Private daily playset qualification (#182)

PR #194 changes daily household delivery to private retained PDF links. Email capabilities last seven days; storage does not expire on that schedule. Account history UI/API is tracked in #193 and is not yet shipped.

All local preflight gates passed. CI identified a request-clock assumption in the dry-run repeat test; the corrected targeted suite passed 197/197. Browser previews cover desktop, mobile, blocked images and the expired-link recovery page. The preview HTML/text use synthetic links with no corresponding stored PDFs. They contain no production capabilities or private household identifiers.

The large valid PDF matrix measures provider JSON including HTML, plaintext, encoding and metadata; provider MIME framing is excluded. Eight files: 53,788,332 attachment request bytes versus 23,566 linked request bytes. Full actual curation/package/send tests separately cover one through eight children. PDFs/manifests stage before sending, with fail-closed storage and request-budget handling.

Production verification

#194 merged as b8a5e8359a9376d29f2efd4be10f3b1fd99ffd76 with successful PR/main CI. Download Worker version 4322056f-bde0-4cd2-95ec-ff35415de28d serves the custom domain; its private bucket has no public access, custom domain or expiration lifecycle. Worker logs/traces are disabled. The signing secret is shared through secrets on the two Workers and is not in this evidence.

A later main commit changed only docs/ROADMAP.md (#201); its CI also passed. The sender bundle digest is unchanged. Daily version 0b4f26d9-e36b-4acb-a711-f5bdfa5b8939 at 100% is tagged d7dabbee53d8a2c81fcfa9a9f0b49830dc4b9d9a. Activation occurred after the protected delivery window. Health passes, delivery remains enabled, TEST_TO remains empty and the original cron creation/modification timestamps are unchanged.

Production dry runs for both eligible households produce one seven-page linked PDF each and 14,500 / 14,476 request bytes. They store no files and send nothing; delivery/claim/outbox/event counts are unchanged.

The authorized synthetic two-child proof uploads 2,294,104-byte and 1,426,412-byte PDFs. Live GET, HEAD, repeated GET and byte ranges pass with matching file digests. Missing/modified signatures and unknown objects return 404; expiry and removed-profile fixtures return 410. A synthetic removed-profile object was deleted after testing; no real profile was changed. Temporary upload credentials needed propagation, then worked, and both temporary tokens were revoked.

Two test emails went only to the founder. The first command-line harness altered Unicode punctuation; the corrected copy used the actual production emailPayload and sendPreparedEmail functions. The corrected request is 21,311 bytes; Gmail reports 27,213 bytes, two links, no attachments, correct Unicode and SPF/DKIM pass. Both received URLs match the successfully verified capabilities. No production signed URL is retained in this evidence. The two synthetic PDFs remain for those test links; the restricted proof-state JSON identifies their random batch for future orphan cleanup. They have no normal delivery ledger/history entry.

Automatic daily releases were restored after verification. Read-only production preparation is the final qualification check; add its run/result below. Browser previews remain distinct from native client rendering certification.

Final read-only production preparation passed in run 34700434756, with current source selected as already deployed and health/binding checks successful. Automatic releases confirmed enabled. #182 closed; #193 remains the account history follow-up.