs/agents/manual-authoring-components.md

@@ -2,6 +2,29 @@
 
 This is the component contract for MCP agents drafting or reviewing `unaltremanual` content. Read it together with the consumer site's `context/writing-profile.md`.
 
+## Private practice readings
+
+Standalone practice readings live in `practiques/<slug>/<lang>/<alumnat|docent>/`,
+using `LLEGIU-ME.md` (ca), `LEEME.md` (es) or `README.md` (en). Use
+`manual_practice_pdf_build` with an explicit practice version to produce a
+private A4-landscape PDF under an ignored, retained `sandbox/practiques/` job.
+The source requires front-matter `title`; `lang` must agree with the path.
+Use `#` for body sections and `##` for subsections. Keep a table's `Table:`
+caption and each standalone image's descriptive caption with its source.
+
+The practice wrapper reuses site metadata and manual typography. Course codes
+appear in parentheses beside the subject; the practice version is shown without
+the academic year. Logos occur only on the first page. Figures are centred and
+automatically fit the usable page after reserving the caption and its spacing.
+
+The initial reading API accepts ordinary Pandoc Markdown, local PNG/JPEG/PDF
+images, links, maths, fenced code and captioned tables. Use provider-rendered
+printable images rather than executable or remote visual sources. Liquid,
+manual-only component wrappers and automatic bibliography assembly are outside
+this reading syntax. Its private source paths are not added to the public
+editorial/translation inventories. Review the returned PDF explicitly; a layout
+approval does not change source `content_status` or authorize publication.
+
 ## Paragraph development
 
 Diagnose paragraph function before polishing sentences. A paragraph should normally have one primary job and, when the material warrants it, develop this sequence: