# #507 · private own-review addendum · addressed1

Open `index.html`; its **Handoff** link opens this document. This is a local, synthetic visual design input, not an implemented product or release. No network/API calls. Existing main presentation, 390/1280 layouts and R2/R31 palette remain; the only flow repair is stale-version gating and explicit fixture read controls outside the product frame.

## Private mount and bounded coverage

Proposed bounded entry: authenticated `/profile` → **Отзывы о площадках** → **Ваш отзыв о площадке**, within existing `ProfilePage`. The collection entry is new presentation in the existing private page, not a new route. Account already redirects to `/profile`. Public header/navigation in this prototype are illustrative context only. Public VenuePage/map reviews remain anonymous and read-only: no owner actions or generic public write CTA.

Use `listOwnVenueReviews`, **GET /v1/me/venue-reviews**, and manage only an actually returned review id/version for the authenticated owner. There is no existing own **GET /:id** wrapper; this slice does not assume one. Latest50 is unpaginated, incomplete coverage. An absent row does not prove deletion or nonexistence; do not open it from a guessed id. Eligibility covers latest30 bases. Missing history is UNKNOWN/missing_history, not expiry.

Own DTO has no original gameId, allowedActions or effective deadline. Do not associate by venueId, name or text, derive a frontend deadline, or offer a replacement game picker. The editable example explicitly uses an externally supplied, verified exact original-game association and current may_submit basis; this is synthetic operator fixture provenance, not a capability of listOwn. Without that genuine association in implementation, show useful read/withdraw management and honest edit unavailability.

## Own text and public truth

Own list COALESCE returns pending body when present; it does not provide both old visible and pending bodies. publicVisible confirms visibility, not that Own.text is publicly displayed. Quote old public text only from the actual public DTO matched by exact returned reviewHandle through bounded existing public pagination. Otherwise show confirmed visibility without inventing the quotation. Pending own text stays separate from old public text; moderation may delay publication. Names, profile identity and game details do not enter the public review projection.

## Commands and recovery

- `submit_revision`: expectedVersion, exact original gameId, current outcome/attendance basis versions, audience, text, topics and consentProjectionHash. Reuse fixed-game admission, consent preview, 14-day/appeal policy and moderation. Text/topic/session changes invalidate consent. No optimistic publication; deny/cooldown/window_closed preserve old public truth.
- `withdraw`: body contains only action + expectedVersion, with existing ownership, installation, session/authentication, CSRF and idempotency checks. Withdrawal is independent of the edit 14-day window, eligibility and OpenAI/provider availability. Explicit confirmation withdraws publication and pending intake; show removal only after confirmed response and reconcile public caches. A withdrawn slot cannot be reopened via submit_revision (`WITHDRAWN_SLOT`); no resubmit/appeal fallback.
- UNKNOWN keeps the frozen original packet/key/payload while the operation is unresolved, blocks new operations, and allows only a deliberate same-request retry or legitimate reconciliation in implementation. Closing cannot silently abandon a pending request. Logout/revoke/identity changes fence late replies and clear the visible private context; re-entry must read own truth and must not replay the prior actor's operation.
- VERSION_CONFLICT now sets persistent `state.readRequired`. Preview/consent/submission and withdrawal confirmation cannot bypass it, including through close/reopen. A failed or UNKNOWN fresh read leaves it set and preserves the known version. Only an explicit successful own-read fixture clears it. Initial read version 7 and fresh-read version 11 are synthetic responses, visibly labelled outside the frame; version 11 comes from the response object, not a local increment offered as production truth. Success closes the dialog and clears draft/consent; a new review, fresh consent for editing and deliberate action are required. No automatic submit follows reload. Actor-generation checks fence delayed reads as well as writes.

The prototype uses one synthetic returned row and local timers. It does not demonstrate real authorization, API reconciliation, cache invalidation, publication delay or provider behavior. Those remain implementation and acceptance responsibilities.

## Source pin and implementation seams

Frozen source HEAD: `cdb0acdf9155e9ea476a97e8c4c3cf018a85fa7f`.
Accepted DEV73 source: `c157c3b1a5cabc539a8ae1a6c2c468825336df7f`.
They are distinct commits with identical tree `a8ea28b3d6f30947c65c0fe22f1aed7299d740af` (cdb0 == accepted c157 **tree only**, per supplied pins). Historical acceptance of that tree does not accept this addendum.

Current frontend seams: `apps/web/src/components/consumer/pages/ProfilePage.tsx`, bounded private management beside `venues/VenueReviewComposer.tsx`, typed command body in `apps/web/src/lib/venue-reviews-api.ts`, and `apps/web/src/styles/venue-reviews.css`. Existing `GameResultsComposition.tsx`/`GameFeedbackPanel.tsx` are relevant only if explicitly supplying a verified fixed-game basis; collection rows cannot inherit the current game's identity. `VenueReviewsPanel.tsx` remains public-read-only. Existing server contract is in `venue-reviews.dto.ts`, `venue-reviews.service.ts` and `venue-reviews.policy.ts`; this design promises no new service, DB, scheduler, DTO or eligibility rewrite. No source files were modified or re-audited in this operation.

## Targeted capture and acceptance plan

Parent/operator should serve only this public directory locally and capture the existing layout at 390 and 1280 widths: published collection, edit consent, pending versus old publication, missing association, unavailable public quotation, withdrawal confirmation and confirmed withdrawal. Check keyboard focus, dialog scrolling and no horizontal overflow. No screenshots are supplied as current evidence.

For the addressed finding, in both edit and withdrawal flows choose VERSION_CONFLICT; verify confirmation remains disabled after close/reopen. Set read outcome to error, then UNKNOWN: both must keep the stale version and lock. Choose successful read: version becomes fixture 11, dialog closes, no command is sent, editing needs new consent, and the next deliberate command uses expectedVersion 11. Check UNKNOWN retry retains the identical frozen key/body and revoke during delayed read ignores the reply. Scenario/reset controls intentionally start a new synthetic example; they are not product recovery controls.

Implementation acceptance still requires own/other actor isolation; exact-basis eligibility and consent invalidation; pending/public separation and moderation denials; withdrawal after window closure/provider outage and with pending intake; conflict recovery; UNKNOWN original-operation reconciliation; logout/revoke/identity fencing; public anonymity/read-only and cache behavior. Use proportional existing frontend/API and server policy tests, genuine authorized private Next/browser evidence, independent Source QA, mandatory CI/security checks, DEV acceptance/smoke and GoBad/Owner UAT. Native #522 and design #539 are not covered.

## Actual checks and status

- `node --check public/app.js`: passed in this operation.
- Targeted Node VM check with a stubbed DOM: passed edit/withdraw conflict, close/reopen guard, failed/UNKNOWN/successful fresh read, expectedVersion from fixture, no automatic submit, frozen UNKNOWN retry and revoked-read generation fence. This is a logic selfcheck, not browser or independent QA evidence.
- Local manifest hashes, Handoff target, unchanged CSS/font and frozen input hashes: checked locally.
- Author browser: **NOT_RUN**. Parent/operator browser: **PENDING**. Independent QA/CI: **NOT_TESTED** for this addendum. Source implementation: **NOT_TESTED**. DEV: **NOT_TESTED** for this addendum. Owner UAT: **NOT_TESTED**. No author selfPASS or release/DONE claim.

## Provenance and artifacts

This is one newly admitted addressed operation on four frozen partial outputs. Original supervisor1012614 stopped at the 300-second bound; native turn.completed/final and completed usage were absent. Historical status remains incomplete/stopped, previous usage **UNKNOWN_NO_COMPLETED_USAGE_EVENT** (not zero), author browser **NOT_RUN**. The original receipt, original hashes and partial files remain immutable outside this public directory. This continuation neither replays nor overwrites that historical outcome. Earlier successful R2/R31 references are visual inputs, not current completion evidence.

`assets/onest.ttf` is the existing locally supplied prior R2 asset, also cited by R31; SHA256 `3faa4b905661849b2332e394b42f91b5bf5575e553c516caa81811e868a4d589`. No font download, new graphics, photos or generated imagery. Unchanged tokens: ink #13221a, paper #f5f6f2, lime #a7f447, purple #7945de, lavender #eee6ff. Manifest records exact deliverable hashes excluding its own hash. Public artifacts contain no source copies, private input files or logs.