@ours.network/cowork 0.3.2 → 0.3.4

package/docs/05-room-workflow.md

@@ -10,7 +10,7 @@ ours-cowork room show <room-id>
 
 In the web console, choose Create room, enter Name, Goal, and Briefing, and submit once. Names are trimmed and Unicode NFC-normalized, must contain 1–64 Unicode characters, and cannot contain Unicode control or format characters. Duplicate names are allowed. The created room is selected automatically and its Invite panel opens. Add invitation requirements one at a time; the UI does not combine room creation and invites into a fabricated atomic operation.
 
-Update the display name with `ours-cowork room settings <room-id> --name "New name"`; other mutable mission fields use the same `room settings` command. The display name is persisted as `room_name`, while the opaque `room_id` remains the stable routing, URL, storage, and identity-correlation key. The underlying room identity is not renamed. Existing unnamed rooms receive the deterministic display name `Room <first 8 room_id characters>` when loaded. Inspect admitted seats with `room participants`. A room activates only when its recorded invite requirements are satisfied. Roles are display labels; participant identity CIDs, not roles, are authorization keys.
+Update the display name with `ours-cowork room settings <room-id> --name "New name"`; other mutable mission fields use the same `room settings` command. A new room announces `ours-cowork-room:<initial room_name>`. The display name is persisted as mutable `room_name`, while the authenticated announced identity name is intentionally frozen: renaming a room does not change its CID, signing key, contacts, or history. Duplicate names are allowed because identity CIDs, not names, are the authorization and routing keys. The opaque `room_id` remains the stable URL, storage, and identity-correlation key. Existing `cowork-room-<room_id>` identities are retained without renaming; existing unnamed rooms receive only the deterministic display name `Room <first 8 room_id characters>` when loaded. Inspect admitted seats with `room participants`. A room activates only when its recorded invite requirements are satisfied. Roles are display labels; participant identity CIDs, not roles, are authorization keys.
 
 Close with `ours-cowork room close <room-id>`. Close is forward-only and removes live room packet state while retaining the local archive. Archive deletion is a separate explicit operation described in the limitations topic.
 

package/docs/08-backup-restore.md

@@ -5,3 +5,5 @@ Stop the daemon before taking a backup. A live copy can split metadata, append-o
 Back up the complete state directory as one unit, preserving ownership and file modes. Do not select only `rooms/` or only room JSON files.
 
 For restore, stop the daemon, replace the complete state directory with the complete backup, restore its original owner and `0700`/`0600` permissions, and then start the daemon. Do not merge individual room directories from different snapshots. Restore to a compatible package version and verify `ours-cowork status` plus representative `room show` and `room history` calls.
+
+Room restore preserves the persisted signing secret, CID, packet state, and exact announced identity name. Current rooms therefore retain the `ours-cowork-room:<initial room_name>` they were created with, even if mutable display metadata was renamed later. Legacy `cowork-room-<room_id>` identities stay legacy; restore never upgrades or recreates them.

package/docs/10-limitations.md

@@ -13,3 +13,4 @@
 - The web console and HTTP room RPC have no authentication. They bind only to `127.0.0.1` and must not be forwarded, proxied, or exposed remotely.
 - Web updates use periodic polling rather than push. A view can lag daemon state until its next refresh; confirmed mutations trigger an immediate refresh.
 - Browser state is transient apart from the selected-room URL hash. Invite receipts disappear when closed and are not recoverable from browser storage.
+- Room names are not unique. New rooms announce `ours-cowork-room:<initial room_name>`, but that authenticated identity name is immutable while `room_name` remains editable. Interfaces must distinguish duplicate or renamed rooms by CID/room ID and may use local display aliases; an alias does not change authenticated provenance.

package/docs/11-web-console.md

@@ -23,7 +23,11 @@ Friendly names are trimmed and Unicode NFC-normalized, must contain 1–64 Unico
 
 ## Communication and records
 
-Communication is the human-readable chat: room and participant messages plus the mission briefing. Messages are not inserted optimistically; a sent message appears after the daemon's ordered history includes it. Events contains relay, recovery, close, and failure details. Archive contains the complete sequence-numbered stream and can show earlier loaded rows.
+Communication is the human-readable room stream: room and participant messages, the mission briefing, and inert file attachment cards at their exact archive sequence. Files are separate communication items and are not attached to nearby message text. The newest 500 communication items are mounted first; Show 500 earlier reveals more loaded history. Messages are not inserted optimistically; a sent message appears after the daemon's ordered history includes it. Events contains relay, recovery, close, and failure details. Archive contains the complete sequence-numbered stream and can show earlier loaded rows.
+
+Files lists every validated file already loaded from the selected room's paged history. It groups versions only when their raw filenames are exactly equal, including case, Unicode form, and whitespace; versions are numbered oldest-first from archive sequence and displayed newest-first. Group headers and expanded version lists mount 500 entries at a time, with controls to reveal every older entry. Repeated uploads remain distinct versions even when their bytes are identical.
+
+Files never preview or interpret content. Download decodes the archive's canonical base64, verifies the declared size and SHA-256 in the browser, and only then downloads a short-lived `application/octet-stream` Blob. An integrity mismatch is blocked. The reported MIME is shown as metadata only, and unsafe control/format characters or trailing spaces/dots are replaced in the derived download name without changing the displayed or grouped filename. Loaded files remain readable and downloadable when a room is closed or the daemon is disconnected; deleting the room removes its entire local archive and UI, with no per-file deletion.
 
 Room list and connection health poll every five seconds. The selected room, participants, and new history poll every two seconds. Polling pauses while the page is hidden, coalesces overlapping cycles, and refreshes after confirmed mutations. Version one does not use push updates.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ours.network/cowork",
-  "version": "0.3.2",
+  "version": "0.3.4",
   "description": "Standalone daemon for durable ours mission rooms.",
   "type": "module",
   "license": "FSL-1.1-Apache-2.0",