Playset history #193

PR #202, merged commit c24f24b4754e3f1d0cf89f036589c88a02cfc4dc.

Local verification: all 36 preflight gates; 19 history/session/retention checks; 21 private download checks; desktop/mobile account browser smoke. PR CI 34702377920 and main CI 34702600928 both passed gate and smoke jobs.

Screenshots use synthetic children. playset-history-* are UI fixtures; live-preview-history-* use an isolated preview D1 household and private R2 file. The actual retained PDF bytes were compared after authenticated download; all temporary preview rows/files were removed and the temporary credential revoked. The expired-link screenshots render the exact Worker HTML, with a sample delivery date.

The read-only production file inventory found two live-owned synthetic qualification PDFs and zero history manifests. They remain private and were not deleted. Earlier attachment-only deliveries cannot offer stored originals; future normal daily sends retain those files and manifests automatically.

No production household profiles, plans, claims or delivery rows were changed for this proof. No email was sent.

Production verified: website release 34702786046, download Worker 9caf557d-188f-44c4-885f-a2b5e37e7cd2, and daily release 34702786103 / version 657ab9c3-7b02-433e-8970-e8a351e16c70 all use the merged source. Sender activation waited for the existing :47 safe window; its cron creation/modification records stayed unchanged. Delivery remains enabled with no test recipient.

The real founder browser session displayed eight sent delivery dates; the dated sign-in return opened and focused September 11. The live expired capability returned HTTP 410 with that original date preserved. sw193-expired-live.html is the actual response with no capability embedded. Browser automation could not reach the local replay server, so the provided PNGs remain clearly labeled rendered previews of the same Worker HTML.

Issue #193 closed after these checks. The broader cleanup monitoring/account-removal follow-up is retained in #183.