From c89a9ed8ff7c0f73792a3d4163ad37a1ba6f00cc Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Thu, 1 Oct 2026 03:09:14 -0400
Subject: [PATCH 01/28] docs: define media kit publication and explicit picture
 selection

---
 ...2026-09-30-media-kit-publication-design.md | 275 ++++++++++++++++++
 1 file changed, 275 insertions(+)
 create mode 100644 docs/superpowers/specs/2026-09-30-media-kit-publication-design.md

diff --git a/docs/superpowers/specs/2026-09-30-media-kit-publication-design.md b/docs/superpowers/specs/2026-09-30-media-kit-publication-design.md
new file mode 100644
index 00000000..1ae34a5b
--- /dev/null
+++ b/docs/superpowers/specs/2026-09-30-media-kit-publication-design.md
@@ -0,0 +1,275 @@
+# Media-kit publication and explicit profile-picture placement
+
+## Status and intent
+
+Locked decisions: BASIC approved the product decisions in this chat on
+2026-09-30. This written design is awaiting BASIC's review before the
+implementation plan. No implementation or production migration is authorized
+by the existence of this document.
+
+Make it straightforward for a trusted contributor to upload and publish a
+sourced image through either the website or MCP. Publishing an image adds it
+to the public media kit. Choosing it as a profile picture is a separate,
+deliberate action. Remove the four declarations and the separate evidence
+confirmation command from the publishing journey.
+
+## Current experience
+
+Contributor intake requests `profile_image` for a person or `primary_logo` for
+a community. Both independent approval and trusted publication apply that
+placement when consuming the upload. A primary logo can also become the compact
+profile image, so changing a label from picture to logo would not fix the issue.
+
+Trusted publication requires four stored booleans and an empty identity slot.
+The website exposes Confirm evidence, Publish, and Independent review as
+competing actions. Source URLs appear as raw text. Broad profile `updatedAt`
+checks can invalidate a proposal after an unrelated edit; the submitter cannot
+use independent review's rebase command on their own proposal.
+
+Existing assets already support multiple placements, additive gallery items,
+downloads, attribution, visibility checks, capacity, retention, and cleanup.
+Reuse those facilities. A second media-storage system is unnecessary.
+
+The inspected checkout is at `ef6d8f3`, the earlier MCP catalog work. Before
+implementation, reconcile this design against current main and current hosted
+feature flags. Paths below identify the existing flow, not a release baseline.
+
+## Locked product rules
+
+1. Remove the checklist and Confirm evidence. Do not hide the same checklist
+   behind another screen, require those booleans through MCP, or populate them
+   automatically as if the publisher made assertions.
+2. Upload completion creates a proposal; it does not publish automatically.
+   A trusted publisher's explicit Publish action makes their own eligible
+   contribution a public media-kit item.
+3. Existing profile pictures do not prevent additive kit publication.
+4. Ordinary contributors' proposals still require independent review.
+   Trusted contributor, trusted publisher, reviewer, owner, and admin authority
+   remain distinct. Existing independent-review self-review restrictions remain.
+5. Direct trusted publication is limited to public, published, unclaimed
+   profiles. Claimed profiles retain their existing owner-management workflow.
+6. Owners and authorized admins can change profile pictures. A trusted publisher
+   can select their own published kit item into a genuinely empty identity slot
+   on an unclaimed profile. Existing pictures require independent review for a
+   contributor-requested replacement.
+7. A publisher can undo their own selection while that selection remains theirs
+   and the profile remains unclaimed. Undoing placement leaves the kit item
+   published. An intervening owner, admin, or reviewer selection transfers control of
+   that placement, even when it selects the same asset.
+8. Contributors can correct metadata or remove their own published kit-only
+   items on eligible unclaimed profiles. They cannot use removal to clear an
+   image selected by another authorized actor or override claimed-profile control.
+9. Keep preview, credit, and a readable source link. Source/sharer credit is
+   valid without a claim of artist authorship. For example, Shared by Karly
+   must not be rewritten as Created by Karly.
+10. Existing restrictions on disputed, rejected, or suppressed material remain.
+    Removing assertions does not mean that the service can verify real-world
+    permission or authorship automatically. It checks recorded eligibility and
+    restrictions and records who performed each action.
+
+## Proposed journeys
+
+Website entry paths include the profile's media contribution action, a direct
+contribution link, and account media contributions. Authentication returns the
+user to their intended contribution rather than to a disconnected account page.
+
+```mermaid
+flowchart TD
+  Profile[Public profile: contribute media] --> Entry[Contribution form]
+  Direct[Direct contribution link] --> Entry
+  Entry --> Auth[Sign in when needed, then return]
+  Auth --> Upload[Upload with credit and source]
+  Upload --> Pending[Account media contributions: preview proposal]
+  Pending -->|Trusted publisher: Publish| Kit[Public media kit and downloads]
+  Pending -->|Ordinary contributor| Review[Independent review]
+  Review -->|Approve| Kit
+  Kit -->|Separate authorized selection| Picture[Profile picture]
+  Picture -->|Undo own unchanged selection on unclaimed profile| Kit
+  Kit -->|Correct or remove own kit-only item| Manage[Contribution management]
+```
+
+The publisher card shows the candidate, attribution, source, and publication
+destination. A primary Publish action replaces the checklist and confirmation
+step. Independent review remains a secondary route; it must not imply a second
+upload. Long source URLs become readable links. Public gallery items need a
+display title; reuse the existing label and a deterministic fallback without
+forcing an additional approval step.
+
+Profile-picture selection lives on the published item, not inside Publish.
+The user can leave the asset in the kit indefinitely without choosing a primary
+placement. Clearing a selection and removing a kit item are distinct actions.
+
+MCP offers the same sequence: upload, inspect proposal, publish to kit, then
+optionally select or clear the primary placement. Corrections and removal must
+also be possible through MCP. No browser-only assertion or permission step is
+introduced. Existing owner media-management operations remain supported.
+
+## Domain and command design
+
+### Assets and publication
+
+Publish to the existing additive `gallery` placement, preserving metadata and
+public media-kit visibility rules. This publication must not create
+`profile_image` or `primary_logo`, suppress automatic artwork, or change a
+profile's compact identity image. Use existing individual downloads; adding logo
+bundles or asset categorization is outside this slice.
+
+Change intake contracts, stored proposal interpretation, publisher commands,
+independent approval, public projections, and clients together. Approval of an
+ordinary new image also means publication to the kit. An explicit replacement
+request must remain distinguishable from an additive image proposal.
+
+Record publication method, actor, resource, inspected version, operation ID,
+and receipt. Trusted publication does not invent an independent reviewer.
+Preserve historical declaration and reviewer records without presenting them
+as a requirement of the new workflow.
+
+### Explicit picture selection
+
+Selecting a published kit asset adds its primary identity placement while
+retaining its gallery placement. Replacing or clearing that primary placement
+therefore cannot retire the underlying kit item merely because it lost its
+identity use. Keep existing media-capacity accounting consistent with one asset
+having multiple placements.
+
+Empty-slot eligibility follows current rendering semantics, including authored,
+legacy, and visible automatic images. This slice does not turn a visible fallback
+image into an empty slot or allow trusted publishers to replace it implicitly.
+
+Record selection actor and a placement revision for new primary actions.
+Do not infer who selected legacy placements. Undo checks the exact current
+selection, current claim/authority, and expected placement version. An intervening
+selection invalidates an older undo request.
+
+A contributor-requested replacement references the already published asset and
+uses independent review. Its approval applies the placement change, not a second
+asset publication: no re-upload, duplicate blob, or duplicate published charge.
+Extend the existing review lifecycle with an explicit placement-change request
+rather than treating an already consumed upload as new media. Existing owner
+and admin management stays available under its existing authority.
+
+### Metadata correction and removal
+
+Reuse the existing asset-management machinery with bounded contributor
+authorization. Check provenance and current state on every command. Permission
+to manage a contribution does not grant general profile editing or management
+of another contributor's assets.
+
+Version metadata corrections and audit the actor and changed attribution/source.
+Do not rewrite historical publication evidence. Removal follows existing logical
+retirement, retention, and cleanup; it is not immediate permanent deletion.
+Active primary use or protected selection blocks contributor removal. A publisher
+may first undo their own eligible placement, then remove their kit-only item.
+
+### Freshness and retries
+
+Use a relevant publication snapshot instead of broad profile `updatedAt` alone.
+Bind it to target identity, type, claim and public state, candidate digest and
+metadata, and applicable restrictions. Recheck grants, verified email, visibility,
+capacity, and authority in the committing transaction. Picture actions additionally
+bind the exact placement and its selection revision.
+
+Unrelated biography, tag, or headline edits do not force another upload.
+A meaningful change returns a conflict and a fresh inspectable proposal; the
+caller can make a new decision against its current version. Do not silently
+retry a changed picture selection or a changed identity. Existing stored bytes
+remain available through the ordinary proposal lifecycle.
+
+Commands retain actor-scoped durable idempotency keys and receipts. A lost response
+is recovered by replaying the same key, not by generating a new operation.
+Removing the declaration step must not weaken those guarantees.
+
+### MCP compatibility
+
+Keep the publication tool as the explicit kit-publication command and retain
+its expected-version/idempotency contract. Add or reuse bounded placement and
+own-contribution management tools with the same server-side authority as the
+website. Publishing authority does not grant `assets:write` owner authority or
+independent-review scope.
+
+Retire the declaration tool from the advertised workflow. A compatibility handler
+can return historical receipts or a terminal retired-command result for old
+calls, but new publication never requires declaration. Update catalog fixtures,
+OAuth tool/scope mapping, documentation, and hosted clients together. Never
+reinterpret an old declaration receipt as a newly approved placement action.
+
+## Existing records and rollout
+
+Pending image contributions become additive kit proposals without losing their
+stored candidate, credit, source, contributor identity, or retention state.
+Changing proposal intent changes its review version. Old inspected commands
+must refuse stale versions; users inspect again without another upload.
+
+Preserve existing deliberately selected primary images. Do not guess that all
+legacy placements were deliberate or that all trusted publications were mistakes.
+Preserve existing visibility. Already public contribution assets must retain a
+kit reference before later primary changes can retire them. Do not make private
+owner assets public as a side effect of conversion.
+
+Karly is the explicit correction approved in this design: keep the published
+logo, add its kit placement if needed, and clear the automatically assigned
+primary placement. A migration dry run must identify the exact current asset and
+placement and refuse the correction if another actor has changed that selection
+or the target has changed authority. No production action occurs during planning.
+
+Verify the media-kit feature gate and public field visibility before rollout so
+Publish cannot report success while the expected kit is unavailable. Preserve
+owner privacy settings. Coordinate backend, MCP, and website versions; do not
+deploy clients that still require removed declarations or implicitly select
+primary placements. Produce a bounded migration report and operation receipts.
+
+## Separate follow-up: proposals to claimed profiles
+
+Locked future direction, outside this implementation:
+
+```mermaid
+flowchart LR
+  Contributor[Contributor proposes update] --> Notify[Notify profile owner]
+  Notify --> Compare[Owner compares current and proposed]
+  Compare -->|Accept| Apply[Apply update]
+  Compare -->|Decline| Unchanged[Leave profile unchanged]
+```
+
+All contributors, including trusted publishers, need the claimed profile owner's
+approval. Store the uploaded candidate and complete proposal so the owner does
+not have to upload it again. The owner is the sole proposal reviewer. Do not add
+a preliminary reviewer queue in this slice. If screening proves necessary later,
+use reviewer authority rather than automatically giving it to trusted contributors.
+Notifications, delivery channels, and generalized profile-field proposals belong
+to that follow-up design.
+
+## Implementation boundaries and verification
+
+Existing seams: `convex/_profileAssets.ts`, `profileAssets.ts`,
+`profileMediaSubmissions.ts`, `_trustedPublication.ts`, `_mediaReview.ts`, the
+API contracts, MCP registration/scope map, contribution forms, publication cards,
+review UI, and public media-kit rendering. Use the current main versions when
+writing the implementation plan.
+
+Deliver one PR with internal phases for backend/contracts, website/MCP, and
+migration/hosted verification. Use an implementer and an independent reviewer
+for each implementation round. Finish required checks and the existing 30-minute
+post-commit review window before declaring a future PR merge-ready.
+
+Acceptance evidence must cover:
+
+- Trusted kit publication without declarations, with an existing profile picture
+  untouched, through both website and authenticated MCP.
+- Ordinary independent approval producing the same additive kit behavior;
+  self-review and claimed-profile direct-publication refusals remain enforced.
+- Explicit empty-slot selection, eligible undo, intervening-selection conflict,
+  independent replacement, and asset retention after losing primary placement.
+- Own-item metadata correction and removal; refusal for another contributor's
+  item, protected primary use, revoked authority, or a newly claimed target.
+- Unrelated profile edits succeeding without re-upload; changed identity,
+  candidate, visibility, claim, restrictions, or placement producing a conflict.
+- Durable same-key retry after uncertain publication or placement outcomes.
+- Public kit/download rendering, readable source/credit, migration dry runs,
+  old-client compatibility, and preservation of historical receipts.
+
+Use targeted backend/contract tests for these boundaries, browser screenshots
+with visual review on desktop and mobile, and actual authenticated hosted MCP
+tool calls. A catalog listing, OAuth login, local fixture, or backend receipt
+alone does not prove the full website/MCP journey. Reuse obvious utility labels
+and existing approved copy; submit any substantive new public prose for BASIC's
+exact-copy review before shipping.

From 75f61cd4a31e46e9ccc3a92f66578228a7db482d Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Thu, 1 Oct 2026 03:20:16 -0400
Subject: [PATCH 02/28] docs: plan media kit publication workflow

---
 .../plans/2026-10-01-media-kit-publication.md | 195 ++++++++++++++++++
 1 file changed, 195 insertions(+)
 create mode 100644 docs/superpowers/plans/2026-10-01-media-kit-publication.md

diff --git a/docs/superpowers/plans/2026-10-01-media-kit-publication.md b/docs/superpowers/plans/2026-10-01-media-kit-publication.md
new file mode 100644
index 00000000..753b384d
--- /dev/null
+++ b/docs/superpowers/plans/2026-10-01-media-kit-publication.md
@@ -0,0 +1,195 @@
+# Media-kit publication implementation plan
+
+> **For agentic workers:** REQUIRED SUB-SKILL: Use superpowers:subagent-driven-development to implement this plan task-by-task. Steps use checkbox (`- [ ]`) syntax for tracking. BASIC selected an implementer and independent reviewer for each round, in one PR.
+
+**Goal:** Publish contributions into the media kit without a declaration checklist, with separate authorized profile-picture actions through the website and MCP.
+
+**Architecture:** Reuse existing assets, gallery placements, uploads, review queues, receipts, and cleanup. Both approval paths publish additive gallery assets. Separate commands handle primary placement and bounded management of a contributor's own published assets.
+
+**Tech Stack:** Next.js, TypeScript, Convex, existing S3 upload/storage paths, Zod contracts, Node test runner, convex-test, Playwright, Storybook. No new dependencies.
+
+**Spec:** [Approved design](../specs/2026-09-30-media-kit-publication-design.md), committed as `60c7b0c` and approved by BASIC before this plan.
+
+## Global constraints
+
+- Deliver one PR with three internal phases: backend/contracts, website/MCP, migration/hosted verification.
+- Use an implementer and an independent reviewer for each implementation round.
+- Remove the checklist and Confirm evidence; do not auto-populate equivalent assertions.
+- Direct trusted publication is own-contribution only, for public, published, unclaimed profiles.
+- Keep contributor, publisher, reviewer, owner, and admin authority distinct; retain independent-review self-review refusal.
+- Existing pictures do not block kit publication. Visible legacy/automatic artwork still occupies a picture slot.
+- Preserve existing visibility, historical receipts, cleanup/legal holds, and one published charge per asset.
+- Use durable actor-scoped idempotency keys; uncertain responses require same-key replay.
+- Node `>=24 <25`, pnpm `10.15.1`; use repository scripts and generated Convex types.
+- Claimed-profile proposals/notifications, logo bundles, and asset categorization are separate follow-ups.
+- New substantive public prose requires BASIC's approval of its exact wording before shipping.
+- No production migration or deployment during planning. Later production actions need their applicable authorization.
+- Do not call a PR merge-ready until its latest pushed commit is at least 30 minutes old and all feedback/check surfaces have been refreshed for that exact head.
+
+## Review focus
+
+1. Existing managed, legacy, automatic, or private pictures remain untouched by additive publication (Task 1).
+2. Another actor selecting the same asset invalidates a publisher's earlier undo authority (Task 2).
+3. Lost responses, shared keys across command kinds, revoked grants, and newly claimed targets do not duplicate operations or expand authority (Tasks 1-4).
+4. Metadata correction cannot erase the required credit/provenance, rewrite historical evidence, or expose private owner media (Task 3).
+5. Old pending proposals and consumed uploads remain usable without duplicate blobs/charges; private or changed primary assets are never swept into a public migration (Task 6).
+
+## Preparation and file map
+
+Planning inspected `origin/main` at `a9f6263dd5d2c6c71fecad7d7f325e331c7baa31`. The planning checkout remains on an older implementation base. Start execution in a fresh isolated worktree from current main using the worktree skill; carry the approved spec and this plan as documentation commits. Re-read applicable AGENTS.md and inspect changes since this reference before editing. Do not rebase the shared planning checkout or extend the old merged PR.
+
+Modify existing seams:
+
+| Files | Responsibility |
+| --- | --- |
+| `convex/schema.ts`, `_trustedPublication.ts`, `_mediaReview.ts`, `profileMediaSubmissions.ts` | Proposal intent, additive approval, authority, snapshots, wrappers |
+| `convex/_profileAssets.ts`, `profileAssets.ts` | Reusable placement/metadata mutations and owner-command provenance |
+| `packages/api-contracts/src/{media-review,media-upload}.ts`, `src/index.ts` | Exact public command/detail contracts and exports |
+| `convex/contributionUploads.ts`, `apps/web/src/lib/server/{mcp-media-upload,profile-media-mcp-import}.ts` | Local minted upload and URL-import placement normalization |
+| `apps/web/src/lib/server/{mcp-media-review,vrdex-mcp}.ts` | MCP dispatch, delegation scopes, previews and receipts |
+| Contribution editor, account contribution/review panels, public media-kit rendering | Website flow and shared action UI |
+| `tests/backend`, `tests/web`, `packages/api-contracts/tests`, `apps/web/e2e` | Existing test runners and fixtures |
+| MCP catalog/smoke scripts and `docs/engineering/media-review-commands.md` | Client catalog, hosted evidence, operating contract |
+
+Create only these focused implementation units:
+
+- `convex/_mediaContributionCommands.ts`: published-contribution snapshots and shared authorized placement/management commands. Existing browser and MCP wrappers call these functions.
+- `tests/backend/media-contribution-commands.test.ts`: Task 2/3 authorization, concurrency, and receipt tests using `_mediaReviewFixture.ts`.
+- `convex/mediaKitPublicationMigration.ts` and its backend test: bounded conversion and exact-resource correction, defaulting to dry-run.
+- `apps/web/src/app/account/media-contributions/published-contribution-card.tsx`: actions for a published item, distinct from the pending publisher card.
+
+No new storage abstraction, review service, permission framework, or notification subsystem.
+
+## Phase 1: Backend and contracts
+
+### Task 1: Additive intake and publication without declarations
+
+**Files:** Modify the proposal/schema/contracts and upload/import seams above; tests in `tests/backend/trusted-publication.test.ts`, `profile-media-submissions.test.ts`, `media-review-authority.test.ts`, and `packages/api-contracts/tests/media-review.test.ts`.
+
+**Interfaces:**
+
+- Keep `MediaPublication = { submissionId, expectedReviewVersion, idempotencyKey }` and `publicationCommand(ctx, input: MediaPublication, actor: ReviewActor): Promise<CommandReceipt>`.
+- Add optional stored `requestKind: "kit_asset" | "identity_placement"` and `candidateAssetId: Id<"profileAssets">`; new image intake writes `kit_asset` and `requestedPlacement: "gallery"`.
+- Add optional `profileAssets.sourceSubmissionId: Id<"profileMediaSubmissions">` as immutable contribution provenance. Set it when publishing an uploaded proposal.
+- Owner upload placement behavior stays unchanged. Contributor legacy primary-placement inputs normalize to gallery instead of implicitly selecting identity placement.
+- `reviewSnapshot(ctx, submission, profile)` keeps its existing return type but uses intent-specific relevant state. Kit snapshots exclude unrelated profile timestamps and existing identity artwork. Placement snapshots include that artwork and selection provenance.
+
+- [ ] **Write regression tests** using the existing upload fixture, without calling its declaration helper:
+
+  ```ts
+  assert.equal(receipt.operationState, "committed");
+  assert.deepEqual(newAssetPlacements.map(p => p.placement), ["gallery"]);
+  assert.equal(currentPrimaryAssetId, previousPrimaryAssetId);
+  assert.equal(evidenceRows.length, 0);
+  ```
+
+  Cover managed/private/legacy/automatic pictures, nonempty kit, independent approval, and no invented reviewer. A biography-only edit must preserve the inspected publication version; changed target identity, candidate metadata, privacy, claim, or restrictions must invalidate it. Retain capacity, verification, source/credit, suppression/rejection/dispute, and revoked-grant refusal tests. Same-key replay returns the original receipt and one asset/charge.
+- [ ] **Run to confirm the new tests fail:** `node --conditions=import --import tsx --test tests/backend/trusted-publication.test.ts tests/backend/profile-media-submissions.test.ts tests/backend/media-review-authority.test.ts`. Expected: assertion failures against the old declaration/primary-slot behavior.
+- [ ] **Implement the shared change:** remove assertion/empty-picture gates from kit eligibility, publish both approval paths through `consumeProfileAssetUploads` with gallery only, preserve credit/provenance, and use `sanitizeProfileAssetLabel(submission.label) ?? "Image"` for the required gallery title. Patch all intake callers, including local minted uploads and URL imports. A meaningful target change requires fresh inspection, never replacement of the stored bytes. Split kit freshness from primary freshness rather than disabling version checks globally.
+- [ ] **Retire declarations:** keep old records untouched. Legacy declaration calls may replay their historical receipts; a fresh legacy declaration returns a terminal `declaration_retired` refusal without adding evidence. New publication does not call that handler.
+- [ ] **Verify:** rerun the targeted tests, then `pnpm test:api-contracts`, `pnpm typecheck:api-contracts`, `pnpm typecheck:backend`. Regenerate Convex types through the normal local backend workflow if schema/API changes require it; do not edit generated files by hand.
+- [ ] **Review and commit:** independent reviewer checks all intake/decision callers and the authority changes; fix findings, rerun affected checks, commit `feat: publish media contributions into the kit`.
+
+### Task 2: Explicit primary selection, undo, and reviewed replacement
+
+**Files:** Create `_mediaContributionCommands.ts` and `media-contribution-commands.test.ts`; modify schema, `_profileAssets.ts`, `profileAssets.ts`, `_mediaReview.ts`, `profileMediaSubmissions.ts`, and the media-review contract.
+
+**Interfaces:**
+
+- Export `PublishedContributionDetail`: string `submissionId`, `assetId`, `profileId`, `profileSlug`, `contributionVersion`; `metadata: { label: string; altText?: string; credit: string; creditUrl?: string; sourceUrl?: string; sourceDescription?: string }`; and `canSelectPrimary`, `canClearPrimary`, `canEditMetadata`, `canRemove` booleans. These are computed capabilities, not assertions supplied by a user.
+- Export `ContributionCommandBase = { submissionId: string; expectedContributionVersion: string; idempotencyKey: string }`.
+- Export `ContributionPlacementCommand = ContributionCommandBase & { action: "select_primary" | "clear_primary" }` with strict schemas and existing bounded ID/version/key limits.
+- Implement `publishedContributionDetail(ctx: QueryCtx | MutationCtx, submissionId: string, actor: ReviewActor): Promise<PublishedContributionDetail>` and `contributionPlacementCommand(ctx: MutationCtx, input: ContributionPlacementCommand, actor: ReviewActor): Promise<CommandReceipt>` in the new module.
+- Browser/MCP wrappers: `contributionDetail`, `contributionDetailForMcpActor`, `placeContribution`, `placeContributionForMcpActor` in `profileMediaSubmissions.ts`. Use the existing verified actor and MCP attestation patterns.
+- `proposeContributionPlacement(ctx: MutationCtx, input: ContributionCommandBase, actor: ReviewActor): Promise<CommandReceipt>` creates an `identity_placement` proposal referencing the existing asset; expose `proposePlacement` and `proposePlacementForMcpActor`. Its receipt resource ID is the new review submission.
+- Add optional placement `selectionActorUserId` and `selectionOperationId`. Every owner/admin/reviewer/publisher identity-selection path writes fresh provenance, including same-asset selection. Legacy missing provenance never grants contributor undo.
+
+- [ ] **Write tests** for a publisher's own public kit asset in an unclaimed profile:
+
+  ```ts
+  assert.equal(selected.operationState, "committed");
+  assert.deepEqual(activePlacements.sort(), ["gallery", "profile_image"]);
+  assert.equal(cleared.operationState, "committed");
+  assert.deepEqual(afterClearPlacements, ["gallery"]);
+  assert.equal(asset.state, "active");
+  ```
+
+  Cover community primary logo, existing visible fallbacks, another contributor's asset, revoked publisher, newly claimed/private target, and stale version. Another authorized actor selecting the same asset must invalidate undo. Reviewed replacement must keep gallery membership of both assets, require a distinct reviewer, and create no new upload/blob/published charge. Repeated placement commands replay one receipt; reuse of the key with another command refuses.
+- [ ] **Run and observe failure:** `node --conditions=import --import tsx --test tests/backend/media-contribution-commands.test.ts`.
+- [ ] **Implement:** resolve immutable source submission and active public asset; check current verified actor, authority and restriction state in the transaction. Selection fills an actually empty identity slot only. Clearing requires the exact unchanged self-selection and current publisher authority. Retain gallery when modifying the primary slot. Owner/admin selection uses its existing authority, but stamps new provenance.
+- [ ] **Extend review:** an `identity_placement` request uses the existing queue/decision receipts, stored public asset preview, source/credit and narrow placement snapshot. Apply existing bounded proposal counts/rate limits without reserving new uploaded bytes. Approval changes placement only. Rejection/withdrawal records the placement-request disposition, without retiring the kit asset, creating a digest-wide content rejection, or scheduling its bytes for proposal-blob cleanup. Explicit moderator suppression remains a separate existing action.
+- [ ] **Verify:** targeted command tests, `media-review-authority.test.ts`, `profile-assets-management.test.ts`, API-contract tests and backend typecheck. Extend preview tests to prove an existing-asset proposal reads the authorized stored object, not its source URL.
+- [ ] **Review and commit:** reviewer checks same-asset reselection, all owner/legacy selection callers, and retention/capacity interactions; commit `feat: separate profile picture selection from publication`.
+
+### Task 3: Own published-item corrections and removal
+
+**Files:** Extend `_mediaContributionCommands.ts`, schema and wrappers; tests in `media-contribution-commands.test.ts` and the media-review contract tests.
+
+**Interfaces:**
+
+- Export `ContributionMetadataPatch` with optional `label`, `altText`, `credit`, `creditUrl`, `sourceUrl`, `sourceDescription` fields, using existing sanitizers/limits. Clearing optional values uses `null`; required credit and at least one provenance field cannot be cleared.
+- Export strict `ContributionManageCommand`: command base plus either `{ action: "update_metadata", metadata: ContributionMetadataPatch }` or `{ action: "remove" }`.
+- Implement `contributionManageCommand(ctx: MutationCtx, input: ContributionManageCommand, actor: ReviewActor): Promise<CommandReceipt>`; expose browser `manageContribution` and attested `manageContributionForMcpActor` wrappers.
+- Add optional asset `sourceDescription` for corrected local provenance. Preserve the original submission/evidence; the published-detail projection reads current asset metadata.
+
+- [ ] **Write tests:** own kit-only corrections commit and change `contributionVersion`; empty credit/provenance and wrong-submitter edits refuse. Removal excludes the item from the public kit through existing logical deletion/retention. Active primary placement, another actor's selection, newly claimed target, suppression, and private owner media block contributor management. Own approved history remains readable without leaking current private asset bytes/metadata. Ordinary contributors can manage their own independently approved kit-only items without a publisher grant.
+- [ ] **Confirm failure** with the Task 2 command-test invocation.
+- [ ] **Implement bounded management:** allow only the listed metadata fields, never bytes, target, visibility, or arbitrary placement changes. Recheck profile/asset/provenance and verification; retain audit before/after metadata and command receipt. Use existing retirement/cleanup machinery and legal-hold behavior. Update capability/version projections after every mutation.
+- [ ] **Verify:** command tests, existing asset-management tests, contract tests and backend typecheck; prove same-key retry cannot produce repeated correction/removal or mutate a different item.
+- [ ] **Review and commit:** reviewer checks post-review metadata permissions, private projections and cleanup references; commit `feat: manage own published media contributions`.
+
+## Phase 2: Website and MCP parity
+
+### Task 4: MCP contracts, dispatch and catalog
+
+**Files:** Modify `apps/web/src/lib/server/mcp-media-review.ts`, `vrdex-mcp.ts`, API-contract exports, `tests/web/mcp-media-review.test.ts`, `vrdex-mcp.test.ts`, `scripts/smoke-vrdex-mcp-compat.ts`, `scripts/smoke-mcp-inspector-client.ts`, and their `tests/scripts` smoke tests.
+
+**Interfaces:**
+
+- Keep `vrdex_media_submission_publish` with its existing input shape, now kit-only.
+- Add `vrdex_media_contribution_get` (submission ID, `mcp:read` + `assets:contribute`), `vrdex_media_contribution_manage` (Task 3 input, `mcp:write` + `assets:contribute`), `vrdex_media_contribution_place` (Task 2 placement input, `mcp:write` + `assets:publish`), and `vrdex_media_contribution_propose_placement` (command base, `mcp:write` + `assets:contribute`).
+- Use the backend functions from Tasks 2/3. Existing owner `vrdex_profile_media_manage` remains owner-scoped; do not widen `assets:write` or route contributor management through owner wrappers.
+- Declaration is absent from advertised tools; compatibility dispatch retains terminal historical behavior from Task 1.
+
+- [ ] **Write transport tests:** no declare call is needed before publish; each new tool dispatches the exact input to the correct attested wrapper and validates `CommandReceipt`/detail output. Missing operation scope prevents backend execution. `assets:contribute` alone cannot select/clear primary even when the account has a publisher grant. Contributor projections omit private reviewer information and private owner assets.
+- [ ] **Run to failure:** `node --import tsx --test tests/web/mcp-media-review.test.ts tests/web/vrdex-mcp.test.ts`.
+- [ ] **Implement registration/mapping:** extend the existing handlers and write-audit machinery. Add scope hints consistent with the existing OAuth recovery path. Provide useful action descriptions that distinguish kit publication, primary placement, and reviewed replacement; treat substantive descriptions as reviewable copy before shipping.
+- [ ] **Update independent catalog expectations:** add new tools/schemas and remove declaration from advertisement in the web catalog fixture and compatibility/Inspector smoke scripts. Preserve independent expected assertions rather than generating them from the implementation under test.
+- [ ] **Verify:** targeted web tests, `pnpm verify:api-contracts`, `pnpm verify:vrdex-mcp`, `pnpm typecheck:web`; local compatibility smoke shows the intended catalog but is not hosted mutation proof.
+- [ ] **Review and commit:** reviewer inspects scopes, actor binding, retries, privacy and compatibility behavior; commit `feat: expose media kit contribution actions through MCP`.
+
+### Task 5: Website publication and published-item actions
+
+**Files:** Modify `apps/web/src/app/_components/profile-media-contribution-editor.tsx`, account `media-contributions/{publication-card,media-contributions-panel}.tsx`, account `media-review/media-review-panel.tsx` and `media-review/media-review-view.ts`, and `apps/web/src/app/_components/profile-public-page.tsx` for verified gallery title/download behavior. Create `published-contribution-card.tsx`. Update `apps/web/src/components/trusted-publication.stories.tsx`, `media-review-comparison.stories.tsx`, `apps/web/e2e/media-contribution.flow.spec.ts`, `media-kit.visual.spec.ts`, and `tests/web/{media-command-result,media-review-view,profile-media-kit}.test.ts`.
+
+**Interfaces:** Pending card consumes `ReviewDetail` and calls Publish once. Published card consumes `PublishedContributionDetail`, calls the Task 2/3 wrappers and exposes only current capabilities. Reviewed replacement sends the Task 2 proposal command. Use existing result/refusal/retry components and retain the exact pending payload/key after an uncertain response.
+
+- [ ] **Write flow assertions:** the trusted publisher card has zero declaration checkboxes and no Confirm evidence action. Publish makes the kit item visible without changing the hero/avatar. Published item allows eligible picture selection, undo, metadata editing and removal. A protected selection has no contributor removal action. Ordinary review approval publishes into the kit; explicit replacement compares current picture with the published candidate.
+- [ ] **Confirm failure** using the existing disposable authenticated media fixture environment. In PowerShell set `$env:VRDEX_E2E_MEDIA_LIFECYCLE='true'`, then run `pnpm --filter web exec playwright test e2e/media-contribution.flow.spec.ts`. Extend its fixture grants/OAuth scopes for publisher and distinct reviewer scenarios. Require executed assertions rather than a skipped suite; absent fixture credentials are a blocker, not proof. Storybook fixtures provide deterministic pending/published/refused/unknown-outcome cases.
+- [ ] **Implement the journey:** submit gallery intent; simplify pending card to preview, destination, attribution, readable source and one primary Publish action. Keep independent review secondary. Render published actions separately and derive visibility from backend capabilities. Show source description as text when no URL exists; URL links use validated existing URLs and readable labels rather than raw signed attachment strings. Preserve authentication return paths and direct contribution links.
+- [ ] **Implement correction UI:** edit current asset metadata, distinguish clearing primary from removing the kit item, and send protected replacements to review without another upload. Retain candidate bytes and draft metadata on conflicts/errors; refresh capabilities before a new decision.
+- [ ] **Verify:** `pnpm typecheck:web`, targeted media result/view/kit tests, local contribution flow, desktop/mobile Storybook and public-kit screenshots. Use a VLM to review spacing, button hierarchy, long sources, disabled/protected states, keyboard accessibility, and no implied avatar placement. Show any substantive new public wording verbatim to BASIC before shipping.
+- [ ] **Review and commit:** reviewer checks UI/backend parity and pending-key recovery; commit `feat: simplify media kit publication and picture actions`.
+
+## Phase 3: Conversion and hosted verification
+
+### Task 6: Bounded migration, Karly correction and end-to-end proof
+
+**Files:** Create `convex/mediaKitPublicationMigration.ts`, `tests/backend/media-kit-publication-migration.test.ts`; modify `tests/backend/hosted-mcp-profile-media-contributions.test.ts`, `apps/web/e2e/media-contribution.flow.spec.ts` for actual hosted lifecycle proof, `docs/engineering/media-review-commands.md`, and `docs/testing/mcp-media-staging-lifecycle.md`.
+
+**Interfaces:** Export an operator-only internal mutation `convertBatch({ dryRun: boolean, cursor: string | null, limit: number })` returning `{ scanned, changed, skipped, conflicts, continueCursor, isDone }`, with limit `1..40`. Dry-run is the default in its operator wrapper. It converts pending uploaded proposals to `kit_asset`/gallery and increments review revision without changing uploaded bytes or historical receipts. It also backfills immutable source-submission provenance only from unique matching approved records.
+
+For the explicit correction, export internal `correctPrimaryToKit({ dryRun: boolean, submissionId, expectedAssetId, expectedPlacementId, expectedPlacementUpdatedAt })`. Require exact current public asset/profile linkage and unchanged eligible primary placement; return a report/refusal, never select another image. Karly's current approved submission is `x1747ftcbeq1k475kz4hqdn77d8fcz0r`; resolve current IDs in dry-run, do not hardcode guessed asset IDs. Keep production correction separate from generic conversion.
+
+- [ ] **Write tests:** repeated conversion changes nothing twice; stored candidate/digest and source stay intact; old review versions refuse; a refreshed pending proposal publishes without re-upload. Already consumed/public assets keep one published charge. Nonunique legacy provenance is skipped, not guessed. Private, claimed, changed or protected primary records refuse the exact correction, while the permitted correction leaves an active public gallery asset and no authored primary placement.
+- [ ] **Run to failure:** `node --conditions=import --import tsx --test tests/backend/media-kit-publication-migration.test.ts`.
+- [ ] **Implement bounded conversion/reporting:** preserve deliberately selected and ambiguous existing pictures, historical assertion/reviewer identities and privacy. Add `profileMediaSubmissions.by_approvedAssetId` for a bounded two-record uniqueness check before backfilling an asset's source submission. Add gallery only to already public contribution assets requiring retention protection. Do not publish private owner media or invent legacy selection provenance. Reconcile legacy uploaded intents at finalization so an upload admitted before conversion can finish into the new kit flow.
+- [ ] **Run regression gates:** targeted media suites, contracts, MCP and web verification, markdown checks, and `pnpm check:backend:generated`. Update operating docs to distinguish kit approval from placement approval, retirement from byte deletion, and old-client behavior.
+- [ ] **Prove staging through actual authenticated MCP:** upload to the minted endpoint, complete, inspect, publish without declare, get approved state, view/download kit, select/undo primary, correct/remove kit-only item, submit a replacement and have a distinct authorized reviewer decide it. Include existing-picture publication, an unrelated profile edit, a stale selection, a protected same-asset reselection, revoked authority and same-key lost-response recovery. Use existing disposable staging identities/resources and runtime; keep raw tokens/upload targets out of public evidence.
+- [ ] **Prove website:** exercise the same staging publisher/reviewer capabilities through browser UI; capture public kit and unchanged/selected/restored picture screenshots on desktop/mobile. Check the deployed feature gate and public field visibility. A receipt alone is insufficient if the asset does not render or download.
+- [ ] **Independent review and one PR:** fix findings, commit the migration/proof/docs round, run whole-branch review and required checks. Publish the PR when authorized. Each change round uses a fresh implementer and independent reviewer; handle/reply to/resolve valid review threads before pushing. After the latest commit's 30-minute window, refresh exact-head checks, PR comments, threads, reviews, mutable AI summaries and mergeability. Do not merge automatically.
+- [ ] **Deployment handoff:** provide the bounded migration dry-run report, Karly exact-resource correction preview, backend/web ordering and hosted evidence. With production authorization, apply reviewed conversion/correction and verify production kit/download/placement state. Planning or implementation approval alone is not authorization for those live actions.
+
+## Completion and handoff
+
+All acceptance items in the approved spec map to Tasks 1-6. Claimed-profile owner-notification proposals remain documented follow-up work, without scaffolding in this PR. Stop after this plan is reviewed; then execute with the already selected subagent implement/review method.

From 4b502d12e91d0cab04da6eca151ebb8ad567718e Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Thu, 1 Oct 2026 03:20:59 -0400
Subject: [PATCH 03/28] docs: bind correction to selection provenance

---
 docs/superpowers/plans/2026-10-01-media-kit-publication.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/superpowers/plans/2026-10-01-media-kit-publication.md b/docs/superpowers/plans/2026-10-01-media-kit-publication.md
index 753b384d..9128f3b5 100644
--- a/docs/superpowers/plans/2026-10-01-media-kit-publication.md
+++ b/docs/superpowers/plans/2026-10-01-media-kit-publication.md
@@ -179,7 +179,7 @@ No new storage abstraction, review service, permission framework, or notificatio
 
 **Interfaces:** Export an operator-only internal mutation `convertBatch({ dryRun: boolean, cursor: string | null, limit: number })` returning `{ scanned, changed, skipped, conflicts, continueCursor, isDone }`, with limit `1..40`. Dry-run is the default in its operator wrapper. It converts pending uploaded proposals to `kit_asset`/gallery and increments review revision without changing uploaded bytes or historical receipts. It also backfills immutable source-submission provenance only from unique matching approved records.
 
-For the explicit correction, export internal `correctPrimaryToKit({ dryRun: boolean, submissionId, expectedAssetId, expectedPlacementId, expectedPlacementUpdatedAt })`. Require exact current public asset/profile linkage and unchanged eligible primary placement; return a report/refusal, never select another image. Karly's current approved submission is `x1747ftcbeq1k475kz4hqdn77d8fcz0r`; resolve current IDs in dry-run, do not hardcode guessed asset IDs. Keep production correction separate from generic conversion.
+For the explicit correction, export internal `correctPrimaryToKit({ dryRun: boolean, submissionId, expectedAssetId, expectedPlacementId, expectedPlacementUpdatedAt, expectedSelectionOperationId: string | null })`. Require exact current public asset/profile linkage and unchanged eligible primary placement, including its selection provenance; return a report/refusal, never select another image. Karly's current approved submission is `x1747ftcbeq1k475kz4hqdn77d8fcz0r`; resolve current IDs in dry-run, do not hardcode guessed asset IDs. Keep production correction separate from generic conversion.
 
 - [ ] **Write tests:** repeated conversion changes nothing twice; stored candidate/digest and source stay intact; old review versions refuse; a refreshed pending proposal publishes without re-upload. Already consumed/public assets keep one published charge. Nonunique legacy provenance is skipped, not guessed. Private, claimed, changed or protected primary records refuse the exact correction, while the permitted correction leaves an active public gallery asset and no authored primary placement.
 - [ ] **Run to failure:** `node --conditions=import --import tsx --test tests/backend/media-kit-publication-migration.test.ts`.

From b1bc1f5bec31bd701c42e3a7df799ae1e2b4fab4 Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Thu, 1 Oct 2026 03:29:13 -0400
Subject: [PATCH 04/28] chore: ignore local development worktrees

---
 .gitignore | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.gitignore b/.gitignore
index 2ffda6ca..5b2b593b 100644
--- a/.gitignore
+++ b/.gitignore
@@ -54,3 +54,6 @@ __pycache__/
 
 # Claude Code personal settings
 .claude/settings.local.json
+
+# Local isolated development checkouts
+.worktrees/

From 8345c94931d467982e9f5f3ef6190aafc818c232 Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Fri, 2 Oct 2026 03:23:38 -0400
Subject: [PATCH 05/28] feat: publish media contributions into the kit

---
 convex/_mediaReview.ts                        | 110 ++++--------
 convex/_profileAssets.ts                      |   1 +
 convex/_trustedPublication.ts                 | 106 ++----------
 convex/contributionUploads.ts                 |  25 +--
 convex/profileMediaSubmissions.ts             |  58 +++----
 convex/schema.ts                              |   3 +
 docs/engineering/media-review-commands.md     |  74 ++++----
 packages/api-contracts/src/media-review.ts    |   2 +
 .../api-contracts/tests/media-review.test.ts  |  11 ++
 ...ed-mcp-profile-media-contributions.test.ts |   2 +-
 tests/backend/media-review-assignment.test.ts |   3 +-
 tests/backend/media-review-authority.test.ts  |   8 +-
 .../backend/profile-media-submissions.test.ts |  43 ++---
 tests/backend/trusted-publication.test.ts     | 160 ++++++++++--------
 14 files changed, 252 insertions(+), 354 deletions(-)

diff --git a/convex/_mediaReview.ts b/convex/_mediaReview.ts
index 9b2b60c6..871e3c4f 100644
--- a/convex/_mediaReview.ts
+++ b/convex/_mediaReview.ts
@@ -250,7 +250,7 @@ export async function applyReviewDecision(
   }
   if (
     profile.updatedAt !== args.expectedProfileUpdatedAt ||
-    (args.decision === "approve" &&
+    (submission.requestKind === "identity_placement" && args.decision === "approve" &&
       profile.updatedAt !== submission.targetProfileUpdatedAt)
   ) {
     throw new ConvexError({
@@ -310,14 +310,14 @@ export async function applyReviewDecision(
     )
     .first();
   if (
-    (currentPlacement?.assetId ?? undefined) !==
-    submission.targetPlacementAssetId
+    submission.requestKind === "identity_placement" &&
+    (currentPlacement?.assetId ?? undefined) !== submission.targetPlacementAssetId
   ) {
     throw new Error(
       "The profile media placement changed. Refresh before deciding.",
     );
   }
-  if (await privateReplacementRequiresElevatedAccess(
+  if (submission.requestKind === "identity_placement" && await privateReplacementRequiresElevatedAccess(
     ctx, profile._id, currentPlacement?.assetId,
     ownsProfile || access.superAdmin,
   )) throw new Error("Private replacement requires profile owner or admin access.");
@@ -335,17 +335,7 @@ export async function applyReviewDecision(
       throw new Error("This image is already published on the profile.");
   }
 
-  const finalPlacement = args.finalPlacement ?? submission.requestedPlacement;
-  if (
-    (profile.profileType === "person" && finalPlacement !== "profile_image") ||
-    (profile.profileType === "community" && finalPlacement !== "primary_logo")
-  ) {
-    throw new Error(
-      "That media placement is not available for this profile type.",
-    );
-  }
-  const finalLabel =
-    "label" in args ? sanitizeProfileAssetLabel(args.label) : submission.label;
+  const finalLabel = sanitizeProfileAssetLabel("label" in args ? args.label : submission.label) ?? "Image";
   const finalAltText =
     "altText" in args
       ? sanitizeProfileAssetAltText(args.altText)
@@ -377,7 +367,7 @@ export async function applyReviewDecision(
         altText: finalAltText,
         credit: finalCredit,
         creditUrl: finalCreditUrl,
-        placements: [finalPlacement],
+        placements: ["gallery"],
       },
     ],
     source: "community_submitted",
@@ -514,6 +504,13 @@ export async function reviewSnapshot(
         .unique(),
     ),
   );
+  const kitAsset = submission.requestKind !== "identity_placement";
+  const restrictions = await Promise.all([
+    ctx.db.query("mediaPublicationRestrictions").withIndex("by_profileId_kind", q => q.eq("profileId", profile._id).eq("kind", "identity")).collect(),
+    ctx.db.query("mediaPublicationRestrictions").withIndex("by_profileId_kind", q => q.eq("profileId", profile._id).eq("kind", "dispute")).collect(),
+    submission.contentSha256 ? ctx.db.query("mediaPublicationRestrictions").withIndex("by_contentSha256_kind", q => q.eq("contentSha256", submission.contentSha256).eq("kind", "rejection")).collect() : [],
+    submission.contentSha256 ? ctx.db.query("mediaPublicationRestrictions").withIndex("by_contentSha256_kind", q => q.eq("contentSha256", submission.contentSha256).eq("kind", "suppression")).collect() : [],
+  ]);
   const reviewVersion = await hash({
     candidate: {
       id: submission._id,
@@ -531,23 +528,31 @@ export async function reviewSnapshot(
       label: submission.label,
       altText: submission.altText,
       expiresAt: submission.expiresAt,
-      targetProfileUpdatedAt: submission.targetProfileUpdatedAt,
-      targetPlacementAssetId: submission.targetPlacementAssetId,
+      targetProfileUpdatedAt: kitAsset ? undefined : submission.targetProfileUpdatedAt,
+      targetPlacementAssetId: kitAsset ? undefined : submission.targetPlacementAssetId,
       requestedPlacement: submission.requestedPlacement,
+      requestKind: submission.requestKind,
+      candidateAssetId: submission.candidateAssetId,
     },
     intent,
-    profile,
-    placement,
-    currentAsset,
-    currentAutomaticImageUrl,
-    authoredPlacements,
-    artworkEvidence: artworkEvidence.map((row) => row && ({
+    restrictions,
+    profile: kitAsset ? {
+      id: profile._id, profileType: profile.profileType, slug: profile.slug,
+      displayName: profile.displayName, claimState: profile.claimState,
+      publicationState: profile.publicationState, publicSurfacingState: profile.publicSurfacingState,
+      fieldVisibility: profile.fieldVisibility,
+    } : profile,
+    placement: kitAsset ? undefined : placement,
+    currentAsset: kitAsset ? undefined : currentAsset,
+    currentAutomaticImageUrl: kitAsset ? undefined : currentAutomaticImageUrl,
+    authoredPlacements: kitAsset ? undefined : authoredPlacements,
+    artworkEvidence: kitAsset ? undefined : artworkEvidence.map((row) => row && ({
       key: row.key, kind: row.kind, locator: row.locator, provider: row.provider,
       status: row.status, entityId: row.entityId, artworkSourceUrl: row.artworkSourceUrl,
       artworkType: row.artworkType, observedAt: row.observedAt,
     })),
-    currentImage,
-    effectiveAsset,
+    currentImage: kitAsset ? undefined : currentImage,
+    effectiveAsset: kitAsset ? undefined : effectiveAsset,
     revision: submission.reviewRevision ?? 0,
   });
   return {
@@ -637,11 +642,13 @@ export async function decideReviewCommand(
     code = "review_changed";
   else if (
     args.decision === "approve" &&
+    submission.requestKind === "identity_placement" &&
     profile.updatedAt !== submission.targetProfileUpdatedAt
   )
     code = "target_changed";
   else if (
     args.decision === "approve" &&
+    submission.requestKind === "identity_placement" &&
     (snapshot.currentPlacement?.assetId ?? undefined) !==
       submission.targetPlacementAssetId
   )
@@ -651,19 +658,13 @@ export async function decideReviewCommand(
   else if (args.decision === "approve" && snapshot.candidate.rendition === null)
     code = "candidate_unavailable";
   if (code === undefined && args.decision === "approve" &&
+    submission.requestKind === "identity_placement" &&
     await privateReplacementRequiresElevatedAccess(
       ctx, profile._id, snapshot.currentPlacement?.assetId,
       authority.ownsProfile || authority.access.superAdmin,
     )) code = "private_replacement_requires_owner_or_admin";
   if (code === undefined && args.decision === "approve") {
-    if (
-      (profile.profileType === "person" &&
-        submission.requestedPlacement !== "profile_image") ||
-      (profile.profileType === "community" &&
-        submission.requestedPlacement !== "primary_logo")
-    )
-      code = "placement_unavailable";
-    else if (!submission.credit.trim()) code = "credit_required";
+    if (!submission.credit.trim()) code = "credit_required";
     else if (submission.contentSha256 !== undefined) {
       const duplicate = await ctx.db
         .query("profileAssets")
@@ -678,46 +679,7 @@ export async function decideReviewCommand(
     }
   }
   if (code === undefined && args.decision === "approve") {
-    let retiringPublicAsset = 0;
-    if (snapshot.currentPlacement !== null) {
-      const asset = await ctx.db.get(snapshot.currentPlacement.assetId);
-      if (
-        asset !== null &&
-        asset.profileId === profile._id &&
-        asset.state === "active" &&
-        asset.visibility === "public" &&
-        asset.retiredAt === undefined
-      ) {
-        const [before, after] = await Promise.all([
-          ctx.db
-            .query("profileAssetPlacements")
-            .withIndex("by_assetId_state_placement", (q) =>
-              q
-                .eq("assetId", asset._id)
-                .eq("state", "active")
-                .lt("placement", submission.requestedPlacement),
-            )
-            .first(),
-          ctx.db
-            .query("profileAssetPlacements")
-            .withIndex("by_assetId_state_placement", (q) =>
-              q
-                .eq("assetId", asset._id)
-                .eq("state", "active")
-                .gt("placement", submission.requestedPlacement),
-            )
-            .first(),
-        ]);
-        if (before === null && after === null) retiringPublicAsset = 1;
-      }
-    }
-    if (
-      !(await hasProfileAssetCapacity(
-        ctx.db,
-        profile._id,
-        1 - retiringPublicAsset,
-      ))
-    )
+    if (!(await hasProfileAssetCapacity(ctx.db, profile._id, 1)))
       code = "capacity_exceeded";
   }
   const receipt: CommandReceipt = {
diff --git a/convex/_profileAssets.ts b/convex/_profileAssets.ts
index 6b059aff..23a201f9 100644
--- a/convex/_profileAssets.ts
+++ b/convex/_profileAssets.ts
@@ -796,6 +796,7 @@ export async function consumeProfileAssetUploads(
     const creditUrl = sanitizeProfileAssetCreditUrl(upload.creditUrl);
     validateProfileAssetGalleryPlacements(upload.placements, label);
     const assetId = await db.insert("profileAssets", {
+      ...(input.approvedSubmissionId === undefined ? {} : { sourceSubmissionId: input.approvedSubmissionId }),
       profileId: input.profileId,
       storageKey: intent.storageKey,
       ...(intent.sourceStorageKey !== undefined && intent.sourceContentSha256 !== undefined
diff --git a/convex/_trustedPublication.ts b/convex/_trustedPublication.ts
index e380f20c..c34546ce 100644
--- a/convex/_trustedPublication.ts
+++ b/convex/_trustedPublication.ts
@@ -11,6 +11,7 @@ import {
 import {
   consumeProfileAssetUploads,
   hasProfileAssetCapacity,
+  sanitizeProfileAssetLabel,
 } from "./_profileAssets";
 import {
   mediaPublicationSchema,
@@ -27,13 +28,6 @@ export type PublicationFacts = {
   ownSubmission: boolean;
   sourceRecorded: boolean;
   credit: string;
-  identityConfirmed: boolean;
-  attributionConfirmed: boolean;
-  publicationPermitted: boolean;
-  noKnownRestrictions: boolean;
-  currentPlacement: unknown | null;
-  legacyImageUrl: string | null;
-  automaticImageUrl: string | null;
   priorSuppression: boolean;
   priorRejection: boolean;
   unresolvedDispute: boolean;
@@ -45,13 +39,6 @@ export function eligible(f: PublicationFacts): boolean {
     f.ownSubmission &&
     f.sourceRecorded &&
     !!f.credit.trim() &&
-    f.identityConfirmed &&
-    f.attributionConfirmed &&
-    f.publicationPermitted &&
-    f.noKnownRestrictions &&
-    f.currentPlacement === null &&
-    !f.legacyImageUrl &&
-    !f.automaticImageUrl &&
     !f.priorSuppression &&
     !f.priorRejection &&
     !f.unresolvedDispute
@@ -108,28 +95,15 @@ async function digest(value: unknown) {
     (b) => b.toString(16).padStart(2, "0"),
   ).join("");
 }
-// Candidate-only revision keeps declarations stable across target refreshes, but never across evidence edits.
-export function evidenceRevision(submission: Doc<"profileMediaSubmissions">) {
-  return digest({
-    submissionId: submission._id,
-    submitterUserId: submission.submitterUserId,
-    originalFileName: submission.originalFileName,
-    contributorNote: submission.contributorNote,
-    label: submission.label,
-    altText: submission.altText,
-    hash: submission.contentSha256,
-    intent: submission.uploadIntentId,
-    sourceUrl: submission.sourceUrl,
-    sourceKind: submission.sourceKind,
-    sourceDescription: submission.sourceDescription,
-    credit: submission.credit,
-    creditUrl: submission.creditUrl,
-    placement: submission.requestedPlacement,
-    profileId: submission.profileId,
-  });
+export function publicationCommand(ctx: MutationCtx, input: MediaPublication, actor: ReviewActor): Promise<CommandReceipt> {
+  return publicationOrLegacyDeclaration(ctx, input, actor);
 }
 
-export async function publicationCommand(
+export function legacyDeclarationCommand(ctx: MutationCtx, input: PublicationEvidence, actor: ReviewActor): Promise<CommandReceipt> {
+  return publicationOrLegacyDeclaration(ctx, input, actor, true);
+}
+
+async function publicationOrLegacyDeclaration(
   ctx: MutationCtx,
   input: MediaPublication | PublicationEvidence,
   actor: ReviewActor,
@@ -168,7 +142,7 @@ export async function publicationCommand(
           code: "idempotency_conflict",
         };
   const snapshot = await reviewSnapshot(ctx, submission, profile);
-  const revision = await evidenceRevision(submission);
+
   let code =
     process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED !== "true"
       ? "review_disabled"
@@ -181,24 +155,8 @@ export async function publicationCommand(
             : !snapshot.candidate.rendition || !submission.contentSha256
               ? "candidate_unavailable"
               : undefined;
+  if (declaration) code = "declaration_retired";
   if (!declaration && !code) {
-    const otherImage = await ctx.db
-      .query("profileAssetPlacements")
-      .withIndex("by_profileId_placement_state_position", (q) =>
-        q
-          .eq("profileId", profile._id)
-          .eq(
-            "placement",
-            submission.requestedPlacement === "profile_image"
-              ? "primary_logo"
-              : "profile_image",
-          )
-          .eq("state", "active"),
-      )
-      .first();
-    const evidence = submission.publicationEvidenceId
-      ? await ctx.db.get(submission.publicationEvidenceId)
-      : null;
     const [
       identityRestriction,
       disputeRestriction,
@@ -262,10 +220,6 @@ export async function publicationCommand(
       await ctx.db.patch(submission._id, {
         priorRestrictionId: restriction._id,
       });
-    const confirmed =
-      evidence?.actorUserId === actor.user._id &&
-      evidence.submissionId === submission._id &&
-      evidence.candidateVersion === revision;
     if (
       !eligible({
         publisherGrant: access.canPublishMedia,
@@ -277,30 +231,12 @@ export async function publicationCommand(
           (submission.sourceKind === "local" &&
             !!submission.sourceDescription?.trim()),
         credit: submission.credit,
-        identityConfirmed: confirmed && evidence.identityConfirmed,
-        attributionConfirmed: confirmed && evidence.attributionConfirmed,
-        publicationPermitted: confirmed && evidence.publicationPermitted,
-        noKnownRestrictions: confirmed && evidence.noKnownRestrictions,
-        currentPlacement: snapshot.currentPlacement ?? otherImage,
-        legacyImageUrl: snapshot.currentAvatarImageUrl,
-        automaticImageUrl: snapshot.currentAutomaticImageUrl,
         priorSuppression: !!suppressedAsset,
         priorRejection: !!priorRejected,
         unresolvedDispute: !!restriction,
       })
     )
       code = "independent_review_required";
-    else if (profile.updatedAt !== submission.targetProfileUpdatedAt)
-      code = "target_changed";
-    else if (submission.targetPlacementAssetId !== undefined)
-      code = "independent_review_required";
-    else if (
-      (profile.profileType === "person" &&
-        submission.requestedPlacement !== "profile_image") ||
-      (profile.profileType === "community" &&
-        submission.requestedPlacement !== "primary_logo")
-    )
-      code = "placement_unavailable";
     else if (!(await hasProfileAssetCapacity(ctx.db, profile._id, 1)))
       code = "capacity_exceeded";
   }
@@ -310,23 +246,7 @@ export async function publicationCommand(
     operationState: code ? "refused" : "committed",
     ...(code ? { code } : {}),
   };
-  if (!code && declaration) {
-    const values = publicationEvidenceSchema.parse(args);
-    const evidenceId = await ctx.db.insert("mediaPublicationEvidence", {
-      submissionId: submission._id,
-      actorUserId: actor.user._id,
-      candidateVersion: revision,
-      identityConfirmed: values.identityConfirmed,
-      attributionConfirmed: values.attributionConfirmed,
-      publicationPermitted: values.publicationPermitted,
-      noKnownRestrictions: values.noKnownRestrictions,
-      createdAt: Date.now(),
-    });
-    await ctx.db.patch(submission._id, {
-      publicationEvidenceId: evidenceId,
-      reviewRevision: (submission.reviewRevision ?? 0) + 1,
-    });
-  } else if (!code) {
+  if (!code) {
     const intent = submission.uploadIntentId
       ? await ctx.db.get(submission.uploadIntentId)
       : null;
@@ -340,11 +260,11 @@ export async function publicationCommand(
         {
           intentId: intent._id,
           uploadToken: intent.uploadToken,
-          label: submission.label,
+          label: sanitizeProfileAssetLabel(submission.label) ?? "Image",
           altText: submission.altText,
           credit: submission.credit,
           creditUrl: submission.creditUrl,
-          placements: [submission.requestedPlacement],
+          placements: ["gallery"],
         },
       ],
       source: "community_submitted",
diff --git a/convex/contributionUploads.ts b/convex/contributionUploads.ts
index 5528901d..5f044415 100644
--- a/convex/contributionUploads.ts
+++ b/convex/contributionUploads.ts
@@ -109,18 +109,18 @@ async function target(
   actor: Id<"users">,
   profileId: Id<"profiles">,
   mode: "owner" | "contributor",
-  placement: "profile_image" | "primary_logo",
+  placement: "profile_image" | "primary_logo" | "gallery",
   expected: number,
 ) {
   const profile = await ctx.db.get(profileId);
   if (!profile || profile.updatedAt !== expected)
     throw new ConvexError({ code: "UPLOAD_TARGET_CHANGED" });
+  if (mode === "contributor") return assertEligibleTarget(profile, "gallery");
   if (
     (profile.profileType === "person" ? "profile_image" : "primary_logo") !==
     placement
   )
     throw new ConvexError({ code: "UPLOAD_PLACEMENT_INVALID" });
-  if (mode === "contributor") return assertEligibleTarget(profile, placement);
   if (
     profile.claimState === "unclaimed" ||
     !(await userOwnsProfile(ctx.db, profileId, actor))
@@ -443,15 +443,6 @@ export const begin = internalMutation({
       tokenIdentifier: `api:${actorUserId}`,
     };
     const expiresAt = now + 10 * 60 * 1000;
-    const placement = await ctx.db
-      .query("profileAssetPlacements")
-      .withIndex("by_profileId_placement_state_position", (q) =>
-        q
-          .eq("profileId", profile._id)
-          .eq("placement", request.placement)
-          .eq("state", "active"),
-      )
-      .first();
     const submissionId =
       request.mode === "owner"
         ? undefined
@@ -461,14 +452,15 @@ export const begin = internalMutation({
             targetProfileDisplayName: profile.displayName,
             submitterUserId: actorUserId,
             submitter: subject,
-            requestedPlacement: request.placement,
+            requestKind: "kit_asset",
+            requestedPlacement: "gallery",
             sourceUrl,
             sourceKind: "local",
             sourceDescription: request.sourceDescription,
             credit: request.credit,
             status: "upload_pending",
             targetProfileUpdatedAt: profile.updatedAt,
-            targetPlacementAssetId: placement?.assetId,
+
             expiresAt,
             createdAt: now,
             updatedAt: now,
@@ -481,8 +473,9 @@ export const begin = internalMutation({
       mimeType: request.contentType,
       byteSize: request.byteLength,
       credit: request.credit,
+      ...(request.mode === "owner" ? {} : { label: "Image" }),
       sourceUrl,
-      placements: [request.placement],
+      placements: [request.mode === "owner" ? request.placement : "gallery"],
       source:
         request.mode === "owner" ? "owner_authored" : "community_submitted",
       purpose:
@@ -583,7 +576,7 @@ export const claim = internalMutation({
       args.actorUserId,
       row.profileId,
       row.mode,
-      intent.placements![0] as "profile_image" | "primary_logo",
+      intent.placements![0] as "profile_image" | "primary_logo" | "gallery",
       row.expectedUpdatedAt,
     );
     if (row.expiresAt <= Date.now())
@@ -770,7 +763,7 @@ export const complete = internalMutation({
       args.actorUserId,
       row.profileId,
       row.mode,
-      intent.placements![0] as "profile_image" | "primary_logo",
+      intent.placements![0] as "profile_image" | "primary_logo" | "gallery",
       row.expectedUpdatedAt,
     );
     if (
diff --git a/convex/profileMediaSubmissions.ts b/convex/profileMediaSubmissions.ts
index c248f0ab..8d9496ab 100644
--- a/convex/profileMediaSubmissions.ts
+++ b/convex/profileMediaSubmissions.ts
@@ -1,6 +1,6 @@
 import { assertLiveContributionToken } from "./_contributionAuth";
 import { effectiveContributionPolicy, contributionChargeRefusal, registerLegacyContribution, reservationBytes } from "./_contributionCapacity";
-import { requirePublisher, publicationCommand, recordPublicationRestriction } from "./_trustedPublication";
+import { requirePublisher, publicationCommand, legacyDeclarationCommand, recordPublicationRestriction } from "./_trustedPublication";
 import { readScopedPagination, writeScopedPagination } from "./_reviewCursor";
 import type { PaginationOptions } from "convex/server";
 import { activeBatchAssignment, hash } from "./_mediaReview";
@@ -42,7 +42,7 @@ import { requireMcpAttributionText, requireSha256Hex } from "./_mcpWriteReceipts
 const OPEN_SUBMISSION_STATUSES = ["upload_pending", "submitted", "under_review"] as const;
 
 const submissionId = v.id("profileMediaSubmissions");
-const requestedPlacement = v.union(v.literal("profile_image"), v.literal("primary_logo"));
+const requestedPlacement = v.union(v.literal("profile_image"), v.literal("primary_logo"), v.literal("gallery"));
 const reviewQueueStatus = v.union(
   v.literal("submitted"),
   v.literal("under_review"),
@@ -230,7 +230,7 @@ export async function assertSubmissionRateLimits(
 
 export function assertEligibleTarget(
   profile: Doc<"profiles"> | null,
-  placement: "profile_image" | "primary_logo",
+  placement: "profile_image" | "primary_logo" | "gallery",
 ) {
   if (
     profile === null ||
@@ -249,8 +249,8 @@ export function assertEligibleTarget(
     });
   }
   if (
-    (profile.profileType === "person" && placement !== "profile_image") ||
-    (profile.profileType === "community" && placement !== "primary_logo")
+    placement !== "gallery" && ((profile.profileType === "person" && placement !== "profile_image") ||
+    (profile.profileType === "community" && placement !== "primary_logo"))
   ) {
     throw new ConvexError({
       code: "MEDIA_PLACEMENT_INVALID",
@@ -279,6 +279,8 @@ function publicSubmission(
       : profile.displayName,
     profileIsPublic,
     profileType: profile.profileType,
+    requestKind: submission.requestKind,
+    candidateAssetId: submission.candidateAssetId,
     requestedPlacement: submission.requestedPlacement,
     status: submission.status,
     ...(submission.publicationMethod ? { publicationMethod: submission.publicationMethod } : {}),
@@ -370,7 +372,7 @@ export const createUploadIntent = mutation({
     if (!(await identityEmailVerified(ctx)) || user.email === undefined) {
       throw new ConvexError({ code: "MEDIA_EMAIL_UNVERIFIED", message: "Verify email" });
     }
-    const profile = assertEligibleTarget(await ctx.db.get(args.profileId), args.requestedPlacement);
+    const profile = assertEligibleTarget(await ctx.db.get(args.profileId), "gallery");
     if (profile.updatedAt !== args.expectedProfileUpdatedAt) {
       throw new ConvexError({ code: "MEDIA_PROFILE_CHANGED", message: "Refresh profile" });
     }
@@ -394,26 +396,18 @@ export const createUploadIntent = mutation({
         message: "A source URL, file name, and credit are required.",
       });
     }
-    const label = sanitizeProfileAssetLabel(args.label);
+    const label = sanitizeProfileAssetLabel(args.label) ?? "Image";
     const altText = sanitizeProfileAssetAltText(args.altText);
     const creditUrl = sanitizeProfileAssetCreditUrl(args.creditUrl);
     const contributorNote = sanitizeNote(args.contributorNote, 500);
-    const targetPlacement = await ctx.db
-      .query("profileAssetPlacements")
-      .withIndex("by_profileId_placement_state_position", (query) =>
-        query
-          .eq("profileId", profile._id)
-          .eq("placement", args.requestedPlacement)
-          .eq("state", "active"),
-      )
-      .first();
     const submissionId = await ctx.db.insert("profileMediaSubmissions", {
       profileId: profile._id,
       targetProfileSlug: profile.slug,
       targetProfileDisplayName: profile.displayName,
       submitterUserId: user._id,
       submitter: subject,
-      requestedPlacement: args.requestedPlacement,
+      requestKind: "kit_asset",
+      requestedPlacement: "gallery",
       originalFileName,
       sourceUrl,
       ...(label !== undefined ? { label } : {}),
@@ -423,7 +417,7 @@ export const createUploadIntent = mutation({
       ...(contributorNote !== undefined ? { contributorNote } : {}),
       status: "upload_pending",
       targetProfileUpdatedAt: profile.updatedAt,
-      ...(targetPlacement === null ? {} : { targetPlacementAssetId: targetPlacement.assetId }),
+
       expiresAt: now + PROFILE_ASSET_UPLOAD_INTENT_TTL_MS,
       createdAt: now,
       updatedAt: now,
@@ -433,6 +427,7 @@ export const createUploadIntent = mutation({
       targetProfileId: profile._id,
       targetSubmissionId: submissionId,
       purpose: "community_proposal",
+      sourceUrl,
       originalFileName,
       mimeType: args.mimeType,
       byteSize: args.byteSize,
@@ -440,7 +435,7 @@ export const createUploadIntent = mutation({
       altText,
       credit,
       creditUrl,
-      placements: [args.requestedPlacement],
+      placements: ["gallery"],
       source: "community_submitted",
       now,
     });
@@ -642,7 +637,7 @@ export const prepareMcpMediaSubmission = internalMutation({
     try {
       sourceUrl = normalizeProfileAssetSourceUrl(normalizeMcpSubmissionSourceUrl(args.sourceUrl));
       credit = sanitizeProfileAssetCredit(args.credit);
-      label = sanitizeProfileAssetLabel(args.label);
+      label = sanitizeProfileAssetLabel(args.label) ?? "Image";
       altText = sanitizeProfileAssetAltText(args.altText);
       creditUrl = sanitizeProfileAssetCreditUrl(args.creditUrl);
     } catch {
@@ -652,15 +647,6 @@ export const prepareMcpMediaSubmission = internalMutation({
       return await refuse("MCP_MEDIA_INPUT_INVALID");
     }
     const contributorNote = sanitizeNote(args.contributorNote, 500);
-    const targetPlacement = await ctx.db
-      .query("profileAssetPlacements")
-      .withIndex("by_profileId_placement_state_position", (query) =>
-        query
-          .eq("profileId", eligible._id)
-          .eq("placement", "profile_image")
-          .eq("state", "active"),
-      )
-      .first();
     const subject = mcpContributorSubject(actor._id);
     const submissionId = await ctx.db.insert("profileMediaSubmissions", {
       profileId: eligible._id,
@@ -668,7 +654,8 @@ export const prepareMcpMediaSubmission = internalMutation({
       targetProfileDisplayName: eligible.displayName,
       submitterUserId: actor._id,
       submitter: subject,
-      requestedPlacement: "profile_image",
+      requestKind: "kit_asset",
+      requestedPlacement: "gallery",
       sourceUrl,
       ...(label === undefined ? {} : { label }),
       ...(altText === undefined ? {} : { altText }),
@@ -677,7 +664,7 @@ export const prepareMcpMediaSubmission = internalMutation({
       ...(contributorNote === undefined ? {} : { contributorNote }),
       status: "upload_pending",
       targetProfileUpdatedAt: eligible.updatedAt,
-      ...(targetPlacement === null ? {} : { targetPlacementAssetId: targetPlacement.assetId }),
+
       expiresAt: now + PROFILE_ASSET_UPLOAD_INTENT_TTL_MS,
       createdAt: now,
       updatedAt: now,
@@ -692,7 +679,7 @@ export const prepareMcpMediaSubmission = internalMutation({
       altText,
       credit,
       creditUrl,
-      placements: ["profile_image"],
+      placements: ["gallery"],
       source: "community_submitted",
       now,
     });
@@ -1364,6 +1351,8 @@ export const getCandidateForStorage = query({
 });
 
 const reviewProjectionFields = {
+  requestKind: v.optional(v.union(v.literal("kit_asset"), v.literal("identity_placement"))),
+  candidateAssetId: v.optional(v.id("profileAssets")),
   publicationMethod: v.optional(v.union(v.literal("trusted_publisher"), v.literal("independent_review"))),
   submissionId: v.id("profileMediaSubmissions"),
   profileId: v.id("profiles"),
@@ -2500,7 +2489,7 @@ export const declarePublicationEvidence = mutation({
   args: evidenceArgs,
   returns: receiptValidator,
   handler: async (ctx, args) =>
-    publicationCommand(ctx, args, await browserReviewActor(ctx), true),
+    legacyDeclarationCommand(ctx, args, await browserReviewActor(ctx)),
 });
 export const declarePublicationEvidenceForMcpActor = internalMutation({
   args: {
@@ -2517,7 +2506,7 @@ export const declarePublicationEvidenceForMcpActor = internalMutation({
       oauthResource,
       ...args },
   ) =>
-    publicationCommand(
+    legacyDeclarationCommand(
       ctx,
       args,
       await trustedReviewActor(ctx, actorUserId, {
@@ -2529,7 +2518,6 @@ export const declarePublicationEvidenceForMcpActor = internalMutation({
         },
         "assets:publish",
       ),
-      true,
     ),
 });
 export const recordPublicationDispute = mutation({
diff --git a/convex/schema.ts b/convex/schema.ts
index c8547d6b..162f8de6 100644
--- a/convex/schema.ts
+++ b/convex/schema.ts
@@ -923,6 +923,8 @@ export default defineSchema({
   }).index("by_profileId_kind", ["profileId", "kind"]).index("by_contentSha256", ["contentSha256"])
     .index("by_contentSha256_kind", ["contentSha256", "kind"]),
   profileMediaSubmissions: defineTable({
+    requestKind: v.optional(v.union(v.literal("kit_asset"), v.literal("identity_placement"))),
+    candidateAssetId: v.optional(v.id("profileAssets")),
     publicationEvidenceId: v.optional(v.id("mediaPublicationEvidence")),
     publicationMethod: v.optional(v.union(v.literal("trusted_publisher"), v.literal("independent_review"))),
     publicationActorUserId: v.optional(v.id("users")),
@@ -980,6 +982,7 @@ export default defineSchema({
     .index("by_contentSha256_status", ["contentSha256", "status"])
     .index("by_publicationMethod_actor", ["publicationMethod", "publicationActorUserId"]),
   profileAssets: defineTable({
+    sourceSubmissionId: v.optional(v.id("profileMediaSubmissions")),
     profileId: v.id("profiles"),
     storageKey: v.string(),
     sourceStorageKey: v.optional(v.string()),
diff --git a/docs/engineering/media-review-commands.md b/docs/engineering/media-review-commands.md
index b40e9387..7f093618 100644
--- a/docs/engineering/media-review-commands.md
+++ b/docs/engineering/media-review-commands.md
@@ -54,17 +54,18 @@ expected review version, approve/reject, private reason, optional public reason,
 and an idempotency key. Rejection requires a public reason. Strict runtime
 contracts reject unknown fields and bound input strings.
 
-The version hashes candidate/provenance, stored upload identity, current target,
-current placement and asset, and the submission's optional `reviewRevision`.
-Missing revisions mean zero for existing rows. Advisory start-review updates do
-not invalidate it. Approval checks the original target and placement snapshots; a
-fresh detail read does not silently rebase the proposal. Rejection remains
-available against a refreshed version when that original placement has changed.
+The version hashes candidate/provenance, stored upload identity, relevant target
+state, and the submission's optional `reviewRevision`. Missing revisions mean
+zero for existing rows. Advisory start-review updates do not invalidate it.
+Kit publication excludes unrelated biography timestamps and existing picture
+artwork. Placement inspection includes the current placement and asset.
+Meaningful evidence changes require fresh inspection. Placement changes also
+require an explicit rebase against the original selection snapshot.
 
 Successful publication and its immutable receipt commit in one transaction.
 Expected terminal refusals also persist receipts. Projected active-public-asset
-capacity is checked before writes, accounting for singleton assets that retire
-only when no other active placement remains. `capacity_exceeded` remains refused
+capacity is checked before writes, with one new asset for each uploaded kit
+contribution. `capacity_exceeded` remains refused
 when capacity later becomes available. The upload consumer retains its final
 transactional capacity assertion. Reusing a key with identical
 canonical input returns the original receipt; changed input returns
@@ -167,36 +168,33 @@ authenticated end-to-end or provider-storage test.
 
 `trusted_publisher` is a separately issued, revocable account feature. Neither
 super-admin, reviewer, application tier nor contribution capacity implies it.
-The browser uses `publisherDetail`, `declarePublicationEvidence`, and `publish`.
-MCP uses `vrdex_media_submission_get`, `vrdex_media_submission_preview`,
-`vrdex_media_submission_declare`, and `vrdex_media_submission_publish`.
-Reads require `mcp:read` and `assets:publish`; declarations and publication require
-`mcp:write` and `assets:publish`. These scopes are requestable, never defaults.
-Every backend operation requires fresh verified email and the explicit grant.
-Publisher projections are own-only and require a current public, published,
-unclaimed target. They omit private reviewer reasons and moderator identities.
-They do not confer independent reviewer authority.
+The browser uses `publisherDetail` and `publish`. MCP publication reads require
+`mcp:read` and `assets:publish`; publication requires `mcp:write` and
+`assets:publish`. These scopes are requestable, never defaults. Every backend
+operation requires fresh verified email and the explicit grant. Publisher
+projections are own-only and require a public, published, unclaimed target.
+They omit private reviewer reasons and moderator identities and do not confer
+independent reviewer authority.
 
 Publication takes exactly `{submissionId, expectedReviewVersion, idempotencyKey}`.
-Before publication, including for older pending proposals, the explicit declaration
-command takes those same fields plus four booleans: `identityConfirmed`,
-`attributionConfirmed`, `publicationPermitted`, and `noKnownRestrictions`.
-Declarations are immutable records bound to the candidate digest, target, placement,
-source reference or local provenance, and attribution. Recording one changes the
-review version. Inspect again before publishing. Absent, false or stale declarations
-require independent review. Nonempty credit or source text never implies consent
-or identity confirmation. Upload completion only submits; it never publishes.
-Choosing Independent review on the contributions page leaves the existing proposal
-in its independent-review queue and closes the publication controls locally.
-
-The publication mutation reads the current target, both image/logo placements,
-legacy image visibility, actual automatic artwork, declarations and restrictions
-in one transaction. Review versions bind authored placements and cached source
-identity/artwork records, including changes without an observed-time bump. Visible
-VRChat icons, group logos and Discord artwork fill a slot. Disabled or hidden
-fallbacks follow public rendering semantics. Existing authored placements remain
-protected even when hidden. A target version or candidate change refuses the
-inspected command. Conflicts preserve the independent-review path.
+The explicit Publish command attaches the stored uploaded contribution to gallery.
+Independent approval uses the same attachment path. Intake stores `kit_asset`
+intent and gallery placement, including legacy picture/logo inputs. Owner upload
+placement behavior is unchanged. Gallery titles use the sanitized submission label
+or `Image`. Assets retain source, credit and immutable `sourceSubmissionId`
+provenance. Upload completion submits the proposal; it never publishes.
+
+Legacy declaration endpoints remain for receipt compatibility. A same-key replay
+returns its historical receipt. A fresh declaration returns `declaration_retired`
+and creates no evidence. Existing evidence records remain untouched.
+
+Kit review versions bind the stored candidate and metadata, target identity,
+privacy, claim state and applicable restrictions. Biography-only edits and
+unrelated picture selection or automatic-artwork changes do not invalidate kit
+inspection. Identity-placement snapshots continue to bind artwork and selection
+provenance. Changed meaningful evidence requires a fresh inspection, with the
+original stored candidate bytes preserved. Existing managed, private, legacy or
+automatic pictures do not block additive kit publication or get replaced by it.
 
 Restriction history is indexed independently of mutable source URLs and collection
 item keys. Identity/dispute records restrict the target; rejection and suppression
@@ -204,7 +202,7 @@ restrict the exact content digest across targets. Legacy rejected submissions an
 suppressed assets are checked by indexed digest as well. An unrelated digest is
 not refused solely because the target once had a rejection. Matching new history
 is linked through `priorRestrictionId`. Byte-different variants are not identified
-perceptually; the explicit no-known-restrictions declaration remains required.
+perceptually.
 The digest lookup considers only rejection and suppression records. An identity or
 dispute record for another target cannot block identical bytes on this target.
 Admin `recordPublicationDispute` records identity/dispute restrictions. Existing
@@ -253,7 +251,7 @@ flowchart TD
   SignIn --> Account[/account/media-contributions]
   Account --> Own
   Own --> Withdraw[Versioned withdrawal]
-  Own --> Publisher[Separate publisher grant: inspect and declare]
+  Own --> Publisher[Separate publisher grant: inspect stored candidate]
   Publisher --> Publish[Explicit publish]
   OAuth --> Assigned[Discover assigned collections]
   Assigned --> Review[Authorized review queue]
diff --git a/packages/api-contracts/src/media-review.ts b/packages/api-contracts/src/media-review.ts
index b2a55fd8..106e0dd3 100644
--- a/packages/api-contracts/src/media-review.ts
+++ b/packages/api-contracts/src/media-review.ts
@@ -90,6 +90,8 @@ export const reviewSnapshotSchema = z.strictObject({
 export type ReviewSnapshot = z.infer<typeof reviewSnapshotSchema>;
 
 export const reviewDetailSchema = z.strictObject({
+  requestKind: z.enum(["kit_asset", "identity_placement"]).optional(),
+  candidateAssetId: boundedId.optional(),
   publicationMethod: z
     .enum(["trusted_publisher", "independent_review"])
     .optional(),
diff --git a/packages/api-contracts/tests/media-review.test.ts b/packages/api-contracts/tests/media-review.test.ts
index dc395a21..fe7cc1d7 100644
--- a/packages/api-contracts/tests/media-review.test.ts
+++ b/packages/api-contracts/tests/media-review.test.ts
@@ -113,3 +113,14 @@ it("retains an indeterminate lost response and replays the original key without
   assert.equal(writes, 1);
   assert.equal(input.decisions[0]?.idempotencyKey, "stable");
 });
+
+import { reviewDetailSchema, mediaPublicationSchema } from "../src/media-review";
+it("describes additive and placement intent without adding assertions to publication", () => {
+  const intent = reviewDetailSchema.pick({ requestKind: true, candidateAssetId: true });
+  assert.deepEqual(intent.parse({ requestKind: "kit_asset" }), { requestKind: "kit_asset" });
+  assert.equal(intent.safeParse({ requestKind: "identity_placement", candidateAssetId: "asset" }).success, true);
+  assert.equal(intent.safeParse({ requestKind: "unknown" }).success, false);
+  const command = { submissionId: "submission", expectedReviewVersion: "version", idempotencyKey: "key" };
+  assert.deepEqual(mediaPublicationSchema.parse(command), command);
+  assert.equal(mediaPublicationSchema.safeParse({ ...command, identityConfirmed: true }).success, false);
+});
diff --git a/tests/backend/hosted-mcp-profile-media-contributions.test.ts b/tests/backend/hosted-mcp-profile-media-contributions.test.ts
index 95aa20a0..63835ce0 100644
--- a/tests/backend/hosted-mcp-profile-media-contributions.test.ts
+++ b/tests/backend/hosted-mcp-profile-media-contributions.test.ts
@@ -376,7 +376,7 @@ describe("hosted MCP profile media contributions", () => {
       null,
     );
     await seeded.t.run((ctx) => ctx.db.patch(seeded.profileId, {
-      fieldVisibility: { avatarImageUrl: "private" },
+      fieldVisibility: { mediaKit: "private" },
     }));
     const privateStatus = await seeded.t.query(
       internal.profileMediaSubmissions.listMcpMediaSubmissionsForActor,
diff --git a/tests/backend/media-review-assignment.test.ts b/tests/backend/media-review-assignment.test.ts
index 2e4275cf..14328bf2 100644
--- a/tests/backend/media-review-assignment.test.ts
+++ b/tests/backend/media-review-assignment.test.ts
@@ -515,7 +515,7 @@ it("refuses assigned approval of a private replacement with a stable receipt, in
       profileId: f.s.profileId, assetId: id, placement: "profile_image",
       position: 0, state: "active", updatedAt: NOW,
     });
-    await ctx.db.patch(f.intent.submissionId, { targetPlacementAssetId: id });
+    await ctx.db.patch(f.intent.submissionId, { requestKind: "identity_placement", requestedPlacement: "profile_image", targetPlacementAssetId: id });
     return id;
   });
   const detail = await f.actor.query(api.profileMediaSubmissions.reviewDetail, {
@@ -772,6 +772,7 @@ it("manages assignments only as a verified super admin and refuses donor assignm
 });
 it("placement changes require a new explicit rebase and previously viewed versions fail", async () => {
   const f = await fixture();
+  await f.t.run(ctx => ctx.db.patch(f.intent.submissionId, { requestKind: "identity_placement", requestedPlacement: "profile_image" }));
   const args = { submissionId: f.intent.submissionId };
   const before = await f.actor.query(
     api.profileMediaSubmissions.reviewDetail,
diff --git a/tests/backend/media-review-authority.test.ts b/tests/backend/media-review-authority.test.ts
index 99abda0d..ac3057c5 100644
--- a/tests/backend/media-review-authority.test.ts
+++ b/tests/backend/media-review-authority.test.ts
@@ -15,7 +15,7 @@ process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED = "true";
 process.env.VRDEX_PROFILE_MEDIA_DIRECT_UPLOAD_ENABLED = "true";
 process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true";
 
-it("projects and versions the automatic image used by the public profile", async () => {
+it("projects automatic artwork without versioning unrelated kit state", async () => {
   const t = convexTest({ schema, modules });
   const seeded = await seed(t);
   const { intent } = await createAndUpload(t, seeded);
@@ -69,7 +69,7 @@ it("projects and versions the automatic image used by the public profile", async
   });
   assert.ok(after);
   assert.notEqual(after.currentAutomaticImageUrl, before.currentAutomaticImageUrl);
-  assert.notEqual(after.reviewVersion, before.reviewVersion);
+  assert.equal(after.reviewVersion, before.reviewVersion);
 });
 
 it("projects owner evidence separately and rechecks revoked authority on replay", async () => {
@@ -352,10 +352,10 @@ it("invalidates versions when candidate, placement or rebase evidence changes",
         idempotencyKey: change,
       },
     );
-    assert.equal(receipt.code, "review_changed", change);
+    assert.equal(receipt.code, ["candidate", "rebase"].includes(change) ? "review_changed" : undefined, change);
     assert.equal(
       (await t.run((ctx) => ctx.db.get(intent.submissionId)))?.status,
-      "submitted",
+      ["candidate", "rebase"].includes(change) ? "submitted" : "approved",
     );
   }
 });
diff --git a/tests/backend/profile-media-submissions.test.ts b/tests/backend/profile-media-submissions.test.ts
index f7318c78..88db5426 100644
--- a/tests/backend/profile-media-submissions.test.ts
+++ b/tests/backend/profile-media-submissions.test.ts
@@ -128,13 +128,14 @@ describe("unclaimed-profile media submissions", () => {
     assert.equal(after.asset?.altText, "Reviewed portrait of Community DJ.");
     assert.equal(after.asset?.credit, "Reviewed artist credit");
     assert.equal(after.asset?.creditUrl, "https://artist.example/credits");
-    assert.equal(after.placements[0]?.placement, "profile_image");
+    assert.equal(after.placements[0]?.placement, "gallery");
     assert.equal(after.submission?.approvedAssetId, decision.assetId);
 
     const publicProfile = await t.query(api.profileAssets.listPublicBySlug, {
       slug: "community-dj",
     });
-    assert.equal(publicProfile?.mediaKit.profileImage?.assetId, decision.assetId);
+    assert.equal(publicProfile?.mediaKit.profileImage, undefined);
+    assert.equal(publicProfile?.mediaKit.galleryAssets[0]?.assetId, decision.assetId);
     assert.notEqual(
       await t.query(api.profileAssets.getPublicAssetForStorage, {
         slug: "community-dj",
@@ -709,18 +710,16 @@ describe("unclaimed-profile media submissions", () => {
       });
     });
 
-    await assert.rejects(
-      t.withIdentity(seeded.moderatorIdentity).mutation(api.profileMediaSubmissions.decide, {
-        submissionId: intent.submissionId,
-        decision: "approve",
-        expectedProfileUpdatedAt: NOW,
-        privateReason: "Would replace newer owner media.",
-      }),
-      /media placement changed/i,
-    );
+    const decision = await t.withIdentity(seeded.moderatorIdentity).mutation(api.profileMediaSubmissions.decide, {
+      submissionId: intent.submissionId, decision: "approve", expectedProfileUpdatedAt: NOW, privateReason: "Add to kit.",
+    });
+    assert.equal(decision.status, "approved");
+    const placements = await t.run(ctx => ctx.db.query("profileAssetPlacements").collect());
+    assert.equal(placements.filter(p => p.placement === "profile_image" && p.state === "active").length, 1);
+    assert.equal(placements.filter(p => p.placement === "gallery").length, 1);
   });
 
-  it("retires the replaced singleton asset instead of exposing it as unplaced media", async () => {
+  it("does not retire existing deleted artwork when adding to the kit", async () => {
     const t = convexTest({ schema, modules });
     const seeded = await seed(t);
     const oldAssetId = await t.run(async (ctx) => {
@@ -775,7 +774,7 @@ describe("unclaimed-profile media submissions", () => {
     assert.equal(decision.status, "approved");
     const retiredAsset = await t.run((ctx) => ctx.db.get(oldAssetId));
     assert.equal(retiredAsset?.state, "deleted");
-    assert.equal(retiredAsset?.retiredAt !== undefined, true);
+    assert.equal(retiredAsset?.retiredAt, undefined);
     assert.equal(
       await t.query(api.profileAssets.getPublicAssetForStorage, {
         slug: "community-dj",
@@ -812,19 +811,11 @@ describe("unclaimed-profile media submissions", () => {
     const ownedProfiles = await owner.query(api.profileAssets.listOwnedMediaKitProfiles, {});
     assert.equal(
       ownedProfiles?.[0]?.assets.some((asset) => asset.assetId === oldAssetId),
-      false,
-    );
-    await assert.rejects(
-      owner.mutation(api.profileAssets.setOwnedAssetDeleted, {
-        profileId: seeded.profileId,
-        assetId: oldAssetId,
-        deleted: false,
-      }),
-      /not found/i,
+      true,
     );
   });
 
-  it("approves a singleton replacement when the profile already has twelve active assets", async () => {
+  it("refuses additive kit publication when twelve active assets use capacity", async () => {
     const t = convexTest({ schema, modules });
     const seeded = await seed(t);
     await t.run(async (ctx) => {
@@ -863,7 +854,7 @@ describe("unclaimed-profile media submissions", () => {
       submissionId: intent.submissionId, expectedReviewVersion: detail.reviewVersion, decision: "approve",
       privateReason: "Replacement approved.", idempotencyKey: "replacement-at-capacity",
     });
-    assert.equal(receipt.operationState, "committed");
+    assert.equal(receipt.code, "capacity_exceeded");
 
     const activeAssets = await t.run((ctx) =>
       ctx.db
@@ -1378,7 +1369,7 @@ describe("shared review receipts", () => {
     );
     assert.ok(detail);
     await t.run((ctx) =>
-      ctx.db.patch(seeded.profileId, { updatedAt: NOW + 1 }),
+      ctx.db.patch(seeded.profileId, { displayName: "Changed identity", updatedAt: NOW + 1 }),
     );
     const command = {
       submissionId: intent.submissionId,
@@ -1392,7 +1383,7 @@ describe("shared review receipts", () => {
       command,
     );
     assert.equal(receipt.code, "review_changed");
-    await t.run((ctx) => ctx.db.patch(seeded.profileId, { updatedAt: NOW }));
+    await t.run((ctx) => ctx.db.patch(seeded.profileId, { displayName: "Community DJ", updatedAt: NOW }));
     assert.deepEqual(
       await reviewer.mutation(
         api.profileMediaSubmissions.decideWithReceipt,
diff --git a/tests/backend/trusted-publication.test.ts b/tests/backend/trusted-publication.test.ts
index 16d13729..5c227f87 100644
--- a/tests/backend/trusted-publication.test.ts
+++ b/tests/backend/trusted-publication.test.ts
@@ -36,22 +36,6 @@ async function fixture() {
     actor.query(api.profileMediaSubmissions.publisherDetail, {
       submissionId: intent.submissionId,
     });
-  const declare = async () => {
-    const before = await detail();
-    assert.ok(before);
-    await actor.mutation(
-      api.profileMediaSubmissions.declarePublicationEvidence,
-      {
-        submissionId: intent.submissionId,
-        expectedReviewVersion: before.reviewVersion,
-        identityConfirmed: true,
-        attributionConfirmed: true,
-        publicationPermitted: true,
-        noKnownRestrictions: true,
-        idempotencyKey: crypto.randomUUID(),
-      },
-    );
-  };
   const publish = async () => {
     const before = await detail();
     assert.ok(before);
@@ -61,47 +45,43 @@ async function fixture() {
       idempotencyKey: crypto.randomUUID(),
     });
   };
-  return { t, s, intent, grantId, actor, detail, declare, publish };
+  return { t, s, intent, grantId, actor, detail, publish };
 }
-it("requires an explicit declaration and records own publication without inventing review", async () => {
+it("publishes into the kit without declarations or inventing review", async () => {
   const f = await fixture();
-  assert.equal((await f.publish()).code, "independent_review_required");
-  await f.declare();
   assert.equal((await f.publish()).operationState, "committed");
   const row = await f.t.run((ctx) => ctx.db.get(f.intent.submissionId));
   assert.equal(row?.publicationMethod, "trusted_publisher");
   assert.equal(row?.reviewer, undefined);
   assert.ok(row?.publicationOperationId);
+  const assets = await f.t.run((ctx) => ctx.db.query("profileAssets").collect());
+  assert.equal(assets[0]?.sourceSubmissionId, f.intent.submissionId);
+  assert.equal(assets[0]?.label, "Image");
+  assert.equal(assets[0]?.sourceUrl, "https://artist.example/press");
+  assert.ok((await f.t.run(ctx => ctx.db.query("contributionUploadReservations").first()))?.publishedBytes);
+  assert.deepEqual((await f.t.run((ctx) => ctx.db.query("profileAssetPlacements").collect())).map(p => p.placement), ["gallery"]);
+  assert.equal((await f.t.run((ctx) => ctx.db.query("mediaPublicationEvidence").collect())).length, 0);
   assert.equal((await f.detail())?.publicationMethod, "trusted_publisher");
 });
 for (const scenario of [
-  "legacy",
   "claimed",
   "missing_credit",
   "dispute",
   "suppression",
   "rejection",
   "revoked",
-  "changed",
 ] as const) {
   it(`refuses trusted publication: ${scenario}`, async () => {
     const f = await fixture();
-    await f.declare();
     const before = await f.detail();
     assert.ok(before);
     await f.t.run(async (ctx) => {
-      if (scenario === "legacy")
-        await ctx.db.patch(f.s.profileId, {
-          avatarImageUrl: "https://example.test/old.png",
-        });
       if (scenario === "claimed")
         await ctx.db.patch(f.s.profileId, { claimState: "claimed_verified" });
       if (scenario === "missing_credit")
         await ctx.db.patch(f.intent.submissionId, { credit: "" });
       if (scenario === "revoked")
         await ctx.db.patch(f.grantId, { state: "revoked" });
-      if (scenario === "changed")
-        await ctx.db.patch(f.s.profileId, { updatedAt: Date.now() });
       if (["dispute", "suppression", "rejection"].includes(scenario))
         await ctx.db.insert("mediaPublicationRestrictions", {
           profileId: f.s.profileId,
@@ -153,13 +133,6 @@ it("separates the publisher grant from admin and reviewer authority", () => {
     ownSubmission: true,
     sourceRecorded: true,
     credit: "Photographer",
-    identityConfirmed: true,
-    attributionConfirmed: true,
-    publicationPermitted: true,
-    noKnownRestrictions: true,
-    currentPlacement: null,
-    legacyImageUrl: null,
-    automaticImageUrl: null,
     priorSuppression: false,
     priorRejection: false,
     unresolvedDispute: false,
@@ -167,15 +140,9 @@ it("separates the publisher grant from admin and reviewer authority", () => {
   assert.equal(eligible(facts), true);
   for (const patch of [
     { publisherGrant: false, independentReviewerGrant: true },
-    { identityConfirmed: false },
-    { attributionConfirmed: false },
     { sourceRecorded: false },
-    { publicationPermitted: false },
-    { noKnownRestrictions: false },
     { ownSubmission: false },
     { publicUnclaimed: false },
-    { currentPlacement: {} },
-    { legacyImageUrl: "https://example.test/old.png" },
   ]) {
     assert.equal(eligible({ ...facts, ...patch }), false);
   }
@@ -210,7 +177,6 @@ it("publishes a community logo, preserves independent self-review refusal, and r
       updatedAt: Date.now(),
     });
   });
-  await f.declare();
   const detail = await f.detail();
   assert.ok(detail);
   assert.equal(
@@ -293,7 +259,7 @@ it("confines publisher-only detail and candidate to own public unclaimed submiss
   );
 });
 for (const kind of ["vrchat_user", "vrchat_group", "discord_guild"] as const) {
-  it(`refuses rendered ${kind} automatic artwork and versions cache changes`, async () => {
+  it(`publishes beside rendered ${kind} automatic artwork without invalidating kit inspection`, async () => {
     const f = await fixture();
     const locator =
       kind === "vrchat_user"
@@ -350,10 +316,8 @@ for (const kind of ["vrchat_user", "vrchat_group", "discord_guild"] as const) {
         observedAt: 1,
       });
     });
-    await f.declare();
     const before = await f.detail();
     assert.ok(before?.currentAutomaticImageUrl);
-    assert.equal((await f.publish()).code, "independent_review_required");
     await f.t.run((ctx) =>
       ctx.db.patch(destinationId, {
         artworkSourceUrl: "https://example.test/changed.png",
@@ -361,7 +325,7 @@ for (const kind of ["vrchat_user", "vrchat_group", "discord_guild"] as const) {
     );
     const after = await f.detail();
     assert.ok(after);
-    assert.notEqual(after.reviewVersion, before.reviewVersion);
+    assert.equal(after.reviewVersion, before.reviewVersion);
     await f.t.run((ctx) =>
       ctx.db.patch(f.s.profileId, { imageFallback: { disabled: true } }),
     );
@@ -371,7 +335,6 @@ for (const kind of ["vrchat_user", "vrchat_group", "discord_guild"] as const) {
 }
 it("keeps unrelated rejection eligible but prevents fresh URLs and item keys evading known content", async () => {
   const f = await fixture();
-  await f.declare();
   await f.t.run((ctx) =>
     ctx.db.insert("mediaPublicationRestrictions", {
       profileId: f.s.profileId,
@@ -384,7 +347,6 @@ it("keeps unrelated rejection eligible but prevents fresh URLs and item keys eva
   );
   assert.equal((await f.publish()).operationState, "committed");
   const g = await fixture();
-  await g.declare();
   await g.t.run(async (ctx) => {
     const row = await ctx.db.get(g.intent.submissionId);
     assert.ok(row);
@@ -401,8 +363,7 @@ it("keeps unrelated rejection eligible but prevents fresh URLs and item keys eva
 for (const kind of ["identity", "dispute"] as const) {
   it(`does not apply another profile's ${kind} restriction to identical bytes`, async () => {
     const f = await fixture();
-    await f.declare();
-    await f.t.run(async (ctx) => {
+      await f.t.run(async (ctx) => {
       const target = (await ctx.db.get(f.s.profileId))!;
       const { _id, _creationTime, ...fields } = target;
       const otherProfileId = await ctx.db.insert("profiles", {
@@ -424,8 +385,7 @@ for (const kind of ["identity", "dispute"] as const) {
 for (const kind of ["rejection", "suppression"] as const) {
   it(`applies another profile's ${kind} restriction to identical bytes`, async () => {
     const f = await fixture();
-    await f.declare();
-    await f.t.run(async (ctx) => {
+      await f.t.run(async (ctx) => {
       const target = (await ctx.db.get(f.s.profileId))!;
       const { _id, _creationTime, ...fields } = target;
       const otherProfileId = await ctx.db.insert("profiles", {
@@ -444,14 +404,14 @@ for (const kind of ["rejection", "suppression"] as const) {
     assert.equal((await f.publish()).code, "independent_review_required");
   });
 }
-it("invalidates declarations on changed credit or source and records correction lineage", async () => {
+it("invalidates inspection on changed credit and records correction lineage", async () => {
   const f = await fixture();
-  await f.declare();
+  const before = await f.detail();
+  assert.ok(before);
   await f.t.run((ctx) =>
     ctx.db.patch(f.intent.submissionId, { credit: "Different attribution" }),
   );
-  assert.equal((await f.publish()).code, "independent_review_required");
-  await f.declare();
+  assert.equal((await f.actor.mutation(api.profileMediaSubmissions.publish, { submissionId: f.intent.submissionId, expectedReviewVersion: before.reviewVersion, idempotencyKey: "stale-credit" })).code, "review_changed");
   const published = await f.publish();
   assert.equal(published.operationState, "committed");
   await f.t
@@ -465,9 +425,8 @@ it("invalidates declarations on changed credit or source and records correction
   );
   assert.equal(restriction?.correctionOfOperationId, published.operationId);
 });
-it("fresh transaction refuses concurrent slot fill and independent review can still approve legacy evidence", async () => {
+it("fresh transaction adds to a nonempty kit and independent review can still approve legacy evidence", async () => {
   const f = await fixture();
-  await f.declare();
   const before = await f.detail();
   assert.ok(before);
   const command = {
@@ -501,9 +460,8 @@ it("fresh transaction refuses concurrent slot fill and independent review can st
   assert.equal(
     (await f.actor.mutation(api.profileMediaSubmissions.publish, command))
       .operationState,
-    "refused",
+    "committed",
   );
-  assert.equal((await f.publish()).code, "independent_review_required");
   const row = await f.t.run((ctx) => ctx.db.get(competitor.submissionId));
   assert.equal(row?.publicationMethod, "independent_review");
   assert.ok(row?.publicationOperationId);
@@ -530,7 +488,7 @@ it("fresh transaction refuses concurrent slot fill and independent review can st
   );
 });
 
-it("records explicit unresolved declarations and local provenance without inferring truth from credit", async () => {
+it("retires fresh legacy declarations without evidence and accepts local provenance", async () => {
   const f = await fixture();
   await f.t.run((ctx) =>
     ctx.db.patch(f.intent.submissionId, {
@@ -541,7 +499,7 @@ it("records explicit unresolved declarations and local provenance without inferr
   );
   const before = await f.detail();
   assert.ok(before);
-  await f.actor.mutation(
+  const retired = await f.actor.mutation(
     api.profileMediaSubmissions.declarePublicationEvidence,
     {
       submissionId: f.intent.submissionId,
@@ -553,13 +511,12 @@ it("records explicit unresolved declarations and local provenance without inferr
       idempotencyKey: "uncertain",
     },
   );
-  assert.equal((await f.publish()).code, "independent_review_required");
-  await f.declare();
+  assert.equal(retired.code, "declaration_retired");
+  assert.equal((await f.t.run(ctx => ctx.db.query("mediaPublicationEvidence").collect())).length, 0);
   assert.equal((await f.publish()).operationState, "committed");
 });
 it("samples publisher publications with resource-bound pagination and omits legacy approvals", async () => {
   const f = await fixture();
-  await f.declare();
   const published = await f.publish();
   const admin = f.t.withIdentity(f.s.moderatorIdentity);
   const page = await admin.query(
@@ -586,3 +543,74 @@ it("samples publisher publications with resource-bound pagination and omits lega
     /Super admin/,
   );
 });
+
+for (const change of ["biography", "identity", "metadata", "privacy", "restriction"] as const) {
+  it(`kit freshness responds to ${change}`, async () => {
+    const f = await fixture();
+    const before = await f.detail();
+    assert.ok(before);
+    await f.t.run(async (ctx) => {
+      if (change === "biography") await ctx.db.patch(f.s.profileId, { bio: "Updated biography", updatedAt: Date.now() });
+      if (change === "identity") await ctx.db.patch(f.s.profileId, { displayName: "Changed identity", updatedAt: Date.now() });
+      if (change === "metadata") await ctx.db.patch(f.intent.submissionId, { credit: "Changed credit" });
+      if (change === "privacy") await ctx.db.patch(f.s.profileId, { publicSurfacingState: "opted_out" });
+      if (change === "restriction") await ctx.db.insert("mediaPublicationRestrictions", { profileId: f.s.profileId, submissionId: f.intent.submissionId, kind: "dispute", actorUserId: f.s.moderatorUserId, createdAt: Date.now() });
+    });
+    if (change !== "privacy") {
+      const after = await f.detail();
+      assert.ok(after);
+      assert.equal(after.reviewVersion === before.reviewVersion, change === "biography");
+      const receipt = await f.actor.mutation(api.profileMediaSubmissions.publish, { submissionId: f.intent.submissionId, expectedReviewVersion: before.reviewVersion, idempotencyKey: change });
+      assert.equal(receipt.operationState, change === "biography" ? "committed" : "refused");
+    } else await assert.rejects(f.publish(), /publication access/);
+  });
+}
+
+for (const visibility of ["public", "private"] as const) {
+  it(`adds gallery media without changing ${visibility} managed picture selection`, async () => {
+    const f = await fixture();
+    const oldAssetId = await f.t.run(async ctx => {
+      const assetId = await ctx.db.insert("profileAssets", {
+        profileId: f.s.profileId, storageKey: "existing.webp", mimeType: "image/webp", byteSize: 100,
+        label: "Existing", visibility, source: "owner_authored", uploadedBy: { issuer: "test", subject: "owner", tokenIdentifier: "owner" },
+        uploadedAt: Date.now(), state: "active", updatedAt: Date.now(),
+      });
+      for (const placement of ["profile_image", "gallery"] as const) await ctx.db.insert("profileAssetPlacements", {
+        profileId: f.s.profileId, assetId, placement, position: 0, state: "active", updatedAt: Date.now(),
+      });
+      return assetId;
+    });
+    const before = await f.detail(); assert.ok(before);
+    const command = { submissionId: f.intent.submissionId, expectedReviewVersion: before.reviewVersion, idempotencyKey: visibility };
+    const receipt = await f.actor.mutation(api.profileMediaSubmissions.publish, command);
+    assert.equal(receipt.operationState, "committed");
+    assert.deepEqual(await f.actor.mutation(api.profileMediaSubmissions.publish, command), receipt);
+    const placements = await f.t.run(ctx => ctx.db.query("profileAssetPlacements").collect());
+    assert.equal(placements.find(p => p.placement === "profile_image" && p.state === "active")?.assetId, oldAssetId);
+    assert.equal(placements.filter(p => p.placement === "gallery" && p.state === "active").length, 2);
+    assert.equal((await f.t.run(ctx => ctx.db.query("profileAssets").collect())).length, 2);
+    assert.equal((await f.t.run(ctx => ctx.db.query("mediaPublicationEvidence").collect())).length, 0);
+  });
+}
+it("replays historical declaration receipts without rewriting legacy evidence", async () => {
+  const f = await fixture(); const detail = await f.detail(); assert.ok(detail);
+  const args = { submissionId: f.intent.submissionId, expectedReviewVersion: detail.reviewVersion, identityConfirmed: true, attributionConfirmed: true, publicationPermitted: true, noKnownRestrictions: true, idempotencyKey: "historical" };
+  const receipt = { operationId: "old-operation", operationState: "committed" as const, resourceId: f.intent.submissionId };
+  const { hash } = await import("../../convex/_mediaReview");
+  const { publicationEvidenceSchema } = await import("../../packages/api-contracts/src/media-review");
+  await f.t.run(async ctx => {
+    const evidenceId = await ctx.db.insert("mediaPublicationEvidence", { submissionId: f.intent.submissionId, actorUserId: f.s.contributorUserId, candidateVersion: "historical", identityConfirmed: true, attributionConfirmed: true, publicationPermitted: true, noKnownRestrictions: true, createdAt: 1 });
+    await ctx.db.patch(f.intent.submissionId, { publicationEvidenceId: evidenceId });
+    await ctx.db.insert("mediaReviewReceipts", { actorUserId: f.s.contributorUserId, idempotencyKey: args.idempotencyKey, inputHash: await hash({ command: "declare", ...publicationEvidenceSchema.parse(args) }), submissionId: f.intent.submissionId, receipt, createdAt: 1 });
+  });
+  assert.deepEqual(await f.actor.mutation(api.profileMediaSubmissions.declarePublicationEvidence, args), receipt);
+  assert.equal((await f.t.run(ctx => ctx.db.query("mediaPublicationEvidence").collect())).length, 1);
+});
+
+it("publishes kit media beside a visible legacy picture", async () => {
+  const f = await fixture();
+  await f.t.run(ctx => ctx.db.patch(f.s.profileId, { avatarImageUrl: "https://example.test/legacy.webp" }));
+  assert.equal((await f.publish()).operationState, "committed");
+  assert.equal((await f.t.run(ctx => ctx.db.get(f.s.profileId)))?.avatarImageUrl, "https://example.test/legacy.webp");
+  assert.deepEqual((await f.t.run(ctx => ctx.db.query("profileAssetPlacements").collect())).map(p => p.placement), ["gallery"]);
+});

From b7d82ee208d2b4b6ca8c822fca99d3e47f76fc72 Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Fri, 2 Oct 2026 03:30:07 -0400
Subject: [PATCH 06/28] fix: bind media inspection to external identity links

---
 convex/_mediaReview.ts                       |  5 +++++
 tests/backend/media-review-authority.test.ts | 13 ++++++++++++
 tests/backend/trusted-publication.test.ts    | 21 ++++++++++++++++++++
 3 files changed, 39 insertions(+)

diff --git a/convex/_mediaReview.ts b/convex/_mediaReview.ts
index 871e3c4f..9737a0ac 100644
--- a/convex/_mediaReview.ts
+++ b/convex/_mediaReview.ts
@@ -29,6 +29,7 @@ import {
 } from "./_identity";
 import { recordPublicationRestriction } from "./_trustedPublication";
 import { isProfileFieldVisible } from "./_profileFieldVisibility";
+import { parseProfileLinkDestination } from "./_profileLinkDestination";
 import {
   automaticProfileImage,
   profileImageSources,
@@ -541,6 +542,10 @@ export async function reviewSnapshot(
       displayName: profile.displayName, claimState: profile.claimState,
       publicationState: profile.publicationState, publicSurfacingState: profile.publicSurfacingState,
       fieldVisibility: profile.fieldVisibility,
+      identityDestinations: (profile.outboundLinks ?? []).flatMap(link => {
+        const destination = parseProfileLinkDestination(link);
+        return destination ? [destination.key] : [];
+      }).sort(),
     } : profile,
     placement: kitAsset ? undefined : placement,
     currentAsset: kitAsset ? undefined : currentAsset,
diff --git a/tests/backend/media-review-authority.test.ts b/tests/backend/media-review-authority.test.ts
index ac3057c5..7ff22894 100644
--- a/tests/backend/media-review-authority.test.ts
+++ b/tests/backend/media-review-authority.test.ts
@@ -70,6 +70,19 @@ it("projects automatic artwork without versioning unrelated kit state", async ()
   assert.ok(after);
   assert.notEqual(after.currentAutomaticImageUrl, before.currentAutomaticImageUrl);
   assert.equal(after.reviewVersion, before.reviewVersion);
+  await t.run(ctx => ctx.db.patch(seeded.profileId, {
+    outboundLinks: [{ type: "vrchat_profile", label: "VRChat", source: "community_submitted",
+      url: "https://vrchat.com/home/user/usr_7023d326-083f-41fe-a3e9-27ea303b50c6" }],
+  }));
+  const changed = await actor.query(api.profileMediaSubmissions.reviewDetail, { submissionId: intent.submissionId });
+  assert.ok(changed);
+  assert.notEqual(changed.reviewVersion, after.reviewVersion);
+  const receipt = await actor.mutation(api.profileMediaSubmissions.decideWithReceipt, {
+    submissionId: intent.submissionId, expectedReviewVersion: after.reviewVersion, decision: "approve",
+    privateReason: "Inspected former identity", idempotencyKey: "old-linked-identity",
+  });
+  assert.equal(receipt.code, "review_changed");
+  assert.equal((await t.run(ctx => ctx.db.get(intent.submissionId)))?.status, "submitted");
 });
 
 it("projects owner evidence separately and rechecks revoked authority on replay", async () => {
diff --git a/tests/backend/trusted-publication.test.ts b/tests/backend/trusted-publication.test.ts
index 5c227f87..4eb39843 100644
--- a/tests/backend/trusted-publication.test.ts
+++ b/tests/backend/trusted-publication.test.ts
@@ -614,3 +614,24 @@ it("publishes kit media beside a visible legacy picture", async () => {
   assert.equal((await f.t.run(ctx => ctx.db.get(f.s.profileId)))?.avatarImageUrl, "https://example.test/legacy.webp");
   assert.deepEqual((await f.t.run(ctx => ctx.db.query("profileAssetPlacements").collect())).map(p => p.placement), ["gallery"]);
 });
+
+for (const kind of ["vrchat_user", "vrchat_group", "discord_guild"] as const) {
+  it(`requires fresh kit inspection after replacing linked ${kind} identity`, async () => {
+    const f = await fixture();
+    const url = (suffix: string) => kind === "discord_guild"
+      ? `https://discord.gg/Club${suffix}`
+      : `https://vrchat.com/home/${kind === "vrchat_user" ? "user/usr" : "group/grp"}_7023d326-083f-41fe-a3e9-27ea303b50c${suffix}`;
+    const link = { type: "website" as const, label: "Identity", source: "community_submitted" as const };
+    await f.t.run(ctx => ctx.db.patch(f.s.profileId, { outboundLinks: [{ ...link, url: url("5") }] }));
+    const before = await f.detail(); assert.ok(before);
+    await f.t.run(ctx => ctx.db.patch(f.s.profileId, { outboundLinks: [{ ...link, url: url("6") }] }));
+    const after = await f.detail(); assert.ok(after);
+    assert.notEqual(after.reviewVersion, before.reviewVersion);
+    const receipt = await f.actor.mutation(api.profileMediaSubmissions.publish, {
+      submissionId: f.intent.submissionId, expectedReviewVersion: before.reviewVersion, idempotencyKey: kind,
+    });
+    assert.equal(receipt.code, "review_changed");
+    assert.equal((await f.t.run(ctx => ctx.db.query("profileAssets").collect())).length, 0);
+    assert.equal((await f.publish()).operationState, "committed");
+  });
+}

From 134e1089ccd77b42c40bd4d946c53191fa89aacc Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Mon, 5 Oct 2026 18:52:41 -0400
Subject: [PATCH 07/28] feat: separate profile picture selection from
 publication

---
 convex/_generated/api.d.ts                    |   2 +
 convex/_mediaContributionCommands.ts          | 110 +++++++
 convex/_mediaReview.ts                        |  71 ++++-
 convex/_profileAssets.ts                      |  37 +++
 convex/_trustedPublication.ts                 |   2 +
 convex/profileAssets.ts                       |   9 +
 convex/profileMediaSubmissions.ts             |  45 ++-
 convex/schema.ts                              |   3 +
 docs/engineering/media-review-commands.md     |  23 ++
 packages/api-contracts/src/media-review.ts    |  23 ++
 .../api-contracts/tests/media-review.test.ts  |  20 ++
 .../media-contribution-commands.test.ts       | 271 ++++++++++++++++++
 tests/backend/profile-foundation.test.ts      |   5 +
 13 files changed, 608 insertions(+), 13 deletions(-)
 create mode 100644 convex/_mediaContributionCommands.ts
 create mode 100644 tests/backend/media-contribution-commands.test.ts

diff --git a/convex/_generated/api.d.ts b/convex/_generated/api.d.ts
index 4c41d5dc..c150cf6e 100644
--- a/convex/_generated/api.d.ts
+++ b/convex/_generated/api.d.ts
@@ -71,6 +71,7 @@ import type * as _localFixtures from "../_localFixtures.js";
 import type * as _mcpToolEvents from "../_mcpToolEvents.js";
 import type * as _mcpWriteReceipts from "../_mcpWriteReceipts.js";
 import type * as _mediaCleanupUrl from "../_mediaCleanupUrl.js";
+import type * as _mediaContributionCommands from "../_mediaContributionCommands.js";
 import type * as _mediaReview from "../_mediaReview.js";
 import type * as _oauth from "../_oauth.js";
 import type * as _oauthConsentTransactions from "../_oauthConsentTransactions.js";
@@ -259,6 +260,7 @@ declare const fullApi: ApiFromModules<{
   _mcpToolEvents: typeof _mcpToolEvents;
   _mcpWriteReceipts: typeof _mcpWriteReceipts;
   _mediaCleanupUrl: typeof _mediaCleanupUrl;
+  _mediaContributionCommands: typeof _mediaContributionCommands;
   _mediaReview: typeof _mediaReview;
   _oauth: typeof _oauth;
   _oauthConsentTransactions: typeof _oauthConsentTransactions;
diff --git a/convex/_mediaContributionCommands.ts b/convex/_mediaContributionCommands.ts
new file mode 100644
index 00000000..6ad9b5fe
--- /dev/null
+++ b/convex/_mediaContributionCommands.ts
@@ -0,0 +1,110 @@
+import { ConvexError } from "convex/values";
+import type { MutationCtx, QueryCtx } from "./_generated/server";
+import { getAccountFeatureAccess } from "./_accountFeatures";
+import { assertReviewActorVerified, hash, reviewSnapshot, type ReviewActor } from "./_mediaReview";
+import { selectProfileAssetIdentity, PROFILE_MEDIA_SUBMISSION_RETENTION_MS } from "./_profileAssets";
+import { effectiveContributionPolicy } from "./_contributionCapacity";
+import { assertSubmissionRateLimits, openSubmissionCountForUser, openSubmissionCountForProfile } from "./profileMediaSubmissions";
+import {
+  contributionCommandBaseSchema, contributionPlacementCommandSchema,
+  type ContributionCommandBase, type ContributionPlacementCommand,
+  type PublishedContributionDetail, type CommandReceipt,
+} from "../packages/api-contracts/src/media-review";
+
+async function contributionState(ctx: QueryCtx | MutationCtx, submissionId: string, actor: ReviewActor) {
+  assertReviewActorVerified(actor);
+  const id = ctx.db.normalizeId("profileMediaSubmissions", submissionId);
+  const submission = id ? await ctx.db.get(id) : null;
+  const profile = submission ? await ctx.db.get(submission.profileId) : null;
+  const asset = submission?.approvedAssetId ? await ctx.db.get(submission.approvedAssetId) : null;
+  if (!submission || !profile || !asset || submission.submitterUserId !== actor.user._id ||
+    submission.status !== "approved" || submission.requestKind === "identity_placement" ||
+    asset.sourceSubmissionId !== submission._id || asset.profileId !== profile._id ||
+    asset.state !== "active" || asset.visibility !== "public" || asset.retiredAt !== undefined || asset.moderatorSuppressedAt !== undefined)
+    throw new ConvexError({ code: "MEDIA_RESOURCE_UNAVAILABLE", message: "Published contribution unavailable." });
+  const placement = profile.profileType === "person" ? "profile_image" as const : "primary_logo" as const;
+  const snapshot = await reviewSnapshot(ctx, { ...submission, requestKind: "identity_placement", candidateAssetId: asset._id, requestedPlacement: placement }, profile);
+  const identityPlacements = await ctx.db.query("profileAssetPlacements").withIndex("by_profileId_state", q => q.eq("profileId", profile._id).eq("state", "active"))
+    .filter(q => q.or(q.eq(q.field("placement"), "profile_image"), q.eq(q.field("placement"), "primary_logo"))).collect();
+  const current = await ctx.db.query("profileAssetPlacements").withIndex("by_profileId_placement_state_position", q =>
+    q.eq("profileId", profile._id).eq("placement", placement).eq("state", "active")).first();
+  const access = await getAccountFeatureAccess(ctx.db, actor.user._id);
+  const restrictions = await Promise.all([
+    ctx.db.query("mediaPublicationRestrictions").withIndex("by_profileId_kind", q => q.eq("profileId", profile._id).eq("kind", "identity")).first(),
+    ctx.db.query("mediaPublicationRestrictions").withIndex("by_profileId_kind", q => q.eq("profileId", profile._id).eq("kind", "dispute")).first(),
+    asset.contentSha256 ? ctx.db.query("mediaPublicationRestrictions").withIndex("by_contentSha256_kind", q => q.eq("contentSha256", asset.contentSha256).eq("kind", "suppression")).first() : null,
+    asset.contentSha256 ? ctx.db.query("mediaPublicationRestrictions").withIndex("by_contentSha256_kind", q => q.eq("contentSha256", asset.contentSha256).eq("kind", "rejection")).first() : null,
+  ]);
+  const publicUnclaimed = profile.claimState === "unclaimed" && profile.publicationState === "published" && profile.publicSurfacingState === "public";
+  const publisher = access.canPublishMedia && publicUnclaimed && !restrictions.some(Boolean);
+  const ownSelection = !!current && current.assetId === asset._id && current.selectionActorUserId === actor.user._id &&
+    current.selectionOperationId?.startsWith("contribution-primary:") === true;
+  return { submission, profile, asset, placement, snapshot, current, identityPlacements, publisher, publicUnclaimed, restrictions, ownSelection,
+    version: await hash({ asset, source: submission, placement: current, picture: snapshot.currentImage, restrictions, publicUnclaimed, revision: snapshot.reviewVersion }) };
+}
+
+export async function publishedContributionDetail(ctx: QueryCtx | MutationCtx, submissionId: string, actor: ReviewActor): Promise<PublishedContributionDetail> {
+  const s = await contributionState(ctx, submissionId, actor);
+  const ownKitOnly = s.publicUnclaimed && !s.restrictions.some(Boolean) &&
+    !s.identityPlacements.some(row => row.assetId === s.asset._id);
+  return {
+    submissionId: s.submission._id, assetId: s.asset._id, profileId: s.profile._id, profileSlug: s.profile.slug,
+    contributionVersion: s.version,
+    metadata: { label: s.asset.label ?? "Image", altText: s.asset.altText, credit: s.asset.credit ?? "",
+      creditUrl: s.asset.creditUrl, sourceUrl: s.asset.sourceUrl, sourceDescription: s.submission.sourceDescription },
+    canSelectPrimary: s.publisher && !s.identityPlacements.length && !s.snapshot.currentImage,
+    canClearPrimary: s.publisher && s.ownSelection,
+    canEditMetadata: ownKitOnly, canRemove: ownKitOnly && s.submission.legalHoldAt === undefined,
+  };
+}
+
+async function command(ctx: MutationCtx, input: ContributionCommandBase | ContributionPlacementCommand, actor: ReviewActor, proposal: boolean): Promise<CommandReceipt> {
+  const args = proposal ? contributionCommandBaseSchema.parse(input) : contributionPlacementCommandSchema.parse(input);
+  const s = await contributionState(ctx, args.submissionId, actor);
+  const inputHash = await hash({ command: proposal ? "propose_placement" : "place_contribution", ...args });
+  const previous = await ctx.db.query("mediaReviewReceipts").withIndex("by_actorUserId_idempotencyKey", q =>
+    q.eq("actorUserId", actor.user._id).eq("idempotencyKey", args.idempotencyKey)).unique();
+  if (previous) {
+    if (!s.publicUnclaimed || (!proposal && !s.publisher) || s.restrictions.some(Boolean))
+      return { operationId: previous.receipt.operationId, operationState: "refused", code: "authority_changed" };
+    return previous.inputHash === inputHash ? previous.receipt : { operationId: previous.receipt.operationId, operationState: "refused", code: "idempotency_conflict" };
+  }
+  const selecting = "action" in args && args.action === "select_primary";
+  let code = process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED !== "true" ? "review_disabled" :
+    !s.publicUnclaimed ? "target_unavailable" : s.restrictions.some(Boolean) ? "publication_restricted" :
+    !proposal && !s.publisher ? "publisher_required" : s.version !== args.expectedContributionVersion ? "contribution_changed" :
+    !proposal && selecting && (s.identityPlacements.length || s.snapshot.currentImage) ? "primary_occupied" :
+    !proposal && !selecting && !s.ownSelection ? "selection_changed" : undefined;
+  if (!code && proposal) {
+    const now = Date.now();
+    const policy = await effectiveContributionPolicy(ctx.db, actor.user._id);
+    if (await openSubmissionCountForUser(ctx, actor.user._id, now) >= policy.limits.openActor ||
+      await openSubmissionCountForProfile(ctx, s.profile._id, now) >= policy.limits.openTarget) code = "proposal_capacity";
+    if (!code) {
+      try { await assertSubmissionRateLimits(ctx, actor.user._id, s.profile._id, now); }
+      catch { code = "proposal_rate_limited"; }
+    }
+  }
+  const receipt: CommandReceipt = { operationId: !proposal && selecting ? `contribution-primary:${crypto.randomUUID()}` : crypto.randomUUID(), operationState: code ? "refused" : "committed", resourceId: s.submission._id, ...(code ? { code } : {}) };
+  if (!code) {
+    const now = Date.now();
+    if (proposal) receipt.resourceId = await ctx.db.insert("profileMediaSubmissions", {
+      requestKind: "identity_placement", candidateAssetId: s.asset._id, profileId: s.profile._id,
+      targetProfileSlug: s.profile.slug, targetProfileDisplayName: s.profile.displayName,
+      submitterUserId: actor.user._id, submitter: actor.subject, requestedPlacement: s.placement,
+      targetProfileUpdatedAt: s.profile.updatedAt, targetPlacementAssetId: s.current?.assetId,
+      targetPlacementVersion: s.snapshot.placementTargetVersion,
+      sourceUrl: s.asset.sourceUrl, sourceKind: s.submission.sourceKind, sourceDescription: s.submission.sourceDescription,
+      credit: s.asset.credit ?? s.submission.credit, creditUrl: s.asset.creditUrl,
+      label: s.asset.label, altText: s.asset.altText, contentSha256: s.asset.contentSha256,
+      status: "submitted", expiresAt: now + PROFILE_MEDIA_SUBMISSION_RETENTION_MS, createdAt: now, updatedAt: now,
+    });
+    else if (selecting) await selectProfileAssetIdentity(ctx.db, { profileId: s.profile._id, assetId: s.asset._id, placement: s.placement, actorUserId: actor.user._id, operationId: receipt.operationId, now });
+    else await ctx.db.patch(s.current!._id, { state: "deleted", updatedAt: now });
+    await ctx.db.insert("profileAuditEvents", { profileId: s.profile._id, action: proposal ? "profile_media_placement_proposed" : selecting ? "profile_media_primary_selected" : "profile_media_primary_cleared", actor: actor.subject, sourceType: "community", createdAt: now });
+  }
+  await ctx.db.insert("mediaReviewReceipts", { actorUserId: actor.user._id, submissionId: s.submission._id, idempotencyKey: args.idempotencyKey, inputHash, receipt, createdAt: Date.now() });
+  return receipt;
+}
+export function contributionPlacementCommand(ctx: MutationCtx, input: ContributionPlacementCommand, actor: ReviewActor) { return command(ctx, input, actor, false); }
+export function proposeContributionPlacement(ctx: MutationCtx, input: ContributionCommandBase, actor: ReviewActor) { return command(ctx, input, actor, true); }
diff --git a/convex/_mediaReview.ts b/convex/_mediaReview.ts
index 9737a0ac..d7616463 100644
--- a/convex/_mediaReview.ts
+++ b/convex/_mediaReview.ts
@@ -8,6 +8,7 @@ import { getAccountFeatureAccess } from "./_accountFeatures";
 import { userOwnsProfile } from "./_profileOwnership";
 import {
   consumeProfileAssetUploads,
+  selectProfileAssetIdentity,
   getPublicProfileMediaKit,
   PROFILE_MEDIA_SUBMISSION_RETENTION_MS,
   hasProfileAssetCapacity,
@@ -251,7 +252,7 @@ export async function applyReviewDecision(
   }
   if (
     profile.updatedAt !== args.expectedProfileUpdatedAt ||
-    (submission.requestKind === "identity_placement" && args.decision === "approve" &&
+    (submission.requestKind === "identity_placement" && !submission.candidateAssetId && args.decision === "approve" &&
       profile.updatedAt !== submission.targetProfileUpdatedAt)
   ) {
     throw new ConvexError({
@@ -264,7 +265,7 @@ export async function applyReviewDecision(
     throw new Error("A private review reason is required.");
   const publicDisposition = sanitizeNote(args.publicDisposition, 240);
   if (args.decision === "reject") {
-    await recordPublicationRestriction(ctx, submission, user._id, "rejection");
+    if (submission.requestKind !== "identity_placement") await recordPublicationRestriction(ctx, submission, user._id, "rejection");
     if (publicDisposition === undefined) {
       throw new Error("A contributor-visible rejection reason is required.");
     }
@@ -275,7 +276,7 @@ export async function applyReviewDecision(
       publicDisposition,
       privateReason,
       decisionProfileUpdatedAt: profile.updatedAt,
-      blobDeleteAfter: now + PROFILE_MEDIA_SUBMISSION_RETENTION_MS,
+      ...(submission.requestKind === "identity_placement" ? {} : { blobDeleteAfter: now + PROFILE_MEDIA_SUBMISSION_RETENTION_MS }),
       updatedAt: now,
     });
     await ctx.db.insert("profileAuditEvents", {
@@ -288,6 +289,31 @@ export async function applyReviewDecision(
     return { status: "rejected" as const };
   }
 
+  if (submission.requestKind === "identity_placement" && submission.candidateAssetId) {
+    const candidate = await ctx.db.get(submission.candidateAssetId);
+    const snapshot = await reviewSnapshot(ctx, submission, profile);
+    if (!candidate || !snapshot.candidate.rendition) throw new Error("The placement candidate is unavailable.");
+    if (submission.targetPlacementVersion !== snapshot.placementTargetVersion)
+      throw new Error("The profile media placement changed. Rebase before deciding.");
+    if ((snapshot.currentPlacement?.assetId ?? undefined) !== submission.targetPlacementAssetId)
+      throw new Error("The profile media placement changed. Refresh before deciding.");
+    if (await privateReplacementRequiresElevatedAccess(ctx, profile._id, snapshot.currentPlacement?.assetId, ownsProfile || access.superAdmin))
+      throw new Error("Private replacement requires profile owner or admin access.");
+    const operationId = commandEvidence?.operationId ?? crypto.randomUUID();
+    if (submission.requestedPlacement !== "profile_image" && submission.requestedPlacement !== "primary_logo")
+      throw new Error("Identity placement is invalid.");
+    await selectProfileAssetIdentity(ctx.db, { profileId: profile._id, assetId: candidate._id,
+      placement: submission.requestedPlacement, actorUserId: user._id, operationId, now });
+    if (!commandEvidence) await ctx.db.insert("mediaReviewReceipts", { actorUserId: user._id,
+      idempotencyKey: `legacy:${operationId}`, inputHash: await hash(args), submissionId: submission._id,
+      receipt: { operationId, operationState: "committed", resourceId: submission._id }, createdAt: now });
+    await ctx.db.patch(submission._id, { status: "approved", approvedAssetId: candidate._id,
+      reviewer: subject, reviewedAt: now, privateReason, publicDisposition,
+      decisionProfileUpdatedAt: profile.updatedAt, updatedAt: now });
+    await ctx.db.insert("profileAuditEvents", { profileId: profile._id, action: "profile_media_placement_approved",
+      actor: subject, sourceType: ownsProfile ? "owner" : "moderator", createdAt: now });
+    return { status: "approved" as const, assetId: candidate._id };
+  }
   if (submission.uploadIntentId === undefined) {
     throw new Error("The submitted media upload is missing.");
   }
@@ -486,7 +512,13 @@ export async function reviewSnapshot(
     submission.uploadIntentId === undefined
       ? null
       : await ctx.db.get(submission.uploadIntentId);
-  const candidateReady =
+  const candidateAsset = submission.requestKind === "identity_placement" && submission.candidateAssetId
+    ? await ctx.db.get(submission.candidateAssetId) : null;
+  const existingCandidateReady = candidateAsset !== null && candidateAsset.profileId === profile._id &&
+    candidateAsset.state === "active" && candidateAsset.visibility === "public" &&
+    candidateAsset.retiredAt === undefined && candidateAsset.moderatorSuppressedAt === undefined &&
+    candidateAsset.contentSha256 === submission.contentSha256;
+  const candidateReady = existingCandidateReady || (
     intent !== null &&
     intent.purpose === "community_proposal" &&
     intent.targetSubmissionId === submission._id &&
@@ -494,7 +526,7 @@ export async function reviewSnapshot(
     (intent.state === "uploaded" || intent.state === "consumed") &&
     submission.blobDeletedAt === undefined &&
     submission.blobCleanupToken === undefined &&
-    intent.contentSha256 === submission.contentSha256;
+    intent.contentSha256 === submission.contentSha256);
   // The hash binds the stored rendition and provenance, current target and placement,
   // and explicit rebase revision. Advisory startReview is deliberately excluded.
   const artworkEvidence = await Promise.all(
@@ -506,6 +538,17 @@ export async function reviewSnapshot(
     ),
   );
   const kitAsset = submission.requestKind !== "identity_placement";
+  const placementTargetVersion = await hash({
+    profileId: profile._id, profileType: profile.profileType, slug: profile.slug, displayName: profile.displayName,
+    claimState: profile.claimState, publicationState: profile.publicationState, publicSurfacingState: profile.publicSurfacingState,
+    fieldVisibility: profile.fieldVisibility, identityDestinations: (profile.outboundLinks ?? []).flatMap(link => {
+      const destination = parseProfileLinkDestination(link); return destination ? [destination.key] : [];
+    }).sort(),
+    placement, currentImage, currentAutomaticImageUrl,
+    currentAsset: currentAsset && { id: currentAsset._id, credit: currentAsset.credit, sourceUrl: currentAsset.sourceUrl,
+      state: currentAsset.state, visibility: currentAsset.visibility, retiredAt: currentAsset.retiredAt, moderatorSuppressedAt: currentAsset.moderatorSuppressedAt },
+    identityPlacements: authoredPlacements.filter(row => row.placement === "profile_image" || row.placement === "primary_logo"),
+  });
   const restrictions = await Promise.all([
     ctx.db.query("mediaPublicationRestrictions").withIndex("by_profileId_kind", q => q.eq("profileId", profile._id).eq("kind", "identity")).collect(),
     ctx.db.query("mediaPublicationRestrictions").withIndex("by_profileId_kind", q => q.eq("profileId", profile._id).eq("kind", "dispute")).collect(),
@@ -529,15 +572,17 @@ export async function reviewSnapshot(
       label: submission.label,
       altText: submission.altText,
       expiresAt: submission.expiresAt,
-      targetProfileUpdatedAt: kitAsset ? undefined : submission.targetProfileUpdatedAt,
+      targetProfileUpdatedAt: kitAsset || submission.candidateAssetId ? undefined : submission.targetProfileUpdatedAt,
       targetPlacementAssetId: kitAsset ? undefined : submission.targetPlacementAssetId,
       requestedPlacement: submission.requestedPlacement,
       requestKind: submission.requestKind,
       candidateAssetId: submission.candidateAssetId,
+      targetPlacementVersion: submission.targetPlacementVersion,
     },
     intent,
+    candidateAsset,
     restrictions,
-    profile: kitAsset ? {
+    profile: kitAsset || submission.candidateAssetId ? {
       id: profile._id, profileType: profile.profileType, slug: profile.slug,
       displayName: profile.displayName, claimState: profile.claimState,
       publicationState: profile.publicationState, publicSurfacingState: profile.publicSurfacingState,
@@ -546,11 +591,12 @@ export async function reviewSnapshot(
         const destination = parseProfileLinkDestination(link);
         return destination ? [destination.key] : [];
       }).sort(),
+      ...(!kitAsset ? { avatarImageUrl: profile.avatarImageUrl } : {}),
     } : profile,
     placement: kitAsset ? undefined : placement,
     currentAsset: kitAsset ? undefined : currentAsset,
     currentAutomaticImageUrl: kitAsset ? undefined : currentAutomaticImageUrl,
-    authoredPlacements: kitAsset ? undefined : authoredPlacements,
+    authoredPlacements: kitAsset ? undefined : authoredPlacements.filter(row => row.placement === "profile_image" || row.placement === "primary_logo"),
     artworkEvidence: kitAsset ? undefined : artworkEvidence.map((row) => row && ({
       key: row.key, kind: row.kind, locator: row.locator, provider: row.provider,
       status: row.status, entityId: row.entityId, artworkSourceUrl: row.artworkSourceUrl,
@@ -561,6 +607,7 @@ export async function reviewSnapshot(
     revision: submission.reviewRevision ?? 0,
   });
   return {
+    placementTargetVersion,
     reviewVersion,
     currentImage,
     currentPlacement:
@@ -648,6 +695,7 @@ export async function decideReviewCommand(
   else if (
     args.decision === "approve" &&
     submission.requestKind === "identity_placement" &&
+    !submission.candidateAssetId &&
     profile.updatedAt !== submission.targetProfileUpdatedAt
   )
     code = "target_changed";
@@ -662,6 +710,8 @@ export async function decideReviewCommand(
     code = "public_reason_required";
   else if (args.decision === "approve" && snapshot.candidate.rendition === null)
     code = "candidate_unavailable";
+  else if (args.decision === "approve" && submission.candidateAssetId &&
+    submission.targetPlacementVersion !== snapshot.placementTargetVersion) code = "placement_changed";
   if (code === undefined && args.decision === "approve" &&
     submission.requestKind === "identity_placement" &&
     await privateReplacementRequiresElevatedAccess(
@@ -670,7 +720,7 @@ export async function decideReviewCommand(
     )) code = "private_replacement_requires_owner_or_admin";
   if (code === undefined && args.decision === "approve") {
     if (!submission.credit.trim()) code = "credit_required";
-    else if (submission.contentSha256 !== undefined) {
+    else if (submission.contentSha256 !== undefined && submission.candidateAssetId === undefined) {
       const duplicate = await ctx.db
         .query("profileAssets")
         .withIndex("by_profileId_contentSha256_state", (q) =>
@@ -683,7 +733,7 @@ export async function decideReviewCommand(
       if (duplicate !== null) code = "already_published";
     }
   }
-  if (code === undefined && args.decision === "approve") {
+  if (code === undefined && args.decision === "approve" && submission.candidateAssetId === undefined) {
     if (!(await hasProfileAssetCapacity(ctx.db, profile._id, 1)))
       code = "capacity_exceeded";
   }
@@ -851,6 +901,7 @@ export async function rebaseReviewCommand(
       targetProfileDisplayName: profile.displayName,
       targetProfileUpdatedAt: profile.updatedAt,
       targetPlacementAssetId: snapshot.currentPlacement?.assetId,
+      ...(submission.candidateAssetId ? { targetPlacementVersion: snapshot.placementTargetVersion } : {}),
       reviewRevision: (submission.reviewRevision ?? 0) + 1,
       updatedAt: Date.now(),
     });
diff --git a/convex/_profileAssets.ts b/convex/_profileAssets.ts
index 23a201f9..d628690f 100644
--- a/convex/_profileAssets.ts
+++ b/convex/_profileAssets.ts
@@ -82,6 +82,31 @@ export type PublicProfileMediaKit = {
 
 export type ProfileAssetDisplayPreference = Doc<"profileAssetDisplayPreferences">;
 
+/** Change the identity slot, retaining assets that still have gallery or other placements. */
+export async function selectProfileAssetIdentity(db: DatabaseWriter, input: {
+  profileId: Id<"profiles">; assetId: Id<"profileAssets">;
+  placement: "profile_image" | "primary_logo"; actorUserId?: Id<"users">;
+  operationId?: string; now: number;
+}) {
+  const current = await db.query("profileAssetPlacements").withIndex("by_profileId_placement_state_position", q =>
+    q.eq("profileId", input.profileId).eq("placement", input.placement).eq("state", "active")).collect();
+  await Promise.all(current.map(row => db.patch(row._id, { state: "deleted", updatedAt: input.now })));
+  await db.insert("profileAssetPlacements", {
+    profileId: input.profileId, assetId: input.assetId, placement: input.placement, position: 0,
+    state: "active", updatedAt: input.now, selectionActorUserId: input.actorUserId,
+    selectionOperationId: input.operationId ?? crypto.randomUUID(),
+  });
+  for (const assetId of new Set(current.map(row => row.assetId))) {
+    if (assetId === input.assetId) continue;
+    const remaining = await db.query("profileAssetPlacements").withIndex("by_assetId_state_placement", q => q.eq("assetId", assetId).eq("state", "active")).first();
+    if (remaining) continue;
+    const asset = await db.get(assetId);
+    if (asset && asset.retiredAt === undefined) await db.patch(assetId, {
+      state: "deleted", deletedAt: asset.deletedAt ?? input.now, retiredAt: input.now, updatedAt: input.now,
+    });
+  }
+}
+
 function bytesToHex(bytes: ArrayBuffer): string {
   return [...new Uint8Array(bytes)]
     .map((byte) => byte.toString(16).padStart(2, "0"))
@@ -149,6 +174,8 @@ export async function getProfileMediaVersion(
       assetId: String(placement.assetId),
       placement: placement.placement,
       position: placement.position,
+      selectionActorUserId: placement.selectionActorUserId,
+      selectionOperationId: placement.selectionOperationId,
     }));
   const digest = await crypto.subtle.digest(
     "SHA-256",
@@ -756,6 +783,7 @@ export async function consumeProfileAssetUploads(
     uploads: ProfileAssetUploadInput[];
     source: Doc<"profileAssets">["source"];
     approvedSubmissionId?: Id<"profileMediaSubmissions">;
+    selectionActorUserId?: Id<"users">;
     bridgeAuthorized?: boolean;
     now: number;
   },
@@ -832,6 +860,15 @@ export async function consumeProfileAssetUploads(
     });
 
     for (const placement of upload.placements) {
+      if (placement === "profile_image" || placement === "primary_logo") {
+        if (seenPlacementKeys.has(placement)) continue;
+        seenPlacementKeys.add(placement);
+        const actor = input.selectionActorUserId ?? (input.requestedBy.issuer === "vrdex:api"
+          ? db.normalizeId("users", input.requestedBy.subject)
+          : (await db.query("users").withIndex("clerkUserId", q => q.eq("clerkUserId", input.requestedBy.subject)).unique())?._id);
+        await selectProfileAssetIdentity(db, { profileId: input.profileId, assetId, placement, actorUserId: actor ?? undefined, now: input.now });
+        continue;
+      }
       const orderedMultiPlacement = placement === "additional_logo" || placement === "gallery";
       const key = orderedMultiPlacement ? `${placement}:${assetId}` : placement;
       if (seenPlacementKeys.has(key)) {
diff --git a/convex/_trustedPublication.ts b/convex/_trustedPublication.ts
index c34546ce..52c8849b 100644
--- a/convex/_trustedPublication.ts
+++ b/convex/_trustedPublication.ts
@@ -156,6 +156,7 @@ async function publicationOrLegacyDeclaration(
               ? "candidate_unavailable"
               : undefined;
   if (declaration) code = "declaration_retired";
+  if (!declaration && submission.requestKind === "identity_placement") code = "placement_requires_review";
   if (!declaration && !code) {
     const [
       identityRestriction,
@@ -201,6 +202,7 @@ async function publicationOrLegacyDeclaration(
                 .eq("contentSha256", submission.contentSha256)
                 .eq("status", "rejected"),
             )
+            .filter(q => q.neq(q.field("requestKind"), "identity_placement"))
             .first()
         : null,
       submission.contentSha256
diff --git a/convex/profileAssets.ts b/convex/profileAssets.ts
index b21829b8..d42ecc0f 100644
--- a/convex/profileAssets.ts
+++ b/convex/profileAssets.ts
@@ -26,6 +26,7 @@ import { canReadProfile } from "./_profilePermissions";
 import { isProfileFieldVisible } from "./_profileFieldVisibility";
 import {
   PROFILE_ASSET_MAX_ACTIVE_COUNT,
+  selectProfileAssetIdentity,
   PROFILE_ASSET_UPLOAD_PROCESSING_MAX_ATTEMPTS,
   PROFILE_ASSET_UPLOAD_PROCESSING_LEASE_MS,
   assertProfileMediaVersion,
@@ -1320,6 +1321,7 @@ async function replaceOwnedAssetPlacements(
   asset: Doc<"profileAssets">,
   placements: ProfileAssetPlacement[],
   now: number,
+  actorUserId: Id<"users">,
 ) {
   const uniquePlacements = [...new Set(placements)];
 
@@ -1342,6 +1344,8 @@ async function replaceOwnedAssetPlacements(
     .filter((query) => query.eq(query.field("state"), "active"))
     .collect();
   const desired = new Set(uniquePlacements);
+  if (asset.sourceSubmissionId && uniquePlacements.some(p => p === "profile_image" || p === "primary_logo") &&
+    current.some(p => p.placement === "gallery")) desired.add("gallery");
 
   await Promise.all(
     current
@@ -1350,6 +1354,10 @@ async function replaceOwnedAssetPlacements(
   );
 
   for (const placement of uniquePlacements) {
+    if (placement === "profile_image" || placement === "primary_logo") {
+      await selectProfileAssetIdentity(db, { profileId, assetId: asset._id, placement, actorUserId, now });
+      continue;
+    }
     if (current.some((item) => item.placement === placement)) {
       continue;
     }
@@ -1549,6 +1557,7 @@ export const manageOwnedMediaForMcpActor = internalMutation({
           currentAsset,
           args.asset.placements,
           now,
+          args.ownerUserId,
         );
       }
 
diff --git a/convex/profileMediaSubmissions.ts b/convex/profileMediaSubmissions.ts
index 8d9496ab..bb7b6538 100644
--- a/convex/profileMediaSubmissions.ts
+++ b/convex/profileMediaSubmissions.ts
@@ -1,4 +1,5 @@
 import { assertLiveContributionToken } from "./_contributionAuth";
+import { publishedContributionDetail, contributionPlacementCommand, proposeContributionPlacement } from "./_mediaContributionCommands";
 import { effectiveContributionPolicy, contributionChargeRefusal, registerLegacyContribution, reservationBytes } from "./_contributionCapacity";
 import { requirePublisher, publicationCommand, legacyDeclarationCommand, recordPublicationRestriction } from "./_trustedPublication";
 import { readScopedPagination, writeScopedPagination } from "./_reviewCursor";
@@ -42,6 +43,36 @@ import { requireMcpAttributionText, requireSha256Hex } from "./_mcpWriteReceipts
 const OPEN_SUBMISSION_STATUSES = ["upload_pending", "submitted", "under_review"] as const;
 
 const submissionId = v.id("profileMediaSubmissions");
+const contributionCommandArgs = {
+  submissionId, expectedContributionVersion: v.string(), idempotencyKey: v.string(),
+};
+const placementCommandArgs = { ...contributionCommandArgs,
+  action: v.union(v.literal("select_primary"), v.literal("clear_primary")),
+};
+export const contributionDetail = query({ args: { submissionId }, handler: async (ctx, args) =>
+  publishedContributionDetail(ctx, args.submissionId, await browserReviewActor(ctx)) });
+export const contributionDetailForMcpActor = internalQuery({
+  args: { submissionId, actorUserId: v.id("users"), ...reviewActorAttestationArgs },
+  handler: async (ctx, args) => publishedContributionDetail(ctx, args.submissionId,
+    await trustedReviewActor(ctx, args.actorUserId, args, "assets:contribute", false)),
+});
+export const placeContribution = mutation({ args: placementCommandArgs, handler: async (ctx, args) =>
+  contributionPlacementCommand(ctx, args, await browserReviewActor(ctx)) });
+export const placeContributionForMcpActor = internalMutation({
+  args: { ...placementCommandArgs, actorUserId: v.id("users"), ...reviewActorAttestationArgs },
+  handler: async (ctx, args) => contributionPlacementCommand(ctx,
+    { submissionId: args.submissionId, expectedContributionVersion: args.expectedContributionVersion,
+      idempotencyKey: args.idempotencyKey, action: args.action },
+    await trustedReviewActor(ctx, args.actorUserId, args, "assets:publish")),
+});
+export const proposePlacement = mutation({ args: contributionCommandArgs, handler: async (ctx, args) =>
+  proposeContributionPlacement(ctx, args, await browserReviewActor(ctx)) });
+export const proposePlacementForMcpActor = internalMutation({
+  args: { ...contributionCommandArgs, actorUserId: v.id("users"), ...reviewActorAttestationArgs },
+  handler: async (ctx, args) => proposeContributionPlacement(ctx,
+    { submissionId: args.submissionId, expectedContributionVersion: args.expectedContributionVersion, idempotencyKey: args.idempotencyKey },
+    await trustedReviewActor(ctx, args.actorUserId, args, "assets:contribute")),
+});
 const requestedPlacement = v.union(v.literal("profile_image"), v.literal("primary_logo"), v.literal("gallery"));
 const reviewQueueStatus = v.union(
   v.literal("submitted"),
@@ -1158,7 +1189,7 @@ async function ownSubmission(
         .withIndex("by_submissionId", (q) => q.eq("submissionId", submission._id))
     .unique();
   const revision = attempt ? await ctx.db.get(attempt.revisionId) : null;
-  const snapshot = await reviewSnapshot(ctx, submission, profile);
+  const { placementTargetVersion: _placementTargetVersion, ...snapshot } = await reviewSnapshot(ctx, submission, profile);
   const asset = submission.approvedAssetId
     ? await ctx.db.get(submission.approvedAssetId)
     : null;
@@ -1648,7 +1679,7 @@ async function withdrawSubmission(
   const now = Date.now();
   await ctx.db.patch(submission._id, {
     status: "withdrawn",
-    blobDeleteAfter: now + PROFILE_MEDIA_SUBMISSION_RETENTION_MS,
+    ...(submission.requestKind === "identity_placement" ? {} : { blobDeleteAfter: now + PROFILE_MEDIA_SUBMISSION_RETENTION_MS }),
     updatedAt: now,
   });
   await ctx.db.insert("profileAuditEvents", {
@@ -2091,7 +2122,7 @@ async function authorizedReviewDetail(
     profile,
     access.access.superAdmin,
   );
-  const snapshot = await reviewSnapshot(ctx, submission, profile);
+  const { placementTargetVersion: _placementTargetVersion, ...snapshot } = await reviewSnapshot(ctx, submission, profile);
   return {
     ...projection,
     ...snapshot,
@@ -2129,6 +2160,14 @@ async function authorizedCandidateStorage(
   const detail = await authorizedReviewDetail(ctx, id, actor, publisher);
   if (detail?.candidate.rendition == null) return null;
   const submission = await ctx.db.get(id);
+  if (submission?.requestKind === "identity_placement" && submission.candidateAssetId) {
+    const asset = await ctx.db.get(submission.candidateAssetId);
+    return asset ? {
+      storageKey: asset.downloadStorageKey ?? asset.storageKey,
+      mimeType: asset.downloadMimeType ?? asset.mimeType,
+      originalFileName: asset.originalFileName, profileDisplayName: detail.profileDisplayName,
+    } : null;
+  }
   const intent =
     submission?.uploadIntentId === undefined
       ? null
diff --git a/convex/schema.ts b/convex/schema.ts
index 162f8de6..6567b7c3 100644
--- a/convex/schema.ts
+++ b/convex/schema.ts
@@ -950,6 +950,7 @@ export default defineSchema({
     status: profileMediaSubmissionStatus,
     targetProfileUpdatedAt: v.number(),
     targetPlacementAssetId: v.optional(v.id("profileAssets")),
+    targetPlacementVersion: v.optional(v.string()),
     decisionProfileUpdatedAt: v.optional(v.number()),
     reviewer: v.optional(authSubject),
     reviewedAt: v.optional(v.number()),
@@ -1020,6 +1021,8 @@ export default defineSchema({
     .index("by_profileId_contentSha256_state", ["profileId", "contentSha256", "state"])
     .index("by_profileId_state_visibility", ["profileId", "state", "visibility"]),
   profileAssetPlacements: defineTable({
+    selectionActorUserId: v.optional(v.id("users")),
+    selectionOperationId: v.optional(v.string()),
     profileId: v.id("profiles"),
     assetId: v.id("profileAssets"),
     placement: profileAssetPlacement,
diff --git a/docs/engineering/media-review-commands.md b/docs/engineering/media-review-commands.md
index 7f093618..91c22172 100644
--- a/docs/engineering/media-review-commands.md
+++ b/docs/engineering/media-review-commands.md
@@ -59,6 +59,10 @@ state, and the submission's optional `reviewRevision`. Missing revisions mean
 zero for existing rows. Advisory start-review updates do not invalidate it.
 Kit publication excludes unrelated biography timestamps and existing picture
 artwork. Placement inspection includes the current placement and asset.
+Existing-asset placement requests store a narrow original-target snapshot that
+includes the exact selection operation. An intervening selection, including
+the same asset, requires a rebase. Unrelated biography edits do not invalidate
+these requests. Their authorized preview reads the existing stored asset.
 Meaningful evidence changes require fresh inspection. Placement changes also
 require an explicit rebase against the original selection snapshot.
 
@@ -77,6 +81,25 @@ may be retried with the same key.
 Legacy `decide` retains its argument/result shape and calls the shared transition.
 The receipt path is the required interface for new browser/MCP clients.
 
+## Published contribution placement
+
+`contributionDetail` and its internal MCP actor counterpart resolve the immutable
+source submission and active public asset. `placeContribution` accepts the source
+submission ID, expected contribution version, actor-scoped idempotency key, and
+`select_primary` or `clear_primary`. Verified trusted publishers may select their
+own asset on a public, published, unclaimed profile only when no managed, legacy,
+or automatic identity image occupies the slot. Undo requires current publisher
+authority and the exact unchanged publisher selection. Owner and reviewer actions
+stamp a fresh selection operation, including same-asset reselection.
+
+`proposePlacement` accepts the same base command without an action. It references
+the existing asset in an `identity_placement` review submission and uses current
+proposal count and rate limits. Approval requires a distinct authorized reviewer
+and changes only the identity placement. Both gallery entries remain published;
+no upload, blob, active asset, or published-byte charge is created. Rejection and
+withdrawal record the placement-request disposition without content rejection or
+proposal-blob cleanup. Explicit moderator suppression remains separate.
+
 ## Delegation and rollout
 
 Review reads use `assets:review:read` plus `mcp:read`; decisions use
diff --git a/packages/api-contracts/src/media-review.ts b/packages/api-contracts/src/media-review.ts
index 106e0dd3..b4edc030 100644
--- a/packages/api-contracts/src/media-review.ts
+++ b/packages/api-contracts/src/media-review.ts
@@ -1,6 +1,29 @@
 import { z } from "zod";
 
 const boundedId = z.string().min(1).max(200);
+export const contributionCommandBaseSchema = z.strictObject({
+  submissionId: boundedId,
+  expectedContributionVersion: z.string().min(1).max(128),
+  idempotencyKey: z.string().min(1).max(128),
+});
+export type ContributionCommandBase = z.infer<typeof contributionCommandBaseSchema>;
+export const contributionPlacementCommandSchema = z.strictObject({
+  ...contributionCommandBaseSchema.shape,
+  action: z.enum(["select_primary", "clear_primary"]),
+});
+export type ContributionPlacementCommand = z.infer<typeof contributionPlacementCommandSchema>;
+export const publishedContributionDetailSchema = z.strictObject({
+  submissionId: boundedId, assetId: boundedId, profileId: boundedId,
+  profileSlug: z.string().max(200), contributionVersion: z.string().min(1).max(128),
+  metadata: z.strictObject({
+    label: z.string().max(80), altText: z.string().max(180).optional(),
+    credit: z.string().max(120), creditUrl: z.string().max(4096).optional(),
+    sourceUrl: z.string().max(4096).optional(), sourceDescription: z.string().max(1000).optional(),
+  }),
+  canSelectPrimary: z.boolean(), canClearPrimary: z.boolean(),
+  canEditMetadata: z.boolean(), canRemove: z.boolean(),
+});
+export type PublishedContributionDetail = z.infer<typeof publishedContributionDetailSchema>;
 export const commandReceiptSchema = z.strictObject({
   operationId: boundedId,
   operationState: z.enum(["committed", "refused", "in_progress"]),
diff --git a/packages/api-contracts/tests/media-review.test.ts b/packages/api-contracts/tests/media-review.test.ts
index fe7cc1d7..d831aadf 100644
--- a/packages/api-contracts/tests/media-review.test.ts
+++ b/packages/api-contracts/tests/media-review.test.ts
@@ -3,8 +3,28 @@ import { it } from "node:test";
 import {
   reviewDecisionSchema,
   reviewPageRequestSchema,
+  contributionCommandBaseSchema,
+  contributionPlacementCommandSchema,
+  publishedContributionDetailSchema,
 } from "../src/media-review";
 import { apiScopes } from "../src/auth";
+it("bounds contribution commands and refuses caller-selected capabilities", () => {
+  const base = { submissionId: "submission", expectedContributionVersion: "version", idempotencyKey: "key" };
+  assert.equal(contributionCommandBaseSchema.safeParse(base).success, true);
+  assert.equal(contributionPlacementCommandSchema.safeParse({ ...base, action: "select_primary" }).success, true);
+  for (const invalid of [
+    { ...base, action: "clear_primary", canClearPrimary: true },
+    { ...base, action: "replace_primary" },
+    { ...base, action: "select_primary", expectedContributionVersion: "v".repeat(129) },
+    { ...base, action: "select_primary", idempotencyKey: "k".repeat(129) },
+    { ...base, action: "select_primary", submissionId: "s".repeat(201) },
+  ]) assert.equal(contributionPlacementCommandSchema.safeParse(invalid).success, false);
+  assert.equal(publishedContributionDetailSchema.safeParse({
+    submissionId: "submission", assetId: "asset", profileId: "profile", profileSlug: "dj",
+    contributionVersion: "version", metadata: { label: "Image", credit: "Artist" },
+    canSelectPrimary: true, canClearPrimary: false, canEditMetadata: true, canRemove: true,
+  }).success, true);
+});
 import {
   dynamicMcpClientScopes,
   dynamicMcpResourceWriteScopes,
diff --git a/tests/backend/media-contribution-commands.test.ts b/tests/backend/media-contribution-commands.test.ts
new file mode 100644
index 00000000..f540e61d
--- /dev/null
+++ b/tests/backend/media-contribution-commands.test.ts
@@ -0,0 +1,271 @@
+import assert from "node:assert/strict";
+import { it } from "node:test";
+import { convexTest } from "convex-test";
+import { api, internal } from "../../convex/_generated/api";
+import { modules, schema, seed, createAndUpload } from "./_mediaReviewFixture";
+import { getProfileMediaVersion, selectProfileAssetIdentity } from "../../convex/_profileAssets";
+
+process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED = "true";
+process.env.VRDEX_PROFILE_MEDIA_DIRECT_UPLOAD_ENABLED = "true";
+process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true";
+
+async function fixture(profileType: "person" | "community" = "person") {
+  const t = convexTest({ schema, modules });
+  const s = await seed(t, profileType);
+  const { intent } = await createAndUpload(t, s);
+  const grant = await t.run(ctx => ctx.db.insert("accountFeatureGrants", {
+    userId: s.contributorUserId, feature: "trusted_publisher", state: "active",
+    grantedBy: { tokenIdentifier: "test:operator", issuer: "test", subject: "operator" },
+    grantedAt: Date.now(), updatedAt: Date.now(),
+  }));
+  const actor = t.withIdentity(s.contributorIdentity);
+  const pending = await actor.query(api.profileMediaSubmissions.publisherDetail, { submissionId: intent.submissionId });
+  assert.ok(pending);
+  assert.equal((await actor.mutation(api.profileMediaSubmissions.publish, {
+    submissionId: intent.submissionId, expectedReviewVersion: pending.reviewVersion, idempotencyKey: "publish",
+  })).operationState, "committed");
+  await t.run(ctx => ctx.db.patch(intent.submissionId, { createdAt: Date.now() - 60_000 }));
+  const detail = () => actor.query(api.profileMediaSubmissions.contributionDetail, { submissionId: intent.submissionId });
+  const place = async (action: "select_primary" | "clear_primary", idempotencyKey = crypto.randomUUID()) => {
+    const d = await detail();
+    return actor.mutation(api.profileMediaSubmissions.placeContribution, {
+      submissionId: intent.submissionId, expectedContributionVersion: d.contributionVersion, action, idempotencyKey,
+    });
+  };
+  const placements = () => t.run(async ctx => (await ctx.db.query("profileAssetPlacements").collect()).filter(p => p.state === "active").map(p => p.placement).sort());
+  return { t, s, intent, grant, actor, detail, place, placements };
+}
+
+for (const profileType of ["person", "community"] as const) {
+  it(`selects and clears its own ${profileType} primary while keeping gallery and bytes`, async () => {
+    const f = await fixture(profileType);
+    assert.equal((await f.detail()).canSelectPrimary, true);
+    assert.equal((await f.place("select_primary")).operationState, "committed");
+    assert.deepEqual(await f.placements(), ["gallery", profileType === "person" ? "profile_image" : "primary_logo"].sort());
+    assert.equal((await f.detail()).canClearPrimary, true);
+    assert.equal((await f.place("clear_primary")).operationState, "committed");
+    assert.deepEqual(await f.placements(), ["gallery"]);
+    assert.equal((await f.t.run(ctx => ctx.db.query("profileAssets").first()))?.state, "active");
+  });
+}
+
+it("replays a command once and refuses changed-key input and stale versions", async () => {
+  const f = await fixture();
+  const d = await f.detail();
+  const input = { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, action: "select_primary" as const, idempotencyKey: "selection" };
+  const first = await f.actor.mutation(api.profileMediaSubmissions.placeContribution, input);
+  assert.deepEqual(await f.actor.mutation(api.profileMediaSubmissions.placeContribution, input), first);
+  assert.equal((await f.actor.mutation(api.profileMediaSubmissions.placeContribution, { ...input, action: "clear_primary" })).code, "idempotency_conflict");
+  assert.equal((await f.actor.mutation(api.profileMediaSubmissions.placeContribution, { ...input, action: "clear_primary", idempotencyKey: "stale" })).code, "contribution_changed");
+});
+
+for (const condition of ["legacy", "revoked", "claimed", "private", "other_contributor"] as const) {
+  it(`refuses selection after ${condition}`, async () => {
+    const f = await fixture();
+    await f.t.run(async ctx => {
+      if (condition === "legacy") await ctx.db.patch(f.s.profileId, { avatarImageUrl: "https://example.test/current.webp" });
+      if (condition === "revoked") await ctx.db.patch(f.grant, { state: "revoked" });
+      if (condition === "claimed") await ctx.db.patch(f.s.profileId, { claimState: "claimed_verified" });
+      if (condition === "private") await ctx.db.patch(f.s.profileId, { publicSurfacingState: "opted_out" });
+      if (condition === "other_contributor") await ctx.db.patch(f.intent.submissionId, { submitterUserId: f.s.moderatorUserId });
+    });
+    if (condition === "other_contributor") await assert.rejects(f.detail(), /unavailable/i);
+    else {
+      assert.equal((await f.detail()).canSelectPrimary, false);
+      assert.equal((await f.place("select_primary")).operationState, "refused");
+    }
+    assert.deepEqual(await f.placements(), ["gallery"]);
+  });
+}
+
+it("same-asset reselection by another authorized actor invalidates publisher undo", async () => {
+  const f = await fixture();
+  await f.place("select_primary");
+  await f.t.run(async ctx => {
+    const p = await ctx.db.query("profileAssetPlacements").filter(q => q.eq(q.field("placement"), "profile_image")).first();
+    assert.ok(p);
+    await ctx.db.patch(p._id, { selectionActorUserId: f.s.moderatorUserId, selectionOperationId: "admin-reselection" });
+  });
+  assert.equal((await f.detail()).canClearPrimary, false);
+  assert.equal((await f.place("clear_primary")).operationState, "refused");
+});
+
+it("owner same-asset selection stamps new provenance and retains the contribution gallery", async () => {
+  const f = await fixture();
+  await f.place("select_primary");
+  const d = await f.detail();
+  const before = await f.t.run(async ctx => (await ctx.db.query("profileAssetPlacements").collect()).find(p => p.placement === "profile_image" && p.state === "active"));
+  await f.t.run(async ctx => {
+    await ctx.db.patch(f.s.profileId, { claimState: "claimed_verified" });
+    await ctx.db.insert("profileOwners", { profileId: f.s.profileId, userId: f.s.moderatorUserId, roleKey: "owner", state: "active", grantedAt: Date.now(), updatedAt: Date.now() });
+  });
+  const version = await f.t.run(ctx => getProfileMediaVersion(ctx.db, f.s.profileId));
+  await f.t.mutation(internal.profileAssets.manageOwnedMediaForMcpActor, {
+    ownerUserId: f.s.moderatorUserId, oauthClientId: "client", oauthTokenId: "token", requestId: "reselect",
+    slug: "community-dj", expectedMediaVersion: version, asset: { assetId: d.assetId, placements: ["profile_image"] },
+  });
+  assert.deepEqual(await f.placements(), ["gallery", "profile_image"]);
+  const after = await f.t.run(async ctx => (await ctx.db.query("profileAssetPlacements").collect()).find(p => p.placement === "profile_image" && p.state === "active"));
+  assert.equal(after?.selectionActorUserId, f.s.moderatorUserId);
+  assert.notEqual(after?.selectionOperationId, before?.selectionOperationId);
+  assert.notEqual(await f.t.run(ctx => getProfileMediaVersion(ctx.db, f.s.profileId)), version);
+  await f.t.run(ctx => ctx.db.patch(f.s.profileId, { claimState: "unclaimed" }));
+  assert.equal((await f.detail()).canClearPrimary, false);
+});
+
+it("ignores biography edits but binds review to the exact original primary selection", async () => {
+  const f = await fixture();
+  const d = await f.detail();
+  await f.t.run(ctx => ctx.db.patch(f.s.profileId, { headline: "Changed biography", updatedAt: Date.now() }));
+  assert.equal((await f.detail()).contributionVersion, d.contributionVersion);
+  const p = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "proposal" });
+  assert.equal(p.operationState, "committed");
+  await f.place("select_primary");
+  const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
+  const review = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: p.resourceId! });
+  assert.ok(review);
+  const result = await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, { submissionId: p.resourceId!, expectedReviewVersion: review.reviewVersion, decision: "approve", privateReason: "Placement checked", idempotencyKey: "changed-placement" });
+  assert.equal(result.code, "placement_changed");
+  assert.equal((await reviewer.mutation(api.profileMediaSubmissions.rebase, { submissionId: p.resourceId!, expectedReviewVersion: review.reviewVersion, idempotencyKey: "rebase-placement" })).operationState, "committed");
+  const rebased = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: p.resourceId! });
+  assert.ok(rebased);
+  assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, { submissionId: p.resourceId!, expectedReviewVersion: rebased.reviewVersion, decision: "approve", privateReason: "Current placement checked", idempotencyKey: "approve-rebased" })).operationState, "committed");
+  assert.equal((await f.detail()).canClearPrimary, false);
+});
+
+it("legacy placements never authorize undo and publisher revocation refuses historical command replay", async () => {
+  const f = await fixture();
+  const d = await f.detail();
+  const input = { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, action: "select_primary" as const, idempotencyKey: "original-selection" };
+  assert.equal((await f.actor.mutation(api.profileMediaSubmissions.placeContribution, input)).operationState, "committed");
+  await f.t.run(async ctx => {
+    const p = await ctx.db.query("profileAssetPlacements").filter(q => q.eq(q.field("placement"), "profile_image")).first();
+    assert.ok(p);
+    await ctx.db.patch(p._id, { selectionActorUserId: undefined, selectionOperationId: undefined });
+  });
+  assert.equal((await f.detail()).canClearPrimary, false);
+  assert.equal((await f.place("clear_primary")).operationState, "refused");
+  await f.t.run(ctx => ctx.db.patch(f.grant, { state: "revoked" }));
+  assert.equal((await f.actor.mutation(api.profileMediaSubmissions.placeContribution, input)).code, "authority_changed");
+});
+
+it("reviews existing-asset placement without a new upload or published charge", async () => {
+  const f = await fixture();
+  const d = await f.detail();
+  const proposal = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, {
+    submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "proposal",
+  });
+  assert.equal(proposal.operationState, "committed");
+  const publisherPreview = await f.actor.query(api.profileMediaSubmissions.publisherDetail, { submissionId: proposal.resourceId! });
+  assert.ok(publisherPreview);
+  assert.equal((await f.actor.mutation(api.profileMediaSubmissions.publish, { submissionId: proposal.resourceId!, expectedReviewVersion: publisherPreview.reviewVersion, idempotencyKey: "publish-placement" })).code, "placement_requires_review");
+  const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
+  const review = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: proposal.resourceId! });
+  assert.ok(review?.candidate.rendition);
+  const stored = await reviewer.query(api.profileMediaSubmissions.getCandidateForStorage, { submissionId: proposal.resourceId! });
+  assert.equal(stored?.storageKey, (await f.t.run(ctx => ctx.db.query("profileAssets").first()))?.storageKey);
+  assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, {
+    submissionId: proposal.resourceId!, expectedReviewVersion: review.reviewVersion, decision: "approve", privateReason: "Correct identity", idempotencyKey: "approve-placement",
+  })).operationState, "committed");
+  assert.deepEqual(await f.placements(), ["gallery", "profile_image"]);
+  assert.equal((await f.t.run(ctx => ctx.db.query("profileAssetUploadIntents").collect())).length, 1);
+  assert.equal((await f.t.run(ctx => ctx.db.query("profileAssets").collect())).length, 1);
+});
+
+for (const disposition of ["reject", "withdraw"] as const) {
+  it(`${disposition} leaves the published asset and its bytes alone`, async () => {
+    const f = await fixture();
+    const d = await f.detail();
+    const p = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "proposal" });
+    assert.equal(p.operationState, "committed");
+    const id = p.resourceId!;
+    if (disposition === "withdraw") await f.actor.mutation(api.profileMediaSubmissions.withdraw, { submissionId: id });
+    else {
+      const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
+      const review = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: id });
+      assert.ok(review);
+      await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, { submissionId: id, expectedReviewVersion: review.reviewVersion, decision: "reject", privateReason: "Placement declined", publicReason: "Declined", idempotencyKey: "reject" });
+    }
+    assert.equal((await f.t.run(ctx => ctx.db.get(id)))?.blobDeleteAfter, undefined);
+    assert.equal((await f.t.run(ctx => ctx.db.query("mediaPublicationRestrictions").collect())).length, 0);
+    assert.equal((await f.t.run(ctx => ctx.db.query("profileAssets").first()))?.state, "active");
+    assert.deepEqual(await f.placements(), ["gallery"]);
+  });
+}
+
+it("requires a distinct reviewer and replaces identity at full capacity without moving either gallery item", async () => {
+  const f = await fixture();
+  const d = await f.detail();
+  const beforeBytes = await f.t.run(ctx => ctx.db.query("contributionUploadReservations").first());
+  const oldAssetId = await f.t.run(async ctx => {
+    const asset = await ctx.db.get(d.assetId);
+    assert.ok(asset);
+    const { _id, _creationTime, sourceSubmissionId, ...fields } = asset;
+    let old;
+    for (let i = 0; i < 11; i++) {
+      const id = await ctx.db.insert("profileAssets", { ...fields, storageKey: `stored/${i}.webp`, contentSha256: `other-${i}` });
+      await ctx.db.insert("profileAssetPlacements", { profileId: f.s.profileId, assetId: id, placement: "gallery", position: i + 1, state: "active", updatedAt: Date.now() });
+      if (i === 0) old = id;
+    }
+    assert.ok(old);
+    await selectProfileAssetIdentity(ctx.db, { profileId: f.s.profileId, assetId: old, placement: "profile_image", actorUserId: f.s.moderatorUserId, now: Date.now() });
+    await ctx.db.insert("accountFeatureGrants", { userId: f.s.contributorUserId, feature: "super_admin", state: "active", grantedBy: { tokenIdentifier: "test:operator", issuer: "test", subject: "operator" }, grantedAt: Date.now(), updatedAt: Date.now() });
+    return old;
+  });
+  const current = await f.detail();
+  const input = { submissionId: f.intent.submissionId, expectedContributionVersion: current.contributionVersion, idempotencyKey: "replacement" };
+  const p = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, input);
+  assert.equal(p.operationState, "committed");
+  assert.deepEqual(await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, input), p);
+  const ownReview = await f.actor.query(api.profileMediaSubmissions.reviewDetail, { submissionId: p.resourceId! });
+  assert.ok(ownReview);
+  assert.equal((await f.actor.mutation(api.profileMediaSubmissions.decideWithReceipt, { submissionId: p.resourceId!, expectedReviewVersion: ownReview.reviewVersion, decision: "approve", privateReason: "Self", idempotencyKey: "self" })).code, "self_review");
+  const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
+  const review = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: p.resourceId! });
+  assert.ok(review);
+  assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, { submissionId: p.resourceId!, expectedReviewVersion: review.reviewVersion, decision: "approve", privateReason: "Correct replacement", idempotencyKey: "independent" })).operationState, "committed");
+  const active = await f.t.run(ctx => ctx.db.query("profileAssetPlacements").filter(q => q.eq(q.field("state"), "active")).collect());
+  assert.ok(active.some(p => p.assetId === oldAssetId && p.placement === "gallery"));
+  assert.ok(active.some(p => p.assetId === d.assetId && p.placement === "gallery"));
+  assert.equal(active.find(p => p.placement === "profile_image")?.assetId, d.assetId);
+  assert.equal((await f.t.run(ctx => ctx.db.query("profileAssets").collect())).length, 12);
+  assert.deepEqual(await f.t.run(ctx => ctx.db.query("contributionUploadReservations").first()), beforeBytes);
+  assert.equal((await f.detail()).canClearPrimary, false);
+});
+
+it("treats visible automatic artwork as occupied and refuses hidden authored identity too", async () => {
+  const f = await fixture();
+  await f.t.run(async ctx => {
+    const external = "usr_7023d326-083f-41fe-a3e9-27ea303b50c5";
+    await ctx.db.patch(f.s.profileId, { outboundLinks: [{ type: "vrchat_profile", label: "VRChat", url: `https://vrchat.com/home/user/${external}`, source: "community_submitted" }] });
+    await ctx.db.insert("profileLinkDestinations", { key: `vrchat_user:${external}`, kind: "vrchat_user", locator: external, provider: "vrchat", status: "resolved", artworkSourceUrl: "https://example.test/icon.webp", artworkType: "user_icon", observedAt: 1 });
+  });
+  assert.equal((await f.detail()).canSelectPrimary, false);
+  assert.equal((await f.place("select_primary")).code, "primary_occupied");
+  await f.t.run(async ctx => {
+    await ctx.db.patch(f.s.profileId, { outboundLinks: [], fieldVisibility: { mediaKit: "private" } });
+    const asset = await ctx.db.query("profileAssets").first();
+    assert.ok(asset);
+    await selectProfileAssetIdentity(ctx.db, { profileId: f.s.profileId, assetId: asset._id, placement: "primary_logo", actorUserId: f.s.moderatorUserId, now: Date.now() });
+  });
+  assert.equal((await f.detail()).canSelectPrimary, false);
+  assert.equal((await f.place("select_primary")).code, "primary_occupied");
+});
+
+it("does not interpret a rejected placement as a digest-wide content rejection", async () => {
+  const f = await fixture();
+  const d = await f.detail();
+  const p = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "proposal" });
+  assert.equal(p.operationState, "committed");
+  const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
+  const review = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: p.resourceId! });
+  assert.ok(review);
+  assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, { submissionId: p.resourceId!, expectedReviewVersion: review.reviewVersion, decision: "reject", privateReason: "Placement only", publicReason: "Declined", idempotencyKey: "reject" })).operationState, "committed");
+  const second = await seed(f.t);
+  const { intent } = await createAndUpload(f.t, second);
+  await f.t.run(ctx => ctx.db.insert("accountFeatureGrants", { userId: second.contributorUserId, feature: "trusted_publisher", state: "active", grantedBy: { tokenIdentifier: "test:operator", issuer: "test", subject: "operator" }, grantedAt: Date.now(), updatedAt: Date.now() }));
+  const actor = f.t.withIdentity(second.contributorIdentity);
+  const pending = await actor.query(api.profileMediaSubmissions.publisherDetail, { submissionId: intent.submissionId });
+  assert.ok(pending);
+  assert.equal((await actor.mutation(api.profileMediaSubmissions.publish, { submissionId: intent.submissionId, expectedReviewVersion: pending.reviewVersion, idempotencyKey: "another-publication" })).operationState, "committed");
+});
diff --git a/tests/backend/profile-foundation.test.ts b/tests/backend/profile-foundation.test.ts
index e7287017..7d599657 100644
--- a/tests/backend/profile-foundation.test.ts
+++ b/tests/backend/profile-foundation.test.ts
@@ -2462,6 +2462,9 @@ describe("profile media kit asset helpers", () => {
 
         return id;
       },
+      normalizeId(_tableName: string, id: string) {
+        return id;
+      },
       async patch(id: string, patch: Record<string, unknown>) {
         for (const rows of Object.values(tables)) {
           const row = rows.find((candidate) => candidate._id === id);
@@ -2559,6 +2562,8 @@ describe("profile media kit asset helpers", () => {
     assert.equal(tables.profileAssets[0]?.label, "Primary logo");
     assert.equal(tables.profileAssets[0]?.source, "owner_authored");
     assert.equal(tables.profileAssetPlacements[0]?.placement, "primary_logo");
+    assert.equal(tables.profileAssetPlacements[0]?.selectionActorUserId, "user123");
+    assert.ok(tables.profileAssetPlacements[0]?.selectionOperationId);
     assert.equal(tables.profileAuditEvents[0]?.action, "api_profile_asset_uploaded");
     assert.equal(tables.apiWriteAuditEvents[0]?.action, "profile_asset_upload_completed");
     assert.equal(tables.apiWriteAuditEvents[0]?.actorKind, "upload_token");

From c137c2d1b593ab0c81afb1e2c002bb5f11880374 Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Mon, 5 Oct 2026 18:56:59 -0400
Subject: [PATCH 08/28] fix: retain cleanup for uploaded identity proposals

---
 convex/_mediaReview.ts                        |  3 +-
 convex/profileMediaSubmissions.ts             |  3 +-
 .../media-contribution-commands.test.ts       |  2 ++
 .../backend/profile-media-submissions.test.ts | 28 +++++++++++++++++++
 4 files changed, 34 insertions(+), 2 deletions(-)

diff --git a/convex/_mediaReview.ts b/convex/_mediaReview.ts
index d7616463..7abf8936 100644
--- a/convex/_mediaReview.ts
+++ b/convex/_mediaReview.ts
@@ -276,7 +276,8 @@ export async function applyReviewDecision(
       publicDisposition,
       privateReason,
       decisionProfileUpdatedAt: profile.updatedAt,
-      ...(submission.requestKind === "identity_placement" ? {} : { blobDeleteAfter: now + PROFILE_MEDIA_SUBMISSION_RETENTION_MS }),
+      ...(submission.requestKind === "identity_placement" && submission.candidateAssetId !== undefined
+        ? {} : { blobDeleteAfter: now + PROFILE_MEDIA_SUBMISSION_RETENTION_MS }),
       updatedAt: now,
     });
     await ctx.db.insert("profileAuditEvents", {
diff --git a/convex/profileMediaSubmissions.ts b/convex/profileMediaSubmissions.ts
index bb7b6538..2a32ab5c 100644
--- a/convex/profileMediaSubmissions.ts
+++ b/convex/profileMediaSubmissions.ts
@@ -1679,7 +1679,8 @@ async function withdrawSubmission(
   const now = Date.now();
   await ctx.db.patch(submission._id, {
     status: "withdrawn",
-    ...(submission.requestKind === "identity_placement" ? {} : { blobDeleteAfter: now + PROFILE_MEDIA_SUBMISSION_RETENTION_MS }),
+    ...(submission.requestKind === "identity_placement" && submission.candidateAssetId !== undefined
+      ? {} : { blobDeleteAfter: now + PROFILE_MEDIA_SUBMISSION_RETENTION_MS }),
     updatedAt: now,
   });
   await ctx.db.insert("profileAuditEvents", {
diff --git a/tests/backend/media-contribution-commands.test.ts b/tests/backend/media-contribution-commands.test.ts
index f540e61d..3bf62520 100644
--- a/tests/backend/media-contribution-commands.test.ts
+++ b/tests/backend/media-contribution-commands.test.ts
@@ -175,6 +175,7 @@ it("reviews existing-asset placement without a new upload or published charge",
 for (const disposition of ["reject", "withdraw"] as const) {
   it(`${disposition} leaves the published asset and its bytes alone`, async () => {
     const f = await fixture();
+    const beforeCharge = await f.t.run(ctx => ctx.db.query("contributionUploadReservations").first());
     const d = await f.detail();
     const p = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "proposal" });
     assert.equal(p.operationState, "committed");
@@ -190,6 +191,7 @@ for (const disposition of ["reject", "withdraw"] as const) {
     assert.equal((await f.t.run(ctx => ctx.db.query("mediaPublicationRestrictions").collect())).length, 0);
     assert.equal((await f.t.run(ctx => ctx.db.query("profileAssets").first()))?.state, "active");
     assert.deepEqual(await f.placements(), ["gallery"]);
+    assert.deepEqual(await f.t.run(ctx => ctx.db.query("contributionUploadReservations").first()), beforeCharge);
   });
 }
 
diff --git a/tests/backend/profile-media-submissions.test.ts b/tests/backend/profile-media-submissions.test.ts
index 88db5426..bebf88bb 100644
--- a/tests/backend/profile-media-submissions.test.ts
+++ b/tests/backend/profile-media-submissions.test.ts
@@ -16,6 +16,34 @@ process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true";
 import { modules, schema, NOW, FIRST_REVIEW_PAGE, TARGET_PROFILE_SNAPSHOT, seed, createAndUpload } from "./_mediaReviewFixture";
 
 describe("unclaimed-profile media submissions", () => {
+  for (const disposition of ["reject", "withdraw"] as const) {
+    it(`schedules retained upload bytes after ${disposition} of an upload-backed identity proposal`, async () => {
+      const t = convexTest({ schema, modules });
+      const seeded = await seed(t);
+      const { intent } = await createAndUpload(t, seeded);
+      await t.run(ctx => ctx.db.patch(intent.submissionId, { requestKind: "identity_placement" }));
+      if (disposition === "withdraw") {
+        assert.equal(await t.withIdentity(seeded.contributorIdentity).mutation(
+          api.profileMediaSubmissions.withdraw, { submissionId: intent.submissionId },
+        ), true);
+      } else {
+        const reviewer = t.withIdentity(seeded.moderatorIdentity);
+        const detail = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: intent.submissionId });
+        assert.ok(detail);
+        assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, {
+          submissionId: intent.submissionId, expectedReviewVersion: detail.reviewVersion,
+          decision: "reject", privateReason: "Placement declined", publicReason: "Declined", idempotencyKey: "reject-uploaded-placement",
+        })).operationState, "committed");
+      }
+      const stored = await t.run(ctx => ctx.db.get(intent.submissionId));
+      assert.equal(stored?.status, disposition === "reject" ? "rejected" : "withdrawn");
+      assert.equal(stored?.uploadIntentId, intent.intentId);
+      assert.equal(stored?.candidateAssetId, undefined);
+      assert.ok((stored?.blobDeleteAfter ?? 0) > Date.now());
+      assert.ok((stored?.blobDeleteAfter ?? 0) <= Date.now() + 30 * 24 * 60 * 60 * 1000);
+      assert.equal((await t.run(ctx => ctx.db.get(intent.intentId)))?.state, "uploaded");
+    });
+  }
   it("does not revive a contribution withdrawn while its upload is processing", async () => {
     const t = convexTest({ schema, modules });
     const seeded = await seed(t);

From 3f083522adf7c7e5f01ac89c965c3c738de62fa0 Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Mon, 5 Oct 2026 19:10:53 -0400
Subject: [PATCH 09/28] feat: manage own published media contributions

---
 convex/_mediaContributionCommands.ts          |  83 +++++++--
 convex/_mediaReview.ts                        |   6 +-
 convex/_profileAssets.ts                      |   3 +
 convex/profileMediaSubmissions.ts             |  29 ++-
 convex/schema.ts                              |   2 +
 docs/engineering/media-review-commands.md     |  20 +++
 packages/api-contracts/src/media-review.ts    |  14 ++
 .../api-contracts/tests/media-review.test.ts  |  11 ++
 .../media-contribution-commands.test.ts       | 169 +++++++++++++++++-
 9 files changed, 318 insertions(+), 19 deletions(-)

diff --git a/convex/_mediaContributionCommands.ts b/convex/_mediaContributionCommands.ts
index 6ad9b5fe..f71d8492 100644
--- a/convex/_mediaContributionCommands.ts
+++ b/convex/_mediaContributionCommands.ts
@@ -2,16 +2,21 @@ import { ConvexError } from "convex/values";
 import type { MutationCtx, QueryCtx } from "./_generated/server";
 import { getAccountFeatureAccess } from "./_accountFeatures";
 import { assertReviewActorVerified, hash, reviewSnapshot, type ReviewActor } from "./_mediaReview";
-import { selectProfileAssetIdentity, PROFILE_MEDIA_SUBMISSION_RETENTION_MS } from "./_profileAssets";
+import { selectProfileAssetIdentity, PROFILE_MEDIA_SUBMISSION_RETENTION_MS,
+  sanitizeProfileAssetLabel, sanitizeProfileAssetAltText, sanitizeProfileAssetCredit,
+  sanitizeProfileAssetCreditUrl, normalizeProfileAssetSourceUrl } from "./_profileAssets";
+import { isProfileFieldVisible } from "./_profileFieldVisibility";
 import { effectiveContributionPolicy } from "./_contributionCapacity";
 import { assertSubmissionRateLimits, openSubmissionCountForUser, openSubmissionCountForProfile } from "./profileMediaSubmissions";
 import {
   contributionCommandBaseSchema, contributionPlacementCommandSchema,
+  contributionManageCommandSchema,
   type ContributionCommandBase, type ContributionPlacementCommand,
+  type ContributionManageCommand,
   type PublishedContributionDetail, type CommandReceipt,
 } from "../packages/api-contracts/src/media-review";
 
-async function contributionState(ctx: QueryCtx | MutationCtx, submissionId: string, actor: ReviewActor) {
+async function contributionState(ctx: QueryCtx | MutationCtx, submissionId: string, actor: ReviewActor, allowDeleted = false) {
   assertReviewActorVerified(actor);
   const id = ctx.db.normalizeId("profileMediaSubmissions", submissionId);
   const submission = id ? await ctx.db.get(id) : null;
@@ -20,7 +25,7 @@ async function contributionState(ctx: QueryCtx | MutationCtx, submissionId: stri
   if (!submission || !profile || !asset || submission.submitterUserId !== actor.user._id ||
     submission.status !== "approved" || submission.requestKind === "identity_placement" ||
     asset.sourceSubmissionId !== submission._id || asset.profileId !== profile._id ||
-    asset.state !== "active" || asset.visibility !== "public" || asset.retiredAt !== undefined || asset.moderatorSuppressedAt !== undefined)
+    (!allowDeleted && asset.state !== "active") || asset.visibility !== "public" || asset.retiredAt !== undefined || asset.moderatorSuppressedAt !== undefined)
     throw new ConvexError({ code: "MEDIA_RESOURCE_UNAVAILABLE", message: "Published contribution unavailable." });
   const placement = profile.profileType === "person" ? "profile_image" as const : "primary_logo" as const;
   const snapshot = await reviewSnapshot(ctx, { ...submission, requestKind: "identity_placement", candidateAssetId: asset._id, requestedPlacement: placement }, profile);
@@ -39,22 +44,28 @@ async function contributionState(ctx: QueryCtx | MutationCtx, submissionId: stri
   const publisher = access.canPublishMedia && publicUnclaimed && !restrictions.some(Boolean);
   const ownSelection = !!current && current.assetId === asset._id && current.selectionActorUserId === actor.user._id &&
     current.selectionOperationId?.startsWith("contribution-primary:") === true;
-  return { submission, profile, asset, placement, snapshot, current, identityPlacements, publisher, publicUnclaimed, restrictions, ownSelection,
-    version: await hash({ asset, source: submission, placement: current, picture: snapshot.currentImage, restrictions, publicUnclaimed, revision: snapshot.reviewVersion }) };
+  const kitVisible = publicUnclaimed && isProfileFieldVisible(profile, "mediaKit", "profile_page");
+  const assetPlacements = await ctx.db.query("profileAssetPlacements").withIndex("by_assetId_state", q =>
+    q.eq("assetId", asset._id).eq("state", "active")).take(20);
+  const protectedSelection = assetPlacements.length === 20 || assetPlacements.some(row => row.placement !== "gallery" ||
+    (row.selectionActorUserId !== undefined && row.selectionActorUserId !== actor.user._id));
+  const ownKitOnly = kitVisible && !restrictions.some(Boolean) && asset.state === "active" &&
+    !protectedSelection;
+  return { submission, profile, asset, placement, snapshot, current, identityPlacements, publisher, publicUnclaimed, restrictions, ownSelection, kitVisible, ownKitOnly, protectedSelection,
+    version: await hash({ asset, source: submission, placement: current, assetPlacements, picture: snapshot.currentImage, restrictions, publicUnclaimed, revision: snapshot.reviewVersion }) };
 }
 
 export async function publishedContributionDetail(ctx: QueryCtx | MutationCtx, submissionId: string, actor: ReviewActor): Promise<PublishedContributionDetail> {
   const s = await contributionState(ctx, submissionId, actor);
-  const ownKitOnly = s.publicUnclaimed && !s.restrictions.some(Boolean) &&
-    !s.identityPlacements.some(row => row.assetId === s.asset._id);
+  const metadata = s.kitVisible ? s.asset : s.submission;
   return {
     submissionId: s.submission._id, assetId: s.asset._id, profileId: s.profile._id, profileSlug: s.profile.slug,
     contributionVersion: s.version,
-    metadata: { label: s.asset.label ?? "Image", altText: s.asset.altText, credit: s.asset.credit ?? "",
-      creditUrl: s.asset.creditUrl, sourceUrl: s.asset.sourceUrl, sourceDescription: s.submission.sourceDescription },
+    metadata: { label: metadata.label ?? "Image", altText: metadata.altText, credit: metadata.credit ?? "",
+      creditUrl: metadata.creditUrl, sourceUrl: metadata.sourceUrl, sourceDescription: metadata.sourceDescription },
     canSelectPrimary: s.publisher && !s.identityPlacements.length && !s.snapshot.currentImage,
     canClearPrimary: s.publisher && s.ownSelection,
-    canEditMetadata: ownKitOnly, canRemove: ownKitOnly && s.submission.legalHoldAt === undefined,
+    canEditMetadata: s.ownKitOnly, canRemove: s.ownKitOnly && s.submission.legalHoldAt === undefined,
   };
 }
 
@@ -94,7 +105,7 @@ async function command(ctx: MutationCtx, input: ContributionCommandBase | Contri
       submitterUserId: actor.user._id, submitter: actor.subject, requestedPlacement: s.placement,
       targetProfileUpdatedAt: s.profile.updatedAt, targetPlacementAssetId: s.current?.assetId,
       targetPlacementVersion: s.snapshot.placementTargetVersion,
-      sourceUrl: s.asset.sourceUrl, sourceKind: s.submission.sourceKind, sourceDescription: s.submission.sourceDescription,
+      sourceUrl: s.asset.sourceUrl, sourceKind: s.submission.sourceKind, sourceDescription: s.asset.sourceDescription,
       credit: s.asset.credit ?? s.submission.credit, creditUrl: s.asset.creditUrl,
       label: s.asset.label, altText: s.asset.altText, contentSha256: s.asset.contentSha256,
       status: "submitted", expiresAt: now + PROFILE_MEDIA_SUBMISSION_RETENTION_MS, createdAt: now, updatedAt: now,
@@ -108,3 +119,53 @@ async function command(ctx: MutationCtx, input: ContributionCommandBase | Contri
 }
 export function contributionPlacementCommand(ctx: MutationCtx, input: ContributionPlacementCommand, actor: ReviewActor) { return command(ctx, input, actor, false); }
 export function proposeContributionPlacement(ctx: MutationCtx, input: ContributionCommandBase, actor: ReviewActor) { return command(ctx, input, actor, true); }
+
+export async function contributionManageCommand(ctx: MutationCtx, input: ContributionManageCommand, actor: ReviewActor): Promise<CommandReceipt> {
+  const args = contributionManageCommandSchema.parse(input);
+  // Logical deletion must still permit exact-input recovery of its durable receipt.
+  const s = await contributionState(ctx, args.submissionId, actor, true);
+  const inputHash = await hash({ command: "manage_contribution", ...args });
+  const previous = await ctx.db.query("mediaReviewReceipts").withIndex("by_actorUserId_idempotencyKey", q =>
+    q.eq("actorUserId", actor.user._id).eq("idempotencyKey", args.idempotencyKey)).unique();
+  if (previous) {
+    if (!s.kitVisible || s.restrictions.some(Boolean) || s.protectedSelection)
+      return { operationId: previous.receipt.operationId, operationState: "refused", code: "authority_changed" };
+    return previous.inputHash === inputHash ? previous.receipt : { operationId: previous.receipt.operationId, operationState: "refused", code: "idempotency_conflict" };
+  }
+  let code = process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED !== "true" || process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED !== "true" ? "review_disabled" :
+    !s.kitVisible ? "target_unavailable" : s.restrictions.some(Boolean) ? "publication_restricted" :
+    !s.ownKitOnly ? "asset_protected" : args.action === "remove" && s.submission.legalHoldAt !== undefined ? "legal_hold" :
+    s.version !== args.expectedContributionVersion ? "contribution_changed" : undefined;
+  const before = { label: s.asset.label, altText: s.asset.altText, credit: s.asset.credit,
+    creditUrl: s.asset.creditUrl, sourceUrl: s.asset.sourceUrl, sourceDescription: s.asset.sourceDescription };
+  const after = { ...before };
+  if (!code && args.action === "update_metadata") {
+    try {
+      if (!Object.keys(args.metadata).length) throw new Error("Metadata change required.");
+      for (const key of ["label", "altText", "credit", "creditUrl", "sourceUrl", "sourceDescription"] as const) {
+        if (!Object.prototype.hasOwnProperty.call(args.metadata, key)) continue;
+        const value = args.metadata[key] ?? undefined;
+        after[key] = key === "label" ? sanitizeProfileAssetLabel(value) :
+          key === "altText" ? sanitizeProfileAssetAltText(value) :
+          key === "credit" ? sanitizeProfileAssetCredit(value) :
+          key === "creditUrl" ? sanitizeProfileAssetCreditUrl(value) :
+          key === "sourceUrl" ? normalizeProfileAssetSourceUrl(value) : value?.trim().replace(/\s+/g, " ") || undefined;
+      }
+      if (!after.label || !after.credit || (!after.sourceUrl && !after.sourceDescription)) throw new Error("Title, credit and provenance required.");
+    } catch { code = "invalid_metadata"; }
+  }
+  const receipt: CommandReceipt = { operationId: crypto.randomUUID(), operationState: code ? "refused" : "committed",
+    resourceId: s.submission._id, ...(code ? { code } : {}) };
+  if (!code) {
+    const now = Date.now();
+    const updatedAt = Math.max(now, s.asset.updatedAt + 1);
+    await ctx.db.patch(s.asset._id, args.action === "remove" ? { state: "deleted", deletedAt: now, updatedAt } : { ...after, updatedAt });
+    await ctx.db.insert("profileAuditEvents", { profileId: s.profile._id,
+      action: args.action === "remove" ? "profile_media_contribution_removed" : "profile_media_contribution_metadata_updated",
+      actor: actor.subject, sourceType: "community", note: JSON.stringify({ assetId: s.asset._id, operationId: receipt.operationId,
+        before, after: args.action === "remove" ? { state: "deleted" } : after }), createdAt: now });
+  }
+  await ctx.db.insert("mediaReviewReceipts", { actorUserId: actor.user._id, submissionId: s.submission._id,
+    idempotencyKey: args.idempotencyKey, inputHash, receipt, createdAt: Date.now() });
+  return receipt;
+}
diff --git a/convex/_mediaReview.ts b/convex/_mediaReview.ts
index 7abf8936..feb34a03 100644
--- a/convex/_mediaReview.ts
+++ b/convex/_mediaReview.ts
@@ -632,10 +632,10 @@ export async function reviewSnapshot(
       rendition: candidateReady
         ? { submissionId: submission._id, kind: "stored_candidate" as const }
         : null,
-      sourceUrl: submission.sourceUrl,
+      sourceUrl: existingCandidateReady ? candidateAsset.sourceUrl : submission.sourceUrl,
       sourceKind: submission.sourceKind,
-      sourceDescription: submission.sourceDescription,
-      credit: submission.credit,
+      sourceDescription: existingCandidateReady ? candidateAsset.sourceDescription : submission.sourceDescription,
+      credit: existingCandidateReady ? candidateAsset.credit ?? "" : submission.credit,
       contentSha256: submission.contentSha256 ?? null,
     },
   };
diff --git a/convex/_profileAssets.ts b/convex/_profileAssets.ts
index d628690f..4e370be5 100644
--- a/convex/_profileAssets.ts
+++ b/convex/_profileAssets.ts
@@ -825,6 +825,9 @@ export async function consumeProfileAssetUploads(
     validateProfileAssetGalleryPlacements(upload.placements, label);
     const assetId = await db.insert("profileAssets", {
       ...(input.approvedSubmissionId === undefined ? {} : { sourceSubmissionId: input.approvedSubmissionId }),
+      ...(input.approvedSubmissionId === undefined ? {} : {
+        sourceDescription: (await db.get(input.approvedSubmissionId))?.sourceDescription,
+      }),
       profileId: input.profileId,
       storageKey: intent.storageKey,
       ...(intent.sourceStorageKey !== undefined && intent.sourceContentSha256 !== undefined
diff --git a/convex/profileMediaSubmissions.ts b/convex/profileMediaSubmissions.ts
index 2a32ab5c..ea95ac10 100644
--- a/convex/profileMediaSubmissions.ts
+++ b/convex/profileMediaSubmissions.ts
@@ -1,5 +1,5 @@
 import { assertLiveContributionToken } from "./_contributionAuth";
-import { publishedContributionDetail, contributionPlacementCommand, proposeContributionPlacement } from "./_mediaContributionCommands";
+import { publishedContributionDetail, contributionPlacementCommand, proposeContributionPlacement, contributionManageCommand } from "./_mediaContributionCommands";
 import { effectiveContributionPolicy, contributionChargeRefusal, registerLegacyContribution, reservationBytes } from "./_contributionCapacity";
 import { requirePublisher, publicationCommand, legacyDeclarationCommand, recordPublicationRestriction } from "./_trustedPublication";
 import { readScopedPagination, writeScopedPagination } from "./_reviewCursor";
@@ -7,6 +7,7 @@ import type { PaginationOptions } from "convex/server";
 import { activeBatchAssignment, hash } from "./_mediaReview";
 import {
   reviewRebaseSchema,
+  contributionManageCommandSchema,
   type CommandReceipt,
 } from "../packages/api-contracts/src/media-review";
 import { changeContributionCharge } from "./_contributionCapacity";
@@ -49,6 +50,11 @@ const contributionCommandArgs = {
 const placementCommandArgs = { ...contributionCommandArgs,
   action: v.union(v.literal("select_primary"), v.literal("clear_primary")),
 };
+const nullableText = v.optional(v.union(v.string(), v.null()));
+const contributionMetadataPatch = v.object({ label: nullableText, altText: nullableText, credit: nullableText,
+  creditUrl: nullableText, sourceUrl: nullableText, sourceDescription: nullableText });
+const manageCommandArgs = { ...contributionCommandArgs, action: v.union(v.literal("update_metadata"), v.literal("remove")),
+  metadata: v.optional(contributionMetadataPatch) };
 export const contributionDetail = query({ args: { submissionId }, handler: async (ctx, args) =>
   publishedContributionDetail(ctx, args.submissionId, await browserReviewActor(ctx)) });
 export const contributionDetailForMcpActor = internalQuery({
@@ -355,9 +361,18 @@ async function reviewSubmission(
   const submitter = includeModeratorEvidence
     ? await ctx.db.get(submission.submitterUserId)
     : null;
+  const candidateAsset = submission.requestKind === "identity_placement" && submission.candidateAssetId
+    ? await ctx.db.get(submission.candidateAssetId) : null;
+  const currentCandidate = candidateAsset?.profileId === profile._id && candidateAsset.state === "active" &&
+    candidateAsset.visibility === "public" && candidateAsset.retiredAt === undefined &&
+    candidateAsset.moderatorSuppressedAt === undefined && candidateAsset.contentSha256 === submission.contentSha256
+    ? candidateAsset : null;
 
   return {
     ...publicSubmission(submission, profile),
+    ...(currentCandidate ? { label: currentCandidate.label, altText: currentCandidate.altText,
+      credit: currentCandidate.credit ?? "", creditUrl: currentCandidate.creditUrl,
+      sourceUrl: currentCandidate.sourceUrl, sourceDescription: currentCandidate.sourceDescription } : {}),
     priorProposalCount,
     priorProposalCountTruncated,
     canViewCandidate:
@@ -2069,6 +2084,18 @@ const receiptValidator = v.object({
   resourceId: v.optional(v.string()),
   code: v.optional(v.string()),
 });
+export const manageContribution = mutation({
+  args: manageCommandArgs,
+  returns: receiptValidator,
+  handler: async (ctx, args) => contributionManageCommand(ctx, contributionManageCommandSchema.parse(args), await browserReviewActor(ctx)),
+});
+export const manageContributionForMcpActor = internalMutation({
+  args: { ...manageCommandArgs, actorUserId: v.id("users"), ...reviewActorAttestationArgs },
+  returns: receiptValidator,
+  handler: async (ctx, { actorUserId, emailVerified, emailVerificationAttestedAt, oauthTokenId, oauthClientId, oauthResource, ...args }) =>
+    contributionManageCommand(ctx, contributionManageCommandSchema.parse(args), await trustedReviewActor(ctx, actorUserId,
+      { emailVerified, emailVerificationAttestedAt, oauthTokenId, oauthClientId, oauthResource }, "assets:contribute")),
+});
 export const decideWithReceipt = mutation({
   args: receiptDecisionArgs,
   returns: receiptValidator,
diff --git a/convex/schema.ts b/convex/schema.ts
index 6567b7c3..42196585 100644
--- a/convex/schema.ts
+++ b/convex/schema.ts
@@ -984,6 +984,7 @@ export default defineSchema({
     .index("by_publicationMethod_actor", ["publicationMethod", "publicationActorUserId"]),
   profileAssets: defineTable({
     sourceSubmissionId: v.optional(v.id("profileMediaSubmissions")),
+    sourceDescription: v.optional(v.string()),
     profileId: v.id("profiles"),
     storageKey: v.string(),
     sourceStorageKey: v.optional(v.string()),
@@ -1030,6 +1031,7 @@ export default defineSchema({
     state: profileAssetState,
     updatedAt: v.number(),
   })
+    .index("by_assetId_state", ["assetId", "state"])
     .index("by_profileId_placement_state_position", [
       "profileId",
       "placement",
diff --git a/docs/engineering/media-review-commands.md b/docs/engineering/media-review-commands.md
index 91c22172..90d65ff7 100644
--- a/docs/engineering/media-review-commands.md
+++ b/docs/engineering/media-review-commands.md
@@ -66,6 +66,26 @@ these requests. Their authorized preview reads the existing stored asset.
 Meaningful evidence changes require fresh inspection. Placement changes also
 require an explicit rebase against the original selection snapshot.
 
+`manageContribution` and internal `manageContributionForMcpActor` accept an own
+approved submission ID, expected contribution version, idempotency key and either
+`update_metadata` or `remove`. Ordinary contributors need no publisher grant.
+MCP uses `assets:contribute` and `mcp:write` with current email/delegation checks.
+Corrections allow only title, alt text, credit, credit URL, source URL and source
+description. Optional values clear with `null`; title, credit and at least one
+provenance value remain required. Actor and before/after metadata enter the audit.
+The submission and publication evidence remain historical; published details and
+existing-asset placement reviews project the current public asset metadata.
+Corrections invalidate inspected placement review versions.
+
+Management requires a public, published, unclaimed target and visible public kit.
+Non-gallery placement, another actor's selection, moderation restriction,
+suppression or private media blocks contributor management. Legal holds block
+removal. Removal uses the existing owner logical-delete state and timestamp,
+excluding the item from public kit/download reads while retaining bytes, gallery
+references, accounting and approved history. It schedules no permanent deletion.
+Exact-input receipt replay recovers a removed item after response loss, with
+current ownership, visibility and selection authority still checked.
+
 Successful publication and its immutable receipt commit in one transaction.
 Expected terminal refusals also persist receipts. Projected active-public-asset
 capacity is checked before writes, with one new asset for each uploaded kit
diff --git a/packages/api-contracts/src/media-review.ts b/packages/api-contracts/src/media-review.ts
index b4edc030..08dfd99a 100644
--- a/packages/api-contracts/src/media-review.ts
+++ b/packages/api-contracts/src/media-review.ts
@@ -12,6 +12,20 @@ export const contributionPlacementCommandSchema = z.strictObject({
   action: z.enum(["select_primary", "clear_primary"]),
 });
 export type ContributionPlacementCommand = z.infer<typeof contributionPlacementCommandSchema>;
+export const contributionMetadataPatchSchema = z.strictObject({
+  label: z.string().max(80).nullable().optional(),
+  altText: z.string().max(180).nullable().optional(),
+  credit: z.string().max(120).nullable().optional(),
+  creditUrl: z.string().max(4096).nullable().optional(),
+  sourceUrl: z.string().max(4096).nullable().optional(),
+  sourceDescription: z.string().max(1000).nullable().optional(),
+});
+export type ContributionMetadataPatch = z.infer<typeof contributionMetadataPatchSchema>;
+export const contributionManageCommandSchema = z.discriminatedUnion("action", [
+  z.strictObject({ ...contributionCommandBaseSchema.shape, action: z.literal("update_metadata"), metadata: contributionMetadataPatchSchema }),
+  z.strictObject({ ...contributionCommandBaseSchema.shape, action: z.literal("remove") }),
+]);
+export type ContributionManageCommand = z.infer<typeof contributionManageCommandSchema>;
 export const publishedContributionDetailSchema = z.strictObject({
   submissionId: boundedId, assetId: boundedId, profileId: boundedId,
   profileSlug: z.string().max(200), contributionVersion: z.string().min(1).max(128),
diff --git a/packages/api-contracts/tests/media-review.test.ts b/packages/api-contracts/tests/media-review.test.ts
index d831aadf..15dff9be 100644
--- a/packages/api-contracts/tests/media-review.test.ts
+++ b/packages/api-contracts/tests/media-review.test.ts
@@ -5,9 +5,20 @@ import {
   reviewPageRequestSchema,
   contributionCommandBaseSchema,
   contributionPlacementCommandSchema,
+  contributionManageCommandSchema,
   publishedContributionDetailSchema,
 } from "../src/media-review";
 import { apiScopes } from "../src/auth";
+it("bounds contribution metadata patches and forbids byte, authority, target and placement changes", () => {
+  const base = { submissionId: "submission", expectedContributionVersion: "version", idempotencyKey: "key" };
+  assert.equal(contributionManageCommandSchema.safeParse({ ...base, action: "remove" }).success, true);
+  assert.equal(contributionManageCommandSchema.safeParse({ ...base, action: "update_metadata", metadata: { credit: null, altText: null } }).success, true);
+  for (const metadata of [{ label: "x".repeat(81) }, { sourceDescription: "x".repeat(1001) }, { credit: "x".repeat(121) },
+    { altText: "x".repeat(181) }, { sourceUrl: "x".repeat(4097) }, { storageKey: "other" }, { visibility: "public" }, { profileId: "other" }, { placements: ["profile_image"] }])
+    assert.equal(contributionManageCommandSchema.safeParse({ ...base, action: "update_metadata", metadata }).success, false);
+  assert.equal(contributionManageCommandSchema.safeParse({ ...base, action: "remove", metadata: {} }).success, false);
+  assert.equal(contributionManageCommandSchema.safeParse({ ...base, action: "update_metadata", metadata: {}, actorUserId: "other" }).success, false);
+});
 it("bounds contribution commands and refuses caller-selected capabilities", () => {
   const base = { submissionId: "submission", expectedContributionVersion: "version", idempotencyKey: "key" };
   assert.equal(contributionCommandBaseSchema.safeParse(base).success, true);
diff --git a/tests/backend/media-contribution-commands.test.ts b/tests/backend/media-contribution-commands.test.ts
index 3bf62520..2250fcf4 100644
--- a/tests/backend/media-contribution-commands.test.ts
+++ b/tests/backend/media-contribution-commands.test.ts
@@ -3,13 +3,129 @@ import { it } from "node:test";
 import { convexTest } from "convex-test";
 import { api, internal } from "../../convex/_generated/api";
 import { modules, schema, seed, createAndUpload } from "./_mediaReviewFixture";
-import { getProfileMediaVersion, selectProfileAssetIdentity } from "../../convex/_profileAssets";
+import { getProfileMediaVersion, getPublicProfileMediaKit, selectProfileAssetIdentity } from "../../convex/_profileAssets";
 
 process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED = "true";
 process.env.VRDEX_PROFILE_MEDIA_DIRECT_UPLOAD_ENABLED = "true";
 process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true";
 
-async function fixture(profileType: "person" | "community" = "person") {
+it("corrects own approved kit metadata without publisher authority and keeps evidence immutable", async () => {
+  const f = await fixture();
+  await f.t.run(ctx => ctx.db.patch(f.grant, { state: "revoked" }));
+  const before = await f.t.run(ctx => ctx.db.get(f.intent.submissionId));
+  const d = await f.detail();
+  const args = { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion,
+    idempotencyKey: "correct", action: "update_metadata" as const,
+    metadata: { label: " Updated image ", altText: null, credit: " New credit ", sourceUrl: null, sourceDescription: "Local photograph" } };
+  const first = await f.actor.mutation(api.profileMediaSubmissions.manageContribution, args);
+  assert.equal(first.operationState, "committed");
+  assert.deepEqual(await f.actor.mutation(api.profileMediaSubmissions.manageContribution, args), first);
+  assert.equal((await f.actor.mutation(api.profileMediaSubmissions.manageContribution, { ...args, metadata: { credit: "different" } })).code, "idempotency_conflict");
+  const next = await f.detail();
+  assert.notEqual(next.contributionVersion, d.contributionVersion);
+  assert.equal(next.metadata.label, "Updated image");
+  assert.equal(next.metadata.credit, "New credit");
+  assert.equal(next.metadata.altText, undefined);
+  assert.equal(next.metadata.sourceUrl, undefined);
+  assert.equal(next.metadata.sourceDescription, "Local photograph");
+  assert.deepEqual(await f.t.run(ctx => ctx.db.get(f.intent.submissionId)), before);
+  const audits = await f.t.run(ctx => ctx.db.query("profileAuditEvents").collect());
+  const correction = audits.filter(row => row.action === "profile_media_contribution_metadata_updated");
+  assert.equal(correction.length, 1);
+  const audit = JSON.parse(correction[0].note!);
+  assert.equal(audit.before.credit, d.metadata.credit);
+  assert.equal(audit.after.credit, "New credit");
+  assert.equal((await f.actor.mutation(api.profileMediaSubmissions.manageContribution, { ...args, idempotencyKey: "stale" })).code, "contribution_changed");
+});
+
+it("removes own kit item once, retains bytes/accounting/history and refuses key reuse for another item", async () => {
+  const f = await fixture();
+  const d = await f.detail();
+  const charge = await f.t.run(ctx => ctx.db.query("contributionUploadReservations").first());
+  const args = { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "remove", action: "remove" as const };
+  const first = await f.actor.mutation(api.profileMediaSubmissions.manageContribution, args);
+  assert.equal(first.operationState, "committed");
+  assert.deepEqual(await f.actor.mutation(api.profileMediaSubmissions.manageContribution, args), first);
+  const removed = await f.t.run(ctx => ctx.db.get(d.assetId));
+  assert.equal(removed?.state, "deleted");
+  assert.ok(removed?.deletedAt);
+  assert.equal(removed?.retiredAt, undefined);
+  assert.deepEqual(await f.t.run(ctx => ctx.db.query("contributionUploadReservations").first()), charge);
+  const kit = await f.t.run(async ctx => getPublicProfileMediaKit(ctx.db, (await ctx.db.get(f.s.profileId))!));
+  assert.equal(kit.galleryAssets.length, 0);
+  assert.equal((await f.actor.query(api.profileMediaSubmissions.getMine, { submissionId: f.intent.submissionId }))?.status, "approved");
+  const second = await seed(f.t);
+  const otherId = await f.t.run(async ctx => {
+    const original = (await ctx.db.get(f.intent.submissionId))!;
+    const asset = (await ctx.db.get(d.assetId))!;
+    const { _id, _creationTime, ...fields } = original;
+    const id = await ctx.db.insert("profileMediaSubmissions", { ...fields, profileId: second.profileId });
+    const { _id: assetId, _creationTime: assetCreatedAt, ...assetFields } = asset;
+    const newAsset = await ctx.db.insert("profileAssets", { ...assetFields, profileId: second.profileId, sourceSubmissionId: id, state: "active", deletedAt: undefined });
+    await ctx.db.patch(id, { approvedAssetId: newAsset });
+    return id;
+  });
+  assert.equal((await f.actor.mutation(api.profileMediaSubmissions.manageContribution, { ...args, submissionId: otherId })).code, "idempotency_conflict");
+  assert.equal((await f.t.run(async ctx => ctx.db.get((await ctx.db.get(otherId))!.approvedAssetId!)))?.state, "active");
+});
+
+for (const metadata of [{ credit: null }, { credit: " " }, { sourceUrl: null, sourceDescription: null }, { sourceUrl: "http://example.test" }, { creditUrl: "javascript:alert(1)" }, { label: null }, {}]) {
+  it(`refuses invalid correction ${JSON.stringify(metadata)}`, async () => {
+    const f = await fixture();
+    const d = await f.detail();
+    const result = await f.actor.mutation(api.profileMediaSubmissions.manageContribution, { submissionId: f.intent.submissionId,
+      expectedContributionVersion: d.contributionVersion, idempotencyKey: "invalid", action: "update_metadata", metadata });
+    assert.equal(result.operationState, "refused");
+    assert.deepEqual(await f.detail(), d);
+  });
+}
+
+for (const condition of ["primary", "other_selection", "claimed", "private_profile", "private_asset", "hidden_kit", "suppressed", "held", "wrong_submitter"] as const) {
+  it(`protects contribution management after ${condition}`, async () => {
+    const f = await fixture();
+    const d = await f.detail();
+    await f.t.run(async ctx => {
+      if (condition === "primary" || condition === "other_selection") await selectProfileAssetIdentity(ctx.db, { profileId: f.s.profileId, assetId: d.assetId, placement: "profile_image", actorUserId: condition === "primary" ? f.s.contributorUserId : f.s.moderatorUserId, now: Date.now() });
+      if (condition === "claimed") await ctx.db.patch(f.s.profileId, { claimState: "claimed_verified" });
+      if (condition === "private_profile") await ctx.db.patch(f.s.profileId, { publicSurfacingState: "opted_out" });
+      if (condition === "private_asset") await ctx.db.patch(d.assetId, { visibility: "private", credit: "Private owner credit" });
+      if (condition === "hidden_kit") await ctx.db.patch(f.s.profileId, { fieldVisibility: { mediaKit: "private" } });
+      if (condition === "suppressed") await ctx.db.patch(d.assetId, { moderatorSuppressedAt: Date.now() });
+      if (condition === "held") await ctx.db.patch(f.intent.submissionId, { legalHoldAt: Date.now() });
+      if (condition === "wrong_submitter") await ctx.db.patch(f.intent.submissionId, { submitterUserId: f.s.moderatorUserId });
+    });
+    const args = { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "blocked", action: "remove" as const };
+    if (condition === "private_asset" || condition === "suppressed" || condition === "wrong_submitter") await assert.rejects(f.actor.mutation(api.profileMediaSubmissions.manageContribution, args), /unavailable/i);
+    else assert.equal((await f.actor.mutation(api.profileMediaSubmissions.manageContribution, args)).operationState, "refused");
+    assert.equal((await f.t.run(ctx => ctx.db.get(d.assetId)))?.state, "active");
+    if (condition !== "wrong_submitter") {
+      const history = await f.actor.query(api.profileMediaSubmissions.getMine, { submissionId: f.intent.submissionId });
+      assert.equal(history?.status, "approved");
+      assert.ok(!JSON.stringify(history).includes("Private owner credit"));
+    }
+  });
+}
+
+it("metadata correction invalidates inspected placement review and refreshes its candidate projection", async () => {
+  const f = await fixture();
+  const d = await f.detail();
+  const proposal = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "proposal" });
+  const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
+  const before = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: proposal.resourceId! });
+  assert.ok(before);
+  assert.equal((await f.actor.mutation(api.profileMediaSubmissions.manageContribution, { submissionId: f.intent.submissionId,
+    expectedContributionVersion: d.contributionVersion, idempotencyKey: "correct", action: "update_metadata", metadata: { credit: "Corrected credit", sourceUrl: "https://corrected.example/source" } })).operationState, "committed");
+  const after = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: proposal.resourceId! });
+  assert.ok(after);
+  assert.notEqual(after.reviewVersion, before.reviewVersion);
+  assert.equal(after.candidate.credit, "Corrected credit");
+  assert.equal(after.candidate.sourceUrl, "https://corrected.example/source");
+  assert.equal(after.credit, "Corrected credit");
+  assert.equal(after.sourceUrl, "https://corrected.example/source");
+  assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, { submissionId: proposal.resourceId!, expectedReviewVersion: before.reviewVersion, decision: "approve", privateReason: "Checked", idempotencyKey: "stale" })).code, "review_changed");
+});
+
+async function fixture(profileType: "person" | "community" = "person", independentlyApproved = false) {
   const t = convexTest({ schema, modules });
   const s = await seed(t, profileType);
   const { intent } = await createAndUpload(t, s);
@@ -19,10 +135,13 @@ async function fixture(profileType: "person" | "community" = "person") {
     grantedAt: Date.now(), updatedAt: Date.now(),
   }));
   const actor = t.withIdentity(s.contributorIdentity);
-  const pending = await actor.query(api.profileMediaSubmissions.publisherDetail, { submissionId: intent.submissionId });
+  if (independentlyApproved) await t.run(ctx => ctx.db.patch(grant, { state: "revoked" }));
+  const reviewer = independentlyApproved ? t.withIdentity(s.moderatorIdentity) : actor;
+  const pending = await reviewer.query(independentlyApproved ? api.profileMediaSubmissions.reviewDetail : api.profileMediaSubmissions.publisherDetail, { submissionId: intent.submissionId });
   assert.ok(pending);
-  assert.equal((await actor.mutation(api.profileMediaSubmissions.publish, {
+  assert.equal((await reviewer.mutation(independentlyApproved ? api.profileMediaSubmissions.decideWithReceipt : api.profileMediaSubmissions.publish, {
     submissionId: intent.submissionId, expectedReviewVersion: pending.reviewVersion, idempotencyKey: "publish",
+    ...(independentlyApproved ? { decision: "approve", privateReason: "Independently reviewed" } : {}),
   })).operationState, "committed");
   await t.run(ctx => ctx.db.patch(intent.submissionId, { createdAt: Date.now() - 60_000 }));
   const detail = () => actor.query(api.profileMediaSubmissions.contributionDetail, { submissionId: intent.submissionId });
@@ -36,6 +155,48 @@ async function fixture(profileType: "person" | "community" = "person") {
   return { t, s, intent, grant, actor, detail, place, placements };
 }
 
+it("allows ordinary independently approved contributors to correct and remove their own kit items", async () => {
+  const f = await fixture("person", true);
+  assert.equal((await f.detail()).canEditMetadata, true);
+  const d = await f.detail();
+  assert.equal((await f.actor.mutation(api.profileMediaSubmissions.manageContribution, { submissionId: f.intent.submissionId,
+    expectedContributionVersion: d.contributionVersion, idempotencyKey: "correct", action: "update_metadata", metadata: { credit: "Corrected credit" } })).operationState, "committed");
+  const fresh = await f.detail();
+  assert.equal((await f.actor.mutation(api.profileMediaSubmissions.manageContribution, { submissionId: f.intent.submissionId,
+    expectedContributionVersion: fresh.contributionVersion, idempotencyKey: "remove", action: "remove" })).operationState, "committed");
+});
+
+it("protects non-kit placement selections and exposes no current metadata for a hidden kit", async () => {
+  const f = await fixture();
+  const d = await f.detail();
+  await f.t.run(async ctx => {
+    await ctx.db.insert("profileAssetPlacements", { profileId: f.s.profileId, assetId: d.assetId, placement: "banner", position: 0,
+      state: "active", selectionActorUserId: f.s.moderatorUserId, selectionOperationId: "owner", updatedAt: Date.now() });
+    await ctx.db.patch(d.assetId, { credit: "Private owner metadata" });
+  });
+  assert.equal((await f.detail()).canEditMetadata, false);
+  assert.equal((await f.actor.mutation(api.profileMediaSubmissions.manageContribution, { submissionId: f.intent.submissionId,
+    expectedContributionVersion: d.contributionVersion, idempotencyKey: "protected", action: "update_metadata", metadata: { credit: "Take over" } })).operationState, "refused");
+  await f.t.run(ctx => ctx.db.patch(f.s.profileId, { fieldVisibility: { mediaKit: "private" } }));
+  assert.ok(!JSON.stringify(await f.detail()).includes("Private owner metadata"));
+});
+
+it("attested MCP contributors manage with contribute scope and lose replay after delegation revocation", async () => {
+  const f = await fixture("person", true);
+  const d = await f.detail();
+  const tokenId = await f.t.run(ctx => ctx.db.insert("oauthAccessTokens", { tokenId: "manage-token", clientId: "client", subjectType: "user",
+    userId: f.s.contributorUserId, resource: "https://example.test/mcp", scopes: ["mcp:read", "mcp:write", "assets:contribute"], status: "active", issuedAt: Date.now(), expiresAt: Date.now() + 60_000 }));
+  const args = { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "mcp-correct",
+    action: "update_metadata" as const, metadata: { credit: "MCP credit" }, actorUserId: f.s.contributorUserId,
+    oauthTokenId: "manage-token", oauthClientId: "client", emailVerified: true, emailVerificationAttestedAt: Date.now() };
+  await assert.rejects(f.t.mutation(internal.profileMediaSubmissions.manageContributionForMcpActor, { ...args, emailVerified: false }), /verified/i);
+  const first = await f.t.mutation(internal.profileMediaSubmissions.manageContributionForMcpActor, args);
+  assert.equal(first.operationState, "committed");
+  assert.deepEqual(await f.t.mutation(internal.profileMediaSubmissions.manageContributionForMcpActor, args), first);
+  await f.t.run(ctx => ctx.db.patch(tokenId, { status: "revoked" }));
+  await assert.rejects(f.t.mutation(internal.profileMediaSubmissions.manageContributionForMcpActor, args), /DENIED/);
+});
+
 for (const profileType of ["person", "community"] as const) {
   it(`selects and clears its own ${profileType} primary while keeping gallery and bytes`, async () => {
     const f = await fixture(profileType);

From abb94e3ed382ea3c81b3fad391d1771e72d14868 Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Mon, 5 Oct 2026 19:30:03 -0400
Subject: [PATCH 10/28] feat: expose media kit contribution actions through MCP

---
 .../media-review-assigned.stories.tsx         |   2 +
 apps/web/src/lib/server/mcp-media-review.ts   |  29 +++-
 apps/web/src/lib/server/vrdex-mcp.ts          | 126 +++++++++++++-----
 convex/_apiWriteAuditEvents.ts                |   3 +
 convex/_mcpToolEvents.ts                      |   4 +
 scripts/smoke-mcp-inspector-client.ts         |   5 +-
 scripts/smoke-vrdex-mcp-compat.ts             |  34 ++++-
 tests/scripts/mcp-compat-smoke-cli.test.ts    |  17 ++-
 tests/scripts/mcp-inspector-smoke.test.ts     |  16 ++-
 tests/web/mcp-media-review.test.ts            |  24 ++++
 tests/web/vrdex-mcp.test.ts                   | 101 +++++++++++++-
 11 files changed, 319 insertions(+), 42 deletions(-)

diff --git a/apps/web/src/components/media-review-assigned.stories.tsx b/apps/web/src/components/media-review-assigned.stories.tsx
index 2ccdee9a..7c304aa3 100644
--- a/apps/web/src/components/media-review-assigned.stories.tsx
+++ b/apps/web/src/components/media-review-assigned.stories.tsx
@@ -19,6 +19,8 @@ const row: Props["row"] = {
   profileType: "person",
   profileIsPublic: true,
   requestedPlacement: "profile_image",
+  requestKind: undefined,
+  candidateAssetId: undefined,
   status: "submitted",
   sourceKind: "local",
   sourceDescription: description,
diff --git a/apps/web/src/lib/server/mcp-media-review.ts b/apps/web/src/lib/server/mcp-media-review.ts
index e0b782b4..e769fdc9 100644
--- a/apps/web/src/lib/server/mcp-media-review.ts
+++ b/apps/web/src/lib/server/mcp-media-review.ts
@@ -1,5 +1,9 @@
 import {
   commandReceiptSchema,
+  contributionCommandBaseSchema,
+  contributionManageCommandSchema,
+  contributionPlacementCommandSchema,
+  publishedContributionDetailSchema,
   mediaPublicationSchema,
   publicationEvidenceSchema,
   reviewRebaseSchema,
@@ -73,13 +77,16 @@ export const mediaSubmissionWriteToolNames = [
   "vrdex_media_submission_withdraw",
 ] as const;
 
-type ReviewQueryName = "list" | "detail" | "candidate" | "current";
+type ReviewQueryName = "list" | "detail" | "candidate" | "current" | "contributionGet";
 type ReviewMutationName =
   | "decide"
   | "withdraw"
   | "rebase"
   | "publish"
-  | "declare";
+  | "declare"
+  | "contributionManage"
+  | "contributionPlace"
+  | "contributionProposePlacement";
 type StoredObject = {
   body: Uint8Array;
   contentType: string;
@@ -308,6 +315,24 @@ export function createMcpMediaReviewHandlers<TActor extends string>(
       };
     },
 
+    async contributionGet(input: unknown): Promise<ToolResult> {
+      const value = mediaReviewGetInputSchema.parse(input);
+      const result = await dependencies.query("contributionGet", { ...(await attestation(dependencies)), ...value });
+      if (result === null) return refusal("Contribution unavailable.");
+      return jsonResult(publishedContributionDetailSchema.parse(result));
+    },
+    async contributionManage(input: unknown): Promise<ToolResult> {
+      const value = contributionManageCommandSchema.parse(input);
+      return jsonResult(commandReceiptSchema.parse(await dependencies.mutate("contributionManage", { ...(await attestation(dependencies)), ...value })));
+    },
+    async contributionPlace(input: unknown): Promise<ToolResult> {
+      const value = contributionPlacementCommandSchema.parse(input);
+      return jsonResult(commandReceiptSchema.parse(await dependencies.mutate("contributionPlace", { ...(await attestation(dependencies)), ...value })));
+    },
+    async contributionProposePlacement(input: unknown): Promise<ToolResult> {
+      const value = contributionCommandBaseSchema.parse(input);
+      return jsonResult(commandReceiptSchema.parse(await dependencies.mutate("contributionProposePlacement", { ...(await attestation(dependencies)), ...value })));
+    },
     async publish(input: unknown): Promise<ToolResult> {
       return jsonResult(
         commandReceiptSchema.parse(
diff --git a/apps/web/src/lib/server/vrdex-mcp.ts b/apps/web/src/lib/server/vrdex-mcp.ts
index ebe18adc..d2575b33 100644
--- a/apps/web/src/lib/server/vrdex-mcp.ts
+++ b/apps/web/src/lib/server/vrdex-mcp.ts
@@ -12,6 +12,7 @@ import {
   fromJsonSchema,
   type AuthInfo,
   type McpHttpHandler,
+  type Tool,
   McpServer,
 } from "@modelcontextprotocol/server";
 import { api, internal } from "@convex-generated-api";
@@ -25,6 +26,10 @@ import {
   ApiProfileUpdateRequestSchema,
   ApiProfileWriteResponseSchema,
   commandReceiptSchema,
+  contributionCommandBaseSchema,
+  contributionManageCommandSchema,
+  contributionPlacementCommandSchema,
+  publishedContributionDetailSchema,
   ProfileAssetPlacementSchema,
   type ApiScope,
   getBearerTokenFromAuthorizationHeader,
@@ -143,6 +148,9 @@ const mcpWriteToolNames = [
   ...mediaReviewWriteToolNames,
   ...mediaSubmissionWriteToolNames,
   "vrdex_media_submission_publish",
+  "vrdex_media_contribution_manage",
+  "vrdex_media_contribution_place",
+  "vrdex_media_contribution_propose_placement",
   "vrdex_media_submission_declare",
   "vrdex_contribution_capacity_request",
   "vrdex_contribution_batch_create",
@@ -182,6 +190,9 @@ const mcpWriteToolResourceScopes: Record<(typeof mcpWriteToolNames)[number], Api
   vrdex_media_review_decide_selected: "assets:review:write",
   vrdex_media_submission_withdraw: "assets:contribute",
   vrdex_media_submission_publish: "assets:publish",
+  vrdex_media_contribution_manage: "assets:contribute",
+  vrdex_media_contribution_place: "assets:publish",
+  vrdex_media_contribution_propose_placement: "assets:contribute",
   vrdex_media_submission_declare: "assets:publish",
   vrdex_contribution_capacity_request: "assets:contribute",
   vrdex_contribution_batch_create: "assets:contribute",
@@ -213,6 +224,7 @@ const mcpOwnedReadToolNames = [
   "vrdex_media_review_assignments",
   ...mediaReviewReadToolNames,
   "vrdex_media_submission_get",
+  "vrdex_media_contribution_get",
   "vrdex_media_submission_preview",
 ] as const;
 const mcpOwnedReadToolScopes: Record<(typeof mcpOwnedReadToolNames)[number], ApiScope> = {
@@ -228,6 +240,7 @@ const mcpOwnedReadToolScopes: Record<(typeof mcpOwnedReadToolNames)[number], Api
   vrdex_get_my_media_submission: "assets:contribute",
   vrdex_media_review_assignments: "assets:review:read",
   vrdex_media_submission_get: "assets:publish",
+  vrdex_media_contribution_get: "assets:contribute",
   vrdex_media_submission_preview: "assets:publish",
   vrdex_media_review_list: "assets:review:read",
   vrdex_media_review_get: "assets:review:read",
@@ -440,7 +453,7 @@ const mcpProfileMediaSubmissionSchema = z.object({
   submissionId: z.string().min(1),
   profileSlug: mcpSlugSchema,
   profileDisplayName: z.string().min(1),
-  requestedPlacement: z.enum(["profile_image", "primary_logo"]),
+  requestedPlacement: z.enum(["profile_image", "primary_logo", "gallery"]),
   status: mcpProfileMediaSubmissionStatusSchema,
   publicDisposition: z.string().optional(),
   approvedAssetId: z.string().min(1).optional(),
@@ -1079,6 +1092,9 @@ const mcpMediaReviewWriteToolNames = new Set<string>([
   ...mediaReviewWriteToolNames,
   ...mediaSubmissionWriteToolNames,
   "vrdex_media_submission_publish",
+  "vrdex_media_contribution_manage",
+  "vrdex_media_contribution_place",
+  "vrdex_media_contribution_propose_placement",
   "vrdex_media_submission_declare",
 ]);
 const definiteMediaReviewErrorCodes = new Map<string, [
@@ -2081,12 +2097,29 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     name: "vrdex",
     version: "0.5.0",
   });
+  const advertisedTools: Tool[] = [];
+  // The SDK enabled flag also blocks calls. Keep historical declaration callable,
+  // and derive its omission from the same registration configurations.
+  const registerTool = ((...args: Parameters<typeof server.registerTool>) => {
+    const registered = server.registerTool(...args);
+    const [name] = args;
+    if (name !== "vrdex_media_submission_declare") {
+      advertisedTools.push({
+        name, title: registered.title, description: registered.description,
+        inputSchema: { type: "object", ...(registered.inputSchema?.["~standard"].jsonSchema.input({ target: "draft-2020-12" }) ?? { properties: {} }) } as Tool["inputSchema"],
+        ...(registered.outputSchema ? { outputSchema: registered.outputSchemaJson as Tool["outputSchema"] } : {}),
+        annotations: registered.annotations, icons: registered.icons,
+        execution: registered.execution, _meta: registered._meta,
+      });
+    }
+    return registered;
+  }) as typeof server.registerTool;
   for (const operation of Object.keys(eventIntakeOperations) as EventIntakeOperation[]) {
     const contract = eventIntakeOperations[operation];
     const readOnly = operation === "draft_get" || operation === "event_get";
     const toolName = `vrdex_event_intake_${operation}` as const;
     const scopes: ApiScope[] = [readOnly ? "mcp:read" : "mcp:write", "events:contribute"];
-    server.registerTool(toolName, {
+    registerTool(toolName, {
       title: toolName, description: `Event intake ${operation.replaceAll("_", " ")}.`,
       inputSchema: fromJsonSchema<Record<string, unknown>>(mcpOutputJsonSchemaForZodSchema(contract.input)), outputSchema: mcpOutputSchema<Record<string, unknown>>(contract.output),
       annotations: { readOnlyHint: readOnly, destructiveHint: operation === "event_retract", idempotentHint: readOnly || operation === "publish" },
@@ -2140,7 +2173,8 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
         }
         const submissionId = args.submissionId as Id<"profileMediaSubmissions">;
         return await adminConvex().query(
-          name === "detail"
+          name === "contributionGet" ? internal.profileMediaSubmissions.contributionDetailForMcpActor
+            : name === "detail"
             ? publisher ? internal.profileMediaSubmissions.publisherDetailForMcpActor : internal.profileMediaSubmissions.reviewDetailForMcpActor
             : name === "current"
               ? publisher
@@ -2159,7 +2193,10 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
       mutate: async (name, args) => {
         const submissionId = args.submissionId as Id<"profileMediaSubmissions">;
         return await adminConvex().mutation(
-          name === "publish" ? internal.profileMediaSubmissions.publishForMcpActor
+          name === "contributionManage" ? internal.profileMediaSubmissions.manageContributionForMcpActor
+            : name === "contributionPlace" ? internal.profileMediaSubmissions.placeContributionForMcpActor
+            : name === "contributionProposePlacement" ? internal.profileMediaSubmissions.proposePlacementForMcpActor
+            : name === "publish" ? internal.profileMediaSubmissions.publishForMcpActor
             : name === "declare" ? internal.profileMediaSubmissions.declarePublicationEvidenceForMcpActor
             : name === "decide"
             ? internal.profileMediaSubmissions.decideForMcpActor
@@ -2328,7 +2365,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     } satisfies PublicSearchResponse;
   }
 
-  server.registerTool(
+  registerTool(
     "search",
     {
       title: "Search VRDex Documents",
@@ -2355,7 +2392,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     },
   );
 
-  server.registerTool(
+  registerTool(
     "fetch",
     {
       title: "Fetch VRDex Document",
@@ -2405,7 +2442,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     },
   );
 
-  server.registerTool(
+  registerTool(
     "vrdex_search",
     {
       title: "Search VRDex",
@@ -2432,7 +2469,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     },
   );
 
-  server.registerTool(
+  registerTool(
     "vrdex_get_profile",
     {
       title: "Get VRDex Profile",
@@ -2466,7 +2503,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     },
   );
 
-  server.registerTool(
+  registerTool(
     "vrdex_list_my_profiles",
     {
       title: "List My VRDex Profiles",
@@ -2529,7 +2566,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     },
   );
 
-  server.registerTool(
+  registerTool(
     "vrdex_list_my_media_submissions",
     {
       title: "List My VRDex Media Submissions",
@@ -2608,7 +2645,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
   ) as ContributionOperation[]) {
     const toolName = collectionToolNames[operation];
     const read = ["get", "items", "capacity", "requests", "status"].includes(operation);
-    server.registerTool(
+    registerTool(
       toolName,
       {
         title: operation,
@@ -2665,7 +2702,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
 
   for (const operation of ["begin", "complete"] as const) {
     const toolName = operation === "begin" ? "vrdex_media_upload_begin" : "vrdex_media_upload_complete";
-    server.registerTool(toolName, {
+    registerTool(toolName, {
       title: operation === "begin" ? "Begin Media Upload" : "Complete Media Upload",
       description: operation === "begin" ? "Reserve a local image upload and return its multipart transfer fields." : "Finalize an uploaded image as owner media or a private contribution.",
       inputSchema: operation === "begin" ? localUploadRequestSchema : localUploadCompleteSchema,
@@ -2702,7 +2739,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
 
   for (const operation of ["get", "preview"] as const) {
     const toolName = operation === "get" ? "vrdex_media_submission_get" : "vrdex_media_submission_preview";
-    server.registerTool(toolName, {
+    registerTool(toolName, {
       title: operation === "get" ? "Contribution" : "Preview", description: toolName,
       inputSchema: operation === "get" ? mediaReviewGetInputSchema : mediaReviewPreviewInputSchema,
       annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
@@ -2712,9 +2749,18 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
       return principal === null ? mcpOwnedReadUnauthorized(toolName) : await mediaReviewHandlersFor(principal, true)[operation](input);
     });
   }
+  registerTool("vrdex_media_contribution_get", {
+    title: "Contribution", description: "vrdex_media_contribution_get",
+    inputSchema: mediaReviewGetInputSchema, outputSchema: mcpOutputSchema(publishedContributionDetailSchema),
+    annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
+    _meta: { securitySchemes: mcpOwnedReadSecuritySchemes("vrdex_media_contribution_get") },
+  }, async input => {
+    const principal = ownedReadPrincipalFor("vrdex_media_contribution_get");
+    return principal === null ? mcpOwnedReadUnauthorized("vrdex_media_contribution_get") : await mediaReviewHandlersFor(principal).contributionGet(input);
+  });
   for (const operation of ["publish", "declare"] as const) {
     const toolName = operation === "publish" ? "vrdex_media_submission_publish" : "vrdex_media_submission_declare";
-    server.registerTool(toolName, {
+    registerTool(toolName, {
       title: operation === "publish" ? "Publish" : "Confirm evidence", description: toolName,
       inputSchema: operation === "publish" ? mediaPublicationSchema : publicationEvidenceSchema,
       outputSchema: mcpOutputSchema(commandReceiptSchema),
@@ -2727,11 +2773,26 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     });
   }
 
+  for (const [toolName, operation, inputSchema, title] of [
+    ["vrdex_media_contribution_manage", "contributionManage", contributionManageCommandSchema, "Manage contribution"],
+    ["vrdex_media_contribution_place", "contributionPlace", contributionPlacementCommandSchema, "Profile picture"],
+    ["vrdex_media_contribution_propose_placement", "contributionProposePlacement", contributionCommandBaseSchema, "Request replacement"],
+  ] as const) {
+    registerTool(toolName, {
+      title, description: toolName, inputSchema, outputSchema: mcpOutputSchema(commandReceiptSchema),
+      annotations: { readOnlyHint: false, destructiveHint: operation === "contributionManage", idempotentHint: true, openWorldHint: false },
+      _meta: { securitySchemes: mcpWriteSecuritySchemes(toolName) },
+    }, async (input: unknown) => {
+      const principal = principalFor(toolName);
+      return principal === null ? mcpWriteUnauthorized(toolName) : await recordNewWrite(toolName, principal, input, () => mediaReviewHandlersFor(principal)[operation](input));
+    });
+  }
+
   for (const assigned of [false, true]) {
     const name = assigned
       ? "vrdex_media_review_assignments"
       : "vrdex_get_my_media_submission";
-    server.registerTool(
+    registerTool(
       name,
       {
         title: assigned ? "Assigned batches" : "My contribution",
@@ -2797,7 +2858,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     );
   }
 
-  server.registerTool(
+  registerTool(
     "vrdex_media_review_list",
     {
       title: "List Media Reviews",
@@ -2815,7 +2876,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     },
   );
 
-  server.registerTool(
+  registerTool(
     "vrdex_media_review_get",
     {
       title: "Get Media Review",
@@ -2833,7 +2894,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     },
   );
 
-  server.registerTool(
+  registerTool(
     "vrdex_media_review_preview",
     {
       title: "Preview Media Review",
@@ -2851,7 +2912,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     },
   );
 
-  server.registerTool(
+  registerTool(
     "vrdex_media_review_decide",
     {
       title: "Decide Media Review",
@@ -2869,20 +2930,20 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     },
   );
 
-  server.registerTool("vrdex_media_review_rebase",{
+  registerTool("vrdex_media_review_rebase",{
     title:"Rebase",description:"vrdex_media_review_rebase",inputSchema:reviewRebaseSchema,
     outputSchema:mcpOutputSchema(commandReceiptSchema),
     annotations:{readOnlyHint:false,destructiveHint:false,idempotentHint:true,openWorldHint:false},
     _meta:{securitySchemes:mcpWriteSecuritySchemes("vrdex_media_review_rebase")},
   },async input=>{const principal=principalFor("vrdex_media_review_rebase");return principal===null?mcpWriteUnauthorized("vrdex_media_review_rebase"):await recordNewWrite("vrdex_media_review_rebase",principal,input,()=>mediaReviewHandlersFor(principal).rebase(input));});
-  server.registerTool("vrdex_media_review_decide_selected",{
+  registerTool("vrdex_media_review_decide_selected",{
     title:"Decide selected",description:"vrdex_media_review_decide_selected",inputSchema:selectedReviewDecisionsSchema,
     outputSchema:mcpOutputSchema(z.strictObject({receipts:z.array(commandReceiptSchema).min(1).max(20)})),
     annotations:{readOnlyHint:false,destructiveHint:true,idempotentHint:true,openWorldHint:false},
     _meta:{securitySchemes:mcpWriteSecuritySchemes("vrdex_media_review_decide_selected")},
   },async input=>{const principal=principalFor("vrdex_media_review_decide_selected");return principal===null?mcpWriteUnauthorized("vrdex_media_review_decide_selected"):await recordNewWrite("vrdex_media_review_decide_selected",principal,input,()=>mediaReviewHandlersFor(principal).decideSelected(input));});
 
-  server.registerTool(
+  registerTool(
     "vrdex_media_submission_withdraw",
     {
       title: "Withdraw Media Submission",
@@ -2900,7 +2961,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     },
   );
 
-  server.registerTool(
+  registerTool(
     "vrdex_get_event",
     {
       title: "Get VRDex Event",
@@ -2929,7 +2990,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     },
   );
 
-  server.registerTool(
+  registerTool(
     "vrdex_list_upcoming_events",
     {
       title: "List VRDex Upcoming Events",
@@ -2957,7 +3018,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     },
   );
 
-  server.registerTool(
+  registerTool(
     "vrdex_get_world",
     {
       title: "Get VRDex World",
@@ -2986,7 +3047,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     },
   );
 
-  server.registerTool(
+  registerTool(
     "vrdex_list_active_worlds",
     {
       title: "List VRDex Active Worlds",
@@ -3012,7 +3073,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     },
   );
 
-  server.registerTool(
+  registerTool(
     "vrdex_event_create",
     {
       title: "Create VRDex Event",
@@ -3121,7 +3182,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     },
   );
 
-  server.registerTool(
+  registerTool(
     "vrdex_event_update",
     {
       title: "Update VRDex Event",
@@ -3231,7 +3292,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     },
   );
 
-  server.registerTool(
+  registerTool(
     "vrdex_profile_update",
     {
       title: "Update VRDex Profile",
@@ -3304,7 +3365,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     },
   );
 
-  server.registerTool(
+  registerTool(
     "vrdex_profile_submit",
     {
       title: "Submit VRDex Community Profile",
@@ -3368,7 +3429,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     },
   );
 
-  server.registerTool(
+  registerTool(
     "vrdex_profile_media_submit",
     {
       title: "Submit VRDex Profile Media",
@@ -3584,7 +3645,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     },
   );
 
-  server.registerTool(
+  registerTool(
     "vrdex_profile_media_manage",
     {
       title: "Manage VRDex Profile Media",
@@ -3872,6 +3933,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     },
   );
 
+  server.server.setRequestHandler("tools/list", () => ({ tools: advertisedTools }));
   return server;
 }
 
diff --git a/convex/_apiWriteAuditEvents.ts b/convex/_apiWriteAuditEvents.ts
index 07d217b7..ade67c64 100644
--- a/convex/_apiWriteAuditEvents.ts
+++ b/convex/_apiWriteAuditEvents.ts
@@ -69,6 +69,9 @@ export const mcpWriteToolNameValidator = v.union(
   v.literal("vrdex_media_review_decide_selected"),
   v.literal("vrdex_media_submission_withdraw"),
   v.literal("vrdex_media_submission_publish"),
+  v.literal("vrdex_media_contribution_manage"),
+  v.literal("vrdex_media_contribution_place"),
+  v.literal("vrdex_media_contribution_propose_placement"),
   v.literal("vrdex_media_submission_declare"),
   v.literal("vrdex_contribution_capacity_request"),
   v.literal("vrdex_contribution_capacity"),
diff --git a/convex/_mcpToolEvents.ts b/convex/_mcpToolEvents.ts
index da61785d..f923ba99 100644
--- a/convex/_mcpToolEvents.ts
+++ b/convex/_mcpToolEvents.ts
@@ -33,6 +33,10 @@ export const mcpToolNameValidator = v.union(
   v.literal("vrdex_media_review_decide_selected"),
   v.literal("vrdex_media_submission_withdraw"),
   v.literal("vrdex_media_submission_publish"),
+  v.literal("vrdex_media_contribution_manage"),
+  v.literal("vrdex_media_contribution_place"),
+  v.literal("vrdex_media_contribution_propose_placement"),
+  v.literal("vrdex_media_contribution_get"),
   v.literal("vrdex_media_submission_declare"),
   v.literal("vrdex_contribution_capacity_request"),
   v.literal("vrdex_contribution_capacity"),
diff --git a/scripts/smoke-mcp-inspector-client.ts b/scripts/smoke-mcp-inspector-client.ts
index c0e32b5c..af53da2d 100644
--- a/scripts/smoke-mcp-inspector-client.ts
+++ b/scripts/smoke-mcp-inspector-client.ts
@@ -8,7 +8,7 @@ import {
   mcpOAuthClientCredentialsFromEnv,
   mcpOAuthClientCredentialsFromOptions,
 } from "./mcp-oauth-client-credentials";
-import { assertHostedToolSecuritySchemes, hostedExpectedToolNames } from "./smoke-vrdex-mcp-compat";
+import { assertHostedContributionSchemas, assertHostedToolSecuritySchemes, hostedExpectedToolNames } from "./smoke-vrdex-mcp-compat";
 
 type InspectorOptions = {
   hostedDataPublicReads: boolean;
@@ -35,6 +35,8 @@ type ToolDescriptor = {
     securitySchemes?: unknown;
   };
   name?: unknown;
+  inputSchema?: unknown;
+  outputSchema?: unknown;
 };
 
 type InspectorSearchResult = {
@@ -282,6 +284,7 @@ function assertHostedTools(body: { tools?: ToolDescriptor[] }, label: string) {
   assertExpectedHostedToolNames(toolNames);
   for (const tool of body.tools ?? []) {
     assertHostedToolSecuritySchemes(tool);
+    assertHostedContributionSchemas(tool);
   }
 }
 
diff --git a/scripts/smoke-vrdex-mcp-compat.ts b/scripts/smoke-vrdex-mcp-compat.ts
index 93eb65b2..0ee509b4 100644
--- a/scripts/smoke-vrdex-mcp-compat.ts
+++ b/scripts/smoke-vrdex-mcp-compat.ts
@@ -46,6 +46,8 @@ type SmokeOptions = {
 type HostedToolDescriptor = {
   _meta?: unknown;
   name?: unknown;
+  inputSchema?: unknown;
+  outputSchema?: unknown;
 };
 
 const localReadTools = [
@@ -84,7 +86,9 @@ const writeToolResourceScopes: Record<string, string> = {
   vrdex_media_review_decide_selected: "assets:review:write",
   vrdex_media_submission_withdraw: "assets:contribute",
   vrdex_media_submission_publish: "assets:publish",
-  vrdex_media_submission_declare: "assets:publish",
+  vrdex_media_contribution_manage: "assets:contribute",
+  vrdex_media_contribution_place: "assets:publish",
+  vrdex_media_contribution_propose_placement: "assets:contribute",
 };
 const writeToolNames = Object.keys(writeToolResourceScopes);
 const contributionCollectionWriteToolNames = new Set([
@@ -114,7 +118,9 @@ const hostedOnlyWriteToolNames = new Set([
   "vrdex_media_review_decide_selected",
   "vrdex_media_submission_withdraw",
   "vrdex_media_submission_publish",
-  "vrdex_media_submission_declare",
+  "vrdex_media_contribution_manage",
+  "vrdex_media_contribution_place",
+  "vrdex_media_contribution_propose_placement",
 ]);
 const localWriteToolNames = writeToolNames.filter((toolName) => !hostedOnlyWriteToolNames.has(toolName));
 // Reads, but of the caller's own inventory, so they advertise a scope pair the
@@ -140,6 +146,7 @@ const ownedReadToolScopes: Record<string, string | string[]> = {
   vrdex_media_review_get: "assets:review:read",
   vrdex_media_review_preview: "assets:review:read",
   vrdex_media_submission_get: "assets:publish",
+  vrdex_media_contribution_get: "assets:contribute",
   vrdex_media_submission_preview: "assets:publish",
 };
 const ownedReadToolNames = Object.keys(ownedReadToolScopes);
@@ -158,6 +165,7 @@ const hostedOnlyOwnedReadToolNames = new Set([
   "vrdex_media_review_get",
   "vrdex_media_review_preview",
   "vrdex_media_submission_get",
+  "vrdex_media_contribution_get",
   "vrdex_media_submission_preview",
 ]);
 const localOwnedReadToolNames = ownedReadToolNames.filter(
@@ -176,6 +184,27 @@ export const hostedExpectedToolNames = [
   ...writeToolNames,
 ];
 
+export function assertHostedContributionSchemas(tool: HostedToolDescriptor) {
+  const name = String(tool.name);
+  if (!name.startsWith("vrdex_media_contribution_")) return;
+  const input = tool.inputSchema as { type?: string; required?: string[]; additionalProperties?: boolean; properties?: Record<string, { enum?: string[] }>; oneOf?: Array<{ required?: string[]; additionalProperties?: boolean }> } | undefined;
+  const output = tool.outputSchema as { required?: string[] } | undefined;
+  assert.equal(input?.type, "object", `${name} input must be an object.`);
+  const variants = input?.oneOf ?? [input];
+  const required = name === "vrdex_media_contribution_get" ? ["submissionId"] : ["submissionId", "expectedContributionVersion", "idempotencyKey"];
+  for (const variant of variants) {
+    assert.equal(variant?.additionalProperties, false, `${name} input must be strict.`);
+    for (const field of required) assert.ok(variant?.required?.includes(field), `${name} input lacks ${field}.`);
+  }
+  if (name === "vrdex_media_contribution_place") assert.deepEqual(input?.properties?.action?.enum, ["select_primary", "clear_primary"], `${name} placement actions changed.`);
+  if (name === "vrdex_media_contribution_manage") {
+    assert.equal(variants.length, 2, `${name} management actions changed.`);
+    for (const variant of variants) assert.ok(variant?.required?.includes("action"), `${name} action is required.`);
+  }
+  const outputFields = name === "vrdex_media_contribution_get" ? ["submissionId", "assetId", "contributionVersion", "metadata", "canSelectPrimary", "canClearPrimary", "canEditMetadata", "canRemove"] : ["operationId", "operationState"];
+  for (const field of outputFields) assert.ok(output?.required?.includes(field), `${name} ${name.endsWith("_get") ? "detail" : "receipt"} lacks ${field}.`);
+}
+
 export function assertHostedToolSecuritySchemes(tool: HostedToolDescriptor) {
   assert.equal(typeof tool._meta, "object", `Hosted tool ${String(tool.name)} is missing _meta.`);
   assert.notEqual(tool._meta, null, `Hosted tool ${String(tool.name)} is missing _meta.`);
@@ -1063,6 +1092,7 @@ async function smokeHostedHttp(results: SmokeResult[], options: SmokeOptions) {
 
   for (const tool of listedTools ?? []) {
     assertHostedToolSecuritySchemes(tool);
+    assertHostedContributionSchemas(tool);
   }
 
   const listedToolNames = new Set((listedTools ?? []).map((tool) => String(tool.name)));
diff --git a/tests/scripts/mcp-compat-smoke-cli.test.ts b/tests/scripts/mcp-compat-smoke-cli.test.ts
index f61bb01a..fd66a48e 100644
--- a/tests/scripts/mcp-compat-smoke-cli.test.ts
+++ b/tests/scripts/mcp-compat-smoke-cli.test.ts
@@ -49,7 +49,19 @@ const writeToolScopes: Record<string, string> = {
   vrdex_media_review_decide_selected: "assets:review:write",
   vrdex_media_submission_withdraw: "assets:contribute",
   vrdex_media_submission_publish: "assets:publish",
-  vrdex_media_submission_declare: "assets:publish",
+  vrdex_media_contribution_manage: "assets:contribute",
+  vrdex_media_contribution_place: "assets:publish",
+  vrdex_media_contribution_propose_placement: "assets:contribute",
+};
+// Independent hosted contract fixture, deliberately not imported from runtime schemas.
+const contributionSchemas: Record<string, Record<string, unknown>> = {
+  vrdex_media_contribution_get: { inputSchema: { type: "object", additionalProperties: false, required: ["submissionId"] }, outputSchema: { required: ["submissionId", "assetId", "contributionVersion", "metadata", "canSelectPrimary", "canClearPrimary", "canEditMetadata", "canRemove"] } },
+  vrdex_media_contribution_manage: { inputSchema: { type: "object", oneOf: [
+    { additionalProperties: false, required: ["submissionId", "expectedContributionVersion", "idempotencyKey", "action", "metadata"] },
+    { additionalProperties: false, required: ["submissionId", "expectedContributionVersion", "idempotencyKey", "action"] },
+  ] }, outputSchema: { required: ["operationId", "operationState"] } },
+  vrdex_media_contribution_place: { inputSchema: { type: "object", additionalProperties: false, required: ["submissionId", "expectedContributionVersion", "idempotencyKey", "action"], properties: { action: { enum: ["select_primary", "clear_primary"] } } }, outputSchema: { required: ["operationId", "operationState"] } },
+  vrdex_media_contribution_propose_placement: { inputSchema: { type: "object", additionalProperties: false, required: ["submissionId", "expectedContributionVersion", "idempotencyKey"] }, outputSchema: { required: ["operationId", "operationState"] } },
 };
 const expectedWriteTools = Object.keys(writeToolScopes);
 // Reads, but of the caller's own inventory, so they advertise a scope pair
@@ -71,6 +83,7 @@ const ownedReadToolScopes: Record<string, string | string[]> = {
   vrdex_media_review_get: "assets:review:read",
   vrdex_media_review_preview: "assets:review:read",
   vrdex_media_submission_get: "assets:publish",
+  vrdex_media_contribution_get: "assets:contribute",
   vrdex_media_submission_preview: "assets:publish",
 };
 const expectedOwnedReadTools = Object.keys(ownedReadToolScopes);
@@ -267,6 +280,7 @@ async function startHostedFailureFixture() {
           // reached the read failures this test is about.
           tools: [...expectedTools, ...expectedOwnedReadTools, ...expectedWriteTools].map((name) => ({
             _meta: { securitySchemes: securitySchemesForTool(name) },
+            ...contributionSchemas[name],
             name,
           })),
         },
@@ -413,6 +427,7 @@ async function startHostedSuccessFixture(extraToolName?: string, omittedScope?:
         result: {
           tools: [...expectedTools, ...expectedOwnedReadTools, ...expectedWriteTools, ...(extraToolName ? [extraToolName] : [])].map((name) => ({
             _meta: { securitySchemes: securitySchemesForTool(name) },
+            ...contributionSchemas[name],
             name,
           })),
         },
diff --git a/tests/scripts/mcp-inspector-smoke.test.ts b/tests/scripts/mcp-inspector-smoke.test.ts
index 9132ce15..b153049c 100644
--- a/tests/scripts/mcp-inspector-smoke.test.ts
+++ b/tests/scripts/mcp-inspector-smoke.test.ts
@@ -5,7 +5,7 @@ import {
   assertExpectedHostedToolNames,
   assertInspectorDataBackedSearch,
 } from "../../scripts/smoke-mcp-inspector-client";
-import { assertHostedToolSecuritySchemes, hostedExpectedToolNames } from "../../scripts/smoke-vrdex-mcp-compat";
+import { assertHostedContributionSchemas, assertHostedToolSecuritySchemes, hostedExpectedToolNames } from "../../scripts/smoke-vrdex-mcp-compat";
 
 describe("MCP Inspector smoke harness", () => {
   const search = { limit: 1, query: "club", type: "all" as const };
@@ -34,10 +34,15 @@ describe("MCP Inspector smoke harness", () => {
     for (const name of [
       "vrdex_contribution_batch_append",
       "vrdex_media_review_decide",
+      "vrdex_media_contribution_get",
+      "vrdex_media_contribution_manage",
+      "vrdex_media_contribution_place",
+      "vrdex_media_contribution_propose_placement",
       "vrdex_event_intake_publish",
     ]) {
       assert.ok(hostedExpectedToolNames.includes(name));
     }
+    assert.ok(!hostedExpectedToolNames.includes("vrdex_media_submission_declare"));
     assert.doesNotThrow(() => {
       assertExpectedHostedToolNames([...hostedExpectedToolNames].reverse());
     });
@@ -54,6 +59,15 @@ describe("MCP Inspector smoke harness", () => {
     );
   });
 
+  it("requires strict contribution command and detail schemas", () => {
+    const schema = { type: "object", additionalProperties: false, required: ["submissionId", "expectedContributionVersion", "idempotencyKey", "action"], properties: { submissionId: { type: "string" }, expectedContributionVersion: { type: "string" }, idempotencyKey: { type: "string" }, action: { enum: ["select_primary", "clear_primary"] } } };
+    const tool = { name: "vrdex_media_contribution_place", inputSchema: schema, outputSchema: { type: "object", required: ["operationId", "operationState"] } };
+    assert.doesNotThrow(() => assertHostedContributionSchemas(tool));
+    assert.throws(() => assertHostedContributionSchemas({ ...tool, inputSchema: { ...schema, additionalProperties: true } }), /strict/);
+    assert.throws(() => assertHostedContributionSchemas({ ...tool, outputSchema: {} }), /receipt/);
+    assert.throws(() => assertHostedContributionSchemas({ ...tool, inputSchema: { ...schema, properties: { ...schema.properties, action: { enum: ["select_primary"] } } } }), /placement/);
+  });
+
   it("checks multi-scope contribution tool metadata", () => {
     assert.doesNotThrow(() => assertHostedToolSecuritySchemes({
       name: "vrdex_contribution_batch_append",
diff --git a/tests/web/mcp-media-review.test.ts b/tests/web/mcp-media-review.test.ts
index 9358996f..60ca809f 100644
--- a/tests/web/mcp-media-review.test.ts
+++ b/tests/web/mcp-media-review.test.ts
@@ -590,3 +590,27 @@ it("declares evidence and publishes only through separate explicit commands", as
     }),
   );
 });
+
+it("contribution handlers bind verified actor, exact command and strict receipt/detail output", async () => {
+  const calls: Array<{ name: string; args: Record<string, unknown> }> = [];
+  const receipt = { operationId: "operation-1", operationState: "committed" };
+  const projection = { submissionId: "submission-1", assetId: "asset-1", profileId: "profile-1", profileSlug: "fixture", contributionVersion: version, metadata: { label: "Image", credit: "Creator" }, canSelectPrimary: true, canClearPrimary: false, canEditMetadata: true, canRemove: true };
+  const handlers = createMcpMediaReviewHandlers(dependencies({
+    query: async (name, args) => { calls.push({ name, args }); return projection; },
+    mutate: async (name, args) => { calls.push({ name, args }); return receipt; },
+  }));
+  const base = { submissionId: "submission-1", expectedContributionVersion: version, idempotencyKey: "same-key" };
+  assert.deepEqual((await handlers.contributionGet({ submissionId: "submission-1" })).structuredContent, projection);
+  for (const [operation, input] of [
+    ["contributionManage", { ...base, action: "update_metadata", metadata: { credit: "Creator" } }],
+    ["contributionPlace", { ...base, action: "select_primary" }],
+    ["contributionProposePlacement", base],
+  ] as const) {
+    assert.deepEqual((await handlers[operation](input)).structuredContent, receipt);
+    assert.deepEqual(calls.at(-1), { name: operation, args: { actorUserId: "user-1", emailVerified: true, emailVerificationAttestedAt: 2000, ...input } });
+    await assert.rejects(() => handlers[operation]({ ...input, actorUserId: "forged" }));
+  }
+  const invalid = createMcpMediaReviewHandlers(dependencies({ query: async () => ({ ...projection, reviewerUserId: "private" }), mutate: async () => ({ ...receipt, privateOwnerAsset: "private" }) }));
+  await assert.rejects(() => invalid.contributionGet({ submissionId: "submission-1" }));
+  await assert.rejects(() => invalid.contributionPlace({ ...base, action: "clear_primary" }));
+});
diff --git a/tests/web/vrdex-mcp.test.ts b/tests/web/vrdex-mcp.test.ts
index 9e8c6d00..2d0712df 100644
--- a/tests/web/vrdex-mcp.test.ts
+++ b/tests/web/vrdex-mcp.test.ts
@@ -250,6 +250,7 @@ function assertAuthenticatedReadSecuritySchemes(value: unknown) {
 
 function isWriteToolName(name: string | undefined) {
   if (name?.startsWith("vrdex_event_intake_") && name !== "vrdex_event_intake_draft_get" && name !== "vrdex_event_intake_event_get") return true;
+  if (name?.startsWith("vrdex_media_contribution_") && name !== "vrdex_media_contribution_get") return true;
   if (name === "vrdex_media_submission_publish" || name === "vrdex_media_submission_declare") return true;
   if (name === "vrdex_media_upload_begin" || name === "vrdex_media_upload_complete") return true;
   return (
@@ -263,6 +264,7 @@ function isWriteToolName(name: string | undefined) {
 // than the public-read schemes every other read tool advertises.
 function isOwnedReadToolName(name: string | undefined) {
   if (name === "vrdex_event_intake_draft_get" || name === "vrdex_event_intake_event_get") return true;
+  if (name === "vrdex_media_contribution_get") return true;
   if (name === "vrdex_media_submission_get" || name === "vrdex_media_submission_preview") return true;
   return (
     name === "vrdex_get_my_media_submission" ||
@@ -351,10 +353,13 @@ describe("VRDex MCP server", () => {
     `);
     const tools=jsonBodyFromProbe(output).result?.tools??[];
     const expected = {
+      vrdex_media_contribution_get: ["mcp:read", "assets:contribute"],
+      vrdex_media_contribution_manage: ["mcp:write", "assets:contribute"],
+      vrdex_media_contribution_place: ["mcp:write", "assets:publish"],
+      vrdex_media_contribution_propose_placement: ["mcp:write", "assets:contribute"],
       vrdex_media_submission_get: ["mcp:read", "assets:publish"],
       vrdex_media_submission_preview: ["mcp:read", "assets:publish"],
       vrdex_media_submission_publish: ["mcp:write", "assets:publish"],
-      vrdex_media_submission_declare: ["mcp:write", "assets:publish"],
       vrdex_media_review_list: ["mcp:read", "assets:review:read"],
       vrdex_media_review_get: ["mcp:read", "assets:review:read"],
       vrdex_media_review_preview: ["mcp:read", "assets:review:read"],
@@ -749,7 +754,9 @@ describe("VRDex MCP server", () => {
       "vrdex_media_upload_begin",
       "vrdex_media_upload_complete",
       "vrdex_media_submission_publish",
-      "vrdex_media_submission_declare",
+      "vrdex_media_contribution_manage",
+      "vrdex_media_contribution_place",
+      "vrdex_media_contribution_propose_placement",
       "vrdex_media_review_decide",
       "vrdex_media_review_rebase",
       "vrdex_media_review_decide_selected",
@@ -778,7 +785,9 @@ describe("VRDex MCP server", () => {
       vrdex_media_review_decide_selected: "assets:review:write",
       vrdex_media_submission_withdraw: "assets:contribute",
       vrdex_media_submission_publish: "assets:publish",
-      vrdex_media_submission_declare: "assets:publish",
+      vrdex_media_contribution_manage: "assets:contribute",
+      vrdex_media_contribution_place: "assets:publish",
+      vrdex_media_contribution_propose_placement: "assets:contribute",
     };
 
     for (const tool of writeTools) {
@@ -3393,3 +3402,89 @@ it("serializes typed event roster links and playable slots through hosted MCP",
   assert.match(output, /"streamId":"alpha"/);
   assert.match(output, /"outboundLinks":\[/);
 });
+
+it("contribution protocol tools dispatch exact attested wrappers, reject missing scopes and hide legacy declaration", () => {
+  const output = runMcpProbe(`
+    import assert from "node:assert/strict";
+    import { getFunctionName } from "convex/server";
+    import { assertHostedContributionSchemas } from "./scripts/smoke-vrdex-mcp-compat.ts";
+    import { createVrdexMcpHandler } from "./apps/web/src/lib/server/vrdex-mcp.ts";
+    const calls=[]; const receipt={operationId:"key",operationState:"committed"};
+    const detail={submissionId:"submission",assetId:"asset",profileId:"profile",profileSlug:"fixture",contributionVersion:"version",metadata:{label:"Image",credit:"Creator"},canSelectPrimary:true,canClearPrimary:false,canEditMetadata:true,canRemove:true};
+    const handler=createVrdexMcpHandler({now:()=>2000,verifyContributorEmail:async()=>true,adminConvex:{
+      query:async(ref,args)=>{calls.push({name:getFunctionName(ref),args});return detail},
+      mutation:async(ref,args)=>{const name=getFunctionName(ref);if(name==="mcpToolEvents:recordWriteInvocation")return null;calls.push({name,args});return name.includes("declarePublicationEvidence")?{operationId:"key",operationState:"refused",code:"legacy_declaration_retired"}:receipt},
+    }});
+    const auth=scopes=>({token:"test",clientId:"client",scopes,resource:new URL("https://app.example.test/mcp"),extra:{subjectType:"user",userId:"user",tokenId:"token",requestId:"request"}});
+    async function request(method,params,scopes){const response=await handler.fetch(new Request("https://app.example.test/mcp",{method:"POST",headers:{accept:"application/json, text/event-stream","content-type":"application/json"},body:JSON.stringify({jsonrpc:"2.0",id:1,method,params})}),{authInfo:auth(scopes)});const body=await response.text();return JSON.parse(body.split(/\\r?\\n/).find(line=>line.startsWith("data: "))?.slice(6)??body).result;}
+    const tools=(await request("tools/list",{},["mcp:read"])).tools;
+    assert.equal(tools.some(tool=>tool.name==="vrdex_media_submission_declare"),false);
+    for(const tool of tools)assertHostedContributionSchemas(tool);
+    const base={submissionId:"submission",expectedContributionVersion:"version",idempotencyKey:"key"};
+    const operations=[
+      ["vrdex_media_contribution_get","contributionDetailForMcpActor",{submissionId:"submission"},"mcp:read","assets:contribute",detail],
+      ["vrdex_media_contribution_manage","manageContributionForMcpActor",{...base,action:"update_metadata",metadata:{credit:"Creator"}},"mcp:write","assets:contribute",receipt],
+      ["vrdex_media_contribution_place","placeContributionForMcpActor",{...base,action:"select_primary"},"mcp:write","assets:publish",receipt],
+      ["vrdex_media_contribution_propose_placement","proposePlacementForMcpActor",base,"mcp:write","assets:contribute",receipt],
+      ["vrdex_media_submission_publish","publishForMcpActor",{submissionId:"submission",expectedReviewVersion:"review",idempotencyKey:"key"},"mcp:write","assets:publish",receipt],
+    ];
+    for(const [name,wrapper,input,mcp,scope,expected] of operations){
+      const descriptor=tools.find(tool=>tool.name===name);assert.ok(descriptor);assert.ok(descriptor.outputSchema);
+      assert.deepEqual(descriptor._meta.securitySchemes,[{scopes:[mcp,scope],type:"oauth2"}]);
+      for(const scopes of [[mcp],[scope]]){const count=calls.length;const result=await request("tools/call",{name,arguments:input},scopes);assert.equal(result.isError,true);assert.equal(calls.length,count);}
+      const result=await request("tools/call",{name,arguments:input},[mcp,scope]);assert.deepEqual(result.structuredContent,expected);
+      assert.deepEqual(calls.at(-1),{name:"profileMediaSubmissions:"+wrapper,args:{actorUserId:"user",emailVerified:true,emailVerificationAttestedAt:2000,...input,oauthTokenId:"token",oauthClientId:"client",oauthResource:"https://app.example.test/mcp"}});
+    }
+    for(const action of ["select_primary","clear_primary"]){const count=calls.length;const result=await request("tools/call",{name:"vrdex_media_contribution_place",arguments:{...base,action}},["mcp:write","assets:contribute"]);assert.equal(result.isError,true);assert.equal(calls.length,count);}
+    const legacyInput={submissionId:"submission",expectedReviewVersion:"review",idempotencyKey:"key",identityConfirmed:true,attributionConfirmed:true,publicationPermitted:true,noKnownRestrictions:true};
+    const legacy=await request("tools/call",{name:"vrdex_media_submission_declare",arguments:legacyInput},["mcp:write","assets:publish"]);
+    assert.equal(legacy.structuredContent.code,"legacy_declaration_retired");assert.equal(calls.at(-1).name,"profileMediaSubmissions:declarePublicationEvidenceForMcpActor");
+    await handler.close();console.log("contribution protocol parity passed");
+  `);
+  assert.match(output, /contribution protocol parity passed/);
+});
+
+it("contribution transport uses actual backend privacy, grant separation and terminal declaration", () => {
+  const output=runMcpProbe(`
+    import assert from "node:assert/strict";
+    import {convexTest} from "convex-test";
+    import {api,internal} from "./convex/_generated/api.js";
+    import {schema,modules,seed,createAndUpload} from "./tests/backend/_mediaReviewFixture.ts";
+    import {createVrdexMcpHandler} from "./apps/web/src/lib/server/vrdex-mcp.ts";
+    process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED="true";process.env.VRDEX_PROFILE_MEDIA_DIRECT_UPLOAD_ENABLED="true";process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED="true";
+    const t=convexTest({schema,modules}),s=await seed(t),{intent}=await createAndUpload(t,s);
+    await t.run(async ctx=>{
+      await ctx.db.insert("accountFeatureGrants",{userId:s.contributorUserId,feature:"trusted_publisher",state:"active",grantedBy:{tokenIdentifier:"test:operator",issuer:"test",subject:"operator"},grantedAt:Date.now(),updatedAt:Date.now()});
+      for(const [tokenId,scopes] of [["publisher",["mcp:read","mcp:write","assets:publish","assets:contribute"]],["contributor",["mcp:read","mcp:write","assets:contribute"]]])await ctx.db.insert("oauthAccessTokens",{tokenId,clientId:"client",userId:s.contributorUserId,subjectType:"user",resource:"https://app.example.test/mcp",scopes,status:"active",issuedAt:Date.now(),expiresAt:Date.now()+600000});
+    });
+    const handler=createVrdexMcpHandler({verifyContributorEmail:async()=>true,adminConvex:{query:(ref,args)=>t.query(ref,args),mutation:(ref,args)=>t.mutation(ref,args)}});
+    async function call(name,args,publisher=false){const scopes=publisher?["mcp:read","mcp:write","assets:publish","assets:contribute"]:["mcp:read","mcp:write","assets:contribute"];const authInfo={token:"test",clientId:"client",scopes,resource:new URL("https://app.example.test/mcp"),extra:{subjectType:"user",userId:s.contributorUserId,tokenId:publisher?"publisher":"contributor",requestId:"request"}};const response=await handler.fetch(new Request("https://app.example.test/mcp",{method:"POST",headers:{accept:"application/json, text/event-stream","content-type":"application/json"},body:JSON.stringify({jsonrpc:"2.0",id:1,method:"tools/call",params:{name,arguments:args}})}),{authInfo});const body=await response.text();return JSON.parse(body.split(/\\r?\\n/).find(line=>line.startsWith("data: "))?.slice(6)??body).result;}
+    const pending=await t.withIdentity(s.contributorIdentity).query(api.profileMediaSubmissions.publisherDetail,{submissionId:intent.submissionId});
+    const pubArgs={submissionId:intent.submissionId,expectedReviewVersion:pending.reviewVersion,idempotencyKey:"publish"};
+    const published=await call("vrdex_media_submission_publish",pubArgs,true);assert.equal(published.structuredContent.operationState,"committed");
+    await t.run(ctx=>ctx.db.patch(intent.submissionId,{privateReason:"private reviewer reason",reviewer:{tokenIdentifier:"private reviewer identity",issuer:"test",subject:"reviewer"}}));
+    const detail=(await call("vrdex_media_contribution_get",{submissionId:intent.submissionId})).structuredContent;assert.ok(detail);assert.equal(detail.canSelectPrimary,true);assert.doesNotMatch(JSON.stringify(detail),/private reviewer|reviewerTokenIdentifier|privateReason|storageKey|ownerAssets/);
+    const base={submissionId:intent.submissionId,expectedContributionVersion:detail.contributionVersion,idempotencyKey:"place"};
+    for(const action of ["select_primary","clear_primary"]){const denied=await call("vrdex_media_contribution_place",{...base,action});assert.equal(denied.isError,true);}
+    assert.equal((await t.run(ctx=>ctx.db.query("profileAssetPlacements").filter(q=>q.eq(q.field("placement"),"profile_image")).collect())).length,0);
+    const legacy=await call("vrdex_media_submission_declare",{...pubArgs,idempotencyKey:"legacy",identityConfirmed:true,attributionConfirmed:true,publicationPermitted:true,noKnownRestrictions:true},true);assert.equal(legacy.structuredContent.code,"declaration_retired");assert.equal(legacy.structuredContent.operationState,"refused");
+    await handler.close();console.log("actual contribution privacy and scopes passed");
+  `);
+  assert.match(output,/actual contribution privacy and scopes passed/);
+});
+
+it("filtered catalog preserves every descriptor emitted by the installed SDK", () => {
+  const output=runMcpProbe(`
+    import assert from "node:assert/strict";
+    import {McpServer,createMcpHandler} from "./apps/web/node_modules/@modelcontextprotocol/server/dist/index.mjs";
+    import {buildVrdexMcpServer,createVrdexMcpHandler} from "./apps/web/src/lib/server/vrdex-mcp.ts";
+    const app=buildVrdexMcpServer(),sdk=new McpServer({name:"parity",version:"1"});
+    // Use the SDK's original catalog generator as the independent transport oracle.
+    for(const [name,tool] of Object.entries(app._registeredTools))sdk.registerTool(name,{title:tool.title,description:tool.description,inputSchema:tool.inputSchema,outputSchema:tool.outputSchema,annotations:tool.annotations,icons:tool.icons,execution:tool.execution,_meta:tool._meta},async()=>({content:[]}));
+    const reference=createMcpHandler(()=>sdk,{legacy:"stateless"}),actual=createVrdexMcpHandler();
+    async function list(handler){const response=await handler.fetch(new Request("https://app.example.test/mcp",{method:"POST",headers:{accept:"application/json, text/event-stream","content-type":"application/json"},body:JSON.stringify({jsonrpc:"2.0",id:1,method:"tools/list",params:{}})}));const body=await response.text();return JSON.parse(body.split(/\\r?\\n/).find(line=>line.startsWith("data: "))?.slice(6)??body).result.tools;}
+    assert.deepEqual(await list(actual),(await list(reference)).filter(tool=>tool.name!=="vrdex_media_submission_declare"));
+    await actual.close();await reference.close();await app.close();console.log("SDK descriptor parity passed");
+  `);
+  assert.match(output,/SDK descriptor parity passed/);
+});

From a7df1b269c402058412027b1e78160387ab1e769 Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Mon, 5 Oct 2026 19:38:27 -0400
Subject: [PATCH 11/28] fix: describe media kit MCP actions

---
 apps/web/src/lib/server/vrdex-mcp.ts | 15 ++++++++-------
 tests/web/vrdex-mcp.test.ts          |  9 +++++++++
 2 files changed, 17 insertions(+), 7 deletions(-)

diff --git a/apps/web/src/lib/server/vrdex-mcp.ts b/apps/web/src/lib/server/vrdex-mcp.ts
index d2575b33..7fb9e321 100644
--- a/apps/web/src/lib/server/vrdex-mcp.ts
+++ b/apps/web/src/lib/server/vrdex-mcp.ts
@@ -2750,7 +2750,7 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     });
   }
   registerTool("vrdex_media_contribution_get", {
-    title: "Contribution", description: "vrdex_media_contribution_get",
+    title: "Contribution", description: "Inspect your published media-kit contribution and available actions.",
     inputSchema: mediaReviewGetInputSchema, outputSchema: mcpOutputSchema(publishedContributionDetailSchema),
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false },
     _meta: { securitySchemes: mcpOwnedReadSecuritySchemes("vrdex_media_contribution_get") },
@@ -2761,7 +2761,8 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
   for (const operation of ["publish", "declare"] as const) {
     const toolName = operation === "publish" ? "vrdex_media_submission_publish" : "vrdex_media_submission_declare";
     registerTool(toolName, {
-      title: operation === "publish" ? "Publish" : "Confirm evidence", description: toolName,
+      title: operation === "publish" ? "Publish" : "Confirm evidence",
+      description: operation === "publish" ? "Publish your contribution to the media kit." : toolName,
       inputSchema: operation === "publish" ? mediaPublicationSchema : publicationEvidenceSchema,
       outputSchema: mcpOutputSchema(commandReceiptSchema),
       annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: true, openWorldHint: false },
@@ -2773,13 +2774,13 @@ export function buildVrdexMcpServer(options: VrdexMcpServerOptions = {}) {
     });
   }
 
-  for (const [toolName, operation, inputSchema, title] of [
-    ["vrdex_media_contribution_manage", "contributionManage", contributionManageCommandSchema, "Manage contribution"],
-    ["vrdex_media_contribution_place", "contributionPlace", contributionPlacementCommandSchema, "Profile picture"],
-    ["vrdex_media_contribution_propose_placement", "contributionProposePlacement", contributionCommandBaseSchema, "Request replacement"],
+  for (const [toolName, operation, inputSchema, title, description] of [
+    ["vrdex_media_contribution_manage", "contributionManage", contributionManageCommandSchema, "Manage contribution", "Correct metadata or remove your own kit-only contribution."],
+    ["vrdex_media_contribution_place", "contributionPlace", contributionPlacementCommandSchema, "Profile picture", "Select your contribution as the profile picture, or undo your unchanged selection."],
+    ["vrdex_media_contribution_propose_placement", "contributionProposePlacement", contributionCommandBaseSchema, "Request replacement", "Request independent review to replace the profile picture with your published contribution."],
   ] as const) {
     registerTool(toolName, {
-      title, description: toolName, inputSchema, outputSchema: mcpOutputSchema(commandReceiptSchema),
+      title, description, inputSchema, outputSchema: mcpOutputSchema(commandReceiptSchema),
       annotations: { readOnlyHint: false, destructiveHint: operation === "contributionManage", idempotentHint: true, openWorldHint: false },
       _meta: { securitySchemes: mcpWriteSecuritySchemes(toolName) },
     }, async (input: unknown) => {
diff --git a/tests/web/vrdex-mcp.test.ts b/tests/web/vrdex-mcp.test.ts
index 2d0712df..be9a8e2f 100644
--- a/tests/web/vrdex-mcp.test.ts
+++ b/tests/web/vrdex-mcp.test.ts
@@ -3420,6 +3420,15 @@ it("contribution protocol tools dispatch exact attested wrappers, reject missing
     const tools=(await request("tools/list",{},["mcp:read"])).tools;
     assert.equal(tools.some(tool=>tool.name==="vrdex_media_submission_declare"),false);
     for(const tool of tools)assertHostedContributionSchemas(tool);
+    const descriptions={
+      vrdex_media_submission_publish:"Publish your contribution to the media kit.",
+      vrdex_media_contribution_get:"Inspect your published media-kit contribution and available actions.",
+      vrdex_media_contribution_manage:"Correct metadata or remove your own kit-only contribution.",
+      vrdex_media_contribution_place:"Select your contribution as the profile picture, or undo your unchanged selection.",
+      vrdex_media_contribution_propose_placement:"Request independent review to replace the profile picture with your published contribution.",
+    };
+    for(const [name,description] of Object.entries(descriptions))assert.equal(tools.find(tool=>tool.name===name)?.description,description,name);
+
     const base={submissionId:"submission",expectedContributionVersion:"version",idempotencyKey:"key"};
     const operations=[
       ["vrdex_media_contribution_get","contributionDetailForMcpActor",{submissionId:"submission"},"mcp:read","assets:contribute",detail],

From 9d2e47e9c6d8fedb0d3821aa21ba2b9abc0bf44a Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Mon, 5 Oct 2026 20:12:22 -0400
Subject: [PATCH 12/28] feat: simplify media kit publication and picture
 actions

---
 apps/web/e2e/media-contribution.flow.spec.ts  | 114 ++++++--
 apps/web/e2e/media-kit.visual.spec.ts         |   9 +-
 .../e2e/trusted-publication.visual.spec.ts    | 275 ++++++++----------
 .../profile-media-contribution-editor.tsx     |   2 +-
 .../app/_components/profile-public-page.tsx   |   9 +-
 .../media-contributions-panel.tsx             |  12 +-
 .../media-contributions/publication-card.tsx  | 218 ++++----------
 .../published-contribution-card.tsx           | 111 +++++++
 .../media-review/media-review-panel.tsx       |  11 +-
 .../account/media-review/media-review-view.ts |   6 +-
 apps/web/src/app/api/e2e/media/route.ts       |   3 +
 .../media-review-assigned.stories.tsx         |   7 +-
 .../media-review-comparison.stories.tsx       |   2 +
 .../trusted-publication.stories.tsx           |  77 ++++-
 convex/_mediaContributionCommands.ts          |   1 +
 convex/e2eMedia.ts                            |  67 ++++-
 convex/profileMediaSubmissions.ts             |   9 +-
 docs/testing/mcp-media-staging-lifecycle.md   |   8 +
 packages/api-contracts/src/media-review.ts    |   2 +-
 .../api-contracts/tests/media-review.test.ts  |   2 +-
 scripts/smoke-vrdex-mcp-compat.ts             |   2 +-
 tests/backend/e2e-media.test.ts               |  37 +++
 .../media-contribution-commands.test.ts       |  34 ++-
 tests/scripts/mcp-compat-smoke-cli.test.ts    |   2 +-
 tests/web/mcp-media-review.test.ts            |   2 +-
 tests/web/media-command-result.test.ts        |  14 +-
 tests/web/media-review-view.test.ts           |   4 +
 tests/web/vrdex-mcp.test.ts                   |   2 +-
 28 files changed, 659 insertions(+), 383 deletions(-)
 create mode 100644 apps/web/src/app/account/media-contributions/published-contribution-card.tsx

diff --git a/apps/web/e2e/media-contribution.flow.spec.ts b/apps/web/e2e/media-contribution.flow.spec.ts
index abe28c93..ca29122f 100644
--- a/apps/web/e2e/media-contribution.flow.spec.ts
+++ b/apps/web/e2e/media-contribution.flow.spec.ts
@@ -1,3 +1,5 @@
+import sharp from "sharp";
+import type { PublishedContributionDetail } from "@vrdex/api-contracts";
 import { createHash, randomBytes } from "node:crypto";
 import { expect, test, type APIRequestContext, type Page } from "@playwright/test";
 import {
@@ -61,7 +63,7 @@ function expectRefusal(response: Awaited<ReturnType<typeof rpc>>, text: string)
 }
 
 async function grant(page: Page, request: APIRequestContext, origin: string, runId: string) {
-  const scopes = ["mcp:read", "assets:review:read", "mcp:write", "assets:contribute", "assets:review:write"];
+  const scopes = ["mcp:read", "assets:review:read", "mcp:write", "assets:contribute", "assets:publish", "assets:review:write"];
   const redirectUri = `${origin}/oauth/e2e-callback`;
   const response = await page.request.post("/api/developer/oauth-apps", {
     headers: { origin },
@@ -342,11 +344,55 @@ test("contributor A submits and different owner B reviews media @media-lifecycle
   // Let the normal creation cooldown expire before the second proposal.
   // The refused key is durable and must not be reused for this request.
   await new Promise((resolve) => setTimeout(resolve, 31_000));
+  const grants = await request.post("/api/e2e/media", { headers, data: { op: "grant-publication-actors", runId, profileId } });
+  expect(grants.status()).toBe(200);
+  const { batchId } = await grants.json() as { batchId: string };
+  const publisherImage = await sharp({ create: { width: 64, height: 48, channels: 3, background: "#173e35" } }).png().toBuffer();
+  const publisherKey = `${runId}-publisher-upload`;
+  const publisherTarget = await call<UploadTarget>(request, authA.access_token, "vrdex_media_upload_begin", {
+    mode: "contributor", profileId, expectedUpdatedAt: before.updatedAt, placement: "gallery", contentType: "image/png", byteLength: publisherImage.length,
+    sha256: createHash("sha256").update(publisherImage).digest("hex"), credit: input.credit, sourceDescription: "Synthetic publisher image", idempotencyKey: publisherKey,
+  });
+  fixture.expiringTransfer = { ...publisherTarget.transfer, image: publisherImage };
+  fixture.expectedReservations = 2;
+  const publisherTransfer = await request.post(publisherTarget.transfer.url, { multipart: { ...publisherTarget.transfer.fields, [publisherTarget.transfer.fileField]: { name: "publisher.png", mimeType: "image/png", buffer: publisherImage } } });
+  expect([201, 204]).toContain(publisherTransfer.status());
+  const publisherCompletion = await call<UploadReceipt>(request, authA.access_token, "vrdex_media_upload_complete", { intentId: publisherTarget.intentId, idempotencyKey: publisherKey });
+  expect(publisherCompletion.operationState).toBe("committed");
+  const publishedSubmissionId = publisherCompletion.resourceId!;
+  await pageA.goto("/account/media-contributions");
+  const publisherCard = pageA.locator("section").filter({ has: pageA.locator(`img[src^="/api/account/media-contributions/submissions/${publishedSubmissionId}/file"]`) });
+  await expect(publisherCard.getByRole("checkbox")).toHaveCount(0);
+  await expect(publisherCard.getByRole("button", { name: "Confirm evidence" })).toHaveCount(0);
+  await publisherCard.getByRole("button", { name: "Publish", exact: true }).click();
+  await expect.poll(async () => (await call<{ submissions: Submission[] }>(request, authA.access_token, "vrdex_list_my_media_submissions", {})).submissions.find(row => row.submissionId === publishedSubmissionId)?.status).toBe("approved");
+  let publishedDetail = await call<PublishedContributionDetail>(request, authA.access_token, "vrdex_media_contribution_get", { submissionId: publishedSubmissionId });
+  const publishedFile = `/api/v0/profiles/${profile.slug}/assets/${publishedDetail.assetId}/file`;
+  const publishedCard = pageA.locator("section").filter({ has: pageA.locator(`img[src="${publishedFile}"]`) });
+  const afterPublish = await call<{ avatarImageUrl?: string }>(request, undefined, "vrdex_get_profile", { slug: profile.slug });
+  expect(afterPublish.avatarImageUrl).toBe(before.avatarImageUrl);
+  await pageB.goto(`/${profile.slug}`);
+  await expect(pageB.getByRole("heading", { name: "Media kit" })).toBeVisible();
+  await expect(pageB.locator(`img[src="${publishedFile}"]`)).toBeVisible();
+  await publishedCard.getByRole("button", { name: "Select picture" }).click();
+  await expect(publishedCard.getByRole("button", { name: "Remove", exact: true })).toHaveCount(0);
+  await publishedCard.getByRole("button", { name: "Clear picture" }).click();
+  await publishedCard.getByRole("button", { name: "Edit metadata" }).click();
+  await publishedCard.getByLabel("Title", { exact: true }).fill("Synthetic publisher title");
+  await publishedCard.getByRole("button", { name: "Save", exact: true }).click();
+  await expect(publishedCard.getByRole("heading", { name: "Synthetic publisher title" })).toBeVisible();
+  await publishedCard.getByRole("button", { name: "Select picture" }).click();
+  publishedDetail = await call<PublishedContributionDetail>(request, authA.access_token, "vrdex_media_contribution_get", { submissionId: publishedSubmissionId });
+  expect(publishedDetail.canClearPrimary).toBe(true);
+  expect(publishedDetail.canRemove).toBe(false);
+  stages.push("trusted website kit publication without declarations or hero change, selection undo and metadata correction");
+  await new Promise(resolve => setTimeout(resolve, 31_000));
+  const refreshed = await call<{ updatedAt: number }>(request, undefined, "vrdex_get_profile", { slug: profile.slug });
   const image = await source.body();
   const directKey = `${runId}-direct`;
   const target = await call<UploadTarget>(request, authA.access_token, "vrdex_media_upload_begin", {
-    mode: "contributor", profileId, expectedUpdatedAt: before.updatedAt,
-    placement: "profile_image", contentType: "image/png", byteLength: image.byteLength,
+    mode: "contributor", profileId, expectedUpdatedAt: refreshed.updatedAt,
+    placement: "gallery", contentType: "image/png", byteLength: image.byteLength,
     sha256: createHash("sha256").update(image).digest("hex"),
     credit: input.credit, sourceDescription: input.altText, idempotencyKey: directKey,
   });
@@ -376,18 +422,13 @@ test("contributor A submits and different owner B reviews media @media-lifecycle
   expect(submitted.submission.submissionId).not.toBe(rejectedCandidate.submission.submissionId);
   const directState = await request.post("/api/e2e/media", { headers, data: { op: "inspect", runId, profileId } });
   expect(directState.status()).toBe(200);
-  expect((await directState.json()).counts.reservations).toBe(2);
-  fixture.expectedReservations = 2;
+  expect((await directState.json()).counts.reservations).toBe(3);
+  fixture.expectedReservations = 3;
   stages.push("minted direct S3 multipart transfer, completion replay and private contributor readback");
+  expect((await request.post("/api/e2e/media", { headers, data: { op: "grant-publication-actors", runId, profileId } })).status()).toBe(200);
 
-  const assign = await request.post("/api/e2e/media", { headers, data: { op: "assign-review-owner", runId, profileId, reviewerEmail: b.email } });
-  expect(assign.status(), "Assign only this synthetic profile to B").toBe(200);
-  const claimedProfile = await call<{ updatedAt: number }>(request, undefined, "vrdex_get_profile", { slug: profile.slug });
-  const claimed = await rpc(request, authA.access_token, "vrdex_profile_media_submit", {
-    ...input, expectedUpdatedAt: claimedProfile.updatedAt, idempotencyKey: `${runId}-claimed`,
-  });
-  expectRefusal(claimed, "The public profile is claimed, so its owner manages profile media.");
   await pageB.goto("/account/media-review");
+  await pageB.getByRole("combobox", { name: "Collection", exact: true }).selectOption(batchId);
   const rejectFile = `/api/account/media-review/submissions/${rejectedCandidate.submission.submissionId}/file`;
   const rejectCard = pageB.locator("section").filter({ has: pageB.locator(`img[src="${rejectFile}"]`) });
   const privateRejection = `Private fixture rejection ${runId}`;
@@ -403,9 +444,9 @@ test("contributor A submits and different owner B reviews media @media-lifecycle
   }).toEqual({ status: "rejected", disposition, asset: undefined });
   const rejectedState = await request.post("/api/e2e/media", { headers, data: { op: "inspect", runId, profileId } });
   expect(rejectedState.status()).toBe(200);
-  expect((await rejectedState.json()).assets).toEqual([]);
+  expect((await rejectedState.json()).assets).toHaveLength(1);
   const stillUnpublished = await call<{ avatarImageUrl?: string }>(request, undefined, "vrdex_get_profile", { slug: profile.slug });
-  expect(stillUnpublished.avatarImageUrl).toBe(before.avatarImageUrl);
+  expect(stillUnpublished.avatarImageUrl).toContain(publishedDetail.assetId);
   for (const privateValue of [privateRejection, disposition, sourceUrl, rejectionSourceUrl])
     expect(JSON.stringify(stillUnpublished)).not.toContain(privateValue);
   const reviewerHistory = await call<{ submissions: Submission[] }>(request, authB.access_token, "vrdex_list_my_media_submissions", {});
@@ -466,18 +507,55 @@ test("contributor A submits and different owner B reviews media @media-lifecycle
   }).toBe("approved");
   const approved = await request.post("/api/e2e/media", { headers, data: { op: "inspect", runId, profileId } });
   const approvedState = await approved.json() as { assets: { id: string; source: string; state: string }[] };
-  expect(approvedState.assets).toHaveLength(1);
+  expect(approvedState.assets).toHaveLength(2);
   expect(approvedState.assets[0].source).toBe("community_submitted");
   const published = await call<{ avatarImageUrl?: string }>(request, undefined, "vrdex_get_profile", { slug: profile.slug });
-  expect(published.avatarImageUrl).toBeTruthy();
+  expect(published.avatarImageUrl).toBe(stillUnpublished.avatarImageUrl);
   expect((await request.get(published.avatarImageUrl!)).ok()).toBe(true);
   await pageB.goto("/account/media-review");
+  await pageB.getByRole("combobox", { name: "Collection", exact: true }).selectOption(batchId);
   await pageB.getByRole("combobox", { name: "Status", exact: true }).selectOption("approved");
   const approvedCard = pageB.locator("section").filter({ has: pageB.locator(`img[src="${privateFile}"]`) });
-  await expect(approvedCard.locator(`img[src="${published.avatarImageUrl}"]`)).toBeVisible();
+  await expect(approvedCard.getByRole("img")).toHaveCount(1);
   await pageB.goto(`/${profile.slug}`);
   await expect(pageB.locator(`img[src="${published.avatarImageUrl}"]`).first()).toBeVisible();
-  stages.push("donor authorization refusal, replay-safe MCP rebase and approval, native preview and authenticated browser/public readback");
+  stages.push("independent approval publishes into kit with unchanged primary picture");
+  const kitDetail = await call<PublishedContributionDetail>(request, authA.access_token, "vrdex_media_contribution_get", { submissionId: submitted.submission.submissionId });
+  expect(kitDetail.canProposePlacement).toBe(true);
+  await pageA.goto("/account/media-contributions");
+  const kitFile = `/api/v0/profiles/${profile.slug}/assets/${kitDetail.assetId}/file`;
+  const kitCard = pageA.locator("section").filter({ has: pageA.locator(`img[src="${kitFile}"]`) });
+  await expect(kitCard.getByRole("button", { name: "Select picture" })).toHaveCount(0);
+  await kitCard.getByRole("button", { name: "Request replacement" }).click();
+  await expect(kitCard.getByText("Submitted", { exact: true })).toBeVisible();
+  expect((await request.post("/api/e2e/media", { headers, data: { op: "grant-publication-actors", runId, profileId } })).status()).toBe(200);
+  const queue = await call<{ page: { submissionId: string; requestKind?: string }[] }>(request, authB.access_token, "vrdex_media_review_list", { batchId, status: "submitted" });
+  const proposal = queue.page.find(row => row.requestKind === "identity_placement");
+  expect(proposal).toBeTruthy();
+  await pageB.goto("/account/media-review");
+  await pageB.getByRole("combobox", { name: "Collection", exact: true }).selectOption(batchId);
+  const replacementFile = `/api/account/media-review/submissions/${proposal!.submissionId}/file`;
+  const replacementCard = pageB.locator("section").filter({ has: pageB.locator(`img[src="${replacementFile}"]`) });
+  await expect(replacementCard.locator(`img[src="${published.avatarImageUrl}"]`)).toBeVisible();
+  await replacementCard.getByLabel("Private review reason", { exact: true }).fill("Synthetic reviewed replacement.");
+  await replacementCard.getByRole("button", { name: "Approve", exact: true }).click();
+  await expect.poll(async () => (await call<PublishedContributionDetail>(request, authA.access_token, "vrdex_media_contribution_get", { submissionId: submitted.submission.submissionId })).canRemove).toBe(false);
+  const replaced = await call<{ avatarImageUrl?: string }>(request, undefined, "vrdex_get_profile", { slug: profile.slug });
+  expect(replaced.avatarImageUrl).toContain(kitDetail.assetId);
+  await pageA.goto("/account/media-contributions");
+  await expect(kitCard.getByRole("button", { name: "Remove", exact: true })).toHaveCount(0);
+  await publishedCard.getByRole("button", { name: "Remove", exact: true }).click();
+  await expect(pageA.getByText("Removed", { exact: true })).toBeVisible();
+  expect((await request.get(publishedFile)).status()).toBe(404);
+  stages.push("explicit replacement compares existing picture with published candidate, separate reviewer protects selection, logical removal of unused kit item");
+  const assign = await request.post("/api/e2e/media", { headers, data: { op: "assign-review-owner", runId, profileId, reviewerEmail: b.email } });
+  expect(assign.status(), "Assign only this synthetic profile to B").toBe(200);
+  const claimedProfile = await call<{ updatedAt: number }>(request, undefined, "vrdex_get_profile", { slug: profile.slug });
+  const claimed = await rpc(request, authA.access_token, "vrdex_profile_media_submit", {
+    ...input, expectedUpdatedAt: claimedProfile.updatedAt, idempotencyKey: `${runId}-claimed`,
+  });
+  expectRefusal(claimed, "The public profile is claimed, so its owner manages profile media.");
+
 
   const audit = await request.post("/api/e2e/media", { headers, data: { op: "inspect-audit", runId, profileId } });
   expect(audit.status()).toBe(200);
diff --git a/apps/web/e2e/media-kit.visual.spec.ts b/apps/web/e2e/media-kit.visual.spec.ts
index 20d7c6ba..c74f19d5 100644
--- a/apps/web/e2e/media-kit.visual.spec.ts
+++ b/apps/web/e2e/media-kit.visual.spec.ts
@@ -767,7 +767,7 @@ test("public profile media kit @visual @fixture", async ({ page }, testInfo) =>
     mediaKit.getByRole("link", { name: "Artwork by Afterglow Studio" }),
   ).toHaveAttribute("href", "https://example.invalid/afterglow-studio");
   await expect(
-    mediaKit.getByRole("link", { name: "https://example.invalid/aurora-source" }),
+    mediaKit.getByRole("link", { name: "Open source" }),
   ).toHaveAttribute("href", "https://example.invalid/aurora-source");
   for (const title of [
     "Aurora press portrait",
@@ -787,5 +787,12 @@ test("public profile media kit @visual @fixture", async ({ page }, testInfo) =>
   await expect(mediaKit.getByRole("link", { name: "Download" }).first()).toBeVisible();
   await expect(mediaKit.getByText("PNG / 180 KB", { exact: true })).toBeVisible();
   await expect(mediaKit.locator("article")).toHaveCount(4);
+  await mediaKit.locator("img").evaluateAll(async images => {
+    await Promise.all(images.map(async image => {
+      (image as HTMLImageElement).loading = "eager";
+      await (image as HTMLImageElement).decode();
+    }));
+  });
   await captureRouteScreenshot(page, testInfo, "profile-media-kit");
+  await mediaKit.screenshot({ path: `playwright-artifacts/screenshots/${testInfo.project.name}-profile-media-kit-section.png` });
 });
diff --git a/apps/web/e2e/trusted-publication.visual.spec.ts b/apps/web/e2e/trusted-publication.visual.spec.ts
index d63c9b4a..6e984437 100644
--- a/apps/web/e2e/trusted-publication.visual.spec.ts
+++ b/apps/web/e2e/trusted-publication.visual.spec.ts
@@ -1,172 +1,127 @@
+import { expect, test } from "@playwright/test";
 import sharp from "sharp";
-import { test, expect } from "@playwright/test";
-import {
-  gotoComponentStory,
-  prepareStorybookVisualPage,
-  captureStorybookScreenshot,
-} from "./storybook-components";
-test("parent inventory retains publication recovery after reactive approval @storybook-visual", async ({
-  page,
-}, testInfo) => {
+import { gotoComponentStory, prepareStorybookVisualPage, captureStorybookScreenshot } from "./storybook-components";
+
+test.beforeEach(async ({ page }) => {
   await prepareStorybookVisualPage(page);
-  const candidate = await sharp({
-    create: { width: 320, height: 320, channels: 3, background: "#173e35" },
-  })
-    .png()
-    .toBuffer();
-  await page.route(
-    "**/api/account/media-contributions/submissions/fixture/file?version=*",
-    (route) => route.fulfill({ contentType: "image/png", body: candidate }),
-  );
-  await gotoComponentStory(
-    page,
-    "account-trusted-publication--reactive-inventory",
-  );
-  await expect(
-    page.getByRole("img", { name: "Candidate", exact: true }),
-  ).toHaveJSProperty("naturalWidth", 320);
-  await page.getByRole("button", { name: "Publish", exact: true }).click();
-  await expect(page.getByText("Approved", { exact: true })).toBeVisible();
-  await expect(
-    page.getByText("Outcome unknown", { exact: true }),
-  ).toBeVisible();
-  await expect(page.getByLabel("Identity confirmed")).toBeDisabled();
-  for (const name of ["Publish", "Confirm evidence", "Independent review"])
-    await expect(
-      page.getByRole("button", { name, exact: true }),
-    ).toBeDisabled();
-  await expect(
-    page.getByRole("img", { name: "Candidate", exact: true }),
-  ).toHaveJSProperty("naturalWidth", 320);
-  await captureStorybookScreenshot(
-    page,
-    testInfo,
-    "parent-publication-recovery",
-  );
-  await page.getByRole("button", { name: "Retry", exact: true }).click();
-  const calls = JSON.parse(
-    (await page.getByTestId("inventory-commands").textContent())!,
-  );
-  expect(calls).toHaveLength(2);
-  expect(calls[1]).toEqual(calls[0]);
-  expect(calls[1].expectedReviewVersion).toBe("v1");
-  await expect(
-    page.getByRole("button", { name: "Retry", exact: true }),
-  ).toHaveCount(0);
-  await expect(
-    page.getByText("Trusted publication", { exact: true }),
-  ).toBeVisible();
+  await page.evaluate(() => sessionStorage.clear()).catch(() => undefined);
+  const image = await sharp({ create: { width: 320, height: 240, channels: 3, background: "#173e35" } }).png().toBuffer();
+  await page.route("**/api/**/file*", route => route.fulfill({ contentType: "image/png", body: image }));
 });
-test("trusted publication keeps declarations and publish separate @storybook-visual", async ({
-  page,
-}, testInfo) => {
-  await prepareStorybookVisualPage(page);
-  const candidate = await sharp(
-    Buffer.from(
-      '<svg xmlns="http://www.w3.org/2000/svg" width="640" height="640"><rect width="640" height="640" fill="#173e35"/><circle cx="320" cy="230" r="105" fill="#9bd9b9"/><path d="M120 600v-70a200 200 0 01400 0v70z" fill="#72b59b"/></svg>',
-    ),
-  )
-    .png()
-    .toBuffer();
-  await page.route(
-    "**/api/account/media-contributions/submissions/fixture/file?version=*",
-    (route) =>
-      route.fulfill({
-        contentType: "image/png",
-        body: candidate,
-      }),
-  );
-  await gotoComponentStory(
-    page,
-    "account-trusted-publication--explicit-commands",
-  );
-  await expect(page.getByTestId("commands")).toHaveText("[]");
-  await expect(
-    page.getByRole("button", { name: "Confirm evidence" }),
-  ).toBeDisabled();
-  for (const label of [
-    "Identity confirmed",
-    "Attribution confirmed",
-    "Publication permitted",
-    "No known restrictions",
-  ])
-    await page.getByLabel(label).check();
-  await expect(page.getByTestId("commands")).toHaveText("[]");
-  await page.getByRole("button", { name: "Confirm evidence" }).click();
-  await expect(page.getByText("Confirmed", { exact: true })).toBeVisible();
-  await expect(page.getByTestId("commands")).not.toContainText(
-    'command\\\":\\\"publish',
-  );
-  await expect(
-    page.getByRole("button", { name: "Confirm evidence" }),
-  ).toBeEnabled();
-  await captureStorybookScreenshot(
-    page,
-    testInfo,
-    "trusted-publication-evidence",
-  );
-  await page.getByRole("button", { name: "Publish", exact: true }).click();
-  await expect(
-    page.getByText("Independent review required", { exact: true }),
-  ).toBeVisible();
-  expect(await page.getByTestId("commands").textContent()).toContain("v2");
-  expect(
-    await page.evaluate(
-      () => document.documentElement.scrollWidth <= window.innerWidth,
-    ),
-  ).toBe(true);
-  await captureStorybookScreenshot(
-    page,
-    testInfo,
-    "trusted-publication-refusal",
-  );
-  await page
-    .getByRole("button", { name: "Independent review", exact: true })
-    .click();
-  await expect(
-    page.getByRole("button", { name: "Publish", exact: true }),
-  ).toHaveCount(0);
-  await expect(
-    page.getByRole("button", { name: "Inspect", exact: true }),
-  ).toBeVisible();
+
+test("kit publication has one primary action and no declarations @storybook-visual", async ({ page }, testInfo) => {
+  await gotoComponentStory(page, "account-trusted-publication--explicit-commands");
+  await expect(page.getByRole("checkbox")).toHaveCount(0);
+  await expect(page.getByRole("button", { name: "Confirm evidence" })).toHaveCount(0);
+  await expect(page.getByText("Media kit", { exact: true })).toBeVisible();
+  await expect(page.getByRole("img")).toHaveCount(1);
+  await page.getByRole("button", { name: "Publish", exact: true }).focus();
+  await expect(page.getByRole("button", { name: "Publish", exact: true })).toBeFocused();
+  await captureStorybookScreenshot(page, testInfo, "publication-pending");
+  await page.keyboard.press("Enter");
+  await expect(page.getByText("Independent review required", { exact: true })).toBeVisible();
+  expect(JSON.parse((await page.getByTestId("commands").textContent())!)).toHaveLength(1);
+  await captureStorybookScreenshot(page, testInfo, "publication-refused");
+  await page.getByRole("button", { name: "Independent review", exact: true }).click();
+  await expect(page.getByRole("button", { name: "Publish", exact: true })).toHaveCount(0);
 });
 
-test("publication retains committed command after response loss @storybook-visual", async ({
-  page,
-}, testInfo) => {
-  await prepareStorybookVisualPage(page);
-  const candidate = await sharp({
-    create: { width: 320, height: 320, channels: 3, background: "#173e35" },
-  })
-    .png()
-    .toBuffer();
-  await page.route(
-    "**/api/account/media-contributions/submissions/fixture/file?version=*",
-    (route) => route.fulfill({ contentType: "image/png", body: candidate }),
-  );
+test("publication recovers exact command after reload and lost response @storybook-visual", async ({ page }, testInfo) => {
   await gotoComponentStory(page, "account-trusted-publication--uncertain");
-  await expect(
-    page.getByRole("img", { name: "Candidate", exact: true }),
-  ).toHaveJSProperty("naturalWidth", 320);
   await page.getByRole("button", { name: "Publish", exact: true }).click();
-  await expect(
-    page.getByText("Outcome unknown", { exact: true }),
-  ).toBeVisible();
-  await expect(page.getByLabel("Identity confirmed")).toBeDisabled();
-  await expect(
-    page.getByRole("button", { name: "Publish", exact: true }),
-  ).toBeDisabled();
-  await expect(
-    page.getByRole("button", { name: "Confirm evidence", exact: true }),
-  ).toBeDisabled();
-  await captureStorybookScreenshot(
-    page,
-    testInfo,
-    "publication-outcome-unknown",
-  );
+  await expect(page.getByText("Outcome unknown", { exact: true })).toBeVisible();
+  const first = JSON.parse((await page.getByTestId("commands").textContent())!)[0];
+  await captureStorybookScreenshot(page, testInfo, "publication-unknown");
+  await page.reload();
+  await expect(page.getByRole("button", { name: "Publish", exact: true })).toBeDisabled();
   await page.getByRole("button", { name: "Retry", exact: true }).click();
   await expect(page.getByText("Published", { exact: true })).toBeVisible();
-  const calls = JSON.parse((await page.getByTestId("commands").textContent())!);
+  const retry = JSON.parse((await page.getByTestId("commands").textContent())!)[0];
+  expect(retry).toEqual(first);
+});
+
+test("parent retains publication recovery when inventory becomes approved @storybook-visual", async ({ page }) => {
+  await gotoComponentStory(page, "account-trusted-publication--reactive-inventory");
+  await page.getByRole("button", { name: "Publish", exact: true }).click();
+  await expect(page.getByText("Outcome unknown", { exact: true })).toBeVisible();
+  await page.getByRole("button", { name: "Retry", exact: true }).click();
+  const calls = JSON.parse((await page.getByTestId("inventory-commands").textContent())!);
   expect(calls).toHaveLength(2);
   expect(calls[1]).toEqual(calls[0]);
+  await expect(page.getByText("Trusted publication", { exact: true })).toBeVisible();
+});
+
+test("published actions follow capabilities and retain corrections on conflict @storybook-visual", async ({ page }, testInfo) => {
+  await gotoComponentStory(page, "account-trusted-publication--published");
+  await expect(page.getByRole("button", { name: "Select picture" })).toBeVisible();
+  await expect(page.getByRole("button", { name: "Remove", exact: true })).toBeVisible();
+  await captureStorybookScreenshot(page, testInfo, "contribution-published");
+  await page.getByRole("button", { name: "Select picture" }).click();
+  await expect(page.getByRole("button", { name: "Clear picture" })).toBeVisible();
+  await expect(page.getByRole("button", { name: "Remove", exact: true })).toHaveCount(0);
+  await page.getByRole("button", { name: "Clear picture" }).click();
+  await page.getByRole("button", { name: "Edit metadata" }).click();
+  await page.getByLabel("Title", { exact: true }).fill("Corrected portrait");
+  await page.getByRole("button", { name: "Save", exact: true }).click();
+  await expect(page.getByText("Review changed. Inspect the current images before deciding again.", { exact: true })).toBeVisible();
+  await expect(page.getByLabel("Title", { exact: true })).toHaveValue("Corrected portrait");
+  await page.getByRole("button", { name: "Save", exact: true }).click();
+  await expect(page.getByRole("heading", { name: "Corrected portrait" })).toBeVisible();
+  await page.getByRole("button", { name: "Remove", exact: true }).click();
+  await expect(page.getByText("Removed", { exact: true })).toBeVisible();
+});
+
+test("protected contribution offers reviewed replacement only @storybook-visual", async ({ page }, testInfo) => {
+  await gotoComponentStory(page, "account-trusted-publication--protected");
+  await expect(page.getByRole("button", { name: "Remove", exact: true })).toHaveCount(0);
+  await expect(page.getByRole("button", { name: "Edit metadata" })).toHaveCount(0);
+  await expect(page.getByRole("button", { name: "Select picture" })).toHaveCount(0);
+  await captureStorybookScreenshot(page, testInfo, "contribution-protected");
+  await page.getByRole("button", { name: "Request replacement" }).click();
+  await expect(page.getByText("Submitted", { exact: true })).toBeVisible();
+  const commands = JSON.parse((await page.getByTestId("published-commands").textContent())!);
+  expect(commands[0].kind).toBe("propose");
+  expect(commands[0].input).not.toHaveProperty("metadata");
+});
+
+test("published correction replays exact payload after reload @storybook-visual", async ({ page }, testInfo) => {
+  await gotoComponentStory(page, "account-trusted-publication--published-uncertain");
+  await page.getByRole("button", { name: "Edit metadata" }).click();
+  await page.getByLabel("Credit", { exact: true }).fill("New photographer");
+  await page.getByRole("button", { name: "Save", exact: true }).click();
+  await expect(page.getByText("Outcome unknown", { exact: true })).toBeVisible();
+  const first = JSON.parse((await page.getByTestId("published-commands").textContent())!)[0];
+  await captureStorybookScreenshot(page, testInfo, "contribution-unknown");
+  await page.reload();
+  await expect(page.getByLabel("Credit", { exact: true })).toHaveValue("New photographer");
+  await expect(page.getByRole("button", { name: "Save", exact: true })).toBeDisabled();
+  await page.getByRole("button", { name: "Retry", exact: true }).click();
+  const retry = JSON.parse((await page.getByTestId("published-commands").textContent())!)[0];
+  expect(retry).toEqual(first);
+  await expect(page.getByText("Saved", { exact: true })).toBeVisible();
+});
+
+test("kit approval previews one image and replacement compares two @storybook-visual", async ({ page }, testInfo) => {
+  await gotoComponentStory(page, "account-assigned-media-review--local-provenance");
+  await expect(page.getByRole("img")).toHaveCount(1);
+  await expect(page.getByText("Media kit", { exact: true })).toBeVisible();
+  await captureStorybookScreenshot(page, testInfo, "review-kit-approval");
+  await gotoComponentStory(page, "account-assigned-media-review--published-replacement");
+  await expect(page.getByRole("img")).toHaveCount(2);
+  await expect(page.getByText("Current", { exact: true })).toBeVisible();
+  await expect(page.getByText("Candidate", { exact: true })).toBeVisible();
+  await captureStorybookScreenshot(page, testInfo, "review-published-replacement");
+});
+
+
+test("logical removal recovery survives unavailable detail and reload @storybook-visual", async ({ page }) => {
+  await gotoComponentStory(page, "account-trusted-publication--removed-uncertain");
+  await page.getByRole("button", { name: "Remove", exact: true }).click();
+  await expect(page.getByText("Outcome unknown", { exact: true })).toBeVisible();
+  const first = JSON.parse((await page.getByTestId("removal-commands").textContent())!)[0];
+  await expect(page.getByRole("img")).toHaveCount(0);
+  await page.reload();
+  await page.getByRole("button", { name: "Retry", exact: true }).click();
+  await expect(page.getByText("Removed", { exact: true })).toBeVisible();
+  expect(JSON.parse((await page.getByTestId("removal-commands").textContent())!)[0]).toEqual(first);
 });
diff --git a/apps/web/src/app/_components/profile-media-contribution-editor.tsx b/apps/web/src/app/_components/profile-media-contribution-editor.tsx
index f150dc37..ba02aa18 100644
--- a/apps/web/src/app/_components/profile-media-contribution-editor.tsx
+++ b/apps/web/src/app/_components/profile-media-contribution-editor.tsx
@@ -97,7 +97,7 @@ export function ProfileMediaContributionEditor({
       const file = prepared.file;
       const intent = await createUploadIntent({
         profileId: profile.id,
-        requestedPlacement: profile.profileType === "person" ? "profile_image" : "primary_logo",
+        requestedPlacement: "gallery",
         originalFileName: file.name,
         mimeType: profileMediaMimeType(file.type, file.name) ?? file.type,
         byteSize: file.size,
diff --git a/apps/web/src/app/_components/profile-public-page.tsx b/apps/web/src/app/_components/profile-public-page.tsx
index 61dd5219..939a93a1 100644
--- a/apps/web/src/app/_components/profile-public-page.tsx
+++ b/apps/web/src/app/_components/profile-public-page.tsx
@@ -343,6 +343,7 @@ function mimeLabel(value: string): string {
 }
 
 function MediaAssetCard({ asset, label, featured = false }: { asset: PublicProfileAsset; label: string; featured?: boolean }) {
+  const title = asset.label?.trim() || label;
   const creditUrl = safeCreditUrl(asset.creditUrl);
   const downloadMimeType = asset.downloadMimeType ?? asset.mimeType;
   const downloadByteSize = asset.downloadByteSize ?? asset.byteSize;
@@ -350,17 +351,17 @@ function MediaAssetCard({ asset, label, featured = false }: { asset: PublicProfi
     <article className={cn("group grid overflow-hidden rounded-card border border-border bg-surface-strong text-sm transition hover:-translate-y-0.5 hover:shadow-panel", featured ? "lg:grid-cols-[minmax(0,1.35fr)_minmax(16rem,0.65fr)]" : undefined)}>
       <div className={cn("relative bg-canvas-muted", featured ? "min-h-72" : "aspect-[4/3]")}>
         <MediaPreviewImage
-          alt={asset.altText || asset.label || label}
+          alt={asset.altText || title}
           className="absolute inset-0 size-full object-contain"
           src={asset.imageUrl}
         />
       </div>
       <div className="grid content-start gap-2 p-4">
-        <h3 className={cn("font-medium", featured ? "text-xl" : undefined)}>{asset.label ?? label}</h3>
+        <h3 className={cn("font-medium", featured ? "text-xl" : undefined)}>{title}</h3>
         {asset.caption ? <p className="leading-6 text-muted">{asset.caption}</p> : null}
         {creditUrl ? (
           <a className="w-fit break-all text-xs text-muted underline underline-offset-4" href={creditUrl}>
-            {asset.credit || creditUrl}
+            {asset.credit || "Open source"}
           </a>
         ) : asset.credit ? (
           <p className="text-xs text-muted">{asset.credit}</p>
@@ -368,7 +369,7 @@ function MediaAssetCard({ asset, label, featured = false }: { asset: PublicProfi
         <p className="text-xs text-muted">
           {mimeLabel(downloadMimeType)} / {formatByteSize(downloadByteSize)}
         </p>
-        <a aria-label={`Download ${asset.label ?? label}`} className={cn(buttonVariants({ size: "sm", variant: "secondary" }), "mt-2 w-fit")} download href={asset.downloadUrl}>
+        <a aria-label={`Download ${title}`} className={cn(buttonVariants({ size: "sm", variant: "secondary" }), "mt-2 w-fit")} download href={asset.downloadUrl}>
           Download
         </a>
       </div>
diff --git a/apps/web/src/app/account/media-contributions/media-contributions-panel.tsx b/apps/web/src/app/account/media-contributions/media-contributions-panel.tsx
index 9e623e73..39084b82 100644
--- a/apps/web/src/app/account/media-contributions/media-contributions-panel.tsx
+++ b/apps/web/src/app/account/media-contributions/media-contributions-panel.tsx
@@ -3,6 +3,7 @@
 import Link from "next/link";
 import { useState } from "react";
 import { PublicationCard } from "./publication-card";
+import { PublishedContributionCard } from "./published-contribution-card";
 import { useMutation, useQuery, usePaginatedQuery } from "convex/react";
 import { api } from "@convex-generated-api";
 
@@ -10,6 +11,11 @@ import { Button } from "@/components/ui/button";
 import { Card, SectionTitle } from "@/components/ui/card";
 import { Notice } from "@/components/ui/notice";
 
+function hasPendingPublication(submissionId: string) {
+  try { return typeof window !== "undefined" && sessionStorage.getItem(`vrdex:publication:${submissionId}`) !== null; }
+  catch { return false; }
+}
+
 const statusLabel = {
   upload_pending: "Upload pending",
   submitted: "Submitted",
@@ -83,7 +89,9 @@ export function MediaContributionsPanel() {
               <div>
                 <dt className="text-muted">Requested use</dt>
                 <dd>
-                  {submission.requestedPlacement === "profile_image"
+                  {submission.requestedPlacement === "gallery"
+                    ? "Media kit"
+                    : submission.requestedPlacement === "profile_image"
                     ? "Profile image"
                     : "Primary logo"}
                 </dd>
@@ -94,6 +102,7 @@ export function MediaContributionsPanel() {
               </div>
             </dl>
             {pendingPublications.has(submission.submissionId) ||
+            hasPendingPublication(submission.submissionId) ||
             (access?.canPublishMedia &&
               submission.publisherTargetAvailable &&
               ["submitted", "under_review"].includes(submission.status)) ? (
@@ -104,6 +113,7 @@ export function MediaContributionsPanel() {
                 }
               />
             ) : null}
+            {submission.status === "approved" && submission.requestKind !== "identity_placement" ? <PublishedContributionCard submissionId={submission.submissionId} /> : null}
             {submission.status === "approved" ? (
               <p className="mt-3 text-sm text-muted">
                 {submission.publicationMethod === "trusted_publisher"
diff --git a/apps/web/src/app/account/media-contributions/publication-card.tsx b/apps/web/src/app/account/media-contributions/publication-card.tsx
index c12cf8eb..66efaccf 100644
--- a/apps/web/src/app/account/media-contributions/publication-card.tsx
+++ b/apps/web/src/app/account/media-contributions/publication-card.tsx
@@ -1,195 +1,79 @@
 "use client";
-import { useState } from "react";
+import { useEffect, useState } from "react";
 import { useMutation, useQuery } from "convex/react";
 import { api } from "@convex-generated-api";
 import type { Id } from "../../../../../../convex/_generated/dataModel";
-import type {
-  CommandReceipt,
-  MediaPublication,
-  PublicationEvidence,
-  ReviewDetail,
-} from "@vrdex/api-contracts";
+import { mediaPublicationSchema, type CommandReceipt, type MediaPublication, type ReviewDetail } from "@vrdex/api-contracts";
 import { Button } from "@/components/ui/button";
 import { Notice } from "@/components/ui/notice";
-import { MediaReviewComparison } from "@/components/media-review-comparison";
-import {
-  reviewDecisionMessage,
-  reviewPlacementImage,
-} from "../media-review/media-review-view";
+import { reviewDecisionMessage } from "../media-review/media-review-view";
 
-export function PublicationCard({
-  submissionId,
-  onPendingChange,
-}: {
+export function PublicationCard({ submissionId, onPendingChange }: {
   submissionId: Id<"profileMediaSubmissions">;
   onPendingChange?: (pending: boolean) => void;
 }) {
-  const detail = useQuery(api.profileMediaSubmissions.publisherDetail, {
-    submissionId,
-  });
-  const declare = useMutation(
-    api.profileMediaSubmissions.declarePublicationEvidence,
-  );
+  const detail = useQuery(api.profileMediaSubmissions.publisherDetail, { submissionId });
   const publish = useMutation(api.profileMediaSubmissions.publish);
-  return (
-    <PublicationCardView
-      detail={detail}
-      declare={(input) => declare({ ...input, submissionId })}
-      publish={(input) => publish({ ...input, submissionId })}
-      onPendingChange={onPendingChange}
-    />
-  );
+  return <PublicationCardView submissionId={submissionId} detail={detail} publish={input => publish({ ...input, submissionId })} onPendingChange={onPendingChange} />;
 }
-const declarations = {
-  identityConfirmed: "Identity confirmed",
-  attributionConfirmed: "Attribution confirmed",
-  publicationPermitted: "Publication permitted",
-  noKnownRestrictions: "No known restrictions",
-} as const;
-export function PublicationCardView({
-  detail,
-  declare,
-  publish,
-  onPendingChange,
-}: {
+
+export function PublicationCardView({ detail, submissionId = detail?.submissionId, publish, onPendingChange }: {
   detail: ReviewDetail | null | undefined;
-  declare: (input: PublicationEvidence) => Promise<CommandReceipt>;
+  submissionId?: string;
   publish: (input: MediaPublication) => Promise<CommandReceipt>;
   onPendingChange?: (pending: boolean) => void;
 }) {
-  const [confirmed, setConfirmed] = useState({
-    identityConfirmed: false,
-    attributionConfirmed: false,
-    publicationPermitted: false,
-    noKnownRestrictions: false,
-  });
   const [reviewOnly, setReviewOnly] = useState(false);
   const [busy, setBusy] = useState(false);
+  const [ready, setReady] = useState(false);
   const [message, setMessage] = useState<string | null>(null);
-  const [pending, setPending] = useState<{
-    kind: "declare" | "publish";
-    input: PublicationEvidence | MediaPublication;
-  } | null>(null);
-  if (!detail) return null;
-  const current = detail;
-  async function command(kind: "declare" | "publish") {
-    setBusy(true);
-    const input =
-      pending?.kind === kind
-        ? pending.input
-        : {
-            submissionId: current.submissionId,
-            expectedReviewVersion: current.reviewVersion,
-            idempotencyKey: crypto.randomUUID(),
-            ...(kind === "declare" ? confirmed : {}),
-          };
-    setPending({ kind, input });
+  const [pending, setPending] = useState<MediaPublication | null>(null);
+  const storageKey = `vrdex:publication:${submissionId}`;
+  useEffect(() => {
+    let recovered: MediaPublication | null = null;
+    try {
+      const value = mediaPublicationSchema.safeParse(JSON.parse(sessionStorage.getItem(storageKey) ?? "null"));
+      if (value.success && value.data.submissionId === submissionId) recovered = value.data;
+    } catch { /* A new decision is safe only when no command was stored. */ }
+    queueMicrotask(() => { if (recovered) { setPending(recovered); setMessage("Outcome unknown"); } setReady(true); });
+  }, [storageKey, submissionId]);
+
+  async function command() {
+    if (!ready || busy || (!pending && !detail)) return;
+    const input = pending ?? { submissionId: detail!.submissionId, expectedReviewVersion: detail!.reviewVersion, idempotencyKey: crypto.randomUUID() };
+    // Store before sending, so reload and a lost response replay this exact command.
+    try { sessionStorage.setItem(storageKey, JSON.stringify(input)); } catch { setMessage("Submission failed"); return; }
+    setPending(input);
     onPendingChange?.(true);
+    setBusy(true);
     try {
-      const receipt =
-        kind === "declare"
-          ? await declare(input as PublicationEvidence)
-          : await publish(input);
-      setMessage(
-        receipt.operationState === "committed"
-          ? kind === "declare"
-            ? "Confirmed"
-            : "Published"
-          : receipt.code === "independent_review_required"
-            ? "Independent review required"
-            : reviewDecisionMessage(receipt).message,
-      );
+      const receipt = await publish(input);
+      setMessage(receipt.operationState === "committed" ? "Published" : receipt.code === "independent_review_required" ? "Independent review required" : reviewDecisionMessage(receipt).message);
       if (receipt.operationState !== "in_progress") {
+        sessionStorage.removeItem(storageKey);
         setPending(null);
         onPendingChange?.(false);
       }
-    } catch {
-      setMessage("Outcome unknown");
-    } finally {
-      setBusy(false);
-    }
+    } catch { setMessage("Outcome unknown"); }
+    finally { setBusy(false); }
   }
-  if (reviewOnly)
-    return (
-      <div className="mt-5 flex items-center gap-3">
-        <span className="text-sm text-muted">Independent review</span>
-        <Button
-          type="button"
-          variant="ghost"
-          onClick={() => setReviewOnly(false)}
-        >
-          Inspect
-        </Button>
-      </div>
-    );
-  return (
-    <div className="mt-5 grid gap-4">
-      <MediaReviewComparison
-        candidateAlt={current.altText ?? "Candidate"}
-        currentAlt="Current image"
-        currentSrc={reviewPlacementImage(current)}
-        candidateSrc={
-          current.candidate.rendition
-            ? `/api/account/media-contributions/submissions/${encodeURIComponent(current.submissionId)}/file?version=${encodeURIComponent(current.reviewVersion)}`
-            : null
-        }
-      />
-      <p className="break-words text-sm text-muted">
-        {current.sourceDescription ?? current.sourceUrl}
-      </p>
-      <fieldset
-        className="grid gap-2 text-sm"
-        disabled={busy || pending !== null}
-      >
-        {Object.entries(declarations).map(([name, label]) => (
-          <label key={name} className="flex items-center gap-2">
-            <input
-              type="checkbox"
-              checked={confirmed[name as keyof typeof confirmed]}
-              onChange={(event) =>
-                setConfirmed({ ...confirmed, [name]: event.target.checked })
-              }
-            />
-            {label}
-          </label>
-        ))}
-      </fieldset>
-      <div className="flex flex-wrap gap-2">
-        <Button
-          type="button"
-          disabled={
-            busy || pending !== null || !Object.values(confirmed).every(Boolean)
-          }
-          onClick={() => void command("declare")}
-        >
-          Confirm evidence
-        </Button>
-        <Button
-          type="button"
-          disabled={busy || pending !== null}
-          onClick={() => void command("publish")}
-        >
-          Publish
-        </Button>
-        <Button
-          type="button"
-          variant="ghost"
-          disabled={busy || pending !== null}
-          onClick={() => setReviewOnly(true)}
-        >
-          Independent review
-        </Button>
-      </div>
-      {message ? <Notice>{message}</Notice> : null}
-      {pending ? (
-        <Button
-          disabled={busy}
-          type="button"
-          onClick={() => void command(pending.kind)}
-        >
-          Retry
-        </Button>
-      ) : null}
+  if (!detail) return null;
+  if (reviewOnly) return <div className="mt-5 flex items-center gap-3"><span className="text-sm text-muted">Independent review</span><Button type="button" variant="ghost" onClick={() => setReviewOnly(false)}>Inspect</Button></div>;
+  return <div className="mt-5 grid gap-4">
+    {detail.candidate.rendition ? (
+      // eslint-disable-next-line @next/next/no-img-element
+      <img className="h-64 w-full rounded-card bg-surface-raised object-contain" alt={detail.altText || "Candidate"} src={`/api/account/media-contributions/submissions/${encodeURIComponent(detail.submissionId)}/file?version=${encodeURIComponent(detail.reviewVersion)}`} />
+    ) : <Notice>Unavailable</Notice>}
+    <dl className="grid gap-3 text-sm sm:grid-cols-2">
+      <div><dt className="text-muted">Destination</dt><dd>Media kit</dd></div>
+      <div><dt className="text-muted">Credit</dt><dd className="break-words">{detail.credit}</dd></div>
+      <div className="min-w-0 sm:col-span-2"><dt className="text-muted">Source</dt><dd className="break-words [overflow-wrap:anywhere]">{detail.sourceUrl ? <a href={detail.sourceUrl} rel="noreferrer" target="_blank" className="underline">{detail.sourceDescription || "Open source"}</a> : detail.sourceDescription}</dd></div>
+    </dl>
+    <div className="flex flex-wrap gap-2">
+      <Button type="button" variant="primary" disabled={!ready || busy || pending !== null} onClick={() => void command()}>Publish</Button>
+      <Button type="button" variant="ghost" disabled={!ready || busy || pending !== null} onClick={() => setReviewOnly(true)}>Independent review</Button>
     </div>
-  );
+    {message ? <Notice role="status">{message}</Notice> : null}
+    {pending ? <Button className="w-fit" type="button" disabled={busy} onClick={() => void command()}>Retry</Button> : null}
+  </div>;
 }
diff --git a/apps/web/src/app/account/media-contributions/published-contribution-card.tsx b/apps/web/src/app/account/media-contributions/published-contribution-card.tsx
new file mode 100644
index 00000000..b0cbe058
--- /dev/null
+++ b/apps/web/src/app/account/media-contributions/published-contribution-card.tsx
@@ -0,0 +1,111 @@
+"use client";
+import { useEffect, useState, type FormEvent } from "react";
+import { useMutation, useQuery } from "convex/react";
+import { api } from "@convex-generated-api";
+import type { Id } from "../../../../../../convex/_generated/dataModel";
+import { publishedContributionDetailSchema, contributionManageCommandSchema, contributionPlacementCommandSchema, contributionCommandBaseSchema, type PublishedContributionDetail, type CommandReceipt, type ContributionManageCommand, type ContributionPlacementCommand, type ContributionCommandBase } from "@vrdex/api-contracts";
+import { Button } from "@/components/ui/button";
+import { Field, Input, Textarea } from "@/components/ui/field";
+import { Notice } from "@/components/ui/notice";
+import { reviewDecisionMessage } from "../media-review/media-review-view";
+
+type Pending = { kind: "manage"; input: ContributionManageCommand } | { kind: "place"; input: ContributionPlacementCommand } | { kind: "propose"; input: ContributionCommandBase };
+export function PublishedContributionCard({ submissionId }: { submissionId: Id<"profileMediaSubmissions"> }) {
+  const detail = useQuery(api.profileMediaSubmissions.contributionDetail, { submissionId });
+  const manage = useMutation(api.profileMediaSubmissions.manageContribution);
+  const place = useMutation(api.profileMediaSubmissions.placeContribution);
+  const propose = useMutation(api.profileMediaSubmissions.proposePlacement);
+  return <PublishedContributionCardView submissionId={submissionId} detail={detail} manage={input => manage({ ...input, submissionId })} place={input => place({ ...input, submissionId })} propose={input => propose({ ...input, submissionId })} />;
+}
+export function PublishedContributionCardView({ submissionId, detail, manage, place, propose }: {
+  submissionId: string;
+  detail: PublishedContributionDetail | null | undefined;
+  manage: (input: ContributionManageCommand) => Promise<CommandReceipt>;
+  place: (input: ContributionPlacementCommand) => Promise<CommandReceipt>;
+  propose: (input: ContributionCommandBase) => Promise<CommandReceipt>;
+}) {
+  const storageKey = `vrdex:contribution:${submissionId}`;
+  const draftKey = `${storageKey}:draft`;
+  const [pending, setPending] = useState<Pending | null>(null);
+  const [busy, setBusy] = useState(false);
+  const [ready, setReady] = useState(false);
+  const [message, setMessage] = useState<string | null>(null);
+  const [editing, setEditing] = useState(false);
+  const [draft, setDraft] = useState<PublishedContributionDetail["metadata"] | null>(null);
+  const [removed, setRemoved] = useState(false);
+  useEffect(() => {
+    try {
+      const saved = JSON.parse(sessionStorage.getItem(storageKey) ?? "null") as Pending | null;
+      const parsed = saved?.kind === "manage" ? contributionManageCommandSchema.safeParse(saved.input) : saved?.kind === "place" ? contributionPlacementCommandSchema.safeParse(saved.input) : saved?.kind === "propose" ? contributionCommandBaseSchema.safeParse(saved.input) : null;
+      const savedDraft = publishedContributionDetailSchema.shape.metadata.safeParse(JSON.parse(sessionStorage.getItem(draftKey) ?? "null"));
+      queueMicrotask(() => {
+        if (parsed?.success && parsed.data.submissionId === submissionId) { setPending(saved); setMessage("Outcome unknown"); }
+        if (savedDraft.success) { setDraft(savedDraft.data); setEditing(true); }
+      });
+    } catch { /* Corrupt local state cannot authorize a command. */ }
+    queueMicrotask(() => setReady(true));
+  }, [storageKey, draftKey, submissionId]);
+  async function run(command: Pending) {
+    if (!ready || busy) return;
+    try { sessionStorage.setItem(storageKey, JSON.stringify(command)); } catch { setMessage("Submission failed"); return; }
+    setPending(command);
+    setBusy(true);
+    try {
+      const receipt = command.kind === "manage" ? await manage(command.input) : command.kind === "place" ? await place(command.input) : await propose(command.input);
+      setMessage(receipt.operationState === "committed" ? command.kind === "propose" ? "Submitted" : command.kind === "manage" ? command.input.action === "remove" ? "Removed" : "Saved" : command.input.action === "clear_primary" ? "Cleared" : "Selected" : reviewDecisionMessage(receipt).message);
+      if (receipt.operationState !== "in_progress") { sessionStorage.removeItem(storageKey); setPending(null); }
+      if (receipt.operationState === "committed" && command.kind === "manage") {
+        sessionStorage.removeItem(draftKey);
+        setDraft(null);
+        setEditing(false);
+        if (command.input.action === "remove") setRemoved(true);
+      }
+    } catch { setMessage("Outcome unknown"); }
+    finally { setBusy(false); }
+  }
+  function base() { return { submissionId, expectedContributionVersion: detail!.contributionVersion, idempotencyKey: crypto.randomUUID() }; }
+  function update(name: keyof PublishedContributionDetail["metadata"], value: string) {
+    const next = { ...(draft ?? detail!.metadata), [name]: value };
+    setDraft(next);
+    try { sessionStorage.setItem(draftKey, JSON.stringify(next)); } catch { setMessage("Submission failed"); }
+  }
+  function save(event: FormEvent) {
+    event.preventDefault();
+    if (!detail || !draft || pending || busy || !detail.canEditMetadata) return;
+    const metadata = Object.fromEntries(Object.entries(draft).map(([key, value]) => [key, value?.trim() || null]));
+    void run({ kind: "manage", input: { ...base(), action: "update_metadata", metadata } });
+  }
+  const locked = !ready || busy || pending !== null;
+  if (removed) return <Notice role="status">Removed</Notice>;
+  if (detail === undefined) return <p className="mt-5 text-sm text-muted" aria-busy="true">Loading…</p>;
+  if (!detail && !pending) return null;
+  return <div className="mt-5 grid gap-4">
+    {detail ? <>
+      {/* eslint-disable-next-line @next/next/no-img-element */}
+      <img className="h-64 w-full rounded-card bg-surface-raised object-contain" src={`/api/v0/profiles/${encodeURIComponent(detail.profileSlug)}/assets/${encodeURIComponent(detail.assetId)}/file`} alt={detail.metadata.altText || detail.metadata.label} />
+      <h3 className="font-medium">{detail.metadata.label}</h3>
+      <p className="break-words text-sm">{detail.metadata.credit}</p>
+      {detail.metadata.sourceUrl ? <a className="w-fit break-words text-sm underline [overflow-wrap:anywhere]" href={detail.metadata.sourceUrl} target="_blank" rel="noreferrer">{detail.metadata.sourceDescription || "Open source"}</a> : <p className="break-words text-sm text-muted [overflow-wrap:anywhere]">{detail.metadata.sourceDescription}</p>}
+      <div className="flex flex-wrap gap-2">
+        {detail.canSelectPrimary ? <Button type="button" disabled={locked} onClick={() => void run({ kind: "place", input: { ...base(), action: "select_primary" } })}>Select picture</Button> : null}
+        {detail.canClearPrimary ? <Button type="button" variant="ghost" disabled={locked} onClick={() => void run({ kind: "place", input: { ...base(), action: "clear_primary" } })}>Clear picture</Button> : null}
+        {detail.canProposePlacement ? <Button type="button" variant="ghost" disabled={locked} onClick={() => void run({ kind: "propose", input: base() })}>Request replacement</Button> : null}
+        {detail.canEditMetadata ? <Button type="button" variant="ghost" disabled={locked} onClick={() => { setDraft(draft ?? detail.metadata); setEditing(true); }}>Edit metadata</Button> : null}
+        {detail.canRemove ? <Button type="button" variant="dangerGhost" disabled={locked} onClick={() => void run({ kind: "manage", input: { ...base(), action: "remove" } })}>Remove</Button> : null}
+      </div>
+      {editing && draft ? <form className="grid gap-4" onSubmit={save}>
+        <fieldset disabled={locked} className="grid gap-4 sm:grid-cols-2">
+          <Field>Title<Input required maxLength={80} value={draft.label} onChange={e => update("label", e.target.value)} /></Field>
+          <Field>Credit<Input required maxLength={120} value={draft.credit} onChange={e => update("credit", e.target.value)} /></Field>
+          <Field>Credit URL<Input type="url" maxLength={4096} value={draft.creditUrl ?? ""} onChange={e => update("creditUrl", e.target.value)} /></Field>
+          <Field>Source URL<Input type="url" maxLength={4096} value={draft.sourceUrl ?? ""} onChange={e => update("sourceUrl", e.target.value)} /></Field>
+          <Field>Alt text<Input maxLength={180} value={draft.altText ?? ""} onChange={e => update("altText", e.target.value)} /></Field>
+          <Field>Source description<Textarea maxLength={1000} rows={3} value={draft.sourceDescription ?? ""} onChange={e => update("sourceDescription", e.target.value)} /></Field>
+        </fieldset>
+        <div className="flex gap-2"><Button type="submit" disabled={locked || !detail.canEditMetadata}>Save</Button><Button type="button" variant="ghost" disabled={locked} onClick={() => { setEditing(false); setDraft(null); sessionStorage.removeItem(draftKey); }}>Cancel</Button></div>
+      </form> : null}
+    </> : null}
+    {message ? <Notice role="status">{message}</Notice> : null}
+    {pending ? <Button className="w-fit" type="button" disabled={busy} onClick={() => void run(pending)}>Retry</Button> : null}
+  </div>;
+}
diff --git a/apps/web/src/app/account/media-review/media-review-panel.tsx b/apps/web/src/app/account/media-review/media-review-panel.tsx
index 6b605a60..b8f47c23 100644
--- a/apps/web/src/app/account/media-review/media-review-panel.tsx
+++ b/apps/web/src/app/account/media-review/media-review-panel.tsx
@@ -208,7 +208,9 @@ export function ReviewCardView({
             <p className="text-xl font-semibold">{row.profileDisplayName}</p>
           )}
           <p className="mt-1 text-sm text-muted">
-            {row.requestedPlacement === "profile_image"
+            {row.requestKind !== "identity_placement"
+              ? "Media kit"
+              : row.requestedPlacement === "profile_image"
               ? "Profile image"
               : "Primary logo"}
           </p>
@@ -235,7 +237,7 @@ export function ReviewCardView({
       ) : null}
       {detail ? (
         <div className="mt-5">
-          <MediaReviewComparison
+          {detail.requestKind === "identity_placement" ? <MediaReviewComparison
             candidateAlt={
               row.altText || `Candidate for ${row.profileDisplayName}`
             }
@@ -246,7 +248,10 @@ export function ReviewCardView({
             }
             currentAlt={`Current image for ${row.profileDisplayName}`}
             currentSrc={reviewPlacementImage(detail)}
-          />
+          /> : detail.candidate.rendition ? (
+            // eslint-disable-next-line @next/next/no-img-element
+            <img className="h-64 w-full rounded-card bg-surface-raised object-contain" alt={row.altText || "Candidate"} src={`/api/account/media-review/submissions/${row.submissionId}/file`} />
+          ) : <Notice>Unavailable</Notice>}
         </div>
       ) : null}
       <dl className="mt-5 grid gap-3 text-sm sm:grid-cols-2">
diff --git a/apps/web/src/app/account/media-review/media-review-view.ts b/apps/web/src/app/account/media-review/media-review-view.ts
index d889fc5a..6dacdbe9 100644
--- a/apps/web/src/app/account/media-review/media-review-view.ts
+++ b/apps/web/src/app/account/media-review/media-review-view.ts
@@ -4,6 +4,8 @@ const conflictCodes = new Set([
   "target_changed",
   "review_changed",
   "placement_changed",
+  "contribution_changed",
+  "selection_changed",
   "target_unavailable",
 ]);
 
@@ -23,7 +25,9 @@ export function reviewDecisionMessage(
   if (
     receipt.code === "target_changed" ||
     receipt.code === "review_changed" ||
-    receipt.code === "placement_changed"
+    receipt.code === "placement_changed" ||
+    receipt.code === "contribution_changed" ||
+    receipt.code === "selection_changed"
   ) {
     return {
       message:
diff --git a/apps/web/src/app/api/e2e/media/route.ts b/apps/web/src/app/api/e2e/media/route.ts
index c4059cc6..ebe94ee6 100644
--- a/apps/web/src/app/api/e2e/media/route.ts
+++ b/apps/web/src/app/api/e2e/media/route.ts
@@ -165,6 +165,9 @@ async function execute(request: NextRequest, cleanup: boolean) {
         throw new Error("Cleanup worker did not reclaim the exact pending upload.");
       return NextResponse.json({ workerReclaimedUpload: true });
     }
+    if (body.op === "grant-publication-actors") {
+      return NextResponse.json(await client.mutation(internal.e2eMedia.grantPublicationActors, args));
+    }
     if (
       body.op === "assign-review-owner" &&
       typeof body.reviewerEmail === "string"
diff --git a/apps/web/src/components/media-review-assigned.stories.tsx b/apps/web/src/components/media-review-assigned.stories.tsx
index 7c304aa3..368154a9 100644
--- a/apps/web/src/components/media-review-assigned.stories.tsx
+++ b/apps/web/src/components/media-review-assigned.stories.tsx
@@ -42,12 +42,13 @@ const row: Props["row"] = {
   publicDisposition: undefined,
   approvedAssetId: undefined,
 };
-function Fixture() {
+function Fixture({ replacement = false }: { replacement?: boolean } = {}) {
   const [selected, setSelected] = useState<ReviewDecision[]>([]);
   const [receipts, setReceipts] = useState<CommandReceipt[]>([]);
   const [revision, setRevision] = useState(1);
   const detail: Props["detail"] = {
     ...row,
+    requestKind: replacement ? "identity_placement" : "kit_asset",
     reviewVersion: String(revision),
     currentProfileUpdatedAt: 2,
     targetProfileUpdatedAt: revision,
@@ -82,7 +83,7 @@ function Fixture() {
         }
       />
       <ReviewCardView
-        row={row}
+        row={{ ...row, requestKind: replacement ? "identity_placement" : "kit_asset" }}
         detail={detail}
         selected={selected[0]}
         select={(input) => {
@@ -273,3 +274,5 @@ function OwnInventoryFixture() {
   );
 }
 export const OwnInventory: Story = { render: () => <OwnInventoryFixture /> };
+
+export const PublishedReplacement: Story = { render: () => <Fixture replacement /> };
diff --git a/apps/web/src/components/media-review-comparison.stories.tsx b/apps/web/src/components/media-review-comparison.stories.tsx
index 2f9a693e..f8887728 100644
--- a/apps/web/src/components/media-review-comparison.stories.tsx
+++ b/apps/web/src/components/media-review-comparison.stories.tsx
@@ -22,3 +22,5 @@ const meta = {
 export default meta;
 type Story = StoryObj<typeof meta>;
 export const Comparison: Story = {};
+
+export const PublishedCandidate: Story = { args: { candidateAlt: "Published candidate", currentAlt: "Current picture" } };
diff --git a/apps/web/src/components/trusted-publication.stories.tsx b/apps/web/src/components/trusted-publication.stories.tsx
index a808827c..b61254fe 100644
--- a/apps/web/src/components/trusted-publication.stories.tsx
+++ b/apps/web/src/components/trusted-publication.stories.tsx
@@ -1,6 +1,7 @@
 import { useState } from "react";
 import type { Meta, StoryObj } from "@storybook/nextjs-vite";
-import type { ReviewDetail } from "@vrdex/api-contracts";
+import type { ReviewDetail, PublishedContributionDetail } from "@vrdex/api-contracts";
+import { PublishedContributionCardView } from "../app/account/media-contributions/published-contribution-card";
 import { PublicationCardView } from "../app/account/media-contributions/publication-card";
 import { MediaContributionsPanel } from "../app/account/media-contributions/media-contributions-panel";
 import { ConvexProvider, ConvexReactClient } from "convex/react";
@@ -12,7 +13,7 @@ const fixture: ReviewDetail = {
   profileDisplayName: "Fixture photographer",
   profileIsPublic: true,
   profileType: "person",
-  requestedPlacement: "profile_image",
+  requestedPlacement: "gallery",
   status: "submitted",
   sourceKind: "local",
   sourceDescription: "Local image supplied by the photographer.",
@@ -38,27 +39,20 @@ const fixture: ReviewDetail = {
 };
 function Fixture({ loseResponse = false }: { loseResponse?: boolean }) {
   const [lost, setLost] = useState(false);
-  const [version, setVersion] = useState("v1");
+
   const [calls, setCalls] = useState<string[]>([]);
   return (
     <main className="mx-auto max-w-4xl p-4">
       <h1 className="text-xl font-semibold">Fixture photographer</h1>
       <PublicationCardView
-        detail={{ ...fixture, reviewVersion: version }}
-        declare={async (input) => {
-          setCalls((previous) => [
-            ...previous,
-            JSON.stringify({ command: "declare", ...input }),
-          ]);
-          setVersion("v2");
-          return { operationId: "declare", operationState: "committed" };
-        }}
+        detail={fixture}
         publish={async (input) => {
           setCalls((previous) => [
             ...previous,
             JSON.stringify({ command: "publish", ...input }),
           ]);
-          if (loseResponse && !lost) {
+          if (loseResponse && !lost && !sessionStorage.getItem("fixture:lost")) {
+            sessionStorage.setItem("fixture:lost", "true");
             setLost(true);
             throw new Error("Lost committed response");
           }
@@ -115,6 +109,7 @@ function ReactiveInventoryFixture() {
             publicationMethod: approved ? "trusted_publisher" : undefined,
           };
           if (name.endsWith(":publisherDetail")) return row;
+          if (name.endsWith(":contributionDetail")) return null;
           return { page: [row], isDone: true, continueCursor: "" };
         },
       }),
@@ -150,3 +145,59 @@ function ReactiveInventoryFixture() {
 export const ReactiveInventory: Story = {
   render: () => <ReactiveInventoryFixture />,
 };
+const publishedFixture: PublishedContributionDetail = {
+  submissionId: "published-fixture", assetId: "fixture-asset", profileId: "profile", profileSlug: "fixture",
+  contributionVersion: "c1", metadata: { label: "Photographer portrait", credit: "Fixture photographer", sourceDescription: "Local image supplied by the photographer. ".repeat(8) },
+  canSelectPrimary: true, canClearPrimary: false, canProposePlacement: false, canEditMetadata: true, canRemove: true,
+};
+function PublishedFixture({ protectedSelection = false, loseResponse = false }: { protectedSelection?: boolean; loseResponse?: boolean }) {
+  const [detail, setDetail] = useState<PublishedContributionDetail>(() => ({ ...publishedFixture, ...(protectedSelection ? { canSelectPrimary: false, canClearPrimary: false, canProposePlacement: true, canEditMetadata: false, canRemove: false } : {}) }));
+  const [calls, setCalls] = useState<unknown[]>([]);
+  const [conflicted, setConflicted] = useState(false);
+  return <main className="mx-auto max-w-4xl p-4"><h1 className="text-xl font-semibold">Fixture photographer</h1>
+    <PublishedContributionCardView submissionId={detail.submissionId} detail={detail}
+      place={async input => {
+        setCalls(previous => [...previous, { kind: "place", input }]);
+        const selected = input.action === "select_primary";
+        setDetail(previous => ({ ...previous, contributionVersion: selected ? "c2" : "c3", canSelectPrimary: !selected, canClearPrimary: selected, canEditMetadata: !selected, canRemove: !selected }));
+        return { operationId: "placement", operationState: "committed" };
+      }}
+      propose={async input => { setCalls(previous => [...previous, { kind: "propose", input }]); return { operationId: "proposed", operationState: "committed" }; }}
+      manage={async input => {
+        setCalls(previous => [...previous, { kind: "manage", input }]);
+        if (loseResponse && !sessionStorage.getItem("fixture:published-lost")) {
+          sessionStorage.setItem("fixture:published-lost", "true");
+          setDetail(previous => ({ ...previous, contributionVersion: "committed-version" }));
+          throw new Error("Lost committed response");
+        }
+        if (!loseResponse && input.action === "update_metadata" && !conflicted) {
+          setConflicted(true);
+          setDetail(previous => ({ ...previous, contributionVersion: "conflict-version" }));
+          return { operationId: "stale", operationState: "refused", code: "contribution_changed" };
+        }
+        if (input.action === "update_metadata") setDetail(previous => ({ ...previous, metadata: { ...previous.metadata, ...Object.fromEntries(Object.entries(input.metadata).filter(([, value]) => value !== null)) }, contributionVersion: "c4" }));
+        return { operationId: "managed", operationState: "committed" };
+      }} />
+    <output className="sr-only" data-testid="published-commands">{JSON.stringify(calls)}</output>
+  </main>;
+}
+export const Published: Story = { render: () => <PublishedFixture /> };
+export const Protected: Story = { render: () => <PublishedFixture protectedSelection /> };
+export const PublishedUncertain: Story = { render: () => <PublishedFixture loseResponse /> };
+function RemovedUncertainFixture() {
+  const [detail, setDetail] = useState<PublishedContributionDetail | null>(() => sessionStorage.getItem("fixture:removed") ? null : publishedFixture);
+  const [calls, setCalls] = useState<unknown[]>([]);
+  return <main className="mx-auto max-w-4xl p-4"><PublishedContributionCardView submissionId={publishedFixture.submissionId} detail={detail}
+    place={async () => ({ operationId: "unused", operationState: "refused" })}
+    propose={async () => ({ operationId: "unused", operationState: "refused" })}
+    manage={async input => {
+      setCalls(previous => [...previous, input]);
+      if (!sessionStorage.getItem("fixture:removed")) {
+        sessionStorage.setItem("fixture:removed", "true");
+        setDetail(null);
+        throw new Error("Removal committed, response lost");
+      }
+      return { operationId: "removed", operationState: "committed" };
+    }} /><output className="sr-only" data-testid="removal-commands">{JSON.stringify(calls)}</output></main>;
+}
+export const RemovedUncertain: Story = { render: () => <RemovedUncertainFixture /> };
diff --git a/convex/_mediaContributionCommands.ts b/convex/_mediaContributionCommands.ts
index f71d8492..58e97490 100644
--- a/convex/_mediaContributionCommands.ts
+++ b/convex/_mediaContributionCommands.ts
@@ -65,6 +65,7 @@ export async function publishedContributionDetail(ctx: QueryCtx | MutationCtx, s
       creditUrl: metadata.creditUrl, sourceUrl: metadata.sourceUrl, sourceDescription: metadata.sourceDescription },
     canSelectPrimary: s.publisher && !s.identityPlacements.length && !s.snapshot.currentImage,
     canClearPrimary: s.publisher && s.ownSelection,
+    canProposePlacement: s.publicUnclaimed && !s.restrictions.some(Boolean) && !s.ownSelection && !!(s.identityPlacements.length || s.snapshot.currentImage),
     canEditMetadata: s.ownKitOnly, canRemove: s.ownKitOnly && s.submission.legalHoldAt === undefined,
   };
 }
diff --git a/convex/e2eMedia.ts b/convex/e2eMedia.ts
index eb62298a..66c5f6b5 100644
--- a/convex/e2eMedia.ts
+++ b/convex/e2eMedia.ts
@@ -251,6 +251,51 @@ export const inspectPendingFixtureCleanup = internalQuery({
   },
 });
 
+export const grantPublicationActors = internalMutation({
+  args: fixtureArgs,
+  handler: async (ctx, args) => {
+    const profile = await fixture(ctx, args);
+    if (profile.claimState !== "unclaimed" || profile.publicationState !== "published")
+      throw new Error("Unclaimed fixture required.");
+    const now = Date.now();
+    const actors: Id<"users">[] = [];
+    for (const [suffix, feature] of [["contributor", "trusted_publisher"], ["reviewer", "media_reviewer"]] as const) {
+      const user = await ctx.db.query("users").withIndex("email", q => q.eq("email", `${args.runId}-${suffix}+clerk_test@e2e.vrdex.net`)).unique();
+      if (!user?.clerkUserId || user.emailVerificationTime === undefined) throw new Error("Verified fixture actor required.");
+      actors.push(user._id);
+      const previous = await ctx.db.query("accountFeatureGrants").withIndex("by_userId_feature_state", q => q.eq("userId", user._id).eq("feature", feature).eq("state", "active")).take(3);
+      if (previous.length > 1 || previous.some(row => row.grantedBy.tokenIdentifier !== `e2e:${args.runId}`)) throw new Error("Unscoped fixture grant.");
+      if (!previous.length) await ctx.db.insert("accountFeatureGrants", {
+        userId: user._id, feature, state: "active", grantedAt: now, updatedAt: now, expiresAt: now + 60 * 60_000,
+        grantedBy: { tokenIdentifier: `e2e:${args.runId}`, issuer: "vrdex:e2e", subject: args.runId },
+      });
+    }
+    const [contributorId, reviewerId] = actors;
+    let batch = await ctx.db.query("contributionBatches").withIndex("by_actor_key", q => q.eq("actorUserId", contributorId!).eq("idempotencyKey", `e2e:${args.runId}`)).unique();
+    const batchId = batch?._id ?? await ctx.db.insert("contributionBatches", { actorUserId: contributorId!, idempotencyKey: `e2e:${args.runId}`, label: args.runId, archived: false, rowCount: 0, createdAt: now });
+    batch ??= await ctx.db.get(batchId);
+    if (!batch || batch.archived || batch.rowCount > 20) throw new Error("Invalid fixture collection.");
+    const assignment = await ctx.db.query("contributionBatchReviewers").withIndex("by_batch_reviewer", q => q.eq("batchId", batchId).eq("reviewerUserId", reviewerId!)).unique();
+    if (!assignment) await ctx.db.insert("contributionBatchReviewers", { batchId, reviewerUserId: reviewerId!, active: true, expiresAt: now + 60 * 60_000 });
+    let rowCount = batch.rowCount;
+    for (const submission of (await rows(ctx, profile._id)).submissions) {
+      if (submission.submitterUserId !== contributorId) throw new Error("Unscoped fixture contribution.");
+      const attempt = await ctx.db.query("contributionItemAttempts").withIndex("by_submissionId", q => q.eq("submissionId", submission._id)).unique();
+      if (attempt) {
+        const revision = await ctx.db.get(attempt.revisionId);
+        if (revision?.batchId !== batchId || attempt.actorUserId !== contributorId) throw new Error("Unscoped fixture attempt.");
+        continue;
+      }
+      const payload = JSON.stringify({ kind: "media" });
+      const revisionId = await ctx.db.insert("contributionItemRevisions", { actorUserId: contributorId!, batchId, itemKey: submission._id, revision: 1, payload, bytes: payload.length, createdAt: now });
+      await ctx.db.insert("contributionItemAttempts", { actorUserId: contributorId!, revisionId, oauthClientId: `e2e:${args.runId}`, submissionId: submission._id, receipt: { operationId: submission._id, operationState: "committed" }, createdAt: now });
+      rowCount++;
+    }
+    await ctx.db.patch(batchId, { rowCount });
+    return { granted: true, batchId };
+  },
+});
+
 export const assignReviewOwner = internalMutation({
   args: { ...fixtureArgs, reviewerEmail: v.string() },
   handler: async (ctx, args) => {
@@ -274,7 +319,7 @@ export const assignReviewOwner = internalMutation({
       throw new Error("Unclaimed fixture required.");
     if (
       !submissions.some(
-        (s) => s.status === "submitted" && s.submitterUserId !== user._id,
+        (s) => ["submitted", "approved"].includes(s.status) && s.submitterUserId !== user._id,
       )
     )
       throw new Error("A different contributor must submit first.");
@@ -480,6 +525,21 @@ async function cleanupRows(
     .withIndex("email", (q) => q.eq("email", `${args.runId}-reviewer+clerk_test@e2e.vrdex.net`))
     .unique();
   const disposableActors = new Set([contributor?._id, reviewer?._id]);
+  const featureGrants = (await Promise.all([...disposableActors].filter((id): id is Id<"users"> => id !== undefined).map(async userId =>
+    (await Promise.all((["trusted_publisher", "media_reviewer"] as const).flatMap(feature => (["active", "revoked"] as const).map(state =>
+      ctx.db.query("accountFeatureGrants").withIndex("by_userId_feature_state", q => q.eq("userId", userId).eq("feature", feature).eq("state", state)).take(3))))).flat(),
+  ))).flat();
+  if (featureGrants.length > 2 || featureGrants.some(row => row.grantedBy.tokenIdentifier !== `e2e:${args.runId}`))
+    throw new Error("Unscoped media fixture feature grant.");
+  const batch = contributor ? await ctx.db.query("contributionBatches").withIndex("by_actor_key", q => q.eq("actorUserId", contributor._id).eq("idempotencyKey", `e2e:${args.runId}`)).unique() : null;
+  const revisions = batch ? await ctx.db.query("contributionItemRevisions").withIndex("by_batch_key_revision", q => q.eq("batchId", batch._id)).take(21) : [];
+  const assignments = batch ? await ctx.db.query("contributionBatchReviewers").withIndex("by_batch_reviewer", q => q.eq("batchId", batch._id)).take(3) : [];
+  const attempts = (await Promise.all(revisions.map(revision => ctx.db.query("contributionItemAttempts").withIndex("by_revision", q => q.eq("revisionId", revision._id)).take(2)))).flat();
+  if (revisions.length > 20 || attempts.length !== revisions.length || assignments.length > 1 ||
+    assignments.some(row => row.reviewerUserId !== reviewer?._id) ||
+    revisions.some(row => row.actorUserId !== contributor?._id || row.legalHoldAt !== undefined) ||
+    attempts.some(row => row.actorUserId !== contributor?._id || row.oauthClientId !== `e2e:${args.runId}` || !data.submissions.some(submission => submission._id === row.submissionId)))
+    throw new Error("Unscoped media fixture assignment.");
   const reviewRows = await Promise.all(data.submissions.map(async (submission) => {
     const [rebases, reviewReceipts, publicationEvidence] = await Promise.all([
       ctx.db.query("mediaReviewRebases")
@@ -515,7 +575,8 @@ async function cleanupRows(
   if (refusalReceipts.length > 20)
     throw new Error("Media fixture receipt bound exceeded.");
   return {
-    profile, ...data, refusalReceipts, publicationRestrictions,
+    profile, ...data, refusalReceipts, publicationRestrictions, featureGrants,
+    batchRows: [...attempts, ...revisions, ...assignments, ...(batch ? [batch] : [])],
     reviewRebases: reviewRows.flatMap((row) => row.rebases),
     reviewReceipts: reviewRows.flatMap((row) => row.reviewReceipts),
     publicationEvidence: reviewRows.flatMap((row) => row.publicationEvidence),
@@ -620,6 +681,8 @@ export const finishCleanup = internalMutation({
       ...data.submissions,
       ...data.intents,
       ...data.refusalReceipts,
+      ...data.featureGrants,
+      ...data.batchRows,
     ])
       await ctx.db.delete(row._id);
     return { slug: data.profile.slug, deletedMedia: true, releasedReservations: data.reservations.length };
diff --git a/convex/profileMediaSubmissions.ts b/convex/profileMediaSubmissions.ts
index ea95ac10..32344563 100644
--- a/convex/profileMediaSubmissions.ts
+++ b/convex/profileMediaSubmissions.ts
@@ -55,8 +55,13 @@ const contributionMetadataPatch = v.object({ label: nullableText, altText: nulla
   creditUrl: nullableText, sourceUrl: nullableText, sourceDescription: nullableText });
 const manageCommandArgs = { ...contributionCommandArgs, action: v.union(v.literal("update_metadata"), v.literal("remove")),
   metadata: v.optional(contributionMetadataPatch) };
-export const contributionDetail = query({ args: { submissionId }, handler: async (ctx, args) =>
-  publishedContributionDetail(ctx, args.submissionId, await browserReviewActor(ctx)) });
+export const contributionDetail = query({ args: { submissionId }, handler: async (ctx, args) => {
+  try { return await publishedContributionDetail(ctx, args.submissionId, await browserReviewActor(ctx)); }
+  catch (error) {
+    if (error instanceof ConvexError && typeof error.data === "object" && error.data?.code === "MEDIA_RESOURCE_UNAVAILABLE") return null;
+    throw error;
+  }
+} });
 export const contributionDetailForMcpActor = internalQuery({
   args: { submissionId, actorUserId: v.id("users"), ...reviewActorAttestationArgs },
   handler: async (ctx, args) => publishedContributionDetail(ctx, args.submissionId,
diff --git a/docs/testing/mcp-media-staging-lifecycle.md b/docs/testing/mcp-media-staging-lifecycle.md
index d5b34b80..c05291a5 100644
--- a/docs/testing/mcp-media-staging-lifecycle.md
+++ b/docs/testing/mcp-media-staging-lifecycle.md
@@ -246,3 +246,11 @@ the import or clear the token merely to make cleanup pass.
 Production contribution approval and the first legitimate public target remain
 separate operator decisions. See
 [the hosted MCP rollout gate](../developers/hosted-mcp-oauth-writes.md#contribution-rollout-gate).
+
+## Media-kit publication candidate
+
+The media-kit publication candidate extends this same opt-in fixture. Contributor A receives a run-scoped, expiring trusted-publisher grant. Reviewer B receives an expiring media-reviewer grant and an active assignment to the run collection. They remain separate accounts. The guarded fixture attaches each synthetic submission to one revision and attempt, including a replacement proposal with no upload intent. It does not grant site-admin authority.
+
+The third image is a generated 64 by 48 PNG, distinct from both static source images. Assertions cover website publication without declarations, unchanged primary picture, selection and undo, metadata correction, ordinary review publication into the kit, explicit review comparison against a published candidate, protected removal refusal, and logical removal of an unused kit item. Removal keeps stored bytes and accounting until fixture teardown. The existing owner-claim refusal remains a separate final check.
+
+Teardown bounds and validates feature grants, batch revisions, attempts, assignments, media rows and receipts against the exact run actors before deleting them. Local Storybook and static Next screenshots prove UI fixture behavior only. Acceptance still requires the exact candidate deployed together to designated staging and an executed authenticated lifecycle with verified cleanup.
diff --git a/packages/api-contracts/src/media-review.ts b/packages/api-contracts/src/media-review.ts
index 08dfd99a..9243b03d 100644
--- a/packages/api-contracts/src/media-review.ts
+++ b/packages/api-contracts/src/media-review.ts
@@ -34,7 +34,7 @@ export const publishedContributionDetailSchema = z.strictObject({
     credit: z.string().max(120), creditUrl: z.string().max(4096).optional(),
     sourceUrl: z.string().max(4096).optional(), sourceDescription: z.string().max(1000).optional(),
   }),
-  canSelectPrimary: z.boolean(), canClearPrimary: z.boolean(),
+  canSelectPrimary: z.boolean(), canClearPrimary: z.boolean(), canProposePlacement: z.boolean(),
   canEditMetadata: z.boolean(), canRemove: z.boolean(),
 });
 export type PublishedContributionDetail = z.infer<typeof publishedContributionDetailSchema>;
diff --git a/packages/api-contracts/tests/media-review.test.ts b/packages/api-contracts/tests/media-review.test.ts
index 15dff9be..adaf7117 100644
--- a/packages/api-contracts/tests/media-review.test.ts
+++ b/packages/api-contracts/tests/media-review.test.ts
@@ -33,7 +33,7 @@ it("bounds contribution commands and refuses caller-selected capabilities", () =
   assert.equal(publishedContributionDetailSchema.safeParse({
     submissionId: "submission", assetId: "asset", profileId: "profile", profileSlug: "dj",
     contributionVersion: "version", metadata: { label: "Image", credit: "Artist" },
-    canSelectPrimary: true, canClearPrimary: false, canEditMetadata: true, canRemove: true,
+    canSelectPrimary: true, canClearPrimary: false, canProposePlacement: false, canEditMetadata: true, canRemove: true,
   }).success, true);
 });
 import {
diff --git a/scripts/smoke-vrdex-mcp-compat.ts b/scripts/smoke-vrdex-mcp-compat.ts
index 0ee509b4..ccdf35d6 100644
--- a/scripts/smoke-vrdex-mcp-compat.ts
+++ b/scripts/smoke-vrdex-mcp-compat.ts
@@ -201,7 +201,7 @@ export function assertHostedContributionSchemas(tool: HostedToolDescriptor) {
     assert.equal(variants.length, 2, `${name} management actions changed.`);
     for (const variant of variants) assert.ok(variant?.required?.includes("action"), `${name} action is required.`);
   }
-  const outputFields = name === "vrdex_media_contribution_get" ? ["submissionId", "assetId", "contributionVersion", "metadata", "canSelectPrimary", "canClearPrimary", "canEditMetadata", "canRemove"] : ["operationId", "operationState"];
+  const outputFields = name === "vrdex_media_contribution_get" ? ["submissionId", "assetId", "contributionVersion", "metadata", "canSelectPrimary", "canClearPrimary", "canProposePlacement", "canEditMetadata", "canRemove"] : ["operationId", "operationState"];
   for (const field of outputFields) assert.ok(output?.required?.includes(field), `${name} ${name.endsWith("_get") ? "detail" : "receipt"} lacks ${field}.`);
 }
 
diff --git a/tests/backend/e2e-media.test.ts b/tests/backend/e2e-media.test.ts
index 9cd0f235..0841bc5f 100644
--- a/tests/backend/e2e-media.test.ts
+++ b/tests/backend/e2e-media.test.ts
@@ -743,3 +743,40 @@ describe("bounded staging media fixture", () => {
     assert.equal(proposal?.blobDeleteAfter, undefined);
   });
 });
+
+it("grants only run-linked publisher and assigned reviewer actors and cleans all fixture assignment records", async () => {
+  const { t, args, users, intent } = await seed();
+  const result = await t.mutation(internal.e2eMedia.grantPublicationActors, args);
+  assert.equal(result.granted, true);
+  assert.deepEqual(await t.mutation(internal.e2eMedia.grantPublicationActors, args), result);
+  const records = await t.run(async ctx => ({ grants: await ctx.db.query("accountFeatureGrants").collect(), attempts: await ctx.db.query("contributionItemAttempts").collect(), assignments: await ctx.db.query("contributionBatchReviewers").collect() }));
+  assert.deepEqual(records.grants.map(row => [row.userId, row.feature]), [[users.contributorId, "trusted_publisher"], [users.reviewerId, "media_reviewer"]]);
+  assert.equal(records.attempts.length, 1);
+  assert.equal(records.attempts[0].submissionId, intent.submissionId);
+  assert.equal(records.assignments[0].reviewerUserId, users.reviewerId);
+  await t.run(ctx => ctx.db.patch(intent.submissionId, { status: "submitted" }));
+  const reviewer = (await t.run(ctx => ctx.db.get(users.reviewerId)))!;
+  const reviewerActor = t.withIdentity({ subject: reviewer.clerkUserId!, issuer: "test", tokenIdentifier: `test|${reviewer.clerkUserId}`, email: reviewer.email!, emailVerified: true });
+  assert.equal((await reviewerActor.query(api.profileMediaSubmissions.reviewDetail, { submissionId: intent.submissionId }))?.submissionId, intent.submissionId);
+  await assert.rejects(t.withIdentity(users.identity).query(api.profileMediaSubmissions.reviewDetail, { submissionId: intent.submissionId }), /MEDIA_REVIEW_ACCESS_REQUIRED/);
+  const replacement = await t.run(async ctx => {
+    const original = (await ctx.db.get(intent.submissionId))!;
+    const { _id, _creationTime, uploadIntentId, ...fields } = original;
+    return ctx.db.insert("profileMediaSubmissions", { ...fields, requestKind: "identity_placement" });
+  });
+  await t.mutation(internal.e2eMedia.grantPublicationActors, args);
+  const noUpload = await t.run(ctx => ctx.db.query("contributionItemAttempts").withIndex("by_submissionId", q => q.eq("submissionId", replacement)).unique());
+  assert.equal(noUpload?.intentId, undefined);
+  const prepared = await t.mutation(internal.e2eMedia.prepareCleanup, args);
+  await t.mutation(internal.e2eMedia.finishCleanup, { ...args, deletedStorageKeys: prepared.storageKeys });
+  assert.deepEqual(await t.run(async ctx => [await ctx.db.query("accountFeatureGrants").collect(), await ctx.db.query("contributionBatches").collect(), await ctx.db.query("contributionItemRevisions").collect(), await ctx.db.query("contributionItemAttempts").collect(), await ctx.db.query("contributionBatchReviewers").collect()]), [[], [], [], [], []]);
+});
+
+it("rejects publication fixture actor grants on production and foreign account grants", async () => {
+  const { t, args, users } = await seed();
+  await t.run(ctx => ctx.db.insert("accountFeatureGrants", { userId: users.contributorId, feature: "trusted_publisher", state: "active", grantedAt: Date.now(), updatedAt: Date.now(), grantedBy: { issuer: "test", subject: "foreign", tokenIdentifier: "foreign" } }));
+  await assert.rejects(t.mutation(internal.e2eMedia.grantPublicationActors, args), /Unscoped fixture grant/);
+  process.env.CONVEX_CLOUD_URL = "https://production.convex.cloud";
+  await assert.rejects(t.mutation(internal.e2eMedia.grantPublicationActors, args), /Staging media fixture is unavailable/);
+  enable();
+});
diff --git a/tests/backend/media-contribution-commands.test.ts b/tests/backend/media-contribution-commands.test.ts
index 2250fcf4..8a3f519b 100644
--- a/tests/backend/media-contribution-commands.test.ts
+++ b/tests/backend/media-contribution-commands.test.ts
@@ -230,7 +230,7 @@ for (const condition of ["legacy", "revoked", "claimed", "private", "other_contr
       if (condition === "private") await ctx.db.patch(f.s.profileId, { publicSurfacingState: "opted_out" });
       if (condition === "other_contributor") await ctx.db.patch(f.intent.submissionId, { submitterUserId: f.s.moderatorUserId });
     });
-    if (condition === "other_contributor") await assert.rejects(f.detail(), /unavailable/i);
+    if (condition === "other_contributor") assert.equal(await f.detail(), null);
     else {
       assert.equal((await f.detail()).canSelectPrimary, false);
       assert.equal((await f.place("select_primary")).operationState, "refused");
@@ -432,3 +432,35 @@ it("does not interpret a rejected placement as a digest-wide content rejection",
   assert.ok(pending);
   assert.equal((await actor.mutation(api.profileMediaSubmissions.publish, { submissionId: intent.submissionId, expectedReviewVersion: pending.reviewVersion, idempotencyKey: "another-publication" })).operationState, "committed");
 });
+
+it("projects replacement capability for an ordinary contributor only on eligible occupied targets", async () => {
+  const f = await fixture();
+  await f.t.run(ctx => ctx.db.patch(f.grant, { state: "revoked" }));
+  assert.equal((await f.detail()).canProposePlacement, false);
+  await f.t.run(ctx => ctx.db.patch(f.s.profileId, { avatarImageUrl: "https://example.test/current.png" }));
+  assert.equal((await f.detail()).canSelectPrimary, false);
+  assert.equal((await f.detail()).canProposePlacement, true);
+  await f.t.run(ctx => ctx.db.patch(f.s.profileId, { claimState: "claimed_verified" }));
+  assert.equal((await f.detail()).canProposePlacement, false);
+  await f.t.run(ctx => ctx.db.patch(f.s.profileId, { claimState: "unclaimed", publicSurfacingState: "opted_out" }));
+  assert.equal((await f.detail()).canProposePlacement, false);
+  await f.t.run(async ctx => {
+    await ctx.db.patch(f.s.profileId, { publicSurfacingState: "public" });
+    await ctx.db.insert("mediaPublicationRestrictions", { profileId: f.s.profileId, kind: "identity", submissionId: f.intent.submissionId, createdAt: Date.now(), actorUserId: f.s.moderatorUserId });
+  });
+  assert.equal((await f.detail()).canProposePlacement, false);
+});
+
+it("browser inventory hides logically removed and unavailable contributions and removal retry preserves its receipt", async () => {
+  const f = await fixture();
+  const d = await f.detail();
+  const input = { submissionId: f.intent.submissionId, expectedContributionVersion: d!.contributionVersion, idempotencyKey: "removed-inventory", action: "remove" as const };
+  const receipt = await f.actor.mutation(api.profileMediaSubmissions.manageContribution, input);
+  assert.equal(receipt.operationState, "committed");
+  assert.equal(await f.detail(), null);
+  assert.deepEqual(await f.actor.mutation(api.profileMediaSubmissions.manageContribution, input), receipt);
+  const second = await fixture();
+  const current = await second.detail();
+  await second.t.run(ctx => ctx.db.patch(current!.assetId, { moderatorSuppressedAt: Date.now() }));
+  assert.equal(await second.detail(), null);
+});
diff --git a/tests/scripts/mcp-compat-smoke-cli.test.ts b/tests/scripts/mcp-compat-smoke-cli.test.ts
index fd66a48e..5b6af199 100644
--- a/tests/scripts/mcp-compat-smoke-cli.test.ts
+++ b/tests/scripts/mcp-compat-smoke-cli.test.ts
@@ -55,7 +55,7 @@ const writeToolScopes: Record<string, string> = {
 };
 // Independent hosted contract fixture, deliberately not imported from runtime schemas.
 const contributionSchemas: Record<string, Record<string, unknown>> = {
-  vrdex_media_contribution_get: { inputSchema: { type: "object", additionalProperties: false, required: ["submissionId"] }, outputSchema: { required: ["submissionId", "assetId", "contributionVersion", "metadata", "canSelectPrimary", "canClearPrimary", "canEditMetadata", "canRemove"] } },
+  vrdex_media_contribution_get: { inputSchema: { type: "object", additionalProperties: false, required: ["submissionId"] }, outputSchema: { required: ["submissionId", "assetId", "contributionVersion", "metadata", "canSelectPrimary", "canClearPrimary", "canProposePlacement", "canEditMetadata", "canRemove"] } },
   vrdex_media_contribution_manage: { inputSchema: { type: "object", oneOf: [
     { additionalProperties: false, required: ["submissionId", "expectedContributionVersion", "idempotencyKey", "action", "metadata"] },
     { additionalProperties: false, required: ["submissionId", "expectedContributionVersion", "idempotencyKey", "action"] },
diff --git a/tests/web/mcp-media-review.test.ts b/tests/web/mcp-media-review.test.ts
index 60ca809f..5763edea 100644
--- a/tests/web/mcp-media-review.test.ts
+++ b/tests/web/mcp-media-review.test.ts
@@ -594,7 +594,7 @@ it("declares evidence and publishes only through separate explicit commands", as
 it("contribution handlers bind verified actor, exact command and strict receipt/detail output", async () => {
   const calls: Array<{ name: string; args: Record<string, unknown> }> = [];
   const receipt = { operationId: "operation-1", operationState: "committed" };
-  const projection = { submissionId: "submission-1", assetId: "asset-1", profileId: "profile-1", profileSlug: "fixture", contributionVersion: version, metadata: { label: "Image", credit: "Creator" }, canSelectPrimary: true, canClearPrimary: false, canEditMetadata: true, canRemove: true };
+  const projection = { submissionId: "submission-1", assetId: "asset-1", profileId: "profile-1", profileSlug: "fixture", contributionVersion: version, metadata: { label: "Image", credit: "Creator" }, canSelectPrimary: true, canClearPrimary: false, canProposePlacement: false, canEditMetadata: true, canRemove: true };
   const handlers = createMcpMediaReviewHandlers(dependencies({
     query: async (name, args) => { calls.push({ name, args }); return projection; },
     mutate: async (name, args) => { calls.push({ name, args }); return receipt; },
diff --git a/tests/web/media-command-result.test.ts b/tests/web/media-command-result.test.ts
index 6e5289fd..c1e1818e 100644
--- a/tests/web/media-command-result.test.ts
+++ b/tests/web/media-command-result.test.ts
@@ -1,6 +1,6 @@
 import assert from "node:assert/strict";
 import { it } from "node:test";
-import { safeCommandError } from "../../apps/web/src/lib/server/media-command-result";
+import { actionableReceipt, safeCommandError } from "../../apps/web/src/lib/server/media-command-result";
 
 it("reports an unadmitted refusal budget error without a durable operation ID", () => {
   const result = safeCommandError({ data: { code: "UPLOAD_REFUSAL_RECEIPT_LIMIT" } }, "caller-key");
@@ -9,3 +9,15 @@ it("reports an unadmitted refusal budget error without a durable operation ID",
   assert.equal("structuredContent" in result, false);
   assert.equal(result.content[0].text.includes("caller-key"), false);
 });
+
+it("preserves exact operation identity for uncertain retry and separates stale contribution decisions", () => {
+  const unknown = actionableReceipt({ operationId: "saved-key", operationState: "in_progress", resourceId: "submission" });
+  assert.equal(unknown.operationId, "saved-key");
+  assert.equal(unknown.nextAction, "retry_same_key");
+  assert.equal(unknown.retryCategory, "uncertain");
+  for (const code of ["contribution_changed", "selection_changed"]) {
+    const refused = actionableReceipt({ operationId: "refused-operation", operationState: "refused", code });
+    assert.equal(refused.nextAction, "inspect_current");
+    assert.equal(refused.retryable, false);
+  }
+});
diff --git a/tests/web/media-review-view.test.ts b/tests/web/media-review-view.test.ts
index c5d00d23..eddd9035 100644
--- a/tests/web/media-review-view.test.ts
+++ b/tests/web/media-review-view.test.ts
@@ -73,3 +73,7 @@ describe("media review view model", () => {
     }), "https://automatic.example/avatar.png");
   });
 });
+
+it("recognizes published contribution and selection conflicts without discarding drafts", () => {
+  for (const code of ["contribution_changed", "selection_changed"]) assert.equal(reviewDecisionMessage({ operationId: "op", operationState: "refused", code }).conflict, true);
+});
diff --git a/tests/web/vrdex-mcp.test.ts b/tests/web/vrdex-mcp.test.ts
index be9a8e2f..0e2aa373 100644
--- a/tests/web/vrdex-mcp.test.ts
+++ b/tests/web/vrdex-mcp.test.ts
@@ -3410,7 +3410,7 @@ it("contribution protocol tools dispatch exact attested wrappers, reject missing
     import { assertHostedContributionSchemas } from "./scripts/smoke-vrdex-mcp-compat.ts";
     import { createVrdexMcpHandler } from "./apps/web/src/lib/server/vrdex-mcp.ts";
     const calls=[]; const receipt={operationId:"key",operationState:"committed"};
-    const detail={submissionId:"submission",assetId:"asset",profileId:"profile",profileSlug:"fixture",contributionVersion:"version",metadata:{label:"Image",credit:"Creator"},canSelectPrimary:true,canClearPrimary:false,canEditMetadata:true,canRemove:true};
+    const detail={submissionId:"submission",assetId:"asset",profileId:"profile",profileSlug:"fixture",contributionVersion:"version",metadata:{label:"Image",credit:"Creator"},canSelectPrimary:true,canClearPrimary:false,canProposePlacement:false,canEditMetadata:true,canRemove:true};
     const handler=createVrdexMcpHandler({now:()=>2000,verifyContributorEmail:async()=>true,adminConvex:{
       query:async(ref,args)=>{calls.push({name:getFunctionName(ref),args});return detail},
       mutation:async(ref,args)=>{const name=getFunctionName(ref);if(name==="mcpToolEvents:recordWriteInvocation")return null;calls.push({name,args});return name.includes("declarePublicationEvidence")?{operationId:"key",operationState:"refused",code:"legacy_declaration_retired"}:receipt},

From 4151fce35a86242a525d967eccf8f2a832dc0726 Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Tue, 6 Oct 2026 01:46:30 -0400
Subject: [PATCH 13/28] feat: add bounded media kit conversion and lifecycle
 preparedness

---
 apps/web/e2e/media-contribution.flow.spec.ts  | 141 +++++++++++++-
 apps/web/src/app/api/e2e/media/route.ts       |   3 +
 convex/_generated/api.d.ts                    |   2 +
 convex/_profileAssets.ts                      |   4 +
 convex/e2eMedia.ts                            |  35 +++-
 convex/mediaKitPublicationMigration.ts        |  92 ++++++++++
 convex/schema.ts                              |   4 +-
 .../media-kit-publication-task-6-report.md    |  28 +++
 docs/engineering/media-review-commands.md     |  12 ++
 docs/testing/mcp-media-staging-lifecycle.md   |  10 +
 scripts/media-kit-publication-migration.mjs   |  30 +++
 tests/backend/e2e-media.test.ts               |  41 +++++
 ...ed-mcp-profile-media-contributions.test.ts |  23 +++
 .../media-kit-publication-migration.test.ts   | 172 ++++++++++++++++++
 .../media-kit-publication-migration.test.ts   |   9 +
 15 files changed, 599 insertions(+), 7 deletions(-)
 create mode 100644 convex/mediaKitPublicationMigration.ts
 create mode 100644 docs/engineering/media-kit-publication-task-6-report.md
 create mode 100644 scripts/media-kit-publication-migration.mjs
 create mode 100644 tests/backend/media-kit-publication-migration.test.ts
 create mode 100644 tests/scripts/media-kit-publication-migration.test.ts

diff --git a/apps/web/e2e/media-contribution.flow.spec.ts b/apps/web/e2e/media-contribution.flow.spec.ts
index ca29122f..e0b8ab59 100644
--- a/apps/web/e2e/media-contribution.flow.spec.ts
+++ b/apps/web/e2e/media-contribution.flow.spec.ts
@@ -96,11 +96,11 @@ async function grant(page: Page, request: APIRequestContext, origin: string, run
   return { ...tokens, clientId: body.application.clientId };
 }
 
-test("contributor A submits and different owner B reviews media @media-lifecycle", async ({ browser, request, baseURL }, testInfo) => {
+test("contributor A submits and distinct assigned reviewer B reviews media @media-lifecycle", async ({ browser, request, baseURL }, testInfo) => {
   test.skip(!enabled, "Explicit media lifecycle or cleanup proof opt-in is required.");
   if ([cleanupOnly, uploadCleanupOnly, process.env.VRDEX_E2E_MEDIA_LIFECYCLE === "true"].filter(Boolean).length !== 1)
     throw new Error("Select one media proof mode.");
-  test.setTimeout(240_000);
+  test.setTimeout(420_000);
   if (baseURL !== "https://staging.vrdex.net") throw new Error("Media lifecycle requires the designated staging origin.");
   if (!clerkTestAuthAvailability().available) throw new Error("Staging Clerk test auth is required.");
   const token = process.env.VRDEX_E2E_BROWSER_TOKEN;
@@ -228,7 +228,7 @@ test("contributor A submits and different owner B reviews media @media-lifecycle
       await testInfo.attach("media-cleanup-recovery", { body: JSON.stringify({ runId, profileId, cleanupErrors }), contentType: "application/json" });
     }
     expect(cleanupErrors, "All fixture cleanup operations must succeed").toEqual([]);
-    await testInfo.attach("media-lifecycle-evidence", { body: JSON.stringify({ candidate: expectedCommit, stages, cleanup: "verified", authority: "B assigned synthetic profile ownership; no live claim/provider proof" }), contentType: "application/json" });
+    await testInfo.attach("media-lifecycle-evidence", { body: JSON.stringify({ candidate: expectedCommit, stages, cleanup: "verified", authority: "B assigned media_reviewer for publication/replacement; synthetic ownership only for final claim refusal" }), contentType: "application/json" });
 
   };
   const a = await createClerkTestAccount(`${runId}-contributor`, { onEmailReserved: (email) => emails.push(email) });
@@ -374,9 +374,48 @@ test("contributor A submits and different owner B reviews media @media-lifecycle
   await pageB.goto(`/${profile.slug}`);
   await expect(pageB.getByRole("heading", { name: "Media kit" })).toBeVisible();
   await expect(pageB.locator(`img[src="${publishedFile}"]`)).toBeVisible();
+  const staleSelectionVersion = publishedDetail.contributionVersion;
+  const downloaded = await request.get(`${publishedFile}?download=1`);
+  expect(downloaded.ok(), "Public kit download must succeed").toBe(true);
+  const decoded = await sharp(await downloaded.body()).metadata();
+  expect(decoded.width).toBeGreaterThan(0);
+  expect(decoded.height).toBeGreaterThan(0);
+  expect(await pageB.locator(`img[src="${publishedFile}"]`).evaluate((image: HTMLImageElement) => image.complete && image.naturalWidth > 0)).toBe(true);
+  const capturePicture = async (state: string) => {
+    await pageB.goto(`/${profile.slug}`);
+    for (const [size, width, height] of [["desktop", 1280, 900], ["mobile", 390, 844]] as const) {
+      await pageB.setViewportSize({ width, height });
+      await testInfo.attach(`public-kit-${state}-${size}`, { body: await pageB.screenshot({ fullPage: true }), contentType: "image/png" });
+    }
+    await pageB.setViewportSize({ width: 1280, height: 900 });
+  };
+  await capturePicture("unchanged");
   await publishedCard.getByRole("button", { name: "Select picture" }).click();
   await expect(publishedCard.getByRole("button", { name: "Remove", exact: true })).toHaveCount(0);
+  const selectedPublic = await call<{ avatarImageUrl?: string }>(request, undefined, "vrdex_get_profile", { slug: profile.slug });
+  expect(selectedPublic.avatarImageUrl).toContain(publishedDetail.assetId);
+  await capturePicture("selected");
+  const staleSelection = await rpc<UploadReceipt>(request, authA.access_token, "vrdex_media_contribution_place", { submissionId: publishedSubmissionId, expectedContributionVersion: staleSelectionVersion, action: "clear_primary", idempotencyKey: `${runId}-stale-selection` });
+  expect(staleSelection.result?.structuredContent).toMatchObject({ operationState: "refused", code: "contribution_changed" });
   await publishedCard.getByRole("button", { name: "Clear picture" }).click();
+  expect((await call<{ avatarImageUrl?: string }>(request, undefined, "vrdex_get_profile", { slug: profile.slug })).avatarImageUrl).toBe(before.avatarImageUrl);
+  await capturePicture("restored");
+  publishedDetail = await call<PublishedContributionDetail>(request, authA.access_token, "vrdex_media_contribution_get", { submissionId: publishedSubmissionId });
+  const rpcSelect = { submissionId: publishedSubmissionId, expectedContributionVersion: publishedDetail.contributionVersion, action: "select_primary", idempotencyKey: `${runId}-rpc-select` };
+  const selectedReceipt = await call<UploadReceipt>(request, authA.access_token, "vrdex_media_contribution_place", rpcSelect);
+  expect(selectedReceipt.operationState).toBe("committed");
+  expect(await call(request, authA.access_token, "vrdex_media_contribution_place", rpcSelect)).toEqual(selectedReceipt);
+  publishedDetail = await call<PublishedContributionDetail>(request, authA.access_token, "vrdex_media_contribution_get", { submissionId: publishedSubmissionId });
+  const rpcClear = { ...rpcSelect, expectedContributionVersion: publishedDetail.contributionVersion, action: "clear_primary", idempotencyKey: `${runId}-rpc-clear` };
+  const clearReceipt = await call<UploadReceipt>(request, authA.access_token, "vrdex_media_contribution_place", rpcClear);
+  expect(clearReceipt.operationState).toBe("committed");
+  expect(await call(request, authA.access_token, "vrdex_media_contribution_place", rpcClear)).toEqual(clearReceipt);
+  publishedDetail = await call<PublishedContributionDetail>(request, authA.access_token, "vrdex_media_contribution_get", { submissionId: publishedSubmissionId });
+  const rpcMetadata = { submissionId: publishedSubmissionId, expectedContributionVersion: publishedDetail.contributionVersion, action: "update_metadata", metadata: { credit: "Synthetic RPC corrected credit" }, idempotencyKey: `${runId}-rpc-metadata` };
+  const metadataReceipt = await call<UploadReceipt>(request, authA.access_token, "vrdex_media_contribution_manage", rpcMetadata);
+  expect(metadataReceipt.operationState).toBe("committed");
+  expect(await call(request, authA.access_token, "vrdex_media_contribution_manage", rpcMetadata)).toEqual(metadataReceipt);
+  stages.push("authenticated MCP select, undo and metadata correction with exact-key recovery");
   await publishedCard.getByRole("button", { name: "Edit metadata" }).click();
   await publishedCard.getByLabel("Title", { exact: true }).fill("Synthetic publisher title");
   await publishedCard.getByRole("button", { name: "Save", exact: true }).click();
@@ -385,6 +424,13 @@ test("contributor A submits and different owner B reviews media @media-lifecycle
   publishedDetail = await call<PublishedContributionDetail>(request, authA.access_token, "vrdex_media_contribution_get", { submissionId: publishedSubmissionId });
   expect(publishedDetail.canClearPrimary).toBe(true);
   expect(publishedDetail.canRemove).toBe(false);
+  const ownPicture = await call<{ avatarImageUrl?: string }>(request, undefined, "vrdex_get_profile", { slug: profile.slug });
+  expect((await request.post("/api/e2e/media", { headers, data: { op: "exercise-publication-guards", action: "reselect_primary", runId, profileId } })).status()).toBe(200);
+  publishedDetail = await call<PublishedContributionDetail>(request, authA.access_token, "vrdex_media_contribution_get", { submissionId: publishedSubmissionId });
+  expect(publishedDetail.canClearPrimary).toBe(false);
+  const protectedUndo = await call<UploadReceipt>(request, authA.access_token, "vrdex_media_contribution_place", { submissionId: publishedSubmissionId, expectedContributionVersion: publishedDetail.contributionVersion, action: "clear_primary", idempotencyKey: `${runId}-protected-same-asset-undo` });
+  expect(protectedUndo).toMatchObject({ operationState: "refused", code: "selection_changed" });
+  expect((await call<{ avatarImageUrl?: string }>(request, undefined, "vrdex_get_profile", { slug: profile.slug })).avatarImageUrl).toBe(ownPicture.avatarImageUrl);
   stages.push("trusted website kit publication without declarations or hero change, selection undo and metadata correction");
   await new Promise(resolve => setTimeout(resolve, 31_000));
   const refreshed = await call<{ updatedAt: number }>(request, undefined, "vrdex_get_profile", { slug: profile.slug });
@@ -422,7 +468,10 @@ test("contributor A submits and different owner B reviews media @media-lifecycle
   expect(submitted.submission.submissionId).not.toBe(rejectedCandidate.submission.submissionId);
   const directState = await request.post("/api/e2e/media", { headers, data: { op: "inspect", runId, profileId } });
   expect(directState.status()).toBe(200);
-  expect((await directState.json()).counts.reservations).toBe(3);
+  const directInspection = await directState.json();
+  expect(directInspection.counts.reservations).toBe(3);
+  expect(directInspection.mediaKitEnabled, "Deployed backend media-kit gate").toBe(true);
+  expect(directInspection.mediaKitPublic, "Fixture public media-kit field visibility").toBe(true);
   fixture.expectedReservations = 3;
   stages.push("minted direct S3 multipart transfer, completion replay and private contributor readback");
   expect((await request.post("/api/e2e/media", { headers, data: { op: "grant-publication-actors", runId, profileId } })).status()).toBe(200);
@@ -451,7 +500,7 @@ test("contributor A submits and different owner B reviews media @media-lifecycle
     expect(JSON.stringify(stillUnpublished)).not.toContain(privateValue);
   const reviewerHistory = await call<{ submissions: Submission[] }>(request, authB.access_token, "vrdex_list_my_media_submissions", {});
   expect(reviewerHistory.submissions).toEqual([]);
-  stages.push("different owner rejection, private reason isolation and no public rejected asset");
+  stages.push("distinct assigned reviewer rejection, private reason isolation and no public rejected asset");
 
   const reviewBeforeRebase = await call<{ reviewVersion: string }>(request, authB.access_token, "vrdex_media_review_get", {
     submissionId: submitted.submission.submissionId,
@@ -548,6 +597,88 @@ test("contributor A submits and different owner B reviews media @media-lifecycle
   await expect(pageA.getByText("Removed", { exact: true })).toBeVisible();
   expect((await request.get(publishedFile)).status()).toBe(404);
   stages.push("explicit replacement compares existing picture with published candidate, separate reviewer protects selection, logical removal of unused kit item");
+  // A fourth unique candidate proves successful MCP writes independently of browser mutations.
+  await new Promise(resolve => setTimeout(resolve, 31_000));
+  const rpcImage = await sharp({ create: { width: 48, height: 64, channels: 3, background: "#412f65" } }).png().toBuffer();
+  const rpcProfile = await call<{ updatedAt: number; avatarImageUrl?: string }>(request, undefined, "vrdex_get_profile", { slug: profile.slug });
+  const rpcUploadKey = `${runId}-rpc-upload`;
+  const rpcTarget = await call<UploadTarget>(request, authA.access_token, "vrdex_media_upload_begin", {
+    mode: "contributor", profileId, expectedUpdatedAt: rpcProfile.updatedAt, placement: "gallery", contentType: "image/png", byteLength: rpcImage.length,
+    sha256: createHash("sha256").update(rpcImage).digest("hex"), credit: "Synthetic MCP image", sourceDescription: "Synthetic RPC photograph", idempotencyKey: rpcUploadKey,
+  });
+  fixture.expiringTransfer = { ...rpcTarget.transfer, image: rpcImage };
+  fixture.expectedReservations = 4;
+  const rpcTransfer = await request.post(rpcTarget.transfer.url, { multipart: { ...rpcTarget.transfer.fields, [rpcTarget.transfer.fileField]: { name: "rpc.png", mimeType: "image/png", buffer: rpcImage } } });
+  expect([201, 204]).toContain(rpcTransfer.status());
+  const rpcCompleteInput = { intentId: rpcTarget.intentId, idempotencyKey: rpcUploadKey };
+  const rpcCompleted = await call<UploadReceipt>(request, authA.access_token, "vrdex_media_upload_complete", rpcCompleteInput);
+  expect(rpcCompleted.operationState).toBe("committed");
+  expect(await call(request, authA.access_token, "vrdex_media_upload_complete", rpcCompleteInput)).toEqual(rpcCompleted);
+  const rpcSubmissionId = rpcCompleted.resourceId!;
+  const rpcInspection = await call<{ reviewVersion: string }>(request, authA.access_token, "vrdex_media_submission_get", { submissionId: rpcSubmissionId });
+  const rpcPreview = await rpc(request, authA.access_token, "vrdex_media_submission_preview", { submissionId: rpcSubmissionId, expectedReviewVersion: rpcInspection.reviewVersion });
+  expect(rpcPreview.result?.content?.some(item => item.type === "image")).toBe(true);
+  expect((await request.post("/api/e2e/media", { headers, data: { op: "exercise-publication-guards", action: "edit_bio", runId, profileId } })).status()).toBe(200);
+  const rpcPublishInput = { submissionId: rpcSubmissionId, expectedReviewVersion: rpcInspection.reviewVersion, idempotencyKey: `${runId}-rpc-publish` };
+  // Discard the first response to model a client losing the committed result.
+  await call<UploadReceipt>(request, authA.access_token, "vrdex_media_submission_publish", rpcPublishInput);
+  const rpcPublication = await call<UploadReceipt>(request, authA.access_token, "vrdex_media_submission_publish", rpcPublishInput);
+  expect(rpcPublication.operationState).toBe("committed");
+  expect(await call(request, authA.access_token, "vrdex_media_submission_publish", rpcPublishInput)).toEqual(rpcPublication);
+  let rpcDetail = await call<PublishedContributionDetail>(request, authA.access_token, "vrdex_media_contribution_get", { submissionId: rpcSubmissionId });
+  expect(rpcDetail.canRemove).toBe(true);
+  const rpcPublic = await call<{ avatarImageUrl?: string }>(request, undefined, "vrdex_get_profile", { slug: profile.slug });
+  expect(rpcPublic.avatarImageUrl).toBe(rpcProfile.avatarImageUrl);
+  const rpcFile = `/api/v0/profiles/${profile.slug}/assets/${rpcDetail.assetId}/file`;
+  const rpcDownload = await request.get(`${rpcFile}?download=1`);
+  expect(rpcDownload.ok()).toBe(true);
+  expect((await sharp(await rpcDownload.body()).metadata()).width).toBe(48);
+  await pageB.goto(`/${profile.slug}`);
+  await expect(pageB.locator(`img[src="${rpcFile}"]`)).toBeVisible();
+  expect(await pageB.locator(`img[src="${rpcFile}"]`).evaluate((image: HTMLImageElement) => image.complete && image.naturalWidth > 0)).toBe(true);
+  const rpcManageInput = { submissionId: rpcSubmissionId, expectedContributionVersion: rpcDetail.contributionVersion, action: "update_metadata", metadata: { label: "Synthetic MCP title" }, idempotencyKey: `${runId}-rpc-title` };
+  const rpcManaged = await call<UploadReceipt>(request, authA.access_token, "vrdex_media_contribution_manage", rpcManageInput);
+  expect(rpcManaged.operationState).toBe("committed");
+  expect(await call(request, authA.access_token, "vrdex_media_contribution_manage", rpcManageInput)).toEqual(rpcManaged);
+  rpcDetail = await call<PublishedContributionDetail>(request, authA.access_token, "vrdex_media_contribution_get", { submissionId: rpcSubmissionId });
+  const rpcProposeInput = { submissionId: rpcSubmissionId, expectedContributionVersion: rpcDetail.contributionVersion, idempotencyKey: `${runId}-rpc-propose` };
+  const rpcProposed = await call<UploadReceipt>(request, authA.access_token, "vrdex_media_contribution_propose_placement", rpcProposeInput);
+  expect(rpcProposed.operationState).toBe("committed");
+  expect(await call(request, authA.access_token, "vrdex_media_contribution_propose_placement", rpcProposeInput)).toEqual(rpcProposed);
+  expect((await request.post("/api/e2e/media", { headers, data: { op: "grant-publication-actors", runId, profileId } })).status()).toBe(200);
+  const rpcReview = await call<{ reviewVersion: string }>(request, authB.access_token, "vrdex_media_review_get", { submissionId: rpcProposed.resourceId! });
+  expect((await request.post("/api/e2e/media", { headers, data: { op: "exercise-publication-guards", action: "reselect_primary", runId, profileId } })).status()).toBe(200);
+  const rpcDecision = { submissionId: rpcProposed.resourceId!, expectedReviewVersion: rpcReview.reviewVersion, decision: "approve", privateReason: "Synthetic independent RPC replacement", idempotencyKey: `${runId}-rpc-review` };
+  const reselectedRefusal = await rpc<UploadReceipt>(request, authB.access_token, "vrdex_media_review_decide", rpcDecision);
+  expect(reselectedRefusal.result?.structuredContent).toMatchObject({ operationState: "refused" });
+  const changedReview = await call<{ reviewVersion: string }>(request, authB.access_token, "vrdex_media_review_get", { submissionId: rpcProposed.resourceId! });
+  const rpcRebase = await call<UploadReceipt>(request, authB.access_token, "vrdex_media_review_rebase", { submissionId: rpcProposed.resourceId!, expectedReviewVersion: changedReview.reviewVersion, idempotencyKey: `${runId}-rpc-rebase` });
+  expect(rpcRebase.operationState).toBe("committed");
+  const freshReview = await call<{ reviewVersion: string }>(request, authB.access_token, "vrdex_media_review_get", { submissionId: rpcProposed.resourceId! });
+  const freshDecisionInput = { ...rpcDecision, expectedReviewVersion: freshReview.reviewVersion, idempotencyKey: `${runId}-rpc-review-fresh` };
+  const rpcApproved = await call<UploadReceipt>(request, authB.access_token, "vrdex_media_review_decide", freshDecisionInput);
+  expect(rpcApproved.operationState).toBe("committed");
+  expect(await call(request, authB.access_token, "vrdex_media_review_decide", freshDecisionInput)).toEqual(rpcApproved);
+  const afterRpcReplacement = await call<{ avatarImageUrl?: string }>(request, undefined, "vrdex_get_profile", { slug: profile.slug });
+  expect(afterRpcReplacement.avatarImageUrl).toContain(rpcDetail.assetId);
+  expect((await call<PublishedContributionDetail>(request, authA.access_token, "vrdex_media_contribution_get", { submissionId: rpcSubmissionId })).canRemove).toBe(false);
+  const oldKit = await call<PublishedContributionDetail>(request, authA.access_token, "vrdex_media_contribution_get", { submissionId: submitted.submission.submissionId });
+  expect(oldKit.canRemove).toBe(true);
+  const rpcRemoveInput = { submissionId: submitted.submission.submissionId, expectedContributionVersion: oldKit.contributionVersion, action: "remove", idempotencyKey: `${runId}-rpc-remove` };
+  const rpcRemoved = await call<UploadReceipt>(request, authA.access_token, "vrdex_media_contribution_manage", rpcRemoveInput);
+  expect(rpcRemoved.operationState).toBe("committed");
+  expect(await call(request, authA.access_token, "vrdex_media_contribution_manage", rpcRemoveInput)).toEqual(rpcRemoved);
+  expect((await request.get(kitFile)).status()).toBe(404);
+  const rpcFinalState = await request.post("/api/e2e/media", { headers, data: { op: "inspect", runId, profileId } });
+  expect((await rpcFinalState.json()).counts.reservations).toBe(4);
+  expect((await request.post("/api/e2e/media", { headers, data: { op: "exercise-publication-guards", action: "revoke_actors", runId, profileId } })).status()).toBe(200);
+  expect((await rpc<UploadReceipt>(request, authA.access_token, "vrdex_media_submission_publish", rpcPublishInput)).result?.structuredContent).toMatchObject({ operationState: "refused", code: "MEDIA_PUBLISH_ACCESS_REQUIRED" });
+  expect((await rpc<UploadReceipt>(request, authA.access_token, "vrdex_media_contribution_place", { submissionId: rpcSubmissionId, expectedContributionVersion: rpcDetail.contributionVersion, action: "clear_primary", idempotencyKey: `${runId}-revoked-primary` })).result?.structuredContent).toMatchObject({ operationState: "refused", code: "publisher_required" });
+  const revokedReviewer = await rpc<UploadReceipt>(request, authB.access_token, "vrdex_media_review_decide", freshDecisionInput);
+  expect(revokedReviewer.result?.isError).toBe(true);
+  expect(revokedReviewer.result?.structuredContent).toMatchObject({ operationState: "refused", code: "MEDIA_REVIEW_ACCESS_REQUIRED" });
+  stages.push("actual authenticated MCP publish/get/render/download, own correction/removal, distinct assigned reviewer replacement, unchanged picture through bio edit, same-asset stale selection and feature-revoked replay denial");
+
   const assign = await request.post("/api/e2e/media", { headers, data: { op: "assign-review-owner", runId, profileId, reviewerEmail: b.email } });
   expect(assign.status(), "Assign only this synthetic profile to B").toBe(200);
   const claimedProfile = await call<{ updatedAt: number }>(request, undefined, "vrdex_get_profile", { slug: profile.slug });
diff --git a/apps/web/src/app/api/e2e/media/route.ts b/apps/web/src/app/api/e2e/media/route.ts
index ebe94ee6..30594cd3 100644
--- a/apps/web/src/app/api/e2e/media/route.ts
+++ b/apps/web/src/app/api/e2e/media/route.ts
@@ -165,6 +165,9 @@ async function execute(request: NextRequest, cleanup: boolean) {
         throw new Error("Cleanup worker did not reclaim the exact pending upload.");
       return NextResponse.json({ workerReclaimedUpload: true });
     }
+    if (body.op === "exercise-publication-guards" && (body.action === "edit_bio" || body.action === "reselect_primary" || body.action === "revoke_actors")) {
+      return NextResponse.json(await client.mutation(internal.e2eMedia.exercisePublicationGuards, { ...args, action: body.action }));
+    }
     if (body.op === "grant-publication-actors") {
       return NextResponse.json(await client.mutation(internal.e2eMedia.grantPublicationActors, args));
     }
diff --git a/convex/_generated/api.d.ts b/convex/_generated/api.d.ts
index c150cf6e..830aedaa 100644
--- a/convex/_generated/api.d.ts
+++ b/convex/_generated/api.d.ts
@@ -161,6 +161,7 @@ import type * as hostedSmokeFixtures from "../hostedSmokeFixtures.js";
 import type * as http from "../http.js";
 import type * as localFixtures from "../localFixtures.js";
 import type * as mcpToolEvents from "../mcpToolEvents.js";
+import type * as mediaKitPublicationMigration from "../mediaKitPublicationMigration.js";
 import type * as migrations from "../migrations.js";
 import type * as oauthApps from "../oauthApps.js";
 import type * as oauthConsentTransactions from "../oauthConsentTransactions.js";
@@ -350,6 +351,7 @@ declare const fullApi: ApiFromModules<{
   http: typeof http;
   localFixtures: typeof localFixtures;
   mcpToolEvents: typeof mcpToolEvents;
+  mediaKitPublicationMigration: typeof mediaKitPublicationMigration;
   migrations: typeof migrations;
   oauthApps: typeof oauthApps;
   oauthConsentTransactions: typeof oauthConsentTransactions;
diff --git a/convex/_profileAssets.ts b/convex/_profileAssets.ts
index 4e370be5..b0cd8410 100644
--- a/convex/_profileAssets.ts
+++ b/convex/_profileAssets.ts
@@ -1086,6 +1086,10 @@ export async function finalizeProfileAssetUploadIntentUpload(
       }
     }
     await settleLegacyContribution(db,intent,input);
+    if (submission.requestKind !== "identity_placement" && (submission.requestKind !== "kit_asset" || submission.requestedPlacement !== "gallery")) {
+      await db.patch(submission._id, { requestKind: "kit_asset", requestedPlacement: "gallery", reviewRevision: (submission.reviewRevision ?? 0) + 1 });
+      await db.patch(intent._id, { placements: ["gallery"] });
+    }
     await db.patch(submission._id, {
       status: "submitted",
       ...(input.contentSha256 !== undefined ? { contentSha256: input.contentSha256 } : {}),
diff --git a/convex/e2eMedia.ts b/convex/e2eMedia.ts
index 66c5f6b5..5730151d 100644
--- a/convex/e2eMedia.ts
+++ b/convex/e2eMedia.ts
@@ -1,3 +1,4 @@
+import { isProfileFieldVisible } from "./_profileFieldVisibility";
 import { queueProfileLinkDestinations } from "./_profileLinkDestinationCache";
 import { v } from "convex/values";
 import {
@@ -344,9 +345,11 @@ export const assignReviewOwner = internalMutation({
 export const inspect = internalQuery({
   args: fixtureArgs,
   handler: async (ctx, args) => {
-    await fixture(ctx, args);
+    const profile = await fixture(ctx, args);
     const data = await rows(ctx, args.profileId);
     return {
+      mediaKitEnabled: process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED === "true",
+      mediaKitPublic: isProfileFieldVisible(profile, "mediaKit", "profile_page"),
       counts: {
         intents: data.intents.length,
         reservations: data.reservations.length,
@@ -688,3 +691,33 @@ export const finishCleanup = internalMutation({
     return { slug: data.profile.slug, deletedMedia: true, releasedReservations: data.reservations.length };
   },
 });
+
+export const exercisePublicationGuards = internalMutation({
+  args: { ...fixtureArgs, action: v.union(v.literal("edit_bio"), v.literal("reselect_primary"), v.literal("revoke_actors")) },
+  handler: async (ctx, args) => {
+    const profile = await fixture(ctx, args);
+    if (profile.claimState !== "unclaimed" || profile.publicationState !== "published" || profile.publicSurfacingState !== "public") throw new Error("Unclaimed fixture required.");
+    const actors = await Promise.all(["contributor", "reviewer"].map(suffix => ctx.db.query("users").withIndex("email", q =>
+      q.eq("email", `${args.runId}-${suffix}+clerk_test@e2e.vrdex.net`)).unique()));
+    if (actors.some(user => !user?.clerkUserId || user.emailVerificationTime === undefined)) throw new Error("Verified fixture actors required.");
+    const now = Date.now();
+    if (args.action === "edit_bio") await ctx.db.patch(profile._id, { bio: "Synthetic unrelated biography edit", updatedAt: Math.max(now, profile.updatedAt + 1) });
+    else if (args.action === "revoke_actors") {
+      for (const [index, feature] of ["trusted_publisher", "media_reviewer"].entries()) {
+        const grants = await ctx.db.query("accountFeatureGrants").withIndex("by_userId_feature_state", q =>
+          q.eq("userId", actors[index]!._id).eq("feature", feature as "trusted_publisher" | "media_reviewer").eq("state", "active")).take(2);
+        if (grants.length !== 1 || grants[0].grantedBy.tokenIdentifier !== `e2e:${args.runId}`) throw new Error("Exact fixture grant required.");
+        await ctx.db.patch(grants[0]._id, { state: "revoked", updatedAt: now });
+      }
+    } else {
+      const primary = await ctx.db.query("profileAssetPlacements").withIndex("by_profileId_placement_state_position", q =>
+        q.eq("profileId", profile._id).eq("placement", "profile_image").eq("state", "active")).take(2);
+      const data = await rows(ctx, profile._id);
+      if (primary.length !== 1 || !data.assets.some(asset => asset._id === primary[0].assetId && asset.state === "active" && asset.visibility === "public") ||
+        !data.submissions.some(submission => submission.submitterUserId === actors[0]!._id && submission.status === "approved" && submission.approvedAssetId === primary[0].assetId))
+        throw new Error("Exact published fixture selection required.");
+      await ctx.db.patch(primary[0]._id, { selectionActorUserId: actors[1]!._id, selectionOperationId: `e2e:${args.runId}:${crypto.randomUUID()}`, updatedAt: Math.max(now, primary[0].updatedAt + 1) });
+    }
+    return { changed: true };
+  },
+});
diff --git a/convex/mediaKitPublicationMigration.ts b/convex/mediaKitPublicationMigration.ts
new file mode 100644
index 00000000..24ae30fd
--- /dev/null
+++ b/convex/mediaKitPublicationMigration.ts
@@ -0,0 +1,92 @@
+import { ConvexError, v } from "convex/values";
+import { internalMutation, type MutationCtx } from "./_generated/server";
+import type { Doc } from "./_generated/dataModel";
+
+async function eligible(ctx: MutationCtx, submission: Doc<"profileMediaSubmissions">) {
+  const profile = await ctx.db.get(submission.profileId);
+  const asset = submission.approvedAssetId ? await ctx.db.get(submission.approvedAssetId) : null;
+  if (!profile || !asset || submission.status !== "approved" || submission.requestKind === "identity_placement" ||
+    profile.claimState !== "unclaimed" || profile.publicationState !== "published" || profile.publicSurfacingState !== "public" ||
+    asset.profileId !== profile._id || asset.state !== "active" || asset.visibility !== "public" ||
+    asset.source !== "community_submitted" || asset.retiredAt !== undefined || asset.moderatorSuppressedAt !== undefined ||
+    submission.legalHoldAt !== undefined || asset.contentSha256 !== submission.contentSha256) return null;
+  const matches = await ctx.db.query("profileMediaSubmissions").withIndex("by_approvedAssetId", q => q.eq("approvedAssetId", asset._id)).take(2);
+  if (matches.length !== 1 || matches[0]._id !== submission._id ||
+    (asset.sourceSubmissionId !== undefined && asset.sourceSubmissionId !== submission._id)) return null;
+    const restrictions = await Promise.all([
+      ctx.db.query("mediaPublicationRestrictions").withIndex("by_profileId_kind", q => q.eq("profileId", profile._id).eq("kind", "identity")).first(),
+      ctx.db.query("mediaPublicationRestrictions").withIndex("by_profileId_kind", q => q.eq("profileId", profile._id).eq("kind", "dispute")).first(),
+      asset.contentSha256 ? ctx.db.query("mediaPublicationRestrictions").withIndex("by_contentSha256_kind", q => q.eq("contentSha256", asset.contentSha256).eq("kind", "suppression")).first() : null,
+      asset.contentSha256 ? ctx.db.query("mediaPublicationRestrictions").withIndex("by_contentSha256_kind", q => q.eq("contentSha256", asset.contentSha256).eq("kind", "rejection")).first() : null,
+    ]);
+    if (restrictions.some(Boolean)) return null;
+
+  return { profile, asset };
+}
+async function gallery(ctx: MutationCtx, asset: Doc<"profileAssets">, dryRun: boolean) {
+  const existing = await ctx.db.query("profileAssetPlacements").withIndex("by_assetId_state_placement", q =>
+    q.eq("assetId", asset._id).eq("state", "active").eq("placement", "gallery")).first();
+  if (existing) return false;
+  if (!dryRun) await ctx.db.insert("profileAssetPlacements", { profileId: asset.profileId, assetId: asset._id,
+    placement: "gallery", position: asset.uploadedAt, state: "active", updatedAt: Date.now() });
+  return true;
+}
+export const convertBatch = internalMutation({
+  args: { dryRun: v.boolean(), cursor: v.union(v.string(), v.null()), limit: v.number() },
+  handler: async (ctx, args) => {
+    if (!Number.isInteger(args.limit) || args.limit < 1 || args.limit > 40) throw new ConvexError("Migration limit must be 1..40.");
+    const page = await ctx.db.query("profileMediaSubmissions").paginate({ cursor: args.cursor, numItems: args.limit });
+    let changed = 0, skipped = 0, conflicts = 0;
+    for (const submission of page.page) {
+      if (submission.requestKind !== "identity_placement" && submission.uploadIntentId &&
+        ["upload_pending", "submitted", "under_review"].includes(submission.status) &&
+        (submission.requestKind !== "kit_asset" || submission.requestedPlacement !== "gallery")) {
+        const intent = await ctx.db.get(submission.uploadIntentId);
+        if (!intent || intent.purpose !== "community_proposal" || intent.targetSubmissionId !== submission._id ||
+          intent.targetProfileId !== submission.profileId || !["pending", "uploaded"].includes(intent.state)) { conflicts++; continue; }
+        if (!args.dryRun) {
+          await ctx.db.patch(submission._id, { requestKind: "kit_asset", requestedPlacement: "gallery", reviewRevision: (submission.reviewRevision ?? 0) + 1 });
+          await ctx.db.patch(intent._id, { placements: ["gallery"] });
+        }
+        changed++; continue;
+      }
+      if (submission.status !== "approved" || !submission.approvedAssetId || submission.requestKind === "identity_placement") { skipped++; continue; }
+      const s = await eligible(ctx, submission);
+      if (!s) { conflicts++; continue; }
+      const legacy = submission.requestKind === undefined;
+      const patch: { sourceSubmissionId?: typeof submission._id; sourceDescription?: string } = {};
+      if (s.asset.sourceSubmissionId === undefined) patch.sourceSubmissionId = submission._id;
+      // ponytail: any profile metadata correction blocks initialization; asset-scoped audit index if needed.
+      const audits = await Promise.all(["profile_media_contribution_metadata_updated", "profile_asset_metadata_updated"].map(action =>
+        ctx.db.query("profileAuditEvents").withIndex("by_profileId_action", q => q.eq("profileId", s.profile._id).eq("action", action)).first()));
+      const approvalTime = submission.reviewedAt ?? (submission.publicationMethod === "trusted_publisher" ? submission.updatedAt : undefined);
+      if (legacy && approvalTime !== undefined && s.asset.updatedAt === approvalTime && !s.asset.sourceUrl && !s.asset.sourceDescription && submission.sourceDescription && !audits.some(Boolean))
+        patch.sourceDescription = submission.sourceDescription;
+      const retained = await gallery(ctx, s.asset, args.dryRun);
+      if (Object.keys(patch).length && !args.dryRun) await ctx.db.patch(s.asset._id, patch);
+      if (retained || Object.keys(patch).length) changed++; else skipped++;
+    }
+    return { scanned: page.page.length, changed, skipped, conflicts, continueCursor: page.continueCursor, isDone: page.isDone };
+  },
+});
+export const correctPrimaryToKit = internalMutation({
+  args: { dryRun: v.boolean(), submissionId: v.id("profileMediaSubmissions"), expectedAssetId: v.id("profileAssets"),
+    expectedPlacementId: v.id("profileAssetPlacements"), expectedPlacementUpdatedAt: v.number(), expectedSelectionOperationId: v.union(v.string(), v.null()) },
+  handler: async (ctx, args) => {
+    const submission = await ctx.db.get(args.submissionId);
+    const s = submission ? await eligible(ctx, submission) : null;
+    const placement = await ctx.db.get(args.expectedPlacementId);
+    if (!s || !placement || s.asset._id !== args.expectedAssetId || placement.assetId !== s.asset._id ||
+      placement.profileId !== s.profile._id || placement.state !== "active" ||
+      placement.placement !== (s.profile.profileType === "person" ? "profile_image" : "primary_logo") ||
+      placement.updatedAt !== args.expectedPlacementUpdatedAt || (placement.selectionOperationId ?? null) !== args.expectedSelectionOperationId ||
+      placement.selectionOperationId !== undefined || placement.selectionActorUserId !== undefined)
+      return { changed: false, code: "resource_changed_or_protected" };
+    const primaries = await ctx.db.query("profileAssetPlacements").withIndex("by_profileId_placement_state_position", q =>
+      q.eq("profileId", s.profile._id).eq("placement", placement.placement).eq("state", "active")).take(2);
+    if (primaries.length !== 1 || primaries[0]._id !== placement._id) return { changed: false, code: "placement_ambiguous" };
+    await gallery(ctx, s.asset, args.dryRun);
+    if (!args.dryRun) await ctx.db.patch(placement._id, { state: "deleted", updatedAt: Date.now() });
+    return { changed: true, code: args.dryRun ? "would_correct" : "corrected" };
+  },
+});
diff --git a/convex/schema.ts b/convex/schema.ts
index 42196585..fd27e1b3 100644
--- a/convex/schema.ts
+++ b/convex/schema.ts
@@ -981,6 +981,7 @@ export default defineSchema({
     .index("by_profileId_contentSha256_createdAt", ["profileId", "contentSha256", "createdAt"])
     .index("by_contentSha256", ["contentSha256"])
     .index("by_contentSha256_status", ["contentSha256", "status"])
+    .index("by_approvedAssetId", ["approvedAssetId"])
     .index("by_publicationMethod_actor", ["publicationMethod", "publicationActorUserId"]),
   profileAssets: defineTable({
     sourceSubmissionId: v.optional(v.id("profileMediaSubmissions")),
@@ -2946,7 +2947,8 @@ export default defineSchema({
     createdAt: v.number(),
   })
     .index("by_profileId_createdAt", ["profileId", "createdAt"])
-    .index("by_action_createdAt", ["action", "createdAt"]),
+    .index("by_action_createdAt", ["action", "createdAt"])
+    .index("by_profileId_action", ["profileId", "action"]),
   seedImportBatches: defineTable({
     externalBatchId: v.string(),
     sourceName: v.string(),
diff --git a/docs/engineering/media-kit-publication-task-6-report.md b/docs/engineering/media-kit-publication-task-6-report.md
new file mode 100644
index 00000000..d9775717
--- /dev/null
+++ b/docs/engineering/media-kit-publication-task-6-report.md
@@ -0,0 +1,28 @@
+# Task 6 local implementation report
+
+Base: 9d2e47e9c6d8fedb0d3821aa21ba2b9abc0bf44a.
+Scope: bounded internal conversion and exact-resource primary correction, regression and hosted preparedness.
+
+Initial RED: migration regression reached the missing mediaKitPublicationMigration module after fixture media gates enabled. Limit test initially rejected the missing module; implementation now passes the bounded-limit assertions.
+GREEN: local implementation and preparedness checks passed; hosted acceptance remains pending.
+
+Controller ruling: sourceDescription initialization only for a uniquely linked active public legacy contribution on a public published unclaimed profile, with no current provenance and no correction audit. Immutable description only. Existing intentional clears remain cleared.
+Hosted acceptance pending: exact-candidate staging authorization and Task4 exact-copy approval are controller gates. No production read/write, credentials, deployment, workflow dispatch or push performed.
+
+Additional RED evidence: admitted-upload regression failed with primary intent instead of gallery; shared finalization normalization then passed. Duplicate active-primary regression failed before bounded take(2) guard. Delayed upload completion (uploadedAt=10, approval/asset.updatedAt=11) failed under the upload-time guard; approval-time guard passed. Restricted legacy gallery regression failed before common restriction guard. Fixture gate readback failed before adding guarded boolean projection.
+
+Controller timing ruling: uploadedAt can precede approval, so source initialization requires asset.updatedAt equal immutable approved reviewedAt (trusted-publisher approved submission.updatedAt only when reviewedAt absent), absent current source fields and absence of BOTH profile_media_contribution_metadata_updated and profile_asset_metadata_updated indexed audit records. Any such profile audit conservatively skips source initialization. Backfill does not stamp asset.updatedAt and cannot erase original timing evidence. Current corrected legacy assets with both source fields cleared are covered.
+
+GREEN: migration 12/12; guarded fixture+migration 39/39; hosted MCP URL admission fixture 15/15; operator wrapper 1/1. Initial full backend 1316/1316, contracts verification, MCP verification, markdown, backend typecheck, local backend codegen/health all passed. Web lint/typecheck/tests passed (618/618); sandbox build could not fetch existing Google Fonts, authorized local build retry passed. Saved final broad backend run passed 1320/1320 (task-6-backend-final.log).
+
+Self-review: all migration joins are bounded indexed lookups; pagination 1..40 and exact primary uniqueness take(2). Generic conversion preserves all primary selections, intent bytes/digests, receipts/reviewer identities and charge records. Approved assets with ambiguous linkage, private/claimed target, holds/suppression/restrictions or foreign profile linkage are conflicts. Identity-placement rows are skipped. Correction refuses every nonlegacy selection provenance even when supplied exact expected value, preserving intentional reselections. Wrapper default is dry-run and --apply is explicit.
+
+Hosted preparedness: guarded inspection now returns only mediaKitEnabled/mediaKitPublic booleans, actual lifecycle asserts these and decodes public download plus checks browser naturalWidth. Desktop/mobile unchanged/selected/restored kit screenshot attachments and stale contribution-selection denial were added. Existing Task5 assigned media_reviewer/run collection authority and cleanup remain intact. None of these hosted assertions were executed against staging. Hosted assertions now include successful MCP select/undo/manage on the website asset and a fourth synthetic minted upload/completion/inspection/preview/publish/get/render/download/manage/propose/rebase/assigned-reviewer approval/removal round. Guarded exact-run controls assert publication survives an unrelated bio edit, a publisher cannot undo a same-asset reviewer reselection, stale reviewer versions refuse, and revoking the relevant publisher/reviewer feature grants denies publication receipt replay, new primary commands and reviewer receipt replay. The first publication response is deliberately discarded before same-key recovery, a simulated client lost response. OAuth revocation remains separate. These assertions are prepared but have not run on hosted staging. Local tests/catalog/receipts are not proof of hosted behavior.
+
+Karly: controller performed separate read-only connected MCP preparation. Worker has not read production. Actual placement.updatedAt, selectionOperationId and claim eligibility still require fresh exact operator preview; no profile/submission timestamp substitution. No live conversion, correction, deployment, credentials, dispatch or push.
+
+Recovery milestone: 56/56 focused backend checks passed (migration 12, hosted URL admission 15, staging fixture 29), including a new same-asset reselection control check proving asset/state preservation, reviewer authority transfer, timing change and private-resource refusal. Operator wrapper remains 1/1. Recovery web and backend typechecks, web lint, markdown (198 files) and local Convex codegen/health passed. Logs: task-6-recovery-{focused,wrapper,web-typecheck,backend-typecheck,web-lint,markdown,codegen}.log. Local Convex retry required network permission only to fetch its backend version, then health returned ok. Prior whole-backend 1320/1320 and web 618/618 evidence remains saved; only the added fixture test and hosted preparedness changed during recovery, so those broader suites were not repeated.
+
+Self-review finding fixed: the final revoked-primary assertion previously addressed an already removed website asset, which could prove resource unavailability instead of feature revocation. It now addresses the fourth active primary and requires publisher_required. Expanded hosted body timeout is seven minutes for the three retained 31-second admission cooldowns plus added RPC/browser operations; teardown retains its independent expiry budget. No rate-limit bypass or extra upload was added.
+
+Final authority self-review: revoked publisher primary clear explicitly requires publisher_required; replay of the successful stored publication key explicitly requires MEDIA_PUBLISH_ACCESS_REQUIRED; assigned-reviewer stored decision replay explicitly requires MEDIA_REVIEW_ACCESS_REQUIRED and isError. This distinguishes current authority loss from stale version, occupied primary, protected selection or missing-resource refusals. pnpm check:backend:generated passed against the staged generated API after local codegen. Hosted execution, copy approval, exact-resource Karly preview, deployment, production apply and push remain controller gates.
diff --git a/docs/engineering/media-review-commands.md b/docs/engineering/media-review-commands.md
index 90d65ff7..ed6cbec1 100644
--- a/docs/engineering/media-review-commands.md
+++ b/docs/engineering/media-review-commands.md
@@ -349,3 +349,15 @@ receipt metadata: `retryable`, `retryCategory`, `nextAction`, and optional bound
 correction, wait or inspection actions. Known backend codes travel as bounded `ConvexError.data.code`; raw backend
 exception text is not returned. Stale or unavailable profile-link targets persist
 a refusal on the exact revision. Terminal receipts remain authoritative on replay.
+
+## Bounded media-kit conversion
+
+Deploy backend schema/functions before the matching website/MCP candidate. New intake and pre-conversion admitted upload finalization both normalize uploaded contributions to gallery intent. Existing-asset identity replacement requests remain placement requests. Old review versions refuse after migration increments reviewRevision; inspect again before deciding. Existing declaration receipts remain historical, while fresh legacy declarations refuse as retired. Old clients publishing valid contributions now publish kit membership only, never implicitly choose a picture.
+
+Run `node --import tsx scripts/media-kit-publication-migration.mjs --target <approved-target> --limit 40` for one dry-run batch. The wrapper defaults to dry-run; `--apply` explicitly enables writes. Record each report's scanned/changed/skipped/conflicts, continueCursor and isDone. Follow continueCursor until isDone. Preview the entire traversal first; restart with a null cursor for the separately authorized apply traversal, inspect conflicts, and stop on drift. Do not reuse a preview's final cursor as the apply starting point. Each transaction scans 1..40 submissions and checks at most two indexed approved-asset matches. An ambiguous link is a conflict, never guessed provenance.
+
+Conversion preserves primary placements, uploaded renditions/digests, historical assertions, receipts, reviewers, accounting and legal holds. It backfills only uniquely linked active public community assets on public, published, unclaimed profiles. Only untouched legacy metadata (asset updatedAt equals immutable approval time (reviewedAt, or the trusted-publisher approved submission updatedAt), no current source URL/description, no contributor or owner profile metadata-correction audit) can initialize the immutable approved description. Any correction audit on the profile conservatively skips initialization; current provenance and intentional clears stay intact. Retained gallery references do not republish private media.
+
+Karly's approved submission handle is `x1747ftcbeq1k475kz4hqdn77d8fcz0r`. The correction is separate from generic conversion. A fresh authorized operator must resolve exact asset and placement IDs, the placement's own updatedAt and selectionOperationId. Never substitute profile or submission timestamps. Save those values with submissionId, expectedAssetId, expectedPlacementId, expectedPlacementUpdatedAt and expectedSelectionOperationId (explicit null for absent legacy provenance) in a local JSON file. Preview with `node --import tsx scripts/media-kit-publication-migration.mjs --target <approved-target> --correction-file <exact-preview.json>`. Apply requires separate exact-resource authorization and a fresh identical preview before adding `--apply`. Changed, reselected, duplicate, claimed, private, foreign, held or restricted resources refuse. The correction retires only the exact legacy primary placement and retains an active public gallery asset. It never selects a replacement picture or deletes bytes.
+
+Kit approval authorizes publication into the public media kit. Placement approval authorizes explicit use of an already published candidate as the picture. Logical removal hides an item but retains storage/accounting/history. Permanent byte deletion remains governed by existing cleanup and legal-hold policy.
diff --git a/docs/testing/mcp-media-staging-lifecycle.md b/docs/testing/mcp-media-staging-lifecycle.md
index c05291a5..85d2330c 100644
--- a/docs/testing/mcp-media-staging-lifecycle.md
+++ b/docs/testing/mcp-media-staging-lifecycle.md
@@ -253,4 +253,14 @@ The media-kit publication candidate extends this same opt-in fixture. Contributo
 
 The third image is a generated 64 by 48 PNG, distinct from both static source images. Assertions cover website publication without declarations, unchanged primary picture, selection and undo, metadata correction, ordinary review publication into the kit, explicit review comparison against a published candidate, protected removal refusal, and logical removal of an unused kit item. Removal keeps stored bytes and accounting until fixture teardown. The existing owner-claim refusal remains a separate final check.
 
+A fourth generated image exercises successful authenticated MCP upload, completion, inspection, preview, publication, contribution readback, metadata correction, replacement proposal and distinct assigned-reviewer approval. Public render and decoded download assertions follow publication. The earlier website asset also exercises successful MCP selection and undo. Discarding the first publication response models a lost client result, then exact-key replay recovers it. Guarded fixture controls edit only the run profile's biography, transfer its unchanged primary selection to the run reviewer, and revoke only the two run-owned feature grants. Assertions refuse publisher undo after same-asset reselection, stale reviewer decisions, and publisher/reviewer receipt replay after relevant feature revocation. The body has a seven-minute limit for the expanded network/browser round and the three existing upload-rate cooldowns; teardown retains its separate expiry budget.
+
 Teardown bounds and validates feature grants, batch revisions, attempts, assignments, media rows and receipts against the exact run actors before deleting them. Local Storybook and static Next screenshots prove UI fixture behavior only. Acceptance still requires the exact candidate deployed together to designated staging and an executed authenticated lifecycle with verified cleanup.
+
+## Task 6 acceptance and operator ordering
+
+Local migration tests, fixture receipts and catalog checks are preparedness, not live evidence. Required hosted acceptance remains pending until exact-candidate staging authorization and approval of Task4's exact public descriptions. Use the existing workflow_dispatch media_lifecycle route and its staging credentials; do not replace the assigned media_reviewer with site-admin authority.
+
+The executed run must show minted upload transfer, completion and same-key recovery, stored preview, kit publication without declaration, approved-state readback, public kit render and usable decoded download, select/undo, metadata correction, kit-only removal and independent existing-asset replacement. Publication with an existing picture must leave that picture unchanged. Check the deployed media-kit feature flag and public field visibility, unrelated biography edits, stale selection refusal, protected same-asset reselection, revoked publisher/reviewer authority and replay denial after revocation. Capture desktop/mobile public kit and unchanged/selected/restored picture screenshots. A successful Publish receipt alone is insufficient.
+
+After separately authorized deployment, preview bounded conversion from null cursor through isDone, review conflicts, then authorize apply from null cursor. Karly's exact-resource operator correction requires its own fresh preview using actual placement.updatedAt and selectionOperationId; public MCP/profile/submission timestamps cannot prove these guards. Production conversion/correction and its public render/download verification remain separate approval gates. Preserve the existing fixture expiry and exact-run cleanup assertions throughout.
diff --git a/scripts/media-kit-publication-migration.mjs b/scripts/media-kit-publication-migration.mjs
new file mode 100644
index 00000000..51d34ecc
--- /dev/null
+++ b/scripts/media-kit-publication-migration.mjs
@@ -0,0 +1,30 @@
+import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+import { fileURLToPath } from "node:url";
+import path from "node:path";
+import { convexCliPath, convexTargetEnv, resolveTargetName } from "./convex-target.ts";
+import { readOption, unknownOption } from "./publish-seed-batch.mjs";
+
+export function migrationInput(args) {
+  const values = ["--target", "--cursor", "--limit", "--correction-file"];
+  if (unknownOption(args, [...values, "--apply"], values)) throw new Error("Unknown or repeated migration option.");
+  const file = readOption(args, "--correction-file");
+  const dryRun = !args.includes("--apply");
+  if (file) return { operation: "correctPrimaryToKit", input: { ...JSON.parse(readFileSync(file, "utf8")), dryRun } };
+  const limit = Number(readOption(args, "--limit") ?? 40);
+  if (!Number.isInteger(limit) || limit < 1 || limit > 40) throw new Error("Migration limit must be 1..40.");
+  return { operation: "convertBatch", input: { dryRun, cursor: readOption(args, "--cursor") ?? null, limit } };
+}
+if (process.argv[1] && path.resolve(process.argv[1]) === fileURLToPath(import.meta.url)) {
+  const args = process.argv.slice(2);
+  const command = migrationInput(args);
+  const requested = resolveTargetName(args);
+  if (requested.error) throw new Error(requested.error);
+  const target = convexTargetEnv(requested.name);
+  if (!target.ok) throw new Error(target.error);
+  console.error(`convex ${target.label} (${target.deployment}), ${command.input.dryRun ? "dry-run" : "apply"}`);
+  const result = spawnSync(process.execPath, [convexCliPath, "run", `mediaKitPublicationMigration:${command.operation}`, JSON.stringify(command.input)],
+    { cwd: path.resolve(path.dirname(fileURLToPath(import.meta.url)), ".."), env: target.env, encoding: "utf8", windowsHide: true });
+  if (result.status !== 0) throw new Error(result.stderr || "Migration operation failed.");
+  console.log(result.stdout.trim());
+}
diff --git a/tests/backend/e2e-media.test.ts b/tests/backend/e2e-media.test.ts
index 0841bc5f..0c06de8b 100644
--- a/tests/backend/e2e-media.test.ts
+++ b/tests/backend/e2e-media.test.ts
@@ -662,6 +662,8 @@ describe("bounded staging media fixture", () => {
     const { t, args } = await seed();
     const result = await t.query(internal.e2eMedia.inspect, args);
     assert.equal(result.counts.submissions, 1);
+    assert.equal(result.mediaKitEnabled, true);
+    assert.equal(result.mediaKitPublic, true);
     const serialized = JSON.stringify(result);
     for (const forbidden of [
       "storageKey",
@@ -780,3 +782,42 @@ it("rejects publication fixture actor grants on production and foreign account g
   await assert.rejects(t.mutation(internal.e2eMedia.grantPublicationActors, args), /Staging media fixture is unavailable/);
   enable();
 });
+
+it("bounds publication guard controls to exact run actors and an unclaimed fixture", async () => {
+  const f = await seed();
+  await f.t.mutation(internal.e2eMedia.grantPublicationActors, f.args);
+  const before = await f.t.run(ctx => ctx.db.get(f.args.profileId));
+  await f.t.mutation(internal.e2eMedia.exercisePublicationGuards, { ...f.args, action: "edit_bio" });
+  const after = await f.t.run(ctx => ctx.db.get(f.args.profileId));
+  assert.notEqual(after?.updatedAt, before?.updatedAt);
+  await f.t.mutation(internal.e2eMedia.exercisePublicationGuards, { ...f.args, action: "revoke_actors" });
+  const grants = await f.t.run(ctx => ctx.db.query("accountFeatureGrants").collect());
+  assert.equal(grants.every(g => g.state === "revoked"), true);
+  await f.t.run(ctx => ctx.db.patch(f.args.profileId, { claimState: "claimed_verified" }));
+  await assert.rejects(f.t.mutation(internal.e2eMedia.exercisePublicationGuards, { ...f.args, action: "edit_bio" }), /Unclaimed fixture required/);
+});
+
+it("reselects only the exact public approved fixture asset without changing its primary", async () => {
+  const f = await seed();
+  await assert.rejects(f.t.mutation(internal.e2eMedia.exercisePublicationGuards, { ...f.args, action: "reselect_primary" }), /Exact published fixture selection required/);
+  const placementId = await f.t.run(async ctx => {
+    const upload = (await ctx.db.get(f.intent.intentId))!;
+    const assetId = await ctx.db.insert("profileAssets", { profileId: f.args.profileId, storageKey: upload.storageKey,
+      mimeType: "image/png", byteSize: 512, visibility: "public", source: "community_submitted",
+      uploadedBy: upload.requestedBy, uploadedAt: 10, updatedAt: 10, state: "active" });
+    await ctx.db.patch(f.intent.submissionId, { status: "approved", approvedAssetId: assetId });
+    return ctx.db.insert("profileAssetPlacements", { profileId: f.args.profileId, assetId, placement: "profile_image",
+      position: 0, state: "active", updatedAt: 10, selectionActorUserId: f.users.contributorId, selectionOperationId: "publisher-selection" });
+  });
+  const before = await f.t.run(ctx => ctx.db.get(placementId));
+  await f.t.mutation(internal.e2eMedia.exercisePublicationGuards, { ...f.args, action: "reselect_primary" });
+  const after = await f.t.run(ctx => ctx.db.get(placementId));
+  assert.equal(after?.assetId, before?.assetId);
+  assert.equal(after?.state, "active");
+  assert.equal(after?.selectionActorUserId, f.users.reviewerId);
+  assert.notEqual(after?.selectionOperationId, before?.selectionOperationId);
+  assert.ok(after!.updatedAt > before!.updatedAt);
+  await f.t.run(ctx => ctx.db.patch(before!.assetId, { visibility: "private" }));
+  await assert.rejects(f.t.mutation(internal.e2eMedia.exercisePublicationGuards, { ...f.args, action: "reselect_primary" }), /Exact published fixture selection required/);
+  assert.deepEqual(await f.t.run(ctx => ctx.db.get(placementId)), after);
+});
diff --git a/tests/backend/hosted-mcp-profile-media-contributions.test.ts b/tests/backend/hosted-mcp-profile-media-contributions.test.ts
index 63835ce0..7fb861a6 100644
--- a/tests/backend/hosted-mcp-profile-media-contributions.test.ts
+++ b/tests/backend/hosted-mcp-profile-media-contributions.test.ts
@@ -823,3 +823,26 @@ describe("hosted MCP profile media contributions", () => {
     );
   });
 });
+
+it("reconciles a legacy hosted URL admission into gallery without importing another candidate", async () => {
+  const f = await seed();
+  const prepared = await f.t.mutation(internal.profileMediaSubmissions.prepareMcpMediaSubmission, input(f.actorUserId));
+  assert.equal(prepared.status, "pending");
+  if (prepared.status !== "pending") throw new Error("Expected prepared fixture");
+  await f.t.run(async ctx => {
+    const intent = (await ctx.db.get(prepared.intentId))!;
+    await ctx.db.patch(intent.targetSubmissionId!, { requestKind: undefined, requestedPlacement: "profile_image" });
+    await ctx.db.patch(intent._id, { placements: ["profile_image"] });
+  });
+  const processingToken = crypto.randomUUID();
+  await f.t.mutation(internal.profileMediaSubmissions.claimMcpMediaSubmissionImport, { intentId: prepared.intentId, processingToken });
+  const completed = await f.t.mutation(internal.profileMediaSubmissions.markMcpMediaSubmissionImported, { intentId: prepared.intentId, processingToken, mimeType: "image/webp", byteSize: 128, contentSha256: "legacy-hosted-candidate" });
+  assert.equal(completed.status, "submitted");
+  const state = await f.t.run(async ctx => ({ intent: await ctx.db.get(prepared.intentId), rows: await ctx.db.query("profileMediaSubmissions").collect(), charges: await ctx.db.query("contributionUploadReservations").collect() }));
+  assert.deepEqual(state.intent?.placements, ["gallery"]);
+  assert.equal(state.rows.length, 1);
+  assert.equal(state.rows[0].requestKind, "kit_asset");
+  assert.equal(state.rows[0].reviewRevision, 1);
+  assert.equal(state.rows[0].sourceUrl, input(f.actorUserId).sourceUrl);
+  assert.equal(state.charges.length, 1);
+});
diff --git a/tests/backend/media-kit-publication-migration.test.ts b/tests/backend/media-kit-publication-migration.test.ts
new file mode 100644
index 00000000..739286d4
--- /dev/null
+++ b/tests/backend/media-kit-publication-migration.test.ts
@@ -0,0 +1,172 @@
+import assert from "node:assert/strict";
+import { it } from "node:test";
+import { convexTest } from "convex-test";
+import { makeFunctionReference } from "convex/server";
+import { modules, schema, seed, createAndUpload } from "./_mediaReviewFixture";
+const migrationModules = { ...modules, "../../convex/mediaKitPublicationMigration.ts": () => import("../../convex/mediaKitPublicationMigration") };
+const convert = makeFunctionReference<"mutation">("mediaKitPublicationMigration:convertBatch");
+process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true";
+process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED = "true";
+process.env.VRDEX_PROFILE_MEDIA_DIRECT_UPLOAD_ENABLED = "true";
+it("previews and converts a stored legacy candidate once without changing its bytes or evidence", async () => {
+  const t = convexTest({ schema, modules: migrationModules });
+  const s = await seed(t);
+  const { intent } = await createAndUpload(t, s);
+  await t.run(ctx => ctx.db.patch(intent.submissionId, { requestKind: undefined, requestedPlacement: "profile_image" }));
+  const before = await t.run(ctx => ctx.db.get(intent.submissionId));
+  const upload = await t.run(ctx => ctx.db.get(intent.intentId));
+  const preview = await t.mutation(convert, { dryRun: true, cursor: null, limit: 40 });
+  assert.equal(preview.changed, 1);
+  assert.deepEqual(await t.run(ctx => ctx.db.get(intent.submissionId)), before);
+  assert.equal((await t.mutation(convert, { dryRun: false, cursor: null, limit: 40 })).changed, 1);
+  const after = await t.run(ctx => ctx.db.get(intent.submissionId));
+  assert.equal(after?.requestKind, "kit_asset");
+  assert.equal(after?.requestedPlacement, "gallery");
+  assert.equal(after?.reviewRevision, (before?.reviewRevision ?? 0) + 1);
+  assert.equal(after?.contentSha256, before?.contentSha256);
+  assert.equal(after?.sourceUrl, before?.sourceUrl);
+  const nextUpload = await t.run(ctx => ctx.db.get(intent.intentId));
+  assert.equal(nextUpload?.storageKey, upload?.storageKey);
+  assert.equal(nextUpload?.contentSha256, upload?.contentSha256);
+  assert.equal((await t.mutation(convert, { dryRun: false, cursor: null, limit: 40 })).changed, 0);
+});
+it("rejects limits outside the bounded operator window", async () => {
+  const t = convexTest({ schema, modules: migrationModules });
+  for (const limit of [0, 41, 1.5]) await assert.rejects(t.mutation(convert, { dryRun: true, cursor: null, limit }));
+});
+
+const correct = makeFunctionReference<"mutation">("mediaKitPublicationMigration:correctPrimaryToKit");
+async function legacyFixture() {
+  const t = convexTest({ schema, modules: migrationModules });
+  const s = await seed(t);
+  const { intent } = await createAndUpload(t, s, "legacy-digest");
+  const assetId = await t.run(async ctx => {
+    const upload = (await ctx.db.get(intent.intentId))!;
+    const id = await ctx.db.insert("profileAssets", { profileId: s.profileId, storageKey: upload.storageKey,
+      mimeType: "image/webp", byteSize: 512, contentSha256: "legacy-digest", visibility: "public", source: "community_submitted",
+      uploadedBy: upload.requestedBy, uploadedAt: 10, updatedAt: 11, state: "active", credit: "Artist", label: "Image" });
+    await ctx.db.patch(intent.submissionId, { status: "approved", requestKind: undefined, approvedAssetId: id, sourceUrl: undefined, sourceDescription: "Original photograph", reviewedAt: 11 });
+    return id;
+  });
+  const placementId = await t.run(ctx => ctx.db.insert("profileAssetPlacements", { profileId: s.profileId, assetId, placement: "profile_image", position: 0, state: "active", updatedAt: 12 }));
+  return { t, s, intent, assetId, placementId, args: { dryRun: true, submissionId: intent.submissionId, expectedAssetId: assetId, expectedPlacementId: placementId, expectedPlacementUpdatedAt: 12, expectedSelectionOperationId: null } };
+}
+it("backfills unique public legacy provenance and gallery while preserving primary and immutable records", async () => {
+  const f = await legacyFixture();
+  const before = await f.t.run(ctx => ctx.db.get(f.intent.submissionId));
+  assert.equal((await f.t.mutation(convert, { dryRun: false, cursor: null, limit: 40 })).changed, 1);
+  const asset = await f.t.run(ctx => ctx.db.get(f.assetId));
+  assert.equal(asset?.sourceSubmissionId, f.intent.submissionId);
+  assert.equal(asset?.sourceDescription, "Original photograph");
+  assert.equal(asset?.contentSha256, "legacy-digest");
+  assert.deepEqual(await f.t.run(ctx => ctx.db.get(f.intent.submissionId)), before);
+  assert.equal((await f.t.run(ctx => ctx.db.get(f.placementId)))?.state, "active");
+  assert.equal((await f.t.mutation(convert, { dryRun: false, cursor: null, limit: 40 })).changed, 0);
+});
+it("refuses ambiguous asset provenance rather than choosing a submission", async () => {
+  const f = await legacyFixture();
+  await f.t.run(async ctx => { const { _id, _creationTime, ...fields } = (await ctx.db.get(f.intent.submissionId))!; await ctx.db.insert("profileMediaSubmissions", fields); });
+  assert.equal((await f.t.mutation(convert, { dryRun: false, cursor: null, limit: 40 })).conflicts, 2);
+  assert.equal((await f.t.run(ctx => ctx.db.get(f.assetId)))?.sourceSubmissionId, undefined);
+});
+it("previews exact legacy primary correction then preserves public active gallery bytes", async () => {
+  const f = await legacyFixture();
+  assert.equal((await f.t.mutation(correct, f.args)).code, "would_correct");
+  assert.equal((await f.t.run(ctx => ctx.db.get(f.placementId)))?.state, "active");
+  assert.equal((await f.t.mutation(correct, { ...f.args, dryRun: false })).code, "corrected");
+  assert.equal((await f.t.run(ctx => ctx.db.get(f.placementId)))?.state, "deleted");
+  assert.equal((await f.t.run(ctx => ctx.db.get(f.assetId)))?.state, "active");
+  const rows = await f.t.run(ctx => ctx.db.query("profileAssetPlacements").collect());
+  assert.deepEqual(rows.filter(p => p.state === "active").map(p => p.placement), ["gallery"]);
+  assert.equal((await f.t.mutation(correct, { ...f.args, dryRun: false })).changed, false);
+});
+it("refuses changed, reselected, claimed, private, held and foreign exact candidates", async () => {
+  for (const change of ["changed", "reselected", "claimed", "private", "held", "foreign"] as const) {
+    const f = await legacyFixture();
+    const other = change === "foreign" ? await seed(f.t, "community") : undefined;
+    await f.t.run(async ctx => {
+      if (change === "changed") await ctx.db.patch(f.placementId, { updatedAt: 13 });
+      if (change === "reselected") await ctx.db.patch(f.placementId, { selectionActorUserId: f.s.moderatorUserId, selectionOperationId: "owner-new-selection" });
+      if (change === "claimed") await ctx.db.patch(f.s.profileId, { claimState: "claimed_verified" });
+      if (change === "private") await ctx.db.patch(f.assetId, { visibility: "private" });
+      if (change === "held") await ctx.db.patch(f.intent.submissionId, { legalHoldAt: 14 });
+      if (change === "foreign") await ctx.db.patch(f.placementId, { profileId: other!.profileId });
+    });
+    assert.equal((await f.t.mutation(correct, { ...f.args, dryRun: false })).changed, false, change);
+    assert.equal((await f.t.run(ctx => ctx.db.get(f.placementId)))?.state, "active");
+  }
+});
+
+it("preserves intentional provenance clears and skips private or corrected legacy initialization", async () => {
+  for (const condition of ["current", "corrected", "audit", "owner_audit", "private"] as const) {
+    const f = await legacyFixture();
+    await f.t.run(async ctx => {
+      if (condition === "current") await ctx.db.patch(f.assetId, { sourceUrl: "https://current.example/source" });
+      if (condition === "corrected") await ctx.db.patch(f.assetId, { updatedAt: 20 });
+      if (condition === "private") await ctx.db.patch(f.assetId, { visibility: "private" });
+      if (condition === "audit" || condition === "owner_audit") await ctx.db.insert("profileAuditEvents", { profileId: f.s.profileId, action: condition === "owner_audit" ? "profile_asset_metadata_updated" : "profile_media_contribution_metadata_updated", actor: { subject: "operator", issuer: "test", tokenIdentifier: "operator" }, sourceType: "community", createdAt: 20 });
+    });
+    await f.t.mutation(convert, { dryRun: false, cursor: null, limit: 40 });
+    assert.equal((await f.t.run(ctx => ctx.db.get(f.assetId)))?.sourceDescription, undefined, condition);
+  }
+});
+
+
+it("finishes a pre-conversion admitted upload in gallery intent without replacing bytes or reservation", async () => {
+  const t = convexTest({ schema, modules: migrationModules });
+  const s = await seed(t);
+  const { api, internal } = await import("../../convex/_generated/api");
+  const intent = await t.withIdentity(s.contributorIdentity).mutation(api.profileMediaSubmissions.createUploadIntent, {
+    profileId: s.profileId, requestedPlacement: "profile_image", originalFileName: "before.webp", mimeType: "image/webp", byteSize: 512,
+    credit: "Artist", sourceUrl: "https://artist.example/source", expectedProfileUpdatedAt: (await t.run(ctx => ctx.db.get(s.profileId)))!.updatedAt,
+  });
+  await t.run(async ctx => { await ctx.db.patch(intent.submissionId, { requestKind: undefined, requestedPlacement: "profile_image" }); await ctx.db.patch(intent.intentId, { placements: ["profile_image"] }); });
+  const token = "processing-before-conversion";
+  await t.mutation(internal.profileAssets.claimUploadIntentForStorage, { intentId: intent.intentId, uploadToken: intent.uploadToken, processingToken: token });
+  await t.mutation(internal.profileAssets.markUploadIntentUploaded, { intentId: intent.intentId, uploadToken: intent.uploadToken, processingToken: token, mimeType: "image/webp", byteSize: 512, contentSha256: "admitted-digest" });
+  assert.deepEqual((await t.run(ctx => ctx.db.get(intent.intentId)))?.placements, ["gallery"]);
+  assert.equal((await t.run(ctx => ctx.db.get(intent.submissionId)))?.status, "submitted");
+  assert.equal((await t.run(ctx => ctx.db.query("contributionUploadReservations").collect())).length, 1);
+});
+
+it("refuses a duplicate active primary instead of correcting ambiguous placement", async () => {
+  const f = await legacyFixture();
+  await f.t.run(ctx => ctx.db.insert("profileAssetPlacements", { profileId: f.s.profileId, assetId: f.assetId, placement: "profile_image", position: 1, state: "active", updatedAt: 12 }));
+  assert.equal((await f.t.mutation(correct, { ...f.args, dryRun: false })).changed, false);
+});
+it("invalidates old review then publishes refreshed converted proposal without another upload or charge", async () => {
+  const t = convexTest({ schema, modules: migrationModules });
+  const s = await seed(t);
+  const { api } = await import("../../convex/_generated/api");
+  const { intent } = await createAndUpload(t, s, "review-converted");
+  await t.run(ctx => ctx.db.patch(intent.submissionId, { requestKind: undefined, requestedPlacement: "profile_image" }));
+  const actor = t.withIdentity(s.moderatorIdentity);
+  const before = await actor.query(api.profileMediaSubmissions.reviewDetail, { submissionId: intent.submissionId });
+  const stored = await t.run(ctx => ctx.db.get(intent.intentId));
+  await t.mutation(convert, { dryRun: false, cursor: null, limit: 40 });
+  const stale = await actor.mutation(api.profileMediaSubmissions.decideWithReceipt, { submissionId: intent.submissionId, expectedReviewVersion: before!.reviewVersion, decision: "approve", privateReason: "Synthetic stale", idempotencyKey: "stale-converted" });
+  assert.equal(stale.code, "review_changed");
+  const after = await actor.query(api.profileMediaSubmissions.reviewDetail, { submissionId: intent.submissionId });
+  assert.notEqual(after?.reviewVersion, before?.reviewVersion);
+  const receipt = await actor.mutation(api.profileMediaSubmissions.decideWithReceipt, { submissionId: intent.submissionId, expectedReviewVersion: after!.reviewVersion, decision: "approve", privateReason: "Synthetic refreshed", idempotencyKey: "fresh-converted" });
+  assert.equal(receipt.operationState, "committed");
+  const asset = await t.run(ctx => ctx.db.query("profileAssets").first());
+  assert.equal(asset?.storageKey, stored?.storageKey);
+  assert.equal(asset?.contentSha256, stored?.contentSha256);
+  assert.deepEqual((await t.run(ctx => ctx.db.query("profileAssetPlacements").collect())).map(row => row.placement), ["gallery"]);
+  const charge = await t.run(ctx => ctx.db.query("contributionUploadReservations").first());
+  await t.mutation(convert, { dryRun: false, cursor: null, limit: 40 });
+  assert.deepEqual(await t.run(ctx => ctx.db.query("contributionUploadReservations").first()), charge);
+  assert.equal((await t.run(ctx => ctx.db.query("profileAssets").collect())).length, 1);
+});
+it("preserves restricted legacy primary and refuses exact correction", async () => {
+  const f = await legacyFixture();
+  await f.t.run(ctx => ctx.db.insert("mediaPublicationRestrictions", { profileId: f.s.profileId, kind: "identity", submissionId: f.intent.submissionId, createdAt: Date.now(), actorUserId: f.s.moderatorUserId }));
+  assert.equal((await f.t.mutation(correct, { ...f.args, dryRun: false })).changed, false);
+});
+
+it("does not add gallery references for a restricted legacy contribution", async () => {
+  const f = await legacyFixture();
+  await f.t.run(ctx => ctx.db.insert("mediaPublicationRestrictions", { profileId: f.s.profileId, kind: "dispute", submissionId: f.intent.submissionId, createdAt: Date.now(), actorUserId: f.s.moderatorUserId }));
+  assert.equal((await f.t.mutation(convert, { dryRun: false, cursor: null, limit: 40 })).changed, 0);
+});
diff --git a/tests/scripts/media-kit-publication-migration.test.ts b/tests/scripts/media-kit-publication-migration.test.ts
new file mode 100644
index 00000000..8c105a95
--- /dev/null
+++ b/tests/scripts/media-kit-publication-migration.test.ts
@@ -0,0 +1,9 @@
+import assert from "node:assert/strict";
+import { it } from "node:test";
+import { migrationInput } from "../../scripts/media-kit-publication-migration.mjs";
+it("defaults bounded migration to dry-run and requires explicit apply", () => {
+  assert.deepEqual(migrationInput([]), { operation: "convertBatch", input: { dryRun: true, cursor: null, limit: 40 } });
+  assert.deepEqual(migrationInput(["--apply", "--limit", "1", "--cursor", "next"]), { operation: "convertBatch", input: { dryRun: false, cursor: "next", limit: 1 } });
+  assert.throws(() => migrationInput(["--limit", "41"]));
+  assert.throws(() => migrationInput(["--oops"]));
+});

From a9d5fe1e74cfe15a560f9e28f85311a26982bd58 Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Tue, 6 Oct 2026 02:02:52 -0400
Subject: [PATCH 14/28] fix(media): guard kit publication and private review
 placement

---
 convex/_mediaReview.ts                        |  24 ++++
 convex/_trustedPublication.ts                 |   3 +
 convex/profileMediaSubmissions.ts             |  12 +-
 docs/engineering/media-review-commands.md     |   6 +-
 tests/backend/media-kit-admission.test.ts     | 107 ++++++++++++++++++
 tests/backend/media-review-assignment.test.ts |   2 +-
 6 files changed, 145 insertions(+), 9 deletions(-)
 create mode 100644 tests/backend/media-kit-admission.test.ts

diff --git a/convex/_mediaReview.ts b/convex/_mediaReview.ts
index feb34a03..38b8e64b 100644
--- a/convex/_mediaReview.ts
+++ b/convex/_mediaReview.ts
@@ -128,6 +128,25 @@ export const reviewActorAttestationArgs = {
   emailVerified: v.optional(v.boolean()),
   emailVerificationAttestedAt: v.optional(v.number()),
 };
+export function publicKitAvailable(profile: Doc<"profiles">) {
+  return process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED === "true" &&
+    isProfileFieldVisible(profile, "mediaKit", "profile_page");
+}
+export async function outwardReviewSnapshot(
+  ctx: Pick<QueryCtx, "db">, submission: Doc<"profileMediaSubmissions">,
+  profile: Doc<"profiles">, elevated = false,
+) {
+  const snapshot = await reviewSnapshot(ctx, submission, profile);
+  if (submission.requestKind !== "identity_placement") return { ...snapshot, currentPlacement: null };
+  const placement = snapshot.currentPlacement;
+  const asset = placement ? await ctx.db.get(placement.assetId) : null;
+  const field = submission.requestedPlacement === "profile_image" ? "avatarImageUrl"
+    : submission.requestedPlacement === "banner" ? "bannerImageUrl" : "mediaKit";
+  return { ...snapshot, currentPlacement: (!elevated && (!asset || asset.visibility !== "public" || asset.state !== "active" ||
+      asset.retiredAt !== undefined || asset.moderatorSuppressedAt !== undefined ||
+      profile.publicationState !== "published" || profile.publicSurfacingState !== "public" ||
+      !isProfileFieldVisible(profile, field, "profile_page"))) ? null : placement };
+}
 function assertContributionsEnabled() {
   if (process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED !== "true")
     throw new ConvexError({
@@ -244,6 +263,9 @@ export async function applyReviewDecision(
     actor,
     submission,
   );
+  if (args.decision === "approve" && submission.requestKind !== "identity_placement" &&
+    !publicKitAvailable(profile))
+    throw new ConvexError({ code: "MEDIA_RESOURCE_UNAVAILABLE", message: "Media contribution unavailable." });
   if (submission.submitterUserId === user._id) {
     throw new ConvexError({
       code: "MEDIA_SELF_REVIEW",
@@ -691,6 +713,8 @@ export async function decideReviewCommand(
     profile.publicSurfacingState !== "public"
   )
     code = "target_unavailable";
+  else if (args.decision === "approve" && submission.requestKind !== "identity_placement" &&
+    !publicKitAvailable(profile)) code = "target_unavailable";
   else if (snapshot.reviewVersion !== args.expectedReviewVersion)
     code = "review_changed";
   else if (
diff --git a/convex/_trustedPublication.ts b/convex/_trustedPublication.ts
index 52c8849b..653651eb 100644
--- a/convex/_trustedPublication.ts
+++ b/convex/_trustedPublication.ts
@@ -6,6 +6,7 @@ import { getAccountFeatureAccess } from "./_accountFeatures";
 import {
   assertReviewActorVerified,
   reviewSnapshot,
+  publicKitAvailable,
   type ReviewActor,
 } from "./_mediaReview";
 import {
@@ -146,6 +147,8 @@ async function publicationOrLegacyDeclaration(
   let code =
     process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED !== "true"
       ? "review_disabled"
+      : !publicKitAvailable(profile)
+        ? "target_unavailable"
       : !["submitted", "under_review"].includes(submission.status)
         ? "already_decided"
         : submission.expiresAt <= Date.now()
diff --git a/convex/profileMediaSubmissions.ts b/convex/profileMediaSubmissions.ts
index 32344563..eab92f5e 100644
--- a/convex/profileMediaSubmissions.ts
+++ b/convex/profileMediaSubmissions.ts
@@ -4,7 +4,7 @@ import { effectiveContributionPolicy, contributionChargeRefusal, registerLegacyC
 import { requirePublisher, publicationCommand, legacyDeclarationCommand, recordPublicationRestriction } from "./_trustedPublication";
 import { readScopedPagination, writeScopedPagination } from "./_reviewCursor";
 import type { PaginationOptions } from "convex/server";
-import { activeBatchAssignment, hash } from "./_mediaReview";
+import { activeBatchAssignment, hash, publicKitAvailable, outwardReviewSnapshot } from "./_mediaReview";
 import {
   reviewRebaseSchema,
   contributionManageCommandSchema,
@@ -1177,7 +1177,7 @@ export const listMine = query({
     return await Promise.all(
       rows.map(async (submission) => {
         const profile = await ctx.db.get(submission.profileId);
-        return profile === null ? null : { ...publicSubmission(submission, profile, true), publisherTargetAvailable: profile.claimState === "unclaimed" && profile.publicationState === "published" && profile.publicSurfacingState === "public" };
+        return profile === null ? null : { ...publicSubmission(submission, profile, true), publisherTargetAvailable: publicKitAvailable(profile) && profile.claimState === "unclaimed" && profile.publicationState === "published" && profile.publicSurfacingState === "public" };
       }),
     ).then((items) => items.filter((item) => item !== null));
   },
@@ -1209,7 +1209,7 @@ async function ownSubmission(
         .withIndex("by_submissionId", (q) => q.eq("submissionId", submission._id))
     .unique();
   const revision = attempt ? await ctx.db.get(attempt.revisionId) : null;
-  const { placementTargetVersion: _placementTargetVersion, ...snapshot } = await reviewSnapshot(ctx, submission, profile);
+  const { placementTargetVersion: _placementTargetVersion, ...snapshot } = await outwardReviewSnapshot(ctx, submission, profile);
   const asset = submission.approvedAssetId
     ? await ctx.db.get(submission.approvedAssetId)
     : null;
@@ -1254,7 +1254,7 @@ async function ownSubmission(
         }
       : {}),
     ...(attempt ? { receipt: attempt.receipt } : {}),
-    publisherTargetAvailable: profile.claimState === "unclaimed" && profile.publicationState === "published" && profile.publicSurfacingState === "public",
+    publisherTargetAvailable: publicKitAvailable(profile) && profile.claimState === "unclaimed" && profile.publicationState === "published" && profile.publicSurfacingState === "public",
   };
 }
 async function ownSubmissionPage(
@@ -2146,7 +2146,7 @@ async function authorizedReviewDetail(
   const profile =
     submission === null ? null : await ctx.db.get(submission.profileId);
   if (submission === null || profile === null) return null;
-  const access = publisher ? { access: { superAdmin: false } } : await reviewerContext(ctx, profile, actor, submission);
+  const access = publisher ? { access: { superAdmin: false }, ownsProfile: false } : await reviewerContext(ctx, profile, actor, submission);
   if (publisher) await requirePublisher(ctx, actor ?? (await browserReviewActor(ctx)), submission, profile,
     );
   const projection = await reviewSubmission(
@@ -2155,7 +2155,7 @@ async function authorizedReviewDetail(
     profile,
     access.access.superAdmin,
   );
-  const { placementTargetVersion: _placementTargetVersion, ...snapshot } = await reviewSnapshot(ctx, submission, profile);
+  const { placementTargetVersion: _placementTargetVersion, ...snapshot } = await outwardReviewSnapshot(ctx, submission, profile, access.ownsProfile || access.access.superAdmin);
   return {
     ...projection,
     ...snapshot,
diff --git a/docs/engineering/media-review-commands.md b/docs/engineering/media-review-commands.md
index ed6cbec1..c2794e57 100644
--- a/docs/engineering/media-review-commands.md
+++ b/docs/engineering/media-review-commands.md
@@ -339,8 +339,10 @@ input/key after response loss and expose Retry. Opposing controls stay locked.
 Unresolved single-review cards remain mounted even if the committed item leaves
 the reactive queue. Publication cards remain mounted while their command is
 unresolved, including when the own-inventory row changes to approved before a
-lost publish response is recovered. Pending recovery survives reactive updates in the mounted
-page, not a full browser reload.
+lost publish response is recovered. Decision, rebase and withdrawal recovery survives
+reactive updates in the mounted page, not a full browser reload. Publication and
+published contribution commands persist exact pending input/key in sessionStorage
+across same-tab reloads, including metadata drafts. Retry reuses that saved input/key.
 
 Upload and collection MCP failures use allowlisted bounded codes and structured
 receipt metadata: `retryable`, `retryCategory`, `nextAction`, and optional bounded
diff --git a/tests/backend/media-kit-admission.test.ts b/tests/backend/media-kit-admission.test.ts
new file mode 100644
index 00000000..c11c4d51
--- /dev/null
+++ b/tests/backend/media-kit-admission.test.ts
@@ -0,0 +1,107 @@
+import assert from "node:assert/strict";
+import { it } from "node:test";
+import { convexTest } from "convex-test";
+import { api, internal } from "../../convex/_generated/api";
+import { modules, schema, seed, createAndUpload, NOW } from "./_mediaReviewFixture";
+process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED = "true";
+process.env.VRDEX_PROFILE_MEDIA_DIRECT_UPLOAD_ENABLED = "true";
+process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true";
+async function fixture(assigned = false) {
+  const t = convexTest({ schema, modules }); const s = await seed(t);
+  const { intent } = await createAndUpload(t, s);
+  await t.run(ctx => ctx.db.insert("accountFeatureGrants", { userId: s.contributorUserId,
+    feature: "trusted_publisher", state: "active", grantedBy: { issuer: "test", subject: "operator", tokenIdentifier: "test:operator" },
+    grantedAt: Date.now(), updatedAt: Date.now() }));
+  if (assigned) await t.run(async ctx => {
+    const grant = (await ctx.db.query("accountFeatureGrants").collect()).find(g => g.userId === s.moderatorUserId)!;
+    await ctx.db.patch(grant._id, { feature: "media_reviewer" });
+    const batchId = await ctx.db.insert("contributionBatches", { actorUserId: s.contributorUserId, idempotencyKey: "collection", label: "Collection", archived: false, rowCount: 1, createdAt: NOW });
+    const revisionId = await ctx.db.insert("contributionItemRevisions", { actorUserId: s.contributorUserId, batchId, itemKey: "one", revision: 1, payload: JSON.stringify({kind: "media"}), bytes: 10, createdAt: NOW });
+    await ctx.db.insert("contributionItemAttempts", { actorUserId: s.contributorUserId, revisionId, oauthClientId: "fixture", submissionId: intent.submissionId, intentId: intent.intentId, receipt: { operationId: "one", operationState: "committed" }, createdAt: NOW });
+    await ctx.db.insert("contributionBatchReviewers", { batchId, reviewerUserId: s.moderatorUserId, active: true, expiresAt: Date.now() + 600000 });
+  });
+  return { t, s, intent };
+}
+for (const transport of ["browser", "mcp"] as const) for (const operation of ["publisher", "reviewer", "legacy"] as const)
+for (const mode of ["hidden", "disabled", "changed"] as const) {
+  if (transport === "mcp" && operation === "legacy") continue;
+  it(`${transport} ${operation} refuses ${mode} kit without consuming or charging`, async () => {
+    const { t, s, intent } = await fixture(operation !== "publisher");
+    const publisher = operation === "publisher";
+    const actor = t.withIdentity(publisher ? s.contributorIdentity : s.moderatorIdentity);
+    const attestation = { actorUserId: publisher ? s.contributorUserId : s.moderatorUserId,
+      emailVerified: true, emailVerificationAttestedAt: Date.now(), submissionId: intent.submissionId };
+    const inspect = () => transport === "browser" ? actor.query(publisher ? api.profileMediaSubmissions.publisherDetail : api.profileMediaSubmissions.reviewDetail, { submissionId: intent.submissionId })
+      : t.query(publisher ? internal.profileMediaSubmissions.publisherDetailForMcpActor : internal.profileMediaSubmissions.reviewDetailForMcpActor, attestation);
+    const initial = await inspect(); assert.ok(initial);
+    const before = await t.run(async ctx => ({ submission: await ctx.db.get(intent.submissionId), upload: await ctx.db.get(intent.intentId), reservations: await ctx.db.query("contributionUploadReservations").collect(), capacity: await ctx.db.query("contributionCapacity").collect() }));
+    if (mode === "disabled") process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "false";
+    else await t.run(ctx => ctx.db.patch(s.profileId, { fieldVisibility: { mediaKit: "private" } }));
+    try {
+      assert.equal((await t.withIdentity(s.contributorIdentity).query(api.profileMediaSubmissions.listMine, {}))[0]?.publisherTargetAvailable, false);
+      assert.equal((await t.withIdentity(s.contributorIdentity).query(api.profileMediaSubmissions.getMine, { submissionId: intent.submissionId }))?.publisherTargetAvailable, false);
+      const detail = mode === "changed" ? initial : await inspect(); assert.ok(detail);
+      const command = { submissionId: intent.submissionId, expectedReviewVersion: detail.reviewVersion, idempotencyKey: crypto.randomUUID() };
+      if (operation === "legacy") {
+        await assert.rejects(actor.mutation(api.profileMediaSubmissions.decide, { submissionId: intent.submissionId, decision: "approve", expectedProfileUpdatedAt: NOW, privateReason: "Review" }), /Media contribution unavailable/);
+      } else {
+        const execute = () => transport === "browser" ? publisher ? actor.mutation(api.profileMediaSubmissions.publish, command) : actor.mutation(api.profileMediaSubmissions.decideWithReceipt, { ...command, decision: "approve", privateReason: "Review" })
+          : publisher ? t.mutation(internal.profileMediaSubmissions.publishForMcpActor, { ...attestation, ...command }) : t.mutation(internal.profileMediaSubmissions.decideForMcpActor, { ...attestation, ...command, decision: "approve", privateReason: "Review" });
+        const receipt = await execute(); assert.equal(receipt.operationState, "refused"); assert.equal(receipt.code, "target_unavailable");
+        process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true";
+        await t.run(ctx => ctx.db.patch(s.profileId, { fieldVisibility: undefined }));
+        assert.deepEqual(await execute(), receipt);
+      }
+      assert.deepEqual(await t.run(async ctx => ({ submission: await ctx.db.get(intent.submissionId), upload: await ctx.db.get(intent.intentId), reservations: await ctx.db.query("contributionUploadReservations").collect(), capacity: await ctx.db.query("contributionCapacity").collect() })), before);
+      assert.equal((await t.run(ctx => ctx.db.query("profileAssets").collect())).length, 0);
+    } finally { process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true"; }
+  });
+}
+for (const mode of ["private", "field-hidden"] as const) for (const identity of [false, true]) {
+  it(`redacts ${mode} ${identity ? "identity" : "additive"} sibling in browser and MCP, preserves private admin review`, async () => {
+    const { t, s, intent } = await fixture();
+    await t.run(async ctx => {
+      if (identity) await ctx.db.patch(intent.submissionId, { requestKind: "identity_placement", requestedPlacement: "profile_image" });
+      if (mode === "field-hidden") await ctx.db.patch(s.profileId, { fieldVisibility: identity ? { avatarImageUrl: "private" } : { mediaKit: "private" } });
+      const assetId = await ctx.db.insert("profileAssets", { profileId: s.profileId, storageKey: "private", mimeType: "image/png", byteSize: 100,
+        visibility: mode === "private" ? "private" : "public", source: "owner_authored", uploadedBy: { issuer: "test", subject: "owner", tokenIdentifier: "test:owner" },
+        uploadedAt: NOW, updatedAt: NOW, state: "active", credit: "Private credit", sourceUrl: "https://private.example/source" });
+      await ctx.db.insert("profileAssetPlacements", { profileId: s.profileId, assetId, placement: identity ? "profile_image" : "gallery", position: 0, state: "active", updatedAt: NOW });
+    });
+    const browser = await t.withIdentity(s.contributorIdentity).query(api.profileMediaSubmissions.publisherDetail, { submissionId: intent.submissionId });
+    const mcp = await t.query(internal.profileMediaSubmissions.publisherDetailForMcpActor, { submissionId: intent.submissionId, actorUserId: s.contributorUserId, emailVerified: true, emailVerificationAttestedAt: Date.now() });
+    assert.equal(browser?.currentPlacement, null); assert.equal(mcp?.currentPlacement, null);
+    const admin = await t.withIdentity(s.moderatorIdentity).query(api.profileMediaSubmissions.reviewDetail, { submissionId: intent.submissionId });
+    const adminMcp = await t.query(internal.profileMediaSubmissions.reviewDetailForMcpActor, { submissionId: intent.submissionId, actorUserId: s.moderatorUserId, emailVerified: true, emailVerificationAttestedAt: Date.now() });
+    assert.equal(admin?.currentPlacement?.credit, identity ? "Private credit" : undefined);
+    assert.deepEqual(adminMcp?.currentPlacement, admin?.currentPlacement);
+    await t.run(async ctx => {
+      await ctx.db.patch(s.profileId, { claimState: "claimed_verified" });
+      await ctx.db.insert("profileOwners", { profileId: s.profileId, userId: s.moderatorUserId,
+        roleKey: "owner", state: "active", grantedAt: NOW, updatedAt: NOW });
+      const grant = (await ctx.db.query("accountFeatureGrants").collect()).find(g => g.userId === s.moderatorUserId)!;
+      await ctx.db.patch(grant._id, { state: "revoked" });
+    });
+    const owner = await t.withIdentity(s.moderatorIdentity).query(api.profileMediaSubmissions.reviewDetail, { submissionId: intent.submissionId });
+    const ownerMcp = await t.query(internal.profileMediaSubmissions.reviewDetailForMcpActor, { submissionId: intent.submissionId, actorUserId: s.moderatorUserId, emailVerified: true, emailVerificationAttestedAt: Date.now() });
+    assert.deepEqual(owner?.currentPlacement, admin?.currentPlacement);
+    assert.deepEqual(ownerMcp?.currentPlacement, admin?.currentPlacement);
+  });
+}
+
+it("replays exact successful receipts after kit privacy or gate changes", async () => {
+  for (const publisher of [false, true]) {
+    const { t, s, intent } = await fixture(!publisher);
+    const actor = t.withIdentity(publisher ? s.contributorIdentity : s.moderatorIdentity);
+    const detail = await actor.query(publisher ? api.profileMediaSubmissions.publisherDetail : api.profileMediaSubmissions.reviewDetail, { submissionId: intent.submissionId });
+    assert.ok(detail);
+    const command = { submissionId: intent.submissionId, expectedReviewVersion: detail.reviewVersion, idempotencyKey: "historical" };
+    const execute = () => publisher ? actor.mutation(api.profileMediaSubmissions.publish, command)
+      : actor.mutation(api.profileMediaSubmissions.decideWithReceipt, { ...command, decision: "approve", privateReason: "Review" });
+    const receipt = await execute(); assert.equal(receipt.operationState, "committed");
+    await t.run(ctx => ctx.db.patch(s.profileId, { fieldVisibility: { mediaKit: "private" } }));
+    process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "false";
+    try { assert.deepEqual(await execute(), receipt); }
+    finally { process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true"; }
+  }
+});
diff --git a/tests/backend/media-review-assignment.test.ts b/tests/backend/media-review-assignment.test.ts
index 14328bf2..c74106a7 100644
--- a/tests/backend/media-review-assignment.test.ts
+++ b/tests/backend/media-review-assignment.test.ts
@@ -522,7 +522,7 @@ it("refuses assigned approval of a private replacement with a stable receipt, in
     submissionId: f.intent.submissionId,
   });
   assert.ok(detail);
-  assert.equal(detail.currentPlacement?.assetId, assetId);
+  assert.equal(detail.currentPlacement, null);
   assert.equal(await f.actor.query(api.profileMediaSubmissions.getCurrentForStorage, {
     submissionId: f.intent.submissionId,
     assetId,

From f2829265dc2aa7fe7431bbc6a73223e756a6c009 Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Tue, 6 Oct 2026 11:37:47 -0400
Subject: [PATCH 15/28] docs: quote recovery log pattern for MDX

---
 docs/engineering/media-kit-publication-task-6-report.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/docs/engineering/media-kit-publication-task-6-report.md b/docs/engineering/media-kit-publication-task-6-report.md
index d9775717..6d86ccee 100644
--- a/docs/engineering/media-kit-publication-task-6-report.md
+++ b/docs/engineering/media-kit-publication-task-6-report.md
@@ -21,7 +21,7 @@ Hosted preparedness: guarded inspection now returns only mediaKitEnabled/mediaKi
 
 Karly: controller performed separate read-only connected MCP preparation. Worker has not read production. Actual placement.updatedAt, selectionOperationId and claim eligibility still require fresh exact operator preview; no profile/submission timestamp substitution. No live conversion, correction, deployment, credentials, dispatch or push.
 
-Recovery milestone: 56/56 focused backend checks passed (migration 12, hosted URL admission 15, staging fixture 29), including a new same-asset reselection control check proving asset/state preservation, reviewer authority transfer, timing change and private-resource refusal. Operator wrapper remains 1/1. Recovery web and backend typechecks, web lint, markdown (198 files) and local Convex codegen/health passed. Logs: task-6-recovery-{focused,wrapper,web-typecheck,backend-typecheck,web-lint,markdown,codegen}.log. Local Convex retry required network permission only to fetch its backend version, then health returned ok. Prior whole-backend 1320/1320 and web 618/618 evidence remains saved; only the added fixture test and hosted preparedness changed during recovery, so those broader suites were not repeated.
+Recovery milestone: 56/56 focused backend checks passed (migration 12, hosted URL admission 15, staging fixture 29), including a new same-asset reselection control check proving asset/state preservation, reviewer authority transfer, timing change and private-resource refusal. Operator wrapper remains 1/1. Recovery web and backend typechecks, web lint, markdown (198 files) and local Convex codegen/health passed. Logs: `task-6-recovery-{focused,wrapper,web-typecheck,backend-typecheck,web-lint,markdown,codegen}.log`. Local Convex retry required network permission only to fetch its backend version, then health returned ok. Prior whole-backend 1320/1320 and web 618/618 evidence remains saved; only the added fixture test and hosted preparedness changed during recovery, so those broader suites were not repeated.
 
 Self-review finding fixed: the final revoked-primary assertion previously addressed an already removed website asset, which could prove resource unavailability instead of feature revocation. It now addresses the fourth active primary and requires publisher_required. Expanded hosted body timeout is seven minutes for the three retained 31-second admission cooldowns plus added RPC/browser operations; teardown retains its independent expiry budget. No rate-limit bypass or extra upload was added.
 

From b3b4b377fd1ff581407bcff2d36b0dba167bdb05 Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Tue, 6 Oct 2026 11:43:45 -0400
Subject: [PATCH 16/28] fix: align contribution management capabilities with
 feature gates

---
 convex/_mediaContributionCommands.ts          |  5 +--
 .../media-contribution-commands.test.ts       | 32 +++++++++++++++++++
 2 files changed, 35 insertions(+), 2 deletions(-)

diff --git a/convex/_mediaContributionCommands.ts b/convex/_mediaContributionCommands.ts
index 58e97490..a27b3a4e 100644
--- a/convex/_mediaContributionCommands.ts
+++ b/convex/_mediaContributionCommands.ts
@@ -1,7 +1,7 @@
 import { ConvexError } from "convex/values";
 import type { MutationCtx, QueryCtx } from "./_generated/server";
 import { getAccountFeatureAccess } from "./_accountFeatures";
-import { assertReviewActorVerified, hash, reviewSnapshot, type ReviewActor } from "./_mediaReview";
+import { assertReviewActorVerified, hash, publicKitAvailable, reviewSnapshot, type ReviewActor } from "./_mediaReview";
 import { selectProfileAssetIdentity, PROFILE_MEDIA_SUBMISSION_RETENTION_MS,
   sanitizeProfileAssetLabel, sanitizeProfileAssetAltText, sanitizeProfileAssetCredit,
   sanitizeProfileAssetCreditUrl, normalizeProfileAssetSourceUrl } from "./_profileAssets";
@@ -49,7 +49,8 @@ async function contributionState(ctx: QueryCtx | MutationCtx, submissionId: stri
     q.eq("assetId", asset._id).eq("state", "active")).take(20);
   const protectedSelection = assetPlacements.length === 20 || assetPlacements.some(row => row.placement !== "gallery" ||
     (row.selectionActorUserId !== undefined && row.selectionActorUserId !== actor.user._id));
-  const ownKitOnly = kitVisible && !restrictions.some(Boolean) && asset.state === "active" &&
+  const ownKitOnly = process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED === "true" &&
+    publicKitAvailable(profile) && kitVisible && !restrictions.some(Boolean) && asset.state === "active" &&
     !protectedSelection;
   return { submission, profile, asset, placement, snapshot, current, identityPlacements, publisher, publicUnclaimed, restrictions, ownSelection, kitVisible, ownKitOnly, protectedSelection,
     version: await hash({ asset, source: submission, placement: current, assetPlacements, picture: snapshot.currentImage, restrictions, publicUnclaimed, revision: snapshot.reviewVersion }) };
diff --git a/tests/backend/media-contribution-commands.test.ts b/tests/backend/media-contribution-commands.test.ts
index 8a3f519b..3fe3bcbd 100644
--- a/tests/backend/media-contribution-commands.test.ts
+++ b/tests/backend/media-contribution-commands.test.ts
@@ -464,3 +464,35 @@ it("browser inventory hides logically removed and unavailable contributions and
   await second.t.run(ctx => ctx.db.patch(current!.assetId, { moderatorSuppressedAt: Date.now() }));
   assert.equal(await second.detail(), null);
 });
+
+for (const gate of ["VRDEX_PROFILE_MEDIA_KIT_ENABLED", "VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED"] as const) {
+  it(`disables management capabilities and new commands when ${gate} is disabled, preserving receipts`, async () => {
+    const f = await fixture();
+    const d = await f.detail();
+    const priorArgs = { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion,
+      idempotencyKey: "before-disabled", action: "update_metadata" as const, metadata: { credit: "Corrected credit" } };
+    const prior = await f.actor.mutation(api.profileMediaSubmissions.manageContribution, priorArgs);
+    assert.equal(prior.operationState, "committed");
+    const fresh = await f.detail();
+    const before = await f.t.run(ctx => ctx.db.get(fresh.assetId));
+    const previousGate = process.env[gate];
+    process.env[gate] = "false";
+    try {
+      const disabled = await f.detail();
+      assert.equal(disabled.canEditMetadata, false);
+      assert.equal(disabled.canRemove, false);
+      for (const action of ["update_metadata", "remove"] as const) {
+        const receipt = await f.actor.mutation(api.profileMediaSubmissions.manageContribution, {
+          submissionId: f.intent.submissionId, expectedContributionVersion: fresh.contributionVersion,
+          idempotencyKey: `disabled-${action}`, action, ...(action === "update_metadata" ? { metadata: priorArgs.metadata } : {}),
+        });
+        assert.equal(receipt.operationState, "refused");
+        assert.equal(receipt.code, "review_disabled");
+      }
+      assert.deepEqual(await f.actor.mutation(api.profileMediaSubmissions.manageContribution, priorArgs), prior);
+      assert.deepEqual(await f.t.run(ctx => ctx.db.get(fresh.assetId)), before);
+    } finally {
+      process.env[gate] = previousGate;
+    }
+  });
+}

From b89889f60d6e0db08745332b9b1c03a66c6ccf25 Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Tue, 6 Oct 2026 11:51:48 -0400
Subject: [PATCH 17/28] fix(media): admit gallery uploads and retain legacy
 provenance

---
 convex/_profileAssets.ts                      |  5 ++-
 convex/contributionUploads.ts                 |  2 +-
 docs/testing/local-media-upload.md            |  2 +-
 packages/api-contracts/src/media-upload.ts    |  2 +-
 .../tests/contribution-batches.test.ts        |  1 +
 tests/backend/contribution-uploads.test.ts    | 20 ++++++++-
 tests/backend/media-kit-admission.test.ts     | 43 +++++++++++++++++++
 7 files changed, 70 insertions(+), 5 deletions(-)

diff --git a/convex/_profileAssets.ts b/convex/_profileAssets.ts
index b0cd8410..cf17fed0 100644
--- a/convex/_profileAssets.ts
+++ b/convex/_profileAssets.ts
@@ -1088,7 +1088,10 @@ export async function finalizeProfileAssetUploadIntentUpload(
     await settleLegacyContribution(db,intent,input);
     if (submission.requestKind !== "identity_placement" && (submission.requestKind !== "kit_asset" || submission.requestedPlacement !== "gallery")) {
       await db.patch(submission._id, { requestKind: "kit_asset", requestedPlacement: "gallery", reviewRevision: (submission.reviewRevision ?? 0) + 1 });
-      await db.patch(intent._id, { placements: ["gallery"] });
+      await db.patch(intent._id, {
+        placements: ["gallery"],
+        ...(intent.sourceUrl === undefined ? { sourceUrl: submission.sourceUrl } : {}),
+      });
     }
     await db.patch(submission._id, {
       status: "submitted",
diff --git a/convex/contributionUploads.ts b/convex/contributionUploads.ts
index 5f044415..b1f40f25 100644
--- a/convex/contributionUploads.ts
+++ b/convex/contributionUploads.ts
@@ -190,7 +190,7 @@ export const begin = internalMutation({
     mode: v.union(v.literal("owner"), v.literal("contributor")),
     profileId: v.id("profiles"),
     expectedUpdatedAt: v.number(),
-    placement: v.union(v.literal("profile_image"), v.literal("primary_logo")),
+    placement: v.union(v.literal("profile_image"), v.literal("primary_logo"), v.literal("gallery")),
     contentType: v.string(),
     byteLength: v.number(),
     sha256: v.string(),
diff --git a/docs/testing/local-media-upload.md b/docs/testing/local-media-upload.md
index eb6df35d..9912f1bc 100644
--- a/docs/testing/local-media-upload.md
+++ b/docs/testing/local-media-upload.md
@@ -61,7 +61,7 @@ Reservations initially charge two source-sized objects plus two 12 MiB derivativ
 
 ## Contracts
 
-`vrdex_media_upload_begin` accepts owner or contributor mode, profile revision, image/logo placement, declared MIME, byte length, SHA-256, credit, bounded provenance, and an idempotency key. A local image needs a source URL or a bounded source description. Local provenance is explicit in stored review data; existing URL intake still requires its source URL. Batch/item references bind an actor-owned staged revision and its exact declaration.
+`vrdex_media_upload_begin` accepts owner or contributor mode, profile revision, placement (`gallery`, `profile_image`, or `primary_logo`), declared MIME, byte length, SHA-256, credit, bounded provenance, and an idempotency key. Contributor mode admits gallery directly and normalizes legacy identity placements to gallery; owner mode retains its profile-type identity placement restriction. A local image needs a source URL or a bounded source description. Local provenance is explicit in stored review data; existing URL intake still requires its source URL. Batch/item references bind an actor-owned staged revision and its exact declaration.
 
 Successful admission contains only intent ID, expiry, and the POST URL/form fields with `fileField: "file"`. Quota refusal instead returns a stable terminal command receipt before any upload or counter write. Each actor can retain up to 256 admission-refusal receipts across OAuth clients. At that cap, a new refusal returns `UPLOAD_REFUSAL_RECEIPT_LIMIT` as an unadmitted error with no operation ID or status-queryable receipt. Existing receipts still replay, and valid new admissions remain available. An incomplete 8 MiB bounded count also fails closed for a fresh refusal. Only the random quarantine key is exposed in those form fields. The complete command accepts the intent ID and idempotency key, revalidates delegation, and returns a durable receipt. The backend requires `mcp:write` plus `assets:write` for owner mode or `assets:contribute` for contributor mode. Contributor completion creates a private proposal regardless of other grants. Owner mode uses existing owner asset finalization.
 
diff --git a/packages/api-contracts/src/media-upload.ts b/packages/api-contracts/src/media-upload.ts
index 9d6224f1..7242e398 100644
--- a/packages/api-contracts/src/media-upload.ts
+++ b/packages/api-contracts/src/media-upload.ts
@@ -3,7 +3,7 @@ export const localUploadRequestSchema = z.strictObject({
   mode: z.enum(["owner", "contributor"]),
   profileId: z.string().min(1).max(200),
   expectedUpdatedAt: z.number().int().nonnegative(),
-  placement: z.enum(["profile_image", "primary_logo"]),
+  placement: z.enum(["profile_image", "primary_logo", "gallery"]),
   contentType: z.enum([
     "image/png",
     "image/jpeg",
diff --git a/packages/api-contracts/tests/contribution-batches.test.ts b/packages/api-contracts/tests/contribution-batches.test.ts
index 34c01a15..f1ebd84c 100644
--- a/packages/api-contracts/tests/contribution-batches.test.ts
+++ b/packages/api-contracts/tests/contribution-batches.test.ts
@@ -133,6 +133,7 @@ it("requires source URL or description for a local upload", () => {
     credit: "Artist",
     idempotencyKey: "upload",
   };
+  assert.equal(localUploadRequestSchema.safeParse({ ...input, placement: "gallery", sourceUrl: "https://artist.example/source" }).success, true);
   assert.equal(localUploadRequestSchema.safeParse(input).success, false);
   assert.equal(localUploadRequestSchema.safeParse({ ...input, sourceUrl: "   " }).success, false);
   assert.equal(localUploadRequestSchema.safeParse({ ...input, sourceUrl: "https://artist.example/source" }).success, true);
diff --git a/tests/backend/contribution-uploads.test.ts b/tests/backend/contribution-uploads.test.ts
index 2c5a4701..3e6445bd 100644
--- a/tests/backend/contribution-uploads.test.ts
+++ b/tests/backend/contribution-uploads.test.ts
@@ -135,6 +135,7 @@ it("rechecks current ownership before replaying a completed admission", async ()
 async function fixture(
   mode: "owner" | "contributor" = "contributor",
   bytesRead?: number,
+  placement: "profile_image" | "primary_logo" | "gallery" = "profile_image",
 ) {
   const t = convexTest({
     schema,
@@ -179,7 +180,7 @@ async function fixture(
     mode,
     profileId: s.profileId,
     expectedUpdatedAt: NOW,
-    placement: "profile_image" as const,
+    placement,
     contentType: "image/png",
     byteLength: 512,
     sha256: "a".repeat(64),
@@ -623,3 +624,20 @@ it("scheduled proposal cleanup advances past a failed batch before retrying it",
     true,
   );
 });
+
+for (const mode of ["owner", "contributor"] as const) {
+  it(`admits actual gallery uploads only through contributor authority: ${mode}`, async () => {
+    if (mode === "owner") {
+      await assert.rejects(fixture(mode, undefined, "gallery"), /UPLOAD_PLACEMENT_INVALID/);
+      return;
+    }
+    const f = await fixture(mode, undefined, "gallery");
+    assert.ok(f.begun.intentId);
+    const stored = await f.t.run(async ctx => ({ intent: await ctx.db.get(f.begun.intentId), submission: await ctx.db.query("profileMediaSubmissions").first() }));
+    assert.deepEqual(stored.intent?.placements, ["gallery"]);
+    assert.equal(stored.submission?.requestedPlacement, "gallery");
+    assert.equal(stored.submission?.requestKind, "kit_asset");
+    await f.t.mutation(internal.contributionUploads.claim, f.claimInput);
+    assert.equal((await f.t.mutation(internal.contributionUploads.complete, f.completeInput)).operationState, "committed");
+  });
+}
diff --git a/tests/backend/media-kit-admission.test.ts b/tests/backend/media-kit-admission.test.ts
index c11c4d51..18c9531e 100644
--- a/tests/backend/media-kit-admission.test.ts
+++ b/tests/backend/media-kit-admission.test.ts
@@ -105,3 +105,46 @@ it("replays exact successful receipts after kit privacy or gate changes", async
     finally { process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true"; }
   }
 });
+
+for (const publisher of [false, true]) for (const currentSource of [false, true]) {
+  it(`preserves legacy browser provenance through ${publisher ? "publication" : "approval"}, current source=${currentSource}`, async () => {
+    const t = convexTest({ schema, modules }); const s = await seed(t);
+    const actor = t.withIdentity(s.contributorIdentity);
+    const upload = await actor.mutation(api.profileMediaSubmissions.createUploadIntent, {
+      profileId: s.profileId, requestedPlacement: "profile_image", originalFileName: "legacy.webp",
+      mimeType: "image/webp", byteSize: 512, sourceUrl: "https://artist.example/original",
+      credit: "Original credit", expectedProfileUpdatedAt: NOW,
+    });
+    await t.run(async ctx => {
+      await ctx.db.patch(upload.submissionId, { requestKind: undefined, requestedPlacement: "profile_image" });
+      await ctx.db.patch(upload.intentId, { placements: ["profile_image"], sourceUrl: currentSource ? "https://artist.example/current" : undefined });
+      if (publisher) await ctx.db.insert("accountFeatureGrants", { userId: s.contributorUserId,
+        feature: "trusted_publisher", state: "active", grantedBy: { issuer: "test", subject: "operator", tokenIdentifier: "test:operator" },
+        grantedAt: Date.now(), updatedAt: Date.now() });
+    });
+    const processingToken = "legacy-worker";
+    await t.mutation(internal.profileAssets.claimUploadIntentForStorage, { intentId: upload.intentId, uploadToken: upload.uploadToken, processingToken });
+    await t.mutation(internal.profileAssets.markUploadIntentUploaded, { intentId: upload.intentId, uploadToken: upload.uploadToken,
+      processingToken, mimeType: "image/webp", byteSize: 512, contentSha256: "legacy-source", width: 800, height: 800 });
+    const before = await t.run(async ctx => ({ capacity: await ctx.db.query("contributionCapacity").collect(), reservations: await ctx.db.query("contributionUploadReservations").collect() }));
+    if (publisher) {
+      const detail = await actor.query(api.profileMediaSubmissions.publisherDetail, { submissionId: upload.submissionId }); assert.ok(detail);
+      assert.equal((await actor.mutation(api.profileMediaSubmissions.publish, { submissionId: upload.submissionId,
+        expectedReviewVersion: detail.reviewVersion, idempotencyKey: "legacy-publish" })).operationState, "committed");
+    } else await t.withIdentity(s.moderatorIdentity).mutation(api.profileMediaSubmissions.decide, {
+      submissionId: upload.submissionId, decision: "approve", expectedProfileUpdatedAt: NOW, privateReason: "Review" });
+    const after = await t.run(async ctx => ({ assets: await ctx.db.query("profileAssets").collect(), placements: await ctx.db.query("profileAssetPlacements").collect(),
+      profile: await ctx.db.get(s.profileId), capacity: await ctx.db.query("contributionCapacity").collect(), reservations: await ctx.db.query("contributionUploadReservations").collect() }));
+    assert.equal(after.assets.length, 1);
+    assert.equal(after.assets[0]?.sourceUrl, currentSource ? "https://artist.example/current" : "https://artist.example/original");
+    assert.equal(after.assets[0]?.credit, "Original credit");
+    assert.deepEqual(after.placements.map(p => p.placement), ["gallery"]);
+    assert.equal(after.profile?.avatarImageUrl, undefined);
+    assert.ok(before.reservations.length === 1 && after.reservations.length === 1);
+    assert.ok(after.capacity.every(row => row.processing === 0));
+    const reservation = after.reservations[0]!;
+    assert.equal(reservation.publishedBytes, before.reservations[0]!.chargedBytes - reservation.quarantineBytes);
+    assert.equal(after.capacity.find(row => row.scope === "published")?.bytes, reservation.publishedBytes);
+    assert.equal(reservation.chargedBytes, reservation.quarantineBytes);
+  });
+}

From 11daf00851ce4114878d7196efcbe4361d4808a8 Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Tue, 13 Oct 2026 04:33:39 -0400
Subject: [PATCH 18/28] fix(media): gate placement and preserve draft
 inspection versions

---
 .../e2e/trusted-publication.visual.spec.ts    | 22 ++++++++++
 .../app/_components/profile-public-page.tsx   |  2 +-
 .../published-contribution-card.tsx           | 32 ++++++++------
 .../media-review-assigned.stories.tsx         |  3 +-
 .../trusted-publication.stories.tsx           | 15 +++++++
 convex/_mediaContributionCommands.ts          | 13 +++---
 docs/engineering/media-review-commands.md     |  2 +
 .../media-contribution-commands.test.ts       | 44 ++++++++++++++++++-
 8 files changed, 111 insertions(+), 22 deletions(-)

diff --git a/apps/web/e2e/trusted-publication.visual.spec.ts b/apps/web/e2e/trusted-publication.visual.spec.ts
index 6e984437..2c7cd07a 100644
--- a/apps/web/e2e/trusted-publication.visual.spec.ts
+++ b/apps/web/e2e/trusted-publication.visual.spec.ts
@@ -65,6 +65,9 @@ test("published actions follow capabilities and retain corrections on conflict @
   await page.getByRole("button", { name: "Save", exact: true }).click();
   await expect(page.getByText("Review changed. Inspect the current images before deciding again.", { exact: true })).toBeVisible();
   await expect(page.getByLabel("Title", { exact: true })).toHaveValue("Corrected portrait");
+  await page.getByRole("button", { name: "Cancel", exact: true }).click();
+  await page.getByRole("button", { name: "Edit metadata" }).click();
+  await page.getByLabel("Title", { exact: true }).fill("Corrected portrait");
   await page.getByRole("button", { name: "Save", exact: true }).click();
   await expect(page.getByRole("heading", { name: "Corrected portrait" })).toBeVisible();
   await page.getByRole("button", { name: "Remove", exact: true }).click();
@@ -125,3 +128,22 @@ test("logical removal recovery survives unavailable detail and reload @storybook
   await expect(page.getByText("Removed", { exact: true })).toBeVisible();
   expect(JSON.parse((await page.getByTestId("removal-commands").textContent())!)[0]).toEqual(first);
 });
+
+for (const reload of [false, true]) {
+  test(`metadata draft retains inspected version after live correction${reload ? " and reload" : ""} @storybook-visual`, async ({ page }, testInfo) => {
+    await gotoComponentStory(page, "account-trusted-publication--concurrent-metadata");
+    await page.getByRole("button", { name: "Edit metadata" }).click();
+    await page.getByLabel("Title", { exact: true }).fill("Draft portrait");
+    await page.getByRole("button", { name: "Live correction" }).click();
+    await expect(page.getByText("Live corrected credit", { exact: true })).toBeVisible();
+    if (reload) await page.reload();
+    await expect(page.getByLabel("Title", { exact: true })).toHaveValue("Draft portrait");
+    await expect(page.getByLabel("Credit", { exact: true })).toHaveValue("Fixture photographer");
+    await page.getByRole("button", { name: "Save", exact: true }).click();
+    await expect(page.getByText("Review changed. Inspect the current images before deciding again.", { exact: true })).toBeVisible();
+    const calls = JSON.parse((await page.getByTestId("concurrent-commands").textContent())!);
+    expect(calls[0].expectedContributionVersion).toBe("c1");
+    expect(calls[0].metadata.credit).toBe("Fixture photographer");
+    await captureStorybookScreenshot(page, testInfo, `concurrent-draft-${reload ? "restored" : "live"}`);
+  });
+}
diff --git a/apps/web/src/app/_components/profile-public-page.tsx b/apps/web/src/app/_components/profile-public-page.tsx
index 939a93a1..9c34b3ea 100644
--- a/apps/web/src/app/_components/profile-public-page.tsx
+++ b/apps/web/src/app/_components/profile-public-page.tsx
@@ -361,7 +361,7 @@ function MediaAssetCard({ asset, label, featured = false }: { asset: PublicProfi
         {asset.caption ? <p className="leading-6 text-muted">{asset.caption}</p> : null}
         {creditUrl ? (
           <a className="w-fit break-all text-xs text-muted underline underline-offset-4" href={creditUrl}>
-            {asset.credit || "Open source"}
+            {asset.credit || "Credit"}
           </a>
         ) : asset.credit ? (
           <p className="text-xs text-muted">{asset.credit}</p>
diff --git a/apps/web/src/app/account/media-contributions/published-contribution-card.tsx b/apps/web/src/app/account/media-contributions/published-contribution-card.tsx
index b0cbe058..5d187c60 100644
--- a/apps/web/src/app/account/media-contributions/published-contribution-card.tsx
+++ b/apps/web/src/app/account/media-contributions/published-contribution-card.tsx
@@ -9,6 +9,7 @@ import { Field, Input, Textarea } from "@/components/ui/field";
 import { Notice } from "@/components/ui/notice";
 import { reviewDecisionMessage } from "../media-review/media-review-view";
 
+type MetadataDraft = { contributionVersion: string; metadata: PublishedContributionDetail["metadata"] };
 type Pending = { kind: "manage"; input: ContributionManageCommand } | { kind: "place"; input: ContributionPlacementCommand } | { kind: "propose"; input: ContributionCommandBase };
 export function PublishedContributionCard({ submissionId }: { submissionId: Id<"profileMediaSubmissions"> }) {
   const detail = useQuery(api.profileMediaSubmissions.contributionDetail, { submissionId });
@@ -31,16 +32,18 @@ export function PublishedContributionCardView({ submissionId, detail, manage, pl
   const [ready, setReady] = useState(false);
   const [message, setMessage] = useState<string | null>(null);
   const [editing, setEditing] = useState(false);
-  const [draft, setDraft] = useState<PublishedContributionDetail["metadata"] | null>(null);
+  const [draft, setDraft] = useState<MetadataDraft | null>(null);
   const [removed, setRemoved] = useState(false);
   useEffect(() => {
     try {
       const saved = JSON.parse(sessionStorage.getItem(storageKey) ?? "null") as Pending | null;
       const parsed = saved?.kind === "manage" ? contributionManageCommandSchema.safeParse(saved.input) : saved?.kind === "place" ? contributionPlacementCommandSchema.safeParse(saved.input) : saved?.kind === "propose" ? contributionCommandBaseSchema.safeParse(saved.input) : null;
-      const savedDraft = publishedContributionDetailSchema.shape.metadata.safeParse(JSON.parse(sessionStorage.getItem(draftKey) ?? "null"));
+      const savedDraft: unknown = JSON.parse(sessionStorage.getItem(draftKey) ?? "null");
+      const savedMetadata = savedDraft && typeof savedDraft === "object" && "metadata" in savedDraft ? publishedContributionDetailSchema.shape.metadata.safeParse(savedDraft.metadata) : null;
+      const savedVersion = savedDraft && typeof savedDraft === "object" && "contributionVersion" in savedDraft ? savedDraft.contributionVersion : null;
       queueMicrotask(() => {
         if (parsed?.success && parsed.data.submissionId === submissionId) { setPending(saved); setMessage("Outcome unknown"); }
-        if (savedDraft.success) { setDraft(savedDraft.data); setEditing(true); }
+        if (savedMetadata?.success && typeof savedVersion === "string" && savedVersion) { setDraft({ contributionVersion: savedVersion, metadata: savedMetadata.data }); setEditing(true); }
       });
     } catch { /* Corrupt local state cannot authorize a command. */ }
     queueMicrotask(() => setReady(true));
@@ -65,15 +68,16 @@ export function PublishedContributionCardView({ submissionId, detail, manage, pl
   }
   function base() { return { submissionId, expectedContributionVersion: detail!.contributionVersion, idempotencyKey: crypto.randomUUID() }; }
   function update(name: keyof PublishedContributionDetail["metadata"], value: string) {
-    const next = { ...(draft ?? detail!.metadata), [name]: value };
+    const initial = draft ?? { contributionVersion: detail!.contributionVersion, metadata: detail!.metadata };
+    const next = { ...initial, metadata: { ...initial.metadata, [name]: value } };
     setDraft(next);
     try { sessionStorage.setItem(draftKey, JSON.stringify(next)); } catch { setMessage("Submission failed"); }
   }
   function save(event: FormEvent) {
     event.preventDefault();
     if (!detail || !draft || pending || busy || !detail.canEditMetadata) return;
-    const metadata = Object.fromEntries(Object.entries(draft).map(([key, value]) => [key, value?.trim() || null]));
-    void run({ kind: "manage", input: { ...base(), action: "update_metadata", metadata } });
+    const metadata = Object.fromEntries(Object.entries(draft.metadata).map(([key, value]) => [key, value?.trim() || null]));
+    void run({ kind: "manage", input: { ...base(), expectedContributionVersion: draft.contributionVersion, action: "update_metadata", metadata } });
   }
   const locked = !ready || busy || pending !== null;
   if (removed) return <Notice role="status">Removed</Notice>;
@@ -85,22 +89,22 @@ export function PublishedContributionCardView({ submissionId, detail, manage, pl
       <img className="h-64 w-full rounded-card bg-surface-raised object-contain" src={`/api/v0/profiles/${encodeURIComponent(detail.profileSlug)}/assets/${encodeURIComponent(detail.assetId)}/file`} alt={detail.metadata.altText || detail.metadata.label} />
       <h3 className="font-medium">{detail.metadata.label}</h3>
       <p className="break-words text-sm">{detail.metadata.credit}</p>
-      {detail.metadata.sourceUrl ? <a className="w-fit break-words text-sm underline [overflow-wrap:anywhere]" href={detail.metadata.sourceUrl} target="_blank" rel="noreferrer">{detail.metadata.sourceDescription || "Open source"}</a> : <p className="break-words text-sm text-muted [overflow-wrap:anywhere]">{detail.metadata.sourceDescription}</p>}
+      {detail.metadata.sourceUrl ? <a className="w-fit break-words text-sm underline [overflow-wrap:anywhere]" href={detail.metadata.sourceUrl} target="_blank" rel="noreferrer">{detail.metadata.sourceDescription || "Source"}</a> : <p className="break-words text-sm text-muted [overflow-wrap:anywhere]">{detail.metadata.sourceDescription}</p>}
       <div className="flex flex-wrap gap-2">
         {detail.canSelectPrimary ? <Button type="button" disabled={locked} onClick={() => void run({ kind: "place", input: { ...base(), action: "select_primary" } })}>Select picture</Button> : null}
         {detail.canClearPrimary ? <Button type="button" variant="ghost" disabled={locked} onClick={() => void run({ kind: "place", input: { ...base(), action: "clear_primary" } })}>Clear picture</Button> : null}
         {detail.canProposePlacement ? <Button type="button" variant="ghost" disabled={locked} onClick={() => void run({ kind: "propose", input: base() })}>Request replacement</Button> : null}
-        {detail.canEditMetadata ? <Button type="button" variant="ghost" disabled={locked} onClick={() => { setDraft(draft ?? detail.metadata); setEditing(true); }}>Edit metadata</Button> : null}
+        {detail.canEditMetadata ? <Button type="button" variant="ghost" disabled={locked} onClick={() => { const initial = draft ?? { contributionVersion: detail.contributionVersion, metadata: detail.metadata }; setDraft(initial); setEditing(true); try { sessionStorage.setItem(draftKey, JSON.stringify(initial)); } catch { setMessage("Submission failed"); } }}>Edit metadata</Button> : null}
         {detail.canRemove ? <Button type="button" variant="dangerGhost" disabled={locked} onClick={() => void run({ kind: "manage", input: { ...base(), action: "remove" } })}>Remove</Button> : null}
       </div>
       {editing && draft ? <form className="grid gap-4" onSubmit={save}>
         <fieldset disabled={locked} className="grid gap-4 sm:grid-cols-2">
-          <Field>Title<Input required maxLength={80} value={draft.label} onChange={e => update("label", e.target.value)} /></Field>
-          <Field>Credit<Input required maxLength={120} value={draft.credit} onChange={e => update("credit", e.target.value)} /></Field>
-          <Field>Credit URL<Input type="url" maxLength={4096} value={draft.creditUrl ?? ""} onChange={e => update("creditUrl", e.target.value)} /></Field>
-          <Field>Source URL<Input type="url" maxLength={4096} value={draft.sourceUrl ?? ""} onChange={e => update("sourceUrl", e.target.value)} /></Field>
-          <Field>Alt text<Input maxLength={180} value={draft.altText ?? ""} onChange={e => update("altText", e.target.value)} /></Field>
-          <Field>Source description<Textarea maxLength={1000} rows={3} value={draft.sourceDescription ?? ""} onChange={e => update("sourceDescription", e.target.value)} /></Field>
+          <Field>Title<Input required maxLength={80} value={draft.metadata.label} onChange={e => update("label", e.target.value)} /></Field>
+          <Field>Credit<Input required maxLength={120} value={draft.metadata.credit} onChange={e => update("credit", e.target.value)} /></Field>
+          <Field>Credit URL<Input type="url" maxLength={4096} value={draft.metadata.creditUrl ?? ""} onChange={e => update("creditUrl", e.target.value)} /></Field>
+          <Field>Source URL<Input type="url" maxLength={4096} value={draft.metadata.sourceUrl ?? ""} onChange={e => update("sourceUrl", e.target.value)} /></Field>
+          <Field>Alt text<Input maxLength={180} value={draft.metadata.altText ?? ""} onChange={e => update("altText", e.target.value)} /></Field>
+          <Field>Source description<Textarea maxLength={1000} rows={3} value={draft.metadata.sourceDescription ?? ""} onChange={e => update("sourceDescription", e.target.value)} /></Field>
         </fieldset>
         <div className="flex gap-2"><Button type="submit" disabled={locked || !detail.canEditMetadata}>Save</Button><Button type="button" variant="ghost" disabled={locked} onClick={() => { setEditing(false); setDraft(null); sessionStorage.removeItem(draftKey); }}>Cancel</Button></div>
       </form> : null}
diff --git a/apps/web/src/components/media-review-assigned.stories.tsx b/apps/web/src/components/media-review-assigned.stories.tsx
index 368154a9..ed903a73 100644
--- a/apps/web/src/components/media-review-assigned.stories.tsx
+++ b/apps/web/src/components/media-review-assigned.stories.tsx
@@ -143,6 +143,7 @@ function ProductionPanelFixture({
     let responseLost = loseResponse;
     const detail = {
       ...row,
+      requestKind: "identity_placement",
       targetProfileUpdatedAt: 2,
       reviewVersion: "v2",
       currentPlacement: null,
@@ -179,7 +180,7 @@ function ProductionPanelFixture({
             };
           if (name.endsWith(":reviewDetail")) return detail;
           return {
-            page: removed ? [] : [row],
+            page: removed ? [] : [{ ...row, requestKind: "identity_placement" }],
             isDone: true,
             continueCursor: "",
           };
diff --git a/apps/web/src/components/trusted-publication.stories.tsx b/apps/web/src/components/trusted-publication.stories.tsx
index b61254fe..76dcc090 100644
--- a/apps/web/src/components/trusted-publication.stories.tsx
+++ b/apps/web/src/components/trusted-publication.stories.tsx
@@ -201,3 +201,18 @@ function RemovedUncertainFixture() {
     }} /><output className="sr-only" data-testid="removal-commands">{JSON.stringify(calls)}</output></main>;
 }
 export const RemovedUncertain: Story = { render: () => <RemovedUncertainFixture /> };
+
+function ConcurrentMetadataFixture() {
+  const [corrected, setCorrected] = useState(() => sessionStorage.getItem("fixture:concurrent-correction") === "true");
+  const [calls, setCalls] = useState<unknown[]>([]);
+  const detail = { ...publishedFixture, contributionVersion: corrected ? "c2" : "c1", metadata: { ...publishedFixture.metadata, credit: corrected ? "Live corrected credit" : publishedFixture.metadata.credit } };
+  return <main className="mx-auto max-w-4xl p-4">
+    <button onClick={() => { sessionStorage.setItem("fixture:concurrent-correction", "true"); setCorrected(true); }}>Live correction</button>
+    <PublishedContributionCardView submissionId={detail.submissionId} detail={detail}
+      place={async () => ({ operationId: "unused", operationState: "refused" })}
+      propose={async () => ({ operationId: "unused", operationState: "refused" })}
+      manage={async input => { setCalls(previous => [...previous, input]); return input.expectedContributionVersion === detail.contributionVersion ? { operationId: "saved", operationState: "committed" } : { operationId: "stale", operationState: "refused", code: "contribution_changed" }; }} />
+    <output className="sr-only" data-testid="concurrent-commands">{JSON.stringify(calls)}</output>
+  </main>;
+}
+export const ConcurrentMetadata: Story = { render: () => <ConcurrentMetadataFixture /> };
diff --git a/convex/_mediaContributionCommands.ts b/convex/_mediaContributionCommands.ts
index a27b3a4e..87ab8e89 100644
--- a/convex/_mediaContributionCommands.ts
+++ b/convex/_mediaContributionCommands.ts
@@ -49,10 +49,12 @@ async function contributionState(ctx: QueryCtx | MutationCtx, submissionId: stri
     q.eq("assetId", asset._id).eq("state", "active")).take(20);
   const protectedSelection = assetPlacements.length === 20 || assetPlacements.some(row => row.placement !== "gallery" ||
     (row.selectionActorUserId !== undefined && row.selectionActorUserId !== actor.user._id));
-  const ownKitOnly = process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED === "true" &&
+  const submissionsEnabled = process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED === "true";
+  const newPlacementAvailable = submissionsEnabled && publicKitAvailable(profile);
+  const ownKitOnly = submissionsEnabled &&
     publicKitAvailable(profile) && kitVisible && !restrictions.some(Boolean) && asset.state === "active" &&
     !protectedSelection;
-  return { submission, profile, asset, placement, snapshot, current, identityPlacements, publisher, publicUnclaimed, restrictions, ownSelection, kitVisible, ownKitOnly, protectedSelection,
+  return { submission, profile, asset, placement, snapshot, current, identityPlacements, publisher, submissionsEnabled, newPlacementAvailable, publicUnclaimed, restrictions, ownSelection, kitVisible, ownKitOnly, protectedSelection,
     version: await hash({ asset, source: submission, placement: current, assetPlacements, picture: snapshot.currentImage, restrictions, publicUnclaimed, revision: snapshot.reviewVersion }) };
 }
 
@@ -64,9 +66,9 @@ export async function publishedContributionDetail(ctx: QueryCtx | MutationCtx, s
     contributionVersion: s.version,
     metadata: { label: metadata.label ?? "Image", altText: metadata.altText, credit: metadata.credit ?? "",
       creditUrl: metadata.creditUrl, sourceUrl: metadata.sourceUrl, sourceDescription: metadata.sourceDescription },
-    canSelectPrimary: s.publisher && !s.identityPlacements.length && !s.snapshot.currentImage,
-    canClearPrimary: s.publisher && s.ownSelection,
-    canProposePlacement: s.publicUnclaimed && !s.restrictions.some(Boolean) && !s.ownSelection && !!(s.identityPlacements.length || s.snapshot.currentImage),
+    canSelectPrimary: s.newPlacementAvailable && s.publisher && !s.identityPlacements.length && !s.snapshot.currentImage,
+    canClearPrimary: s.submissionsEnabled && s.publisher && s.ownSelection,
+    canProposePlacement: s.newPlacementAvailable && s.publicUnclaimed && !s.restrictions.some(Boolean) && !s.ownSelection && !!(s.identityPlacements.length || s.snapshot.currentImage),
     canEditMetadata: s.ownKitOnly, canRemove: s.ownKitOnly && s.submission.legalHoldAt === undefined,
   };
 }
@@ -86,6 +88,7 @@ async function command(ctx: MutationCtx, input: ContributionCommandBase | Contri
   let code = process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED !== "true" ? "review_disabled" :
     !s.publicUnclaimed ? "target_unavailable" : s.restrictions.some(Boolean) ? "publication_restricted" :
     !proposal && !s.publisher ? "publisher_required" : s.version !== args.expectedContributionVersion ? "contribution_changed" :
+    (proposal || selecting) && !s.newPlacementAvailable ? "target_unavailable" :
     !proposal && selecting && (s.identityPlacements.length || s.snapshot.currentImage) ? "primary_occupied" :
     !proposal && !selecting && !s.ownSelection ? "selection_changed" : undefined;
   if (!code && proposal) {
diff --git a/docs/engineering/media-review-commands.md b/docs/engineering/media-review-commands.md
index c2794e57..0697aafe 100644
--- a/docs/engineering/media-review-commands.md
+++ b/docs/engineering/media-review-commands.md
@@ -103,6 +103,8 @@ The receipt path is the required interface for new browser/MCP clients.
 
 ## Published contribution placement
 
+New primary selection and replacement proposals require enabled submissions and a visible, enabled public media kit. Clearing an unchanged selection made by the contributor requires enabled submissions and current publisher authority, but remains available if the kit is hidden or disabled. Historical exact-input receipts retain their existing authority checks. Metadata drafts retain the contribution version inspected when editing began, including after reload; a concurrent correction refuses the stale draft rather than overwriting newer metadata.
+
 `contributionDetail` and its internal MCP actor counterpart resolve the immutable
 source submission and active public asset. `placeContribution` accepts the source
 submission ID, expected contribution version, actor-scoped idempotency key, and
diff --git a/tests/backend/media-contribution-commands.test.ts b/tests/backend/media-contribution-commands.test.ts
index 3fe3bcbd..7afd50fe 100644
--- a/tests/backend/media-contribution-commands.test.ts
+++ b/tests/backend/media-contribution-commands.test.ts
@@ -412,7 +412,7 @@ it("treats visible automatic artwork as occupied and refuses hidden authored ide
     await selectProfileAssetIdentity(ctx.db, { profileId: f.s.profileId, assetId: asset._id, placement: "primary_logo", actorUserId: f.s.moderatorUserId, now: Date.now() });
   });
   assert.equal((await f.detail()).canSelectPrimary, false);
-  assert.equal((await f.place("select_primary")).code, "primary_occupied");
+  assert.equal((await f.place("select_primary")).code, "target_unavailable");
 });
 
 it("does not interpret a rejected placement as a digest-wide content rejection", async () => {
@@ -496,3 +496,45 @@ for (const gate of ["VRDEX_PROFILE_MEDIA_KIT_ENABLED", "VRDEX_PROFILE_MEDIA_SUBM
     }
   });
 }
+
+for (const condition of ["disabled_kit", "hidden_kit", "disabled_submissions"] as const) {
+  it(`gates new placement and proposals after ${condition}, preserves historical replay and safe undo`, async () => {
+    const f = await fixture();
+    const initial = await f.detail();
+    await f.t.run(ctx => ctx.db.insert("oauthAccessTokens", { tokenId: "placement-token", clientId: "client", subjectType: "user", userId: f.s.contributorUserId, resource: "https://example.test/mcp", scopes: ["mcp:read", "mcp:write", "assets:contribute", "assets:publish"], status: "active", issuedAt: Date.now(), expiresAt: Date.now() + 60_000 }));
+    const attestation = { actorUserId: f.s.contributorUserId, oauthTokenId: "placement-token", oauthClientId: "client", emailVerified: true, emailVerificationAttestedAt: Date.now() };
+    const priorInput = { submissionId: f.intent.submissionId, expectedContributionVersion: initial.contributionVersion, idempotencyKey: "historical-select", action: "select_primary" as const };
+    const prior = await f.actor.mutation(api.profileMediaSubmissions.placeContribution, priorInput);
+    assert.equal(prior.operationState, "committed");
+    const env = { kit: process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED, submissions: process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED };
+    if (condition === "hidden_kit") await f.t.run(ctx => ctx.db.patch(f.s.profileId, { fieldVisibility: { mediaKit: "private" } }));
+    if (condition === "disabled_kit") process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "false";
+    if (condition === "disabled_submissions") process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED = "false";
+    try {
+      const detail = await f.detail();
+      assert.deepEqual(await f.t.query(internal.profileMediaSubmissions.contributionDetailForMcpActor, { submissionId: f.intent.submissionId, ...attestation }), detail);
+      assert.equal(detail.canSelectPrimary, false);
+      assert.equal(detail.canProposePlacement, false);
+      assert.equal(detail.canClearPrimary, condition !== "disabled_submissions");
+      assert.deepEqual(await f.actor.mutation(api.profileMediaSubmissions.placeContribution, priorInput), prior);
+      const cleared = await f.place("clear_primary", "new-clear");
+      assert.equal(cleared.operationState, condition === "disabled_submissions" ? "refused" : "committed");
+      if (condition === "disabled_submissions") assert.equal(cleared.code, "review_disabled");
+      const empty = await f.detail();
+      assert.equal(empty.canSelectPrimary, false);
+      assert.equal((await f.place("select_primary", "new-select")).code, condition === "disabled_submissions" ? "review_disabled" : "target_unavailable");
+      await f.t.run(ctx => ctx.db.patch(f.s.profileId, { avatarImageUrl: "https://example.test/current.png" }));
+      const mcpSelection = await f.t.mutation(internal.profileMediaSubmissions.placeContributionForMcpActor, { submissionId: f.intent.submissionId, expectedContributionVersion: (await f.detail()).contributionVersion, idempotencyKey: "mcp-new-select", action: "select_primary", ...attestation });
+      assert.equal(mcpSelection.code, condition === "disabled_submissions" ? "review_disabled" : "target_unavailable");
+      const occupied = await f.detail();
+      assert.equal(occupied.canProposePlacement, false);
+      const proposal = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: occupied.contributionVersion, idempotencyKey: "new-proposal" });
+      assert.equal(proposal.code, condition === "disabled_submissions" ? "review_disabled" : "target_unavailable");
+      const mcpProposal = await f.t.mutation(internal.profileMediaSubmissions.proposePlacementForMcpActor, { submissionId: f.intent.submissionId, expectedContributionVersion: occupied.contributionVersion, idempotencyKey: "mcp-new-proposal", ...attestation });
+      assert.equal(mcpProposal.code, proposal.code);
+    } finally {
+      process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = env.kit;
+      process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED = env.submissions;
+    }
+  });
+}

From f97c61d6727e45d42c367d56c3b7018a7159253d Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Tue, 13 Oct 2026 04:49:00 -0400
Subject: [PATCH 19/28] fix: accept gallery media submission MCP results

---
 apps/web/src/lib/server/vrdex-mcp.ts       | 2 +-
 docs/developers/api-changelog.md           | 4 ++++
 docs/developers/hosted-mcp-oauth-writes.md | 6 ++++--
 tests/web/vrdex-mcp.test.ts                | 4 +++-
 4 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/apps/web/src/lib/server/vrdex-mcp.ts b/apps/web/src/lib/server/vrdex-mcp.ts
index 7fb9e321..2a44735d 100644
--- a/apps/web/src/lib/server/vrdex-mcp.ts
+++ b/apps/web/src/lib/server/vrdex-mcp.ts
@@ -477,7 +477,7 @@ const mcpProfileMediaSubmitResultSchema = z.object({
   operation: z.literal("submit"),
   replayed: z.boolean(),
   submission: mcpProfileMediaSubmissionSchema.extend({
-    requestedPlacement: z.literal("profile_image"),
+    requestedPlacement: z.enum(["profile_image", "gallery"]),
   }),
 });
 const ownSubmissionPageInput = z.strictObject({
diff --git a/docs/developers/api-changelog.md b/docs/developers/api-changelog.md
index 112502f9..cfd43f64 100644
--- a/docs/developers/api-changelog.md
+++ b/docs/developers/api-changelog.md
@@ -9,6 +9,10 @@ docs update and a changelog entry so early consumers and agents can adapt.
 
 ## Unreleased
 
+- fixed hosted MCP URL media submissions returning a tool error after creating a
+  private gallery proposal. The output validator accepts gallery results and
+  legacy profile-image replays.
+
 - upgraded the hosted and stdio MCP SDK to `@modelcontextprotocol/server` 2.0.0.
   Modern `2026-07-28` discovery returns server identity in result `_meta` and
   accepts requests without `clientInfo`; legacy initialization remains supported.
diff --git a/docs/developers/hosted-mcp-oauth-writes.md b/docs/developers/hosted-mcp-oauth-writes.md
index 43271764..a82a21d5 100644
--- a/docs/developers/hosted-mcp-oauth-writes.md
+++ b/docs/developers/hosted-mcp-oauth-writes.md
@@ -178,10 +178,12 @@ turn a local path into a server-readable path and does not add a second import
 tool.
 
 `vrdex_profile_media_submit` imports one image from a public HTTPS URL for the
-profile image of an unclaimed, public person profile. It requires the exact
+media kit of an unclaimed, public person profile. It requires the exact
 `updatedAt` revision read from the public profile, an operator-chosen
 `idempotencyKey`, and a credit. The server imports and validates the bytes, then
-creates only a private media proposal. It never creates a public profile asset,
+creates only a private gallery media proposal. The result also accepts the
+legacy `profile_image` placement for existing same-key replays. It never
+creates a public profile asset,
 placement, or approval. Claimed, community, stale, hidden, and unpublished
 targets are refused. Every submission call, including a same-key replay, checks
 the current primary-email verification state through Clerk. It does not trust
diff --git a/tests/web/vrdex-mcp.test.ts b/tests/web/vrdex-mcp.test.ts
index 0e2aa373..fa9cbea4 100644
--- a/tests/web/vrdex-mcp.test.ts
+++ b/tests/web/vrdex-mcp.test.ts
@@ -2179,7 +2179,7 @@ describe("VRDex MCP server", () => {
         submissionId: "submission_123",
         profileSlug: "community-dj",
         profileDisplayName: "Community DJ",
-        requestedPlacement: "profile_image",
+        requestedPlacement: "gallery",
         status: "submitted",
         createdAt: 1,
         updatedAt: 2,
@@ -2344,6 +2344,8 @@ describe("VRDex MCP server", () => {
     );
     assert.match(result.submitted, /"operation":"submit"/);
     assert.match(result.submitted, /"replayed":false/);
+    assert.match(result.submitted, /"requestedPlacement":"gallery"/);
+    assert.doesNotMatch(result.submitted, /"isError":true/);
     assert.match(result.status, /"submissions"/);
     assert.match(result.status, /"status":"submitted"/);
     assert.match(result.invalid, /unrecognized|invalid/i);

From cebb456ee9ae8a5fa088ff49abaf569ee7fb8d85 Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Tue, 13 Oct 2026 05:12:43 -0400
Subject: [PATCH 20/28] fix(media): recheck kit admission and candidate
 approval

---
 .../web/e2e/media-admission.storybook.spec.ts | 18 +++++
 apps/web/e2e/media-kit.visual.spec.ts         |  2 +-
 .../src/app/_components/profile-edit-form.tsx |  1 +
 .../profile-media-contribution-editor.tsx     | 10 ++-
 .../published-contribution-card.tsx           |  2 +-
 ...file-media-contribution-editor.stories.tsx | 11 +++
 convex/_mediaContributionCommands.ts          |  8 +-
 convex/_mediaReview.ts                        | 14 +++-
 convex/_trustedPublication.ts                 | 15 +++-
 convex/contributionUploads.ts                 |  4 +-
 convex/profileMediaSubmissions.ts             |  7 +-
 convex/profiles.ts                            |  2 +
 docs/engineering/media-review-commands.md     | 15 ++++
 packages/api-contracts/src/media-review.ts    |  6 +-
 .../api-contracts/tests/media-review.test.ts  |  7 ++
 tests/backend/contribution-batches.test.ts    |  1 +
 .../contribution-capacity-followups.test.ts   |  1 +
 .../contribution-capacity-load.test.ts        |  1 +
 tests/backend/contribution-capacity.test.ts   |  1 +
 tests/backend/contribution-uploads.test.ts    | 25 +++++++
 ...ed-mcp-profile-media-contributions.test.ts | 15 ++++
 .../media-contribution-commands.test.ts       | 75 +++++++++++++++++++
 tests/web/vrdex-mcp.test.ts                   | 12 +++
 23 files changed, 233 insertions(+), 20 deletions(-)
 create mode 100644 apps/web/e2e/media-admission.storybook.spec.ts

diff --git a/apps/web/e2e/media-admission.storybook.spec.ts b/apps/web/e2e/media-admission.storybook.spec.ts
new file mode 100644
index 00000000..1d10c6df
--- /dev/null
+++ b/apps/web/e2e/media-admission.storybook.spec.ts
@@ -0,0 +1,18 @@
+import { expect, test } from "@playwright/test";
+import { gotoComponentStory, prepareStorybookVisualPage, captureStorybookScreenshot } from "./storybook-components";
+
+test.beforeEach(async ({ page }) => { await prepareStorybookVisualPage(page); });
+test("available contribution form keeps the credit URL limit @storybook-visual", async ({ page }, testInfo) => {
+  await gotoComponentStory(page, "profiles-media-contribution-editor--inline");
+  await expect(page.getByRole("heading", { name: "Media contributions" })).toBeVisible();
+  await expect(page.locator('input[name="creditUrl"]')).toHaveAttribute("maxlength", "2048");
+  await captureStorybookScreenshot(page, testInfo, "contribution-intake-available");
+});
+test("unavailable kit hides contribution intake @storybook-visual", async ({ page }, testInfo) => {
+  await gotoComponentStory(page, "profiles-media-contribution-editor--unavailable");
+  await expect(page.getByRole("heading", { name: "Edit profile" })).toBeVisible();
+  await expect(page.getByRole("heading", { name: "Media contributions" })).toHaveCount(0);
+  await expect(page.locator('input[type="file"]')).toHaveCount(0);
+  await expect(page.locator('input[name="creditUrl"]')).toHaveCount(0);
+  await captureStorybookScreenshot(page, testInfo, "contribution-intake-unavailable");
+});
diff --git a/apps/web/e2e/media-kit.visual.spec.ts b/apps/web/e2e/media-kit.visual.spec.ts
index c74f19d5..eb893085 100644
--- a/apps/web/e2e/media-kit.visual.spec.ts
+++ b/apps/web/e2e/media-kit.visual.spec.ts
@@ -767,7 +767,7 @@ test("public profile media kit @visual @fixture", async ({ page }, testInfo) =>
     mediaKit.getByRole("link", { name: "Artwork by Afterglow Studio" }),
   ).toHaveAttribute("href", "https://example.invalid/afterglow-studio");
   await expect(
-    mediaKit.getByRole("link", { name: "Open source" }),
+    mediaKit.locator('a[href="https://example.invalid/aurora-source"]'),
   ).toHaveAttribute("href", "https://example.invalid/aurora-source");
   for (const title of [
     "Aurora press portrait",
diff --git a/apps/web/src/app/_components/profile-edit-form.tsx b/apps/web/src/app/_components/profile-edit-form.tsx
index e2e58dd0..80ddbdc3 100644
--- a/apps/web/src/app/_components/profile-edit-form.tsx
+++ b/apps/web/src/app/_components/profile-edit-form.tsx
@@ -303,6 +303,7 @@ function ConnectedProfileEditForm({
       ) : null}
       {mediaContributionsEnabled && profile.subject === "community_submitter" ? (
         <ProfileMediaContributionEditor
+          available={profile.canContributeMedia}
           autoFocus={mediaContributionFocus}
           profile={{
             id: profile.id,
diff --git a/apps/web/src/app/_components/profile-media-contribution-editor.tsx b/apps/web/src/app/_components/profile-media-contribution-editor.tsx
index ba02aa18..0f7d7be1 100644
--- a/apps/web/src/app/_components/profile-media-contribution-editor.tsx
+++ b/apps/web/src/app/_components/profile-media-contribution-editor.tsx
@@ -67,9 +67,11 @@ function safeMessage(error: unknown) {
 
 export function ProfileMediaContributionEditor({
   autoFocus = false,
+  available = true,
   profile,
 }: {
   autoFocus?: boolean;
+  available?: boolean;
   profile: ContributionProfile;
 }) {
   const router = useRouter();
@@ -131,16 +133,18 @@ export function ProfileMediaContributionEditor({
     }
   }
 
-  return <ProfileMediaContributionEditorView autoFocus={autoFocus} busy={busy} onSubmit={submit} status={status} />;
+  return <ProfileMediaContributionEditorView available={available} autoFocus={autoFocus} busy={busy} onSubmit={submit} status={status} />;
 }
 
 export function ProfileMediaContributionEditorView({
   autoFocus = false,
+  available = true,
   busy = false,
   onSubmit,
   status = null,
 }: {
   autoFocus?: boolean;
+  available?: boolean;
   busy?: boolean;
   onSubmit?: (event: FormEvent<HTMLFormElement>) => void;
   status?: string | null;
@@ -151,6 +155,8 @@ export function ProfileMediaContributionEditorView({
     if (autoFocus) sectionRef.current?.scrollIntoView({ block: "start" });
   }, [autoFocus]);
 
+  if (!available) return null;
+
   return (
     <section className="border-t border-border py-6" id="media-contributions" ref={sectionRef}>
       <h2 className="text-lg font-semibold">Media contributions</h2>
@@ -171,7 +177,7 @@ export function ProfileMediaContributionEditorView({
             </Field>
             <Field>
               Credit URL
-              <Input name="creditUrl" placeholder="https://" type="url" />
+              <Input maxLength={2048} name="creditUrl" placeholder="https://" type="url" />
             </Field>
             <Field>
               Public label
diff --git a/apps/web/src/app/account/media-contributions/published-contribution-card.tsx b/apps/web/src/app/account/media-contributions/published-contribution-card.tsx
index 5d187c60..7dfa3b0b 100644
--- a/apps/web/src/app/account/media-contributions/published-contribution-card.tsx
+++ b/apps/web/src/app/account/media-contributions/published-contribution-card.tsx
@@ -101,7 +101,7 @@ export function PublishedContributionCardView({ submissionId, detail, manage, pl
         <fieldset disabled={locked} className="grid gap-4 sm:grid-cols-2">
           <Field>Title<Input required maxLength={80} value={draft.metadata.label} onChange={e => update("label", e.target.value)} /></Field>
           <Field>Credit<Input required maxLength={120} value={draft.metadata.credit} onChange={e => update("credit", e.target.value)} /></Field>
-          <Field>Credit URL<Input type="url" maxLength={4096} value={draft.metadata.creditUrl ?? ""} onChange={e => update("creditUrl", e.target.value)} /></Field>
+          <Field>Credit URL<Input type="url" maxLength={2048} value={draft.metadata.creditUrl ?? ""} onChange={e => update("creditUrl", e.target.value)} /></Field>
           <Field>Source URL<Input type="url" maxLength={4096} value={draft.metadata.sourceUrl ?? ""} onChange={e => update("sourceUrl", e.target.value)} /></Field>
           <Field>Alt text<Input maxLength={180} value={draft.metadata.altText ?? ""} onChange={e => update("altText", e.target.value)} /></Field>
           <Field>Source description<Textarea maxLength={1000} rows={3} value={draft.metadata.sourceDescription ?? ""} onChange={e => update("sourceDescription", e.target.value)} /></Field>
diff --git a/apps/web/src/components/profile-media-contribution-editor.stories.tsx b/apps/web/src/components/profile-media-contribution-editor.stories.tsx
index 6bb2d76a..7c408c6a 100644
--- a/apps/web/src/components/profile-media-contribution-editor.stories.tsx
+++ b/apps/web/src/components/profile-media-contribution-editor.stories.tsx
@@ -24,3 +24,14 @@ export const Inline: Story = {
     </PageShell>
   ),
 };
+
+export const Unavailable: Story = {
+  render: () => (
+    <PageShell className="py-10">
+      <PageContainer max="3xl">
+        <h1 className="text-3xl font-semibold">Edit profile</h1>
+        <div className="mt-8"><ProfileMediaContributionEditorView available={false} /></div>
+      </PageContainer>
+    </PageShell>
+  ),
+};
diff --git a/convex/_mediaContributionCommands.ts b/convex/_mediaContributionCommands.ts
index 87ab8e89..cf976ddd 100644
--- a/convex/_mediaContributionCommands.ts
+++ b/convex/_mediaContributionCommands.ts
@@ -1,3 +1,4 @@
+import { publicationRestrictions } from "./_trustedPublication";
 import { ConvexError } from "convex/values";
 import type { MutationCtx, QueryCtx } from "./_generated/server";
 import { getAccountFeatureAccess } from "./_accountFeatures";
@@ -34,12 +35,7 @@ async function contributionState(ctx: QueryCtx | MutationCtx, submissionId: stri
   const current = await ctx.db.query("profileAssetPlacements").withIndex("by_profileId_placement_state_position", q =>
     q.eq("profileId", profile._id).eq("placement", placement).eq("state", "active")).first();
   const access = await getAccountFeatureAccess(ctx.db, actor.user._id);
-  const restrictions = await Promise.all([
-    ctx.db.query("mediaPublicationRestrictions").withIndex("by_profileId_kind", q => q.eq("profileId", profile._id).eq("kind", "identity")).first(),
-    ctx.db.query("mediaPublicationRestrictions").withIndex("by_profileId_kind", q => q.eq("profileId", profile._id).eq("kind", "dispute")).first(),
-    asset.contentSha256 ? ctx.db.query("mediaPublicationRestrictions").withIndex("by_contentSha256_kind", q => q.eq("contentSha256", asset.contentSha256).eq("kind", "suppression")).first() : null,
-    asset.contentSha256 ? ctx.db.query("mediaPublicationRestrictions").withIndex("by_contentSha256_kind", q => q.eq("contentSha256", asset.contentSha256).eq("kind", "rejection")).first() : null,
-  ]);
+  const restrictions = await publicationRestrictions(ctx, profile._id, asset.contentSha256);
   const publicUnclaimed = profile.claimState === "unclaimed" && profile.publicationState === "published" && profile.publicSurfacingState === "public";
   const publisher = access.canPublishMedia && publicUnclaimed && !restrictions.some(Boolean);
   const ownSelection = !!current && current.assetId === asset._id && current.selectionActorUserId === actor.user._id &&
diff --git a/convex/_mediaReview.ts b/convex/_mediaReview.ts
index 38b8e64b..e7fc564a 100644
--- a/convex/_mediaReview.ts
+++ b/convex/_mediaReview.ts
@@ -28,7 +28,7 @@ import {
   identityEmailVerified,
   isCurrentEmailVerificationAttestation,
 } from "./_identity";
-import { recordPublicationRestriction } from "./_trustedPublication";
+import { publicationRestrictions, recordPublicationRestriction } from "./_trustedPublication";
 import { isProfileFieldVisible } from "./_profileFieldVisibility";
 import { parseProfileLinkDestination } from "./_profileLinkDestination";
 import {
@@ -263,7 +263,7 @@ export async function applyReviewDecision(
     actor,
     submission,
   );
-  if (args.decision === "approve" && submission.requestKind !== "identity_placement" &&
+  if (args.decision === "approve" && (submission.requestKind !== "identity_placement" || submission.candidateAssetId !== undefined) &&
     !publicKitAvailable(profile))
     throw new ConvexError({ code: "MEDIA_RESOURCE_UNAVAILABLE", message: "Media contribution unavailable." });
   if (submission.submitterUserId === user._id) {
@@ -316,6 +316,8 @@ export async function applyReviewDecision(
     const candidate = await ctx.db.get(submission.candidateAssetId);
     const snapshot = await reviewSnapshot(ctx, submission, profile);
     if (!candidate || !snapshot.candidate.rendition) throw new Error("The placement candidate is unavailable.");
+    if ((await publicationRestrictions(ctx, profile._id, candidate.contentSha256)).some(Boolean))
+      throw new ConvexError({ code: "MEDIA_PUBLICATION_RESTRICTED", message: "Media contribution unavailable." });
     if (submission.targetPlacementVersion !== snapshot.placementTargetVersion)
       throw new Error("The profile media placement changed. Rebase before deciding.");
     if ((snapshot.currentPlacement?.assetId ?? undefined) !== submission.targetPlacementAssetId)
@@ -713,7 +715,7 @@ export async function decideReviewCommand(
     profile.publicSurfacingState !== "public"
   )
     code = "target_unavailable";
-  else if (args.decision === "approve" && submission.requestKind !== "identity_placement" &&
+  else if (args.decision === "approve" && (submission.requestKind !== "identity_placement" || submission.candidateAssetId !== undefined) &&
     !publicKitAvailable(profile)) code = "target_unavailable";
   else if (snapshot.reviewVersion !== args.expectedReviewVersion)
     code = "review_changed";
@@ -737,6 +739,12 @@ export async function decideReviewCommand(
     code = "candidate_unavailable";
   else if (args.decision === "approve" && submission.candidateAssetId &&
     submission.targetPlacementVersion !== snapshot.placementTargetVersion) code = "placement_changed";
+  if (code === undefined && args.decision === "approve" &&
+    submission.requestKind === "identity_placement" && submission.candidateAssetId) {
+    const candidate = await ctx.db.get(submission.candidateAssetId);
+    if ((await publicationRestrictions(ctx, profile._id, candidate?.contentSha256)).some(Boolean))
+      code = "publication_restricted";
+  }
   if (code === undefined && args.decision === "approve" &&
     submission.requestKind === "identity_placement" &&
     await privateReplacementRequiresElevatedAccess(
diff --git a/convex/_trustedPublication.ts b/convex/_trustedPublication.ts
index 653651eb..1a1f9fb0 100644
--- a/convex/_trustedPublication.ts
+++ b/convex/_trustedPublication.ts
@@ -1,5 +1,5 @@
 import { transferPublishedCharge } from "./_contributionCapacity";
-import type { Doc } from "./_generated/dataModel";
+import type { Doc, Id } from "./_generated/dataModel";
 import type { MutationCtx, QueryCtx } from "./_generated/server";
 import { ConvexError } from "convex/values";
 import { getAccountFeatureAccess } from "./_accountFeatures";
@@ -68,6 +68,19 @@ export async function requirePublisher(
   return access;
 }
 
+export async function publicationRestrictions(
+  ctx: Pick<QueryCtx, "db">,
+  profileId: Id<"profiles">,
+  contentSha256?: string,
+) {
+  return Promise.all([
+    ctx.db.query("mediaPublicationRestrictions").withIndex("by_profileId_kind", q => q.eq("profileId", profileId).eq("kind", "identity")).first(),
+    ctx.db.query("mediaPublicationRestrictions").withIndex("by_profileId_kind", q => q.eq("profileId", profileId).eq("kind", "dispute")).first(),
+    contentSha256 ? ctx.db.query("mediaPublicationRestrictions").withIndex("by_contentSha256_kind", q => q.eq("contentSha256", contentSha256).eq("kind", "suppression")).first() : null,
+    contentSha256 ? ctx.db.query("mediaPublicationRestrictions").withIndex("by_contentSha256_kind", q => q.eq("contentSha256", contentSha256).eq("kind", "rejection")).first() : null,
+  ]);
+}
+
 export async function recordPublicationRestriction(
   ctx: MutationCtx,
   submission: Doc<"profileMediaSubmissions">,
diff --git a/convex/contributionUploads.ts b/convex/contributionUploads.ts
index b1f40f25..9855a928 100644
--- a/convex/contributionUploads.ts
+++ b/convex/contributionUploads.ts
@@ -111,11 +111,12 @@ async function target(
   mode: "owner" | "contributor",
   placement: "profile_image" | "primary_logo" | "gallery",
   expected: number,
+  newKitIntake = false,
 ) {
   const profile = await ctx.db.get(profileId);
   if (!profile || profile.updatedAt !== expected)
     throw new ConvexError({ code: "UPLOAD_TARGET_CHANGED" });
-  if (mode === "contributor") return assertEligibleTarget(profile, "gallery");
+  if (mode === "contributor") return assertEligibleTarget(profile, "gallery", newKitIntake);
   if (
     (profile.profileType === "person" ? "profile_image" : "primary_logo") !==
     placement
@@ -368,6 +369,7 @@ export const begin = internalMutation({
       request.mode,
       request.placement,
       request.expectedUpdatedAt,
+      !old,
     );
     if (old) {
       if (old.state !== "pending" || old.expiresAt <= Date.now())
diff --git a/convex/profileMediaSubmissions.ts b/convex/profileMediaSubmissions.ts
index eab92f5e..73a021d4 100644
--- a/convex/profileMediaSubmissions.ts
+++ b/convex/profileMediaSubmissions.ts
@@ -273,11 +273,13 @@ export async function assertSubmissionRateLimits(
 export function assertEligibleTarget(
   profile: Doc<"profiles"> | null,
   placement: "profile_image" | "primary_logo" | "gallery",
+  newKitIntake = false,
 ) {
   if (
     profile === null ||
     profile.publicationState !== "published" ||
-    profile.publicSurfacingState !== "public"
+    profile.publicSurfacingState !== "public" ||
+    (newKitIntake && !publicKitAvailable(profile))
   ) {
     throw new ConvexError({
       code: "MEDIA_TARGET_UNAVAILABLE",
@@ -423,7 +425,7 @@ export const createUploadIntent = mutation({
     if (!(await identityEmailVerified(ctx)) || user.email === undefined) {
       throw new ConvexError({ code: "MEDIA_EMAIL_UNVERIFIED", message: "Verify email" });
     }
-    const profile = assertEligibleTarget(await ctx.db.get(args.profileId), "gallery");
+    const profile = assertEligibleTarget(await ctx.db.get(args.profileId), "gallery", true);
     if (profile.updatedAt !== args.expectedProfileUpdatedAt) {
       throw new ConvexError({ code: "MEDIA_PROFILE_CHANGED", message: "Refresh profile" });
     }
@@ -657,6 +659,7 @@ export const prepareMcpMediaSubmission = internalMutation({
       return await refuse(targetRefusal);
     }
     const eligible = profile!;
+    if (!publicKitAvailable(eligible)) return await refuse("MCP_MEDIA_TARGET_UNAVAILABLE");
 
     const now = Date.now();
     if (
diff --git a/convex/profiles.ts b/convex/profiles.ts
index c3b4e9b7..67e013c9 100644
--- a/convex/profiles.ts
+++ b/convex/profiles.ts
@@ -1,4 +1,5 @@
 import { projectProfileLinkDestinations, queueProfileLinkDestinations } from "./_profileLinkDestinationCache";
+import { publicKitAvailable } from "./_mediaReview";
 import { ConvexError, type Infer, v } from "convex/values";
 
 import type { Doc, Id } from "./_generated/dataModel";
@@ -876,6 +877,7 @@ export const editableProfile = query({
       // including them, so the editor has to know not to send them there once
       // the save succeeds.
       publiclyViewable: canReadProfile("public", profile),
+      canContributeMedia: profile.claimState === "unclaimed" && canReadProfile("public", profile) && publicKitAvailable(profile),
       // Sent back with the save, so a second editor is told the profile moved
       // rather than quietly overwriting whatever changed underneath them.
       updatedAt: profile.updatedAt,
diff --git a/docs/engineering/media-review-commands.md b/docs/engineering/media-review-commands.md
index 0697aafe..ea3d5337 100644
--- a/docs/engineering/media-review-commands.md
+++ b/docs/engineering/media-review-commands.md
@@ -47,6 +47,21 @@ when no URL exists. Legacy URL intake still requires a URL. The
 [local upload verification guide](../testing/local-media-upload.md) documents
 transport, reservations, cleanup configuration, and the separate S3 proof gate.
 
+New browser, local-upload, and URL-import kit intake requires the kit feature and
+public media-kit field to be available before reserving upload capacity. Existing
+admitted uploads can finish and replay their receipts. Owner identity uploads
+keep their separate authority and target rules. The editable-profile projection
+uses the same availability predicate to hide unavailable contribution intake.
+
+Existing-asset placement proposals recheck public-kit availability and current
+profile identity/dispute and content suppression/rejection restrictions at fresh
+approval, through both receipt and legacy decision wrappers. Profile restrictions
+apply even without a content digest. Historical committed receipts retain their
+existing replay checks.
+
+Credit URL command contracts and form inputs allow at most 2,048 characters,
+matching backend credit validation. Source URLs retain their separate 4,096 limit.
+
 ## Decisions and retries
 
 `decideWithReceipt` and internal `decideForMcpActor` accept submission ID,
diff --git a/packages/api-contracts/src/media-review.ts b/packages/api-contracts/src/media-review.ts
index 9243b03d..54a06c10 100644
--- a/packages/api-contracts/src/media-review.ts
+++ b/packages/api-contracts/src/media-review.ts
@@ -16,7 +16,7 @@ export const contributionMetadataPatchSchema = z.strictObject({
   label: z.string().max(80).nullable().optional(),
   altText: z.string().max(180).nullable().optional(),
   credit: z.string().max(120).nullable().optional(),
-  creditUrl: z.string().max(4096).nullable().optional(),
+  creditUrl: z.string().max(2048).nullable().optional(),
   sourceUrl: z.string().max(4096).nullable().optional(),
   sourceDescription: z.string().max(1000).nullable().optional(),
 });
@@ -31,7 +31,7 @@ export const publishedContributionDetailSchema = z.strictObject({
   profileSlug: z.string().max(200), contributionVersion: z.string().min(1).max(128),
   metadata: z.strictObject({
     label: z.string().max(80), altText: z.string().max(180).optional(),
-    credit: z.string().max(120), creditUrl: z.string().max(4096).optional(),
+    credit: z.string().max(120), creditUrl: z.string().max(2048).optional(),
     sourceUrl: z.string().max(4096).optional(), sourceDescription: z.string().max(1000).optional(),
   }),
   canSelectPrimary: z.boolean(), canClearPrimary: z.boolean(), canProposePlacement: z.boolean(),
@@ -161,7 +161,7 @@ export const reviewDetailSchema = z.strictObject({
   label: z.string().max(1000).optional(),
   altText: z.string().max(1000).optional(),
   credit: z.string().max(1000),
-  creditUrl: z.string().max(4096).optional(),
+  creditUrl: z.string().max(2048).optional(),
   contributorNote: z.string().max(1000).optional(),
   publicDisposition: z.string().max(240).optional(),
   approvedAssetId: boundedId.optional(),
diff --git a/packages/api-contracts/tests/media-review.test.ts b/packages/api-contracts/tests/media-review.test.ts
index adaf7117..8820a44e 100644
--- a/packages/api-contracts/tests/media-review.test.ts
+++ b/packages/api-contracts/tests/media-review.test.ts
@@ -155,3 +155,10 @@ it("describes additive and placement intent without adding assertions to publica
   assert.deepEqual(mediaPublicationSchema.parse(command), command);
   assert.equal(mediaPublicationSchema.safeParse({ ...command, identityConfirmed: true }).success, false);
 });
+
+it("credit URL command contract bounds 2048 independently of the 4096 source URL limit", () => {
+  const prefix = "https://credit.example/";
+  const base = { submissionId: "submission", expectedContributionVersion: "version", idempotencyKey: "key", action: "update_metadata", metadata: { creditUrl: prefix + "a".repeat(2048 - prefix.length), sourceUrl: "https://source.example/" + "a".repeat(4000) } };
+  assert.equal(contributionManageCommandSchema.safeParse(base).success, true);
+  assert.equal(contributionManageCommandSchema.safeParse({ ...base, metadata: { creditUrl: base.metadata.creditUrl + "a" } }).success, false);
+});
diff --git a/tests/backend/contribution-batches.test.ts b/tests/backend/contribution-batches.test.ts
index 95b9e296..0a7cc082 100644
--- a/tests/backend/contribution-batches.test.ts
+++ b/tests/backend/contribution-batches.test.ts
@@ -1,3 +1,4 @@
+process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true";
 import assert from "node:assert/strict";
 import { it } from "node:test";
 import { convexTest } from "convex-test";
diff --git a/tests/backend/contribution-capacity-followups.test.ts b/tests/backend/contribution-capacity-followups.test.ts
index da87bacd..fbd08c2f 100644
--- a/tests/backend/contribution-capacity-followups.test.ts
+++ b/tests/backend/contribution-capacity-followups.test.ts
@@ -1,3 +1,4 @@
+process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true";
 import assert from "node:assert/strict";
 import { it } from "node:test";
 import { convexTest } from "convex-test";
diff --git a/tests/backend/contribution-capacity-load.test.ts b/tests/backend/contribution-capacity-load.test.ts
index 6425a784..61ca3d29 100644
--- a/tests/backend/contribution-capacity-load.test.ts
+++ b/tests/backend/contribution-capacity-load.test.ts
@@ -1,3 +1,4 @@
+process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true";
 import assert from "node:assert/strict";
 import { it } from "node:test";
 import { performance } from "node:perf_hooks";
diff --git a/tests/backend/contribution-capacity.test.ts b/tests/backend/contribution-capacity.test.ts
index 9c79b614..2f33713a 100644
--- a/tests/backend/contribution-capacity.test.ts
+++ b/tests/backend/contribution-capacity.test.ts
@@ -1,3 +1,4 @@
+process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true";
 import assert from "node:assert/strict";
 import { it } from "node:test";
 import { convexTest } from "convex-test";
diff --git a/tests/backend/contribution-uploads.test.ts b/tests/backend/contribution-uploads.test.ts
index 3e6445bd..8c368505 100644
--- a/tests/backend/contribution-uploads.test.ts
+++ b/tests/backend/contribution-uploads.test.ts
@@ -641,3 +641,28 @@ for (const mode of ["owner", "contributor"] as const) {
     assert.equal((await f.t.mutation(internal.contributionUploads.complete, f.completeInput)).operationState, "committed");
   });
 }
+
+for (const unavailable of ["hidden", "disabled"] as const) {
+  it(`refuses new ${unavailable} kit intake before quota, keeps legacy completion and replay`, async () => {
+    const f = await fixture();
+    const before = await f.t.run(async ctx => ({ intents: await ctx.db.query("profileAssetUploadIntents").collect(), reservations: await ctx.db.query("contributionUploadReservations").collect(), capacity: await ctx.db.query("contributionCapacity").collect() }));
+    if (unavailable === "hidden") await f.t.run(ctx => ctx.db.patch(f.s.profileId, { fieldVisibility: { mediaKit: "private" } }));
+    else process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "false";
+    try {
+      await assert.rejects(f.t.mutation(internal.contributionUploads.begin, { ...f.input, idempotencyKey: "new-intake" }), /MEDIA_TARGET_UNAVAILABLE/);
+      const after = await f.t.run(async ctx => ({ intents: await ctx.db.query("profileAssetUploadIntents").collect(), reservations: await ctx.db.query("contributionUploadReservations").collect(), capacity: await ctx.db.query("contributionCapacity").collect() }));
+      assert.deepEqual(after, before);
+      await assert.rejects(f.t.withIdentity(f.s.contributorIdentity).mutation(api.profileMediaSubmissions.createUploadIntent, { profileId: f.s.profileId, requestedPlacement: "profile_image", originalFileName: "new.png", mimeType: "image/png", byteSize: 512, sourceUrl: "https://artist.example/source", credit: "Artist", expectedProfileUpdatedAt: NOW }), /MEDIA_TARGET_UNAVAILABLE/);
+      await f.t.mutation(internal.contributionUploads.claim, f.claimInput);
+      const completed = await f.t.mutation(internal.contributionUploads.complete, f.completeInput);
+      assert.equal(completed.operationState, "committed");
+      assert.deepEqual((await f.t.mutation(internal.contributionUploads.begin, f.input)).receipt, completed);
+    } finally { process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true"; }
+  });
+}
+
+it("keeps private owner identity intake distinct from public-kit visibility", async () => {
+  const f = await fixture("owner");
+  await f.t.run(ctx => ctx.db.patch(f.s.profileId, { publicSurfacingState: "opted_out", fieldVisibility: { mediaKit: "private" } }));
+  assert.ok((await f.t.mutation(internal.contributionUploads.begin, { ...f.input, idempotencyKey: "private-owner-upload" })).intentId);
+});
diff --git a/tests/backend/hosted-mcp-profile-media-contributions.test.ts b/tests/backend/hosted-mcp-profile-media-contributions.test.ts
index 7fb861a6..4bc9440b 100644
--- a/tests/backend/hosted-mcp-profile-media-contributions.test.ts
+++ b/tests/backend/hosted-mcp-profile-media-contributions.test.ts
@@ -846,3 +846,18 @@ it("reconciles a legacy hosted URL admission into gallery without importing anot
   assert.equal(state.rows[0].sourceUrl, input(f.actorUserId).sourceUrl);
   assert.equal(state.charges.length, 1);
 });
+
+for (const unavailable of ["hidden", "disabled"] as const) {
+  it(`refuses new URL intake for a ${unavailable} kit without a submission or reservation`, async () => {
+    const f = await seed();
+    if (unavailable === "hidden") await f.t.run(ctx => ctx.db.patch(f.profileId, { fieldVisibility: { mediaKit: "private" } }));
+    else process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "false";
+    try {
+      const result = await f.t.mutation(internal.profileMediaSubmissions.prepareMcpMediaSubmission, input(f.actorUserId));
+      assert.equal(result.status, "failed");
+      assert.equal(result.errorCode, "MCP_MEDIA_TARGET_UNAVAILABLE");
+      const counts = await f.t.run(async ctx => ({ submissions: (await ctx.db.query("profileMediaSubmissions").collect()).length, intents: (await ctx.db.query("profileAssetUploadIntents").collect()).length, reservations: (await ctx.db.query("contributionUploadReservations").collect()).length, capacity: (await ctx.db.query("contributionCapacity").collect()).length }));
+      assert.deepEqual(counts, { submissions: 0, intents: 0, reservations: 0, capacity: 0 });
+    } finally { process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true"; }
+  });
+}
diff --git a/tests/backend/media-contribution-commands.test.ts b/tests/backend/media-contribution-commands.test.ts
index 7afd50fe..4753fdfd 100644
--- a/tests/backend/media-contribution-commands.test.ts
+++ b/tests/backend/media-contribution-commands.test.ts
@@ -538,3 +538,78 @@ for (const condition of ["disabled_kit", "hidden_kit", "disabled_submissions"] a
     }
   });
 }
+
+for (const unavailable of ["hidden", "disabled"] as const) {
+  it(`refuses fresh candidate approval for a ${unavailable} kit, including a fresh inspection and legacy decisions`, async () => {
+    const f = await fixture();
+    const d = await f.detail();
+    const proposal = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "candidate-proposal" });
+    const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
+    const id = proposal.resourceId!;
+    if (unavailable === "hidden") await f.t.run(ctx => ctx.db.patch(f.s.profileId, { fieldVisibility: { mediaKit: "private" } }));
+    else process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "false";
+    try {
+      const fresh = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: id });
+      assert.ok(fresh);
+      assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, { submissionId: id, expectedReviewVersion: fresh.reviewVersion, decision: "approve", privateReason: "Checked", idempotencyKey: "unavailable" })).code, "target_unavailable");
+      await assert.rejects(reviewer.mutation(api.profileMediaSubmissions.decide, { submissionId: id, expectedProfileUpdatedAt: (await f.t.run(ctx => ctx.db.get(f.s.profileId)))!.updatedAt, decision: "approve", privateReason: "Checked" }), /unavailable/i);
+      assert.deepEqual(await f.placements(), ["gallery"]);
+      assert.equal((await f.t.run(ctx => ctx.db.query("profileMediaSubmissions").filter(q => q.eq(q.field("candidateAssetId"), d.assetId)).first()))?.status, "submitted");
+    } finally { process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true"; }
+  });
+}
+for (const kind of ["identity", "dispute", "suppression", "rejection"] as const) {
+  it(`rechecks current ${kind} restrictions at receipt and legacy candidate approval`, async () => {
+    const f = await fixture();
+    const d = await f.detail();
+    if (kind === "identity" || kind === "dispute") await f.t.run(ctx => ctx.db.patch(d.assetId, { contentSha256: undefined }));
+    const freshContribution = await f.detail();
+    const p = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: freshContribution.contributionVersion, idempotencyKey: "candidate-proposal" });
+    const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
+    const before = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: p.resourceId! });
+    assert.ok(before);
+    await f.t.run(async ctx => {
+      const asset = await ctx.db.get(d.assetId);
+      await ctx.db.insert("mediaPublicationRestrictions", { profileId: f.s.profileId, submissionId: f.intent.submissionId, kind, actorUserId: f.s.moderatorUserId, createdAt: Date.now(), ...(kind === "identity" || kind === "dispute" ? {} : { contentSha256: asset!.contentSha256 }) });
+    });
+    const after = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: p.resourceId! });
+    assert.ok(after);
+    assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, { submissionId: p.resourceId!, expectedReviewVersion: after.reviewVersion, decision: "approve", privateReason: "Checked", idempotencyKey: "restricted" })).code, "publication_restricted");
+    await assert.rejects(reviewer.mutation(api.profileMediaSubmissions.decide, { submissionId: p.resourceId!, expectedProfileUpdatedAt: (await f.t.run(ctx => ctx.db.get(f.s.profileId)))!.updatedAt, decision: "approve", privateReason: "Checked" }), /RESTRICTED/);
+    assert.deepEqual(await f.placements(), ["gallery"]);
+  });
+}
+it("credit URL metadata accepts 2048 and rejects 2049 at the strict backend command boundary", async () => {
+  const f = await fixture(); const d = await f.detail();
+  const prefix = "https://credit.example/";
+  const input = { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "credit-boundary", action: "update_metadata" as const, metadata: { creditUrl: prefix + "a".repeat(2048 - prefix.length) } };
+  assert.equal((await f.actor.mutation(api.profileMediaSubmissions.manageContribution, input)).operationState, "committed");
+  const fresh = await f.detail(); assert.equal(fresh.metadata.creditUrl?.length, 2048);
+  await assert.rejects(f.actor.mutation(api.profileMediaSubmissions.manageContribution, { ...input, expectedContributionVersion: fresh.contributionVersion, idempotencyKey: "credit-too-long", metadata: { creditUrl: input.metadata.creditUrl + "a" } }), /2048/);
+});
+
+it("editable profile projection uses current public-kit availability for intake", async () => {
+  const t = convexTest({ schema, modules: { ...modules, "../../convex/profiles.ts": () => import("../../convex/profiles") } });
+  const s = await seed(t); const actor = t.withIdentity(s.contributorIdentity);
+  assert.equal((await actor.query(api.profiles.editableProfile, { slug: "community-dj" }))?.canContributeMedia, true);
+  await t.run(ctx => ctx.db.patch(s.profileId, { fieldVisibility: { mediaKit: "private" } }));
+  assert.equal((await actor.query(api.profiles.editableProfile, { slug: "community-dj" }))?.canContributeMedia, false);
+  await t.run(ctx => ctx.db.patch(s.profileId, { fieldVisibility: {} }));
+  process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "false";
+  try { assert.equal((await actor.query(api.profiles.editableProfile, { slug: "community-dj" }))?.canContributeMedia, false); }
+  finally { process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true"; }
+});
+
+it("replays exact committed placement review after kit withdrawal and a later restriction", async () => {
+  const f = await fixture(); const d = await f.detail();
+  const p = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "candidate-proposal" });
+  const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
+  const detail = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: p.resourceId! }); assert.ok(detail);
+  const args = { submissionId: p.resourceId!, expectedReviewVersion: detail.reviewVersion, decision: "approve" as const, privateReason: "Checked", idempotencyKey: "approved-review" };
+  const receipt = await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, args); assert.equal(receipt.operationState, "committed");
+  await f.t.run(async ctx => { await ctx.db.patch(f.s.profileId, { fieldVisibility: { mediaKit: "private" } }); await ctx.db.insert("mediaPublicationRestrictions", { profileId: f.s.profileId, submissionId: f.intent.submissionId, kind: "identity", actorUserId: f.s.moderatorUserId, createdAt: Date.now() }); });
+  process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "false";
+  try { assert.deepEqual(await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, args), receipt); }
+  finally { process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true"; }
+  assert.deepEqual(await f.placements(), ["gallery", "profile_image"]);
+});
diff --git a/tests/web/vrdex-mcp.test.ts b/tests/web/vrdex-mcp.test.ts
index fa9cbea4..e43bba75 100644
--- a/tests/web/vrdex-mcp.test.ts
+++ b/tests/web/vrdex-mcp.test.ts
@@ -3431,6 +3431,18 @@ it("contribution protocol tools dispatch exact attested wrappers, reject missing
     };
     for(const [name,description] of Object.entries(descriptions))assert.equal(tools.find(tool=>tool.name===name)?.description,description,name);
 
+    const manageTool=tools.find(tool=>tool.name==="vrdex_media_contribution_manage");
+    assert.ok(manageTool);
+    const findCreditSchema=value=>{if(!value||typeof value!=="object")return undefined;if(value.creditUrl)return value.creditUrl;for(const child of Object.values(value)){const found=findCreditSchema(child);if(found)return found}};
+    const creditSchema=findCreditSchema(manageTool.inputSchema);
+    const creditStringSchema=creditSchema.anyOf?.find(schema=>schema.type==="string")??creditSchema;
+    assert.equal(creditStringSchema.maxLength,2048);
+    const prefix="https://credit.example/";
+    const creditBase={submissionId:"submission",expectedContributionVersion:"version",idempotencyKey:"credit-boundary",action:"update_metadata",metadata:{creditUrl:prefix+"a".repeat(2048-prefix.length)}};
+    assert.equal((await request("tools/call",{name:"vrdex_media_contribution_manage",arguments:creditBase},["mcp:write","assets:contribute"])).isError,undefined);
+    const count=calls.length;
+    assert.equal((await request("tools/call",{name:"vrdex_media_contribution_manage",arguments:{...creditBase,metadata:{creditUrl:creditBase.metadata.creditUrl+"a"}}},["mcp:write","assets:contribute"])).isError,true);
+    assert.equal(calls.length,count);
     const base={submissionId:"submission",expectedContributionVersion:"version",idempotencyKey:"key"};
     const operations=[
       ["vrdex_media_contribution_get","contributionDetailForMcpActor",{submissionId:"submission"},"mcp:read","assets:contribute",detail],

From 4702c5d636b25530adb46478dd416b183d5a87ee Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Tue, 13 Oct 2026 12:52:29 -0400
Subject: [PATCH 21/28] fix(media): enforce replacement admission and scoped
 review

---
 apps/web/e2e/media-contribution.flow.spec.ts  |  11 +-
 convex/_mediaContributionCommands.ts          |  11 +-
 convex/_mediaReview.ts                        |  25 +++-
 convex/e2eMedia.ts                            |   2 +
 convex/mediaKitPublicationMigration.ts        |   3 +-
 convex/profileMediaSubmissions.ts             |  60 ++++----
 convex/schema.ts                              |   1 +
 docs/engineering/media-review-commands.md     |  10 ++
 docs/testing/mcp-media-staging-lifecycle.md   |   2 +
 .../media-contribution-commands.test.ts       | 135 +++++++++++++++++-
 .../media-kit-publication-migration.test.ts   |  16 +++
 tests/web/contribution-batches.test.ts        |   1 +
 tests/web/mcp-media-review.test.ts            |   6 +
 13 files changed, 237 insertions(+), 46 deletions(-)

diff --git a/apps/web/e2e/media-contribution.flow.spec.ts b/apps/web/e2e/media-contribution.flow.spec.ts
index e0b8ab59..a4b22a19 100644
--- a/apps/web/e2e/media-contribution.flow.spec.ts
+++ b/apps/web/e2e/media-contribution.flow.spec.ts
@@ -1,5 +1,5 @@
 import sharp from "sharp";
-import type { PublishedContributionDetail } from "@vrdex/api-contracts";
+import type { CommandReceipt, PublishedContributionDetail } from "@vrdex/api-contracts";
 import { createHash, randomBytes } from "node:crypto";
 import { expect, test, type APIRequestContext, type Page } from "@playwright/test";
 import {
@@ -641,11 +641,14 @@ test("contributor A submits and distinct assigned reviewer B reviews media @medi
   expect(rpcManaged.operationState).toBe("committed");
   expect(await call(request, authA.access_token, "vrdex_media_contribution_manage", rpcManageInput)).toEqual(rpcManaged);
   rpcDetail = await call<PublishedContributionDetail>(request, authA.access_token, "vrdex_media_contribution_get", { submissionId: rpcSubmissionId });
+  // Upload begin and replacement proposals share the actor submission cooldown.
+  await new Promise(resolve => setTimeout(resolve, 31_000));
+  expect((await request.post("/api/e2e/media", { headers, data: { op: "grant-publication-actors", runId, profileId } })).status()).toBe(200);
   const rpcProposeInput = { submissionId: rpcSubmissionId, expectedContributionVersion: rpcDetail.contributionVersion, idempotencyKey: `${runId}-rpc-propose` };
-  const rpcProposed = await call<UploadReceipt>(request, authA.access_token, "vrdex_media_contribution_propose_placement", rpcProposeInput);
-  expect(rpcProposed.operationState).toBe("committed");
+  const rpcProposed = await call<CommandReceipt>(request, authA.access_token, "vrdex_media_contribution_propose_placement", rpcProposeInput);
+  expect(rpcProposed, "RPC replacement must pass the shared submission cooldown").toMatchObject({ operationState: "committed" });
+  expect(rpcProposed.code).toBeUndefined();
   expect(await call(request, authA.access_token, "vrdex_media_contribution_propose_placement", rpcProposeInput)).toEqual(rpcProposed);
-  expect((await request.post("/api/e2e/media", { headers, data: { op: "grant-publication-actors", runId, profileId } })).status()).toBe(200);
   const rpcReview = await call<{ reviewVersion: string }>(request, authB.access_token, "vrdex_media_review_get", { submissionId: rpcProposed.resourceId! });
   expect((await request.post("/api/e2e/media", { headers, data: { op: "exercise-publication-guards", action: "reselect_primary", runId, profileId } })).status()).toBe(200);
   const rpcDecision = { submissionId: rpcProposed.resourceId!, expectedReviewVersion: rpcReview.reviewVersion, decision: "approve", privateReason: "Synthetic independent RPC replacement", idempotencyKey: `${runId}-rpc-review` };
diff --git a/convex/_mediaContributionCommands.ts b/convex/_mediaContributionCommands.ts
index cf976ddd..a2969c13 100644
--- a/convex/_mediaContributionCommands.ts
+++ b/convex/_mediaContributionCommands.ts
@@ -30,8 +30,6 @@ async function contributionState(ctx: QueryCtx | MutationCtx, submissionId: stri
     throw new ConvexError({ code: "MEDIA_RESOURCE_UNAVAILABLE", message: "Published contribution unavailable." });
   const placement = profile.profileType === "person" ? "profile_image" as const : "primary_logo" as const;
   const snapshot = await reviewSnapshot(ctx, { ...submission, requestKind: "identity_placement", candidateAssetId: asset._id, requestedPlacement: placement }, profile);
-  const identityPlacements = await ctx.db.query("profileAssetPlacements").withIndex("by_profileId_state", q => q.eq("profileId", profile._id).eq("state", "active"))
-    .filter(q => q.or(q.eq(q.field("placement"), "profile_image"), q.eq(q.field("placement"), "primary_logo"))).collect();
   const current = await ctx.db.query("profileAssetPlacements").withIndex("by_profileId_placement_state_position", q =>
     q.eq("profileId", profile._id).eq("placement", placement).eq("state", "active")).first();
   const access = await getAccountFeatureAccess(ctx.db, actor.user._id);
@@ -50,7 +48,7 @@ async function contributionState(ctx: QueryCtx | MutationCtx, submissionId: stri
   const ownKitOnly = submissionsEnabled &&
     publicKitAvailable(profile) && kitVisible && !restrictions.some(Boolean) && asset.state === "active" &&
     !protectedSelection;
-  return { submission, profile, asset, placement, snapshot, current, identityPlacements, publisher, submissionsEnabled, newPlacementAvailable, publicUnclaimed, restrictions, ownSelection, kitVisible, ownKitOnly, protectedSelection,
+  return { submission, profile, asset, placement, snapshot, current, publisher, submissionsEnabled, newPlacementAvailable, publicUnclaimed, restrictions, ownSelection, kitVisible, ownKitOnly, protectedSelection,
     version: await hash({ asset, source: submission, placement: current, assetPlacements, picture: snapshot.currentImage, restrictions, publicUnclaimed, revision: snapshot.reviewVersion }) };
 }
 
@@ -62,9 +60,9 @@ export async function publishedContributionDetail(ctx: QueryCtx | MutationCtx, s
     contributionVersion: s.version,
     metadata: { label: metadata.label ?? "Image", altText: metadata.altText, credit: metadata.credit ?? "",
       creditUrl: metadata.creditUrl, sourceUrl: metadata.sourceUrl, sourceDescription: metadata.sourceDescription },
-    canSelectPrimary: s.newPlacementAvailable && s.publisher && !s.identityPlacements.length && !s.snapshot.currentImage,
+    canSelectPrimary: s.newPlacementAvailable && s.publisher && !s.snapshot.identityOccupied,
     canClearPrimary: s.submissionsEnabled && s.publisher && s.ownSelection,
-    canProposePlacement: s.newPlacementAvailable && s.publicUnclaimed && !s.restrictions.some(Boolean) && !s.ownSelection && !!(s.identityPlacements.length || s.snapshot.currentImage),
+    canProposePlacement: s.newPlacementAvailable && s.publicUnclaimed && !s.restrictions.some(Boolean) && !s.ownSelection && s.snapshot.identityOccupied,
     canEditMetadata: s.ownKitOnly, canRemove: s.ownKitOnly && s.submission.legalHoldAt === undefined,
   };
 }
@@ -85,7 +83,8 @@ async function command(ctx: MutationCtx, input: ContributionCommandBase | Contri
     !s.publicUnclaimed ? "target_unavailable" : s.restrictions.some(Boolean) ? "publication_restricted" :
     !proposal && !s.publisher ? "publisher_required" : s.version !== args.expectedContributionVersion ? "contribution_changed" :
     (proposal || selecting) && !s.newPlacementAvailable ? "target_unavailable" :
-    !proposal && selecting && (s.identityPlacements.length || s.snapshot.currentImage) ? "primary_occupied" :
+    proposal && !s.snapshot.identityOccupied ? "primary_empty" :
+    !proposal && selecting && s.snapshot.identityOccupied ? "primary_occupied" :
     !proposal && !selecting && !s.ownSelection ? "selection_changed" : undefined;
   if (!code && proposal) {
     const now = Date.now();
diff --git a/convex/_mediaReview.ts b/convex/_mediaReview.ts
index e7fc564a..238f676b 100644
--- a/convex/_mediaReview.ts
+++ b/convex/_mediaReview.ts
@@ -136,7 +136,7 @@ export async function outwardReviewSnapshot(
   ctx: Pick<QueryCtx, "db">, submission: Doc<"profileMediaSubmissions">,
   profile: Doc<"profiles">, elevated = false,
 ) {
-  const snapshot = await reviewSnapshot(ctx, submission, profile);
+  const { identityOccupied, ...snapshot } = await reviewSnapshot(ctx, submission, profile);
   if (submission.requestKind !== "identity_placement") return { ...snapshot, currentPlacement: null };
   const placement = snapshot.currentPlacement;
   const asset = placement ? await ctx.db.get(placement.assetId) : null;
@@ -315,6 +315,7 @@ export async function applyReviewDecision(
   if (submission.requestKind === "identity_placement" && submission.candidateAssetId) {
     const candidate = await ctx.db.get(submission.candidateAssetId);
     const snapshot = await reviewSnapshot(ctx, submission, profile);
+    if (!snapshot.identityOccupied) throw new Error("Replacement requires an occupied identity placement.");
     if (!candidate || !snapshot.candidate.rendition) throw new Error("The placement candidate is unavailable.");
     if ((await publicationRestrictions(ctx, profile._id, candidate.contentSha256)).some(Boolean))
       throw new ConvexError({ code: "MEDIA_PUBLICATION_RESTRICTED", message: "Media contribution unavailable." });
@@ -575,10 +576,10 @@ export async function reviewSnapshot(
     identityPlacements: authoredPlacements.filter(row => row.placement === "profile_image" || row.placement === "primary_logo"),
   });
   const restrictions = await Promise.all([
-    ctx.db.query("mediaPublicationRestrictions").withIndex("by_profileId_kind", q => q.eq("profileId", profile._id).eq("kind", "identity")).collect(),
-    ctx.db.query("mediaPublicationRestrictions").withIndex("by_profileId_kind", q => q.eq("profileId", profile._id).eq("kind", "dispute")).collect(),
-    submission.contentSha256 ? ctx.db.query("mediaPublicationRestrictions").withIndex("by_contentSha256_kind", q => q.eq("contentSha256", submission.contentSha256).eq("kind", "rejection")).collect() : [],
-    submission.contentSha256 ? ctx.db.query("mediaPublicationRestrictions").withIndex("by_contentSha256_kind", q => q.eq("contentSha256", submission.contentSha256).eq("kind", "suppression")).collect() : [],
+    ctx.db.query("mediaPublicationRestrictions").withIndex("by_profileId_kind", q => q.eq("profileId", profile._id).eq("kind", "identity")).first(),
+    ctx.db.query("mediaPublicationRestrictions").withIndex("by_profileId_kind", q => q.eq("profileId", profile._id).eq("kind", "dispute")).first(),
+    submission.contentSha256 ? ctx.db.query("mediaPublicationRestrictions").withIndex("by_contentSha256_kind", q => q.eq("contentSha256", submission.contentSha256).eq("kind", "rejection")).first() : null,
+    submission.contentSha256 ? ctx.db.query("mediaPublicationRestrictions").withIndex("by_contentSha256_kind", q => q.eq("contentSha256", submission.contentSha256).eq("kind", "suppression")).first() : null,
   ]);
   const reviewVersion = await hash({
     candidate: {
@@ -606,7 +607,7 @@ export async function reviewSnapshot(
     },
     intent,
     candidateAsset,
-    restrictions,
+    restrictions: restrictions.map(Boolean),
     profile: kitAsset || submission.candidateAssetId ? {
       id: profile._id, profileType: profile.profileType, slug: profile.slug,
       displayName: profile.displayName, claimState: profile.claimState,
@@ -632,6 +633,7 @@ export async function reviewSnapshot(
     revision: submission.reviewRevision ?? 0,
   });
   return {
+    identityOccupied: authoredPlacements.some(row => row.placement === "profile_image" || row.placement === "primary_logo") || currentImage !== null,
     placementTargetVersion,
     reviewVersion,
     currentImage,
@@ -733,6 +735,8 @@ export async function decideReviewCommand(
       submission.targetPlacementAssetId
   )
     code = "placement_changed";
+  else if (args.decision === "approve" && submission.requestKind === "identity_placement" && submission.candidateAssetId && !snapshot.identityOccupied)
+    code = "primary_empty";
   else if (args.decision === "reject" && args.publicReason === undefined)
     code = "public_reason_required";
   else if (args.decision === "approve" && snapshot.candidate.rendition === null)
@@ -832,9 +836,16 @@ export async function hasSubmissionAssignment(
   submission: Doc<"profileMediaSubmissions">,
   userId: Id<"users">,
 ) {
+  const candidate = submission.requestKind === "identity_placement" && submission.candidateAssetId
+    ? await ctx.db.get(submission.candidateAssetId) : null;
+  const source = candidate?.sourceSubmissionId ? await ctx.db.get(candidate.sourceSubmissionId) : null;
+  const assignedSubmission = source && source.status === "approved" && source.requestKind !== "identity_placement" &&
+    candidate?.profileId === submission.profileId && source.profileId === submission.profileId &&
+    source.submitterUserId === submission.submitterUserId && source.approvedAssetId === candidate?._id
+    ? source : submission;
   const attempt = await ctx.db
     .query("contributionItemAttempts")
-    .withIndex("by_submissionId", (q) => q.eq("submissionId", submission._id))
+    .withIndex("by_submissionId", (q) => q.eq("submissionId", assignedSubmission._id))
     .unique();
   const revision = attempt ? await ctx.db.get(attempt.revisionId) : null;
   return (
diff --git a/convex/e2eMedia.ts b/convex/e2eMedia.ts
index 5730151d..82fbdd97 100644
--- a/convex/e2eMedia.ts
+++ b/convex/e2eMedia.ts
@@ -281,6 +281,8 @@ export const grantPublicationActors = internalMutation({
     let rowCount = batch.rowCount;
     for (const submission of (await rows(ctx, profile._id)).submissions) {
       if (submission.submitterUserId !== contributorId) throw new Error("Unscoped fixture contribution.");
+      // Existing-asset replacements inherit the original contribution assignment.
+      if (submission.requestKind === "identity_placement" && submission.candidateAssetId) continue;
       const attempt = await ctx.db.query("contributionItemAttempts").withIndex("by_submissionId", q => q.eq("submissionId", submission._id)).unique();
       if (attempt) {
         const revision = await ctx.db.get(attempt.revisionId);
diff --git a/convex/mediaKitPublicationMigration.ts b/convex/mediaKitPublicationMigration.ts
index 24ae30fd..eb822c26 100644
--- a/convex/mediaKitPublicationMigration.ts
+++ b/convex/mediaKitPublicationMigration.ts
@@ -46,7 +46,8 @@ export const convertBatch = internalMutation({
           intent.targetProfileId !== submission.profileId || !["pending", "uploaded"].includes(intent.state)) { conflicts++; continue; }
         if (!args.dryRun) {
           await ctx.db.patch(submission._id, { requestKind: "kit_asset", requestedPlacement: "gallery", reviewRevision: (submission.reviewRevision ?? 0) + 1 });
-          await ctx.db.patch(intent._id, { placements: ["gallery"] });
+          await ctx.db.patch(intent._id, { placements: ["gallery"],
+            ...(intent.sourceUrl === undefined && submission.sourceUrl !== undefined ? { sourceUrl: submission.sourceUrl } : {}) });
         }
         changed++; continue;
       }
diff --git a/convex/profileMediaSubmissions.ts b/convex/profileMediaSubmissions.ts
index 73a021d4..4ee17965 100644
--- a/convex/profileMediaSubmissions.ts
+++ b/convex/profileMediaSubmissions.ts
@@ -64,8 +64,14 @@ export const contributionDetail = query({ args: { submissionId }, handler: async
 } });
 export const contributionDetailForMcpActor = internalQuery({
   args: { submissionId, actorUserId: v.id("users"), ...reviewActorAttestationArgs },
-  handler: async (ctx, args) => publishedContributionDetail(ctx, args.submissionId,
-    await trustedReviewActor(ctx, args.actorUserId, args, "assets:contribute", false)),
+  handler: async (ctx, args) => {
+    const actor = await trustedReviewActor(ctx, args.actorUserId, args, "assets:contribute", false);
+    try { return await publishedContributionDetail(ctx, args.submissionId, actor); }
+    catch (error) {
+      if (error instanceof ConvexError && typeof error.data === "object" && error.data?.code === "MEDIA_RESOURCE_UNAVAILABLE") return null;
+      throw error;
+    }
+  },
 });
 export const placeContribution = mutation({ args: placementCommandArgs, handler: async (ctx, args) =>
   contributionPlacementCommand(ctx, args, await browserReviewActor(ctx)) });
@@ -1564,32 +1570,34 @@ async function authorizedReviewPage(
       .withIndex("by_batch_key_revision", (q) => q.eq("batchId", batch._id))
       .paginate(paginationOpts);
     const page = [];
+    const seen = new Set<string>();
     for (const rev of revisions.page) {
-      const attempt = await ctx.db
-        .query("contributionItemAttempts")
-        .withIndex("by_revision", (q) => q.eq("revisionId", rev._id))
-        .unique();
-      const submission = attempt?.submissionId
-        ? await ctx.db.get(attempt.submissionId)
-        : null;
-      if (
-        !submission ||
-        submission.status !== status ||
-        (args.profileId && submission.profileId !== args.profileId) ||
-        (["submitted", "under_review"].includes(status) &&
-          submission.expiresAt <= Date.now())
-      )
-        continue;
-      const profile = await ctx.db.get(submission.profileId);
-      if (!profile) continue;
-      try {
-        await reviewerContext(ctx, profile, currentActor, submission);
-      } catch {
-        continue;
+      const attempt = await ctx.db.query("contributionItemAttempts")
+        .withIndex("by_revision", q => q.eq("revisionId", rev._id)).unique();
+      const source = attempt?.submissionId ? await ctx.db.get(attempt.submissionId) : null;
+      if (!source || rev.actorUserId !== source.submitterUserId) continue;
+      const candidate = source.approvedAssetId ? await ctx.db.get(source.approvedAssetId) : null;
+      const inherited = source.status === "approved" && source.requestKind !== "identity_placement" &&
+        candidate && candidate.profileId === source.profileId && candidate.sourceSubmissionId === source._id &&
+        (status === "submitted" || status === "under_review")
+        ? await ctx.db.query("profileMediaSubmissions")
+          .withIndex("by_candidateAssetId_status_expiresAt", q => q.eq("candidateAssetId", candidate._id).eq("status", status).gt("expiresAt", Date.now()))
+          .take(11) : [];
+      // Open target capacity is ten; fail closed rather than truncate unexpected overflow.
+      if (inherited.length > 10) throw new Error("Replacement review queue exceeds target capacity.");
+      for (const submission of [source, ...inherited]) {
+        if (seen.has(submission._id) || submission.profileId !== source.profileId ||
+          submission.submitterUserId !== source.submitterUserId || submission.status !== status ||
+          (submission !== source && submission.requestKind !== "identity_placement") ||
+          (args.profileId && submission.profileId !== args.profileId) ||
+          (["submitted", "under_review"].includes(status) && submission.expiresAt <= Date.now())) continue;
+        const profile = await ctx.db.get(submission.profileId);
+        if (!profile) continue;
+        try { await reviewerContext(ctx, profile, currentActor, submission); }
+        catch { continue; }
+        seen.add(submission._id);
+        page.push(await reviewSubmission(ctx, submission, profile, access.superAdmin));
       }
-      page.push(
-        await reviewSubmission(ctx, submission, profile, access.superAdmin),
-      );
     }
     return {
       ...writeScopedPagination(revisions,scope),
diff --git a/convex/schema.ts b/convex/schema.ts
index 6d59d68b..4ea06838 100644
--- a/convex/schema.ts
+++ b/convex/schema.ts
@@ -982,6 +982,7 @@ export default defineSchema({
     .index("by_contentSha256", ["contentSha256"])
     .index("by_contentSha256_status", ["contentSha256", "status"])
     .index("by_approvedAssetId", ["approvedAssetId"])
+    .index("by_candidateAssetId_status_expiresAt", ["candidateAssetId", "status", "expiresAt"])
     .index("by_publicationMethod_actor", ["publicationMethod", "publicationActorUserId"]),
   profileAssets: defineTable({
     sourceSubmissionId: v.optional(v.id("profileMediaSubmissions")),
diff --git a/docs/engineering/media-review-commands.md b/docs/engineering/media-review-commands.md
index ea3d5337..2633195d 100644
--- a/docs/engineering/media-review-commands.md
+++ b/docs/engineering/media-review-commands.md
@@ -380,3 +380,13 @@ Conversion preserves primary placements, uploaded renditions/digests, historical
 Karly's approved submission handle is `x1747ftcbeq1k475kz4hqdn77d8fcz0r`. The correction is separate from generic conversion. A fresh authorized operator must resolve exact asset and placement IDs, the placement's own updatedAt and selectionOperationId. Never substitute profile or submission timestamps. Save those values with submissionId, expectedAssetId, expectedPlacementId, expectedPlacementUpdatedAt and expectedSelectionOperationId (explicit null for absent legacy provenance) in a local JSON file. Preview with `node --import tsx scripts/media-kit-publication-migration.mjs --target <approved-target> --correction-file <exact-preview.json>`. Apply requires separate exact-resource authorization and a fresh identical preview before adding `--apply`. Changed, reselected, duplicate, claimed, private, foreign, held or restricted resources refuse. The correction retires only the exact legacy primary placement and retains an active public gallery asset. It never selects a replacement picture or deletes bytes.
 
 Kit approval authorizes publication into the public media kit. Placement approval authorizes explicit use of an already published candidate as the picture. Logical removal hides an item but retains storage/accounting/history. Permanent byte deletion remains governed by existing cleanup and legal-hold policy.
+
+## Existing-asset replacement boundaries
+
+New replacement proposals require an occupied identity slot, including visible legacy or automatic artwork. Empty targets return a durable `primary_empty` refusal for ordinary and trusted contributors through browser and MCP commands. Fresh approval of an existing-asset proposal checks occupancy again, including after rebase. Uploaded legacy identity proposals and owner/admin media management retain their existing rules. Historical command receipts remain recoverable.
+
+A replacement candidate inherits reviewer authority from its approved asset's original submission and collection assignment. Current reviewer grant and assignment are required for queue, inspection and decision. Assigned website and MCP queues project the new proposal's submission ID; direct media review commands operate on that ID. Original collection revisions, attempts, receipts and audits remain unchanged. Collection item apply continues to refer to its original item, so review replacements through the media-review queue or exact media-review commands.
+
+Queue projection reads at most 40 source revisions and eleven indexed, unexpired proposals of the requested open status per source asset. More than ten matching proposals fails closed instead of truncating unexpected overflow. Duplicate submission IDs are removed, foreign profile/submitter proposals are excluded, and each row passes current reviewer authority. This permits up to 440 projected rows on a source-revision page; the continuation cursor remains tied to the source revisions. Direct trusted contributions without a source collection retain distinct admin review and do not acquire an ordinary reviewer assignment automatically. A future assignment intake is needed for those contributions.
+
+Restriction versions track existence of each indexed restriction kind, using one bounded read per kind. Adding more history while the same restriction already exists does not invalidate inspection again; the first restriction changes the version and fresh approval still refuses. MCP contribution lookup returns the existing unavailable tool result only for known missing or unavailable resources. Token, scope and verification errors retain their authority failure.
diff --git a/docs/testing/mcp-media-staging-lifecycle.md b/docs/testing/mcp-media-staging-lifecycle.md
index 85d2330c..b228c45e 100644
--- a/docs/testing/mcp-media-staging-lifecycle.md
+++ b/docs/testing/mcp-media-staging-lifecycle.md
@@ -264,3 +264,5 @@ Local migration tests, fixture receipts and catalog checks are preparedness, not
 The executed run must show minted upload transfer, completion and same-key recovery, stored preview, kit publication without declaration, approved-state readback, public kit render and usable decoded download, select/undo, metadata correction, kit-only removal and independent existing-asset replacement. Publication with an existing picture must leave that picture unchanged. Check the deployed media-kit feature flag and public field visibility, unrelated biography edits, stale selection refusal, protected same-asset reselection, revoked publisher/reviewer authority and replay denial after revocation. Capture desktop/mobile public kit and unchanged/selected/restored picture screenshots. A successful Publish receipt alone is insufficient.
 
 After separately authorized deployment, preview bounded conversion from null cursor through isDone, review conflicts, then authorize apply from null cursor. Karly's exact-resource operator correction requires its own fresh preview using actual placement.updatedAt and selectionOperationId; public MCP/profile/submission timestamps cannot prove these guards. Production conversion/correction and its public render/download verification remain separate approval gates. Preserve the existing fixture expiry and exact-run cleanup assertions throughout.
+
+The RPC upload and subsequent replacement proposal share the contributor submission cooldown. Wait 31 seconds after the upload before proposing with a fresh key; a refusal receipt remains durable on its original key. The fixture establishes the published source contribution's scoped reviewer assignment before proposing. It does not grant a new replacement assignment afterward. Saved-run cleanup attachments prove cleanup in that run, not a later live readback.
diff --git a/tests/backend/media-contribution-commands.test.ts b/tests/backend/media-contribution-commands.test.ts
index 4753fdfd..63cf5e6e 100644
--- a/tests/backend/media-contribution-commands.test.ts
+++ b/tests/backend/media-contribution-commands.test.ts
@@ -108,6 +108,7 @@ for (const condition of ["primary", "other_selection", "claimed", "private_profi
 
 it("metadata correction invalidates inspected placement review and refreshes its candidate projection", async () => {
   const f = await fixture();
+    await occupyFallback(f);
   const d = await f.detail();
   const proposal = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "proposal" });
   const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
@@ -276,12 +277,13 @@ it("owner same-asset selection stamps new provenance and retains the contributio
 
 it("ignores biography edits but binds review to the exact original primary selection", async () => {
   const f = await fixture();
+    await occupyFallback(f);
   const d = await f.detail();
   await f.t.run(ctx => ctx.db.patch(f.s.profileId, { headline: "Changed biography", updatedAt: Date.now() }));
   assert.equal((await f.detail()).contributionVersion, d.contributionVersion);
   const p = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "proposal" });
   assert.equal(p.operationState, "committed");
-  await f.place("select_primary");
+  await f.t.run(ctx => selectProfileAssetIdentity(ctx.db, { profileId: f.s.profileId, assetId: d.assetId, placement: "profile_image", actorUserId: f.s.moderatorUserId, now: Date.now() }));
   const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
   const review = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: p.resourceId! });
   assert.ok(review);
@@ -312,6 +314,7 @@ it("legacy placements never authorize undo and publisher revocation refuses hist
 
 it("reviews existing-asset placement without a new upload or published charge", async () => {
   const f = await fixture();
+    await occupyFallback(f);
   const d = await f.detail();
   const proposal = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, {
     submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "proposal",
@@ -336,6 +339,7 @@ it("reviews existing-asset placement without a new upload or published charge",
 for (const disposition of ["reject", "withdraw"] as const) {
   it(`${disposition} leaves the published asset and its bytes alone`, async () => {
     const f = await fixture();
+    await occupyFallback(f);
     const beforeCharge = await f.t.run(ctx => ctx.db.query("contributionUploadReservations").first());
     const d = await f.detail();
     const p = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "proposal" });
@@ -417,6 +421,7 @@ it("treats visible automatic artwork as occupied and refuses hidden authored ide
 
 it("does not interpret a rejected placement as a digest-wide content rejection", async () => {
   const f = await fixture();
+  await occupyFallback(f);
   const d = await f.detail();
   const p = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "proposal" });
   assert.equal(p.operationState, "committed");
@@ -542,6 +547,7 @@ for (const condition of ["disabled_kit", "hidden_kit", "disabled_submissions"] a
 for (const unavailable of ["hidden", "disabled"] as const) {
   it(`refuses fresh candidate approval for a ${unavailable} kit, including a fresh inspection and legacy decisions`, async () => {
     const f = await fixture();
+    await occupyFallback(f);
     const d = await f.detail();
     const proposal = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "candidate-proposal" });
     const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
@@ -561,6 +567,7 @@ for (const unavailable of ["hidden", "disabled"] as const) {
 for (const kind of ["identity", "dispute", "suppression", "rejection"] as const) {
   it(`rechecks current ${kind} restrictions at receipt and legacy candidate approval`, async () => {
     const f = await fixture();
+    await occupyFallback(f);
     const d = await f.detail();
     if (kind === "identity" || kind === "dispute") await f.t.run(ctx => ctx.db.patch(d.assetId, { contentSha256: undefined }));
     const freshContribution = await f.detail();
@@ -601,7 +608,8 @@ it("editable profile projection uses current public-kit availability for intake"
 });
 
 it("replays exact committed placement review after kit withdrawal and a later restriction", async () => {
-  const f = await fixture(); const d = await f.detail();
+  const f = await fixture();
+    await occupyFallback(f); const d = await f.detail();
   const p = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "candidate-proposal" });
   const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
   const detail = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: p.resourceId! }); assert.ok(detail);
@@ -613,3 +621,126 @@ it("replays exact committed placement review after kit withdrawal and a later re
   finally { process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true"; }
   assert.deepEqual(await f.placements(), ["gallery", "profile_image"]);
 });
+
+async function occupyFallback(f: Awaited<ReturnType<typeof fixture>>) {
+  await f.t.run(ctx => ctx.db.patch(f.s.profileId, { avatarImageUrl: "https://example.test/current.png" }));
+}
+for (const trusted of [false, true]) for (const mcp of [false, true]) {
+  it(`durably refuses empty replacement for ${trusted ? "trusted" : "ordinary"} ${mcp ? "MCP" : "browser"} contributors`, async () => {
+    const f = await fixture("person", !trusted); const d = await f.detail();
+    const attestation = await contributionAttestation(f);
+    const args = { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "empty" };
+    const call = () => mcp ? f.t.mutation(internal.profileMediaSubmissions.proposePlacementForMcpActor, { ...args, ...attestation }) : f.actor.mutation(api.profileMediaSubmissions.proposePlacement, args);
+    const receipt = await call(); assert.equal(receipt.code, "primary_empty"); assert.equal(receipt.operationState, "refused");
+    await occupyFallback(f); assert.deepEqual(await call(), receipt);
+    assert.equal((await f.t.run(ctx => ctx.db.query("profileMediaSubmissions").collect())).length, 1);
+  });
+}
+async function contributionAttestation(f: Awaited<ReturnType<typeof fixture>>) {
+  await f.t.run(ctx => ctx.db.insert("oauthAccessTokens", { tokenId: "replacement-token", clientId: "client", subjectType: "user", userId: f.s.contributorUserId,
+    resource: "https://example.test/mcp", scopes: ["mcp:read", "mcp:write", "assets:contribute"], status: "active", issuedAt: Date.now(), expiresAt: Date.now() + 60_000 }));
+  return { actorUserId: f.s.contributorUserId, oauthTokenId: "replacement-token", oauthClientId: "client", emailVerified: true, emailVerificationAttestedAt: Date.now() };
+}
+it("actual MCP proposal boundary reports upload cooldown and admits a fresh key after the unchanged window", async () => {
+  const f = await fixture(); await occupyFallback(f); const attestation = await contributionAttestation(f);
+  await f.t.run(ctx => ctx.db.patch(f.intent.submissionId, { createdAt: Date.now() }));
+  const d = await f.detail(); const args = { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "cooldown", ...attestation };
+  const refused = await f.t.mutation(internal.profileMediaSubmissions.proposePlacementForMcpActor, args);
+  assert.equal(refused.code, "proposal_rate_limited"); assert.equal(refused.operationState, "refused");
+  await f.t.run(ctx => ctx.db.patch(f.intent.submissionId, { createdAt: Date.now() - 31_000 }));
+  assert.deepEqual(await f.t.mutation(internal.profileMediaSubmissions.proposePlacementForMcpActor, args), refused);
+  const fresh = await f.detail();
+  assert.equal((await f.t.mutation(internal.profileMediaSubmissions.proposePlacementForMcpActor, { ...args, expectedContributionVersion: fresh.contributionVersion, idempotencyKey: "after-cooldown" })).operationState, "committed");
+});
+it("refuses fresh receipt and legacy approval after an old replacement is rebased onto an empty slot", async () => {
+  const f = await fixture(); await occupyFallback(f); const d = await f.detail();
+  const proposal = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "occupied" });
+  const reviewer = f.t.withIdentity(f.s.moderatorIdentity); await f.t.run(ctx => ctx.db.patch(f.s.profileId, { avatarImageUrl: undefined }));
+  const detail = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: proposal.resourceId! }); assert.ok(detail);
+  await reviewer.mutation(api.profileMediaSubmissions.rebase, { submissionId: proposal.resourceId!, expectedReviewVersion: detail.reviewVersion, idempotencyKey: "empty-rebase" });
+  const fresh = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: proposal.resourceId! }); assert.ok(fresh);
+  const args = { submissionId: proposal.resourceId!, expectedReviewVersion: fresh.reviewVersion, decision: "approve" as const, privateReason: "Checked", idempotencyKey: "empty-review" };
+  const refused = await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, args); assert.equal(refused.code, "primary_empty");
+  assert.deepEqual(await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, args), refused);
+  await assert.rejects(reviewer.mutation(api.profileMediaSubmissions.decide, { submissionId: proposal.resourceId!, expectedProfileUpdatedAt: (await f.t.run(ctx => ctx.db.get(f.s.profileId)))!.updatedAt, decision: "approve", privateReason: "Checked" }), /occupied/);
+  assert.deepEqual(await f.placements(), ["gallery"]);
+});
+it("inherits only the original batch assignment for a candidate replacement", async () => {
+  const f = await fixture(); await occupyFallback(f); const d = await f.detail();
+  const assignment = await f.t.run(async ctx => {
+    const grants = await ctx.db.query("accountFeatureGrants").collect();
+    for (const grant of grants) if (grant.userId === f.s.moderatorUserId) await ctx.db.patch(grant._id, { state: "revoked" });
+    await ctx.db.insert("accountFeatureGrants", { userId: f.s.moderatorUserId, feature: "media_reviewer", state: "active", grantedAt: Date.now(), updatedAt: Date.now(), grantedBy: { issuer: "test", subject: "operator", tokenIdentifier: "test:operator" } });
+    const batchId = await ctx.db.insert("contributionBatches", { actorUserId: f.s.contributorUserId, idempotencyKey: "source-batch", label: "Source", archived: false, rowCount: 1, createdAt: Date.now() });
+    const revisionId = await ctx.db.insert("contributionItemRevisions", { actorUserId: f.s.contributorUserId, batchId, itemKey: "source", revision: 1, payload: "{}", bytes: 2, createdAt: Date.now() });
+    await ctx.db.insert("contributionItemAttempts", { actorUserId: f.s.contributorUserId, revisionId, oauthClientId: "client", submissionId: f.intent.submissionId, receipt: { operationId: "source", operationState: "committed" }, createdAt: Date.now() });
+    return { id: await ctx.db.insert("contributionBatchReviewers", { batchId, reviewerUserId: f.s.moderatorUserId, active: true, expiresAt: Date.now() + 60_000 }), batchId };
+  });
+  const p = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "assigned-replacement" });
+  const reviewer = f.t.withIdentity(f.s.moderatorIdentity); const detail = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: p.resourceId! }); assert.ok(detail);
+  const foreign = await seed(f.t, "community");
+  await f.t.run(async ctx => {
+    const proposal = (await ctx.db.get(ctx.db.normalizeId("profileMediaSubmissions", p.resourceId!)!))!;
+    const { _id, _creationTime, ...fields } = proposal;
+    await ctx.db.insert("profileMediaSubmissions", { ...fields, profileId: foreign.profileId });
+    await ctx.db.insert("profileMediaSubmissions", { ...fields, submitterUserId: f.s.moderatorUserId });
+    await ctx.db.insert("profileMediaSubmissions", { ...fields, status: "rejected" });
+  });
+  const listArgs = { batchId: assignment.batchId, status: "submitted" as const, paginationOpts: { cursor: null, numItems: 40 } };
+  const queue = await reviewer.query(api.profileMediaSubmissions.listForReview, listArgs);
+  assert.deepEqual(queue.page.map(row => row.submissionId), [p.resourceId]);
+  const mcpQueue = await f.t.query(internal.profileMediaSubmissions.listForReviewForMcpActor, { ...listArgs, actorUserId: f.s.moderatorUserId, emailVerified: true, emailVerificationAttestedAt: Date.now() });
+  assert.deepEqual(mcpQueue.page.map(row => row.submissionId), [p.resourceId]);
+  assert.equal(await f.t.run(ctx => ctx.db.query("contributionItemAttempts").withIndex("by_submissionId", q => q.eq("submissionId", ctx.db.normalizeId("profileMediaSubmissions", p.resourceId!)!)).first()), null);
+  await f.t.run(ctx => ctx.db.patch(assignment.id, { active: false }));
+  await assert.rejects(reviewer.query(api.profileMediaSubmissions.listForReview, listArgs), /BATCH_UNAVAILABLE/);
+  await assert.rejects(reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: p.resourceId! }), /ACCESS_REQUIRED/);
+  await f.t.run(ctx => ctx.db.patch(assignment.id, { active: true }));
+  assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, { submissionId: p.resourceId!, expectedReviewVersion: detail.reviewVersion, decision: "approve", privateReason: "Assigned replacement checked", idempotencyKey: "assigned-approve" })).operationState, "committed");
+});
+it("unbatched replacement refuses an ordinary reviewer and keeps distinct admin review", async () => {
+  const f = await fixture(); await occupyFallback(f); const d = await f.detail();
+  const p = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "unbatched" });
+  const grant = await f.t.run(async ctx => { const old = (await ctx.db.query("accountFeatureGrants").collect()).find(g => g.userId === f.s.moderatorUserId)!; await ctx.db.patch(old._id, { feature: "media_reviewer" }); return old._id; });
+  const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
+  await assert.rejects(reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: p.resourceId! }), /ACCESS_REQUIRED/);
+  await f.t.run(ctx => ctx.db.patch(grant, { feature: "super_admin" }));
+  const detail = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: p.resourceId! }); assert.ok(detail);
+  assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, { submissionId: p.resourceId!, expectedReviewVersion: detail.reviewVersion, decision: "approve", privateReason: "Admin checked", idempotencyKey: "admin" })).operationState, "committed");
+});
+it("MCP get returns known unavailable as null but preserves token and verification errors", async () => {
+  const f = await fixture(); const attestation = await contributionAttestation(f); const d = await f.detail();
+  await f.t.run(ctx => ctx.db.patch(d.assetId, { state: "deleted" }));
+  assert.equal(await f.t.query(internal.profileMediaSubmissions.contributionDetailForMcpActor, { submissionId: f.intent.submissionId, ...attestation }), null);
+  await assert.rejects(f.t.query(internal.profileMediaSubmissions.contributionDetailForMcpActor, { submissionId: f.intent.submissionId, ...attestation, emailVerified: false }), /verified/i);
+  await f.t.run(async ctx => { const token = await ctx.db.query("oauthAccessTokens").withIndex("by_tokenId", q => q.eq("tokenId", "replacement-token")).unique(); await ctx.db.patch(token!._id, { status: "revoked" }); });
+  await assert.rejects(f.t.query(internal.profileMediaSubmissions.contributionDetailForMcpActor, { submissionId: f.intent.submissionId, ...attestation }), /DENIED/);
+});
+it("restriction snapshot tracks bounded existence rather than append-only history", async () => {
+  const f = await fixture(); await occupyFallback(f); const d = await f.detail();
+  const p = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "restricted-history" });
+  const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
+  const insert = (count: number) => f.t.run(async ctx => { for (let i = 0; i < count; i++) await ctx.db.insert("mediaPublicationRestrictions", { profileId: f.s.profileId, submissionId: f.intent.submissionId, kind: "identity", actorUserId: f.s.moderatorUserId, createdAt: Date.now() }); });
+  const clean = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: p.resourceId! }); await insert(1);
+  const blocked = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: p.resourceId! }); assert.notEqual(blocked!.reviewVersion, clean!.reviewVersion);
+  await insert(250); const more = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: p.resourceId! }); assert.equal(more!.reviewVersion, blocked!.reviewVersion);
+  assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, { submissionId: p.resourceId!, expectedReviewVersion: more!.reviewVersion, decision: "approve", privateReason: "Checked", idempotencyKey: "blocked" })).code, "publication_restricted");
+});
+for (const managed of [false, true]) for (const mcp of [false, true]) {
+  it(`admits ${mcp ? "MCP" : "browser"} replacement with ${managed ? "managed" : "visible fallback"} identity occupancy`, async () => {
+    const f = await fixture("person", true); const d = await f.detail();
+    if (!managed) await occupyFallback(f);
+    else await f.t.run(async ctx => { const asset = (await ctx.db.get(d.assetId))!; const { _id, _creationTime, sourceSubmissionId, ...fields } = asset; const id = await ctx.db.insert("profileAssets", { ...fields, storageKey: "other.webp", source: "owner_authored" }); await selectProfileAssetIdentity(ctx.db, { profileId: f.s.profileId, assetId: id, placement: "profile_image", actorUserId: f.s.moderatorUserId, now: Date.now() }); });
+    const fresh = await f.detail(); assert.equal(fresh.canProposePlacement, true);
+    const args = { submissionId: f.intent.submissionId, expectedContributionVersion: fresh.contributionVersion, idempotencyKey: "occupied" };
+    const receipt = mcp ? await f.t.mutation(internal.profileMediaSubmissions.proposePlacementForMcpActor, { ...args, ...await contributionAttestation(f) }) : await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, args);
+    assert.equal(receipt.operationState, "committed");
+    const reviewer = f.t.withIdentity(f.s.moderatorIdentity); const review = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: receipt.resourceId! }); assert.ok(review);
+    assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, { submissionId: receipt.resourceId!, expectedReviewVersion: review.reviewVersion, decision: "approve", privateReason: "Replacement checked", idempotencyKey: "approve" })).operationState, "committed");
+  });
+}
+it("hidden fallback artwork leaves an empty replacement target", async () => {
+  const f = await fixture(); await f.t.run(ctx => ctx.db.patch(f.s.profileId, { avatarImageUrl: "https://example.test/hidden.png", fieldVisibility: { avatarImageUrl: "private" } }));
+  const d = await f.detail(); assert.equal(d.canProposePlacement, false);
+  assert.equal((await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "hidden-fallback" })).code, "primary_empty");
+});
diff --git a/tests/backend/media-kit-publication-migration.test.ts b/tests/backend/media-kit-publication-migration.test.ts
index 739286d4..ce841053 100644
--- a/tests/backend/media-kit-publication-migration.test.ts
+++ b/tests/backend/media-kit-publication-migration.test.ts
@@ -170,3 +170,19 @@ it("does not add gallery references for a restricted legacy contribution", async
   await f.t.run(ctx => ctx.db.insert("mediaPublicationRestrictions", { profileId: f.s.profileId, kind: "dispute", submissionId: f.intent.submissionId, createdAt: Date.now(), actorUserId: f.s.moderatorUserId }));
   assert.equal((await f.t.mutation(convert, { dryRun: false, cursor: null, limit: 40 })).changed, 0);
 });
+for (const existing of [undefined, "https://current.example/provenance"]) {
+  it(`migration before completion preserves ${existing ? "existing" : "missing legacy"} URL provenance through publication`, async () => {
+    const t = convexTest({ schema, modules: migrationModules }); const s = await seed(t);
+    const { api, internal } = await import("../../convex/_generated/api");
+    const intent = await t.withIdentity(s.contributorIdentity).mutation(api.profileMediaSubmissions.createUploadIntent, { profileId: s.profileId, requestedPlacement: "profile_image", originalFileName: "before.webp", mimeType: "image/webp", byteSize: 512, credit: "Artist", sourceUrl: "https://artist.example/source", expectedProfileUpdatedAt: (await t.run(ctx => ctx.db.get(s.profileId)))!.updatedAt });
+    await t.run(async ctx => { await ctx.db.patch(intent.submissionId, { requestKind: undefined, requestedPlacement: "profile_image" }); await ctx.db.patch(intent.intentId, { placements: ["profile_image"], sourceUrl: existing }); });
+    await t.mutation(convert, { dryRun: true, cursor: null, limit: 40 }); assert.equal((await t.run(ctx => ctx.db.get(intent.intentId)))!.sourceUrl, existing);
+    await t.mutation(convert, { dryRun: false, cursor: null, limit: 40 });
+    assert.equal((await t.run(ctx => ctx.db.get(intent.intentId)))!.sourceUrl, existing ?? "https://artist.example/source");
+    await t.mutation(internal.profileAssets.claimUploadIntentForStorage, { intentId: intent.intentId, uploadToken: intent.uploadToken, processingToken: "migration" });
+    await t.mutation(internal.profileAssets.markUploadIntentUploaded, { intentId: intent.intentId, uploadToken: intent.uploadToken, processingToken: "migration", mimeType: "image/webp", byteSize: 512, contentSha256: "migrated-url" });
+    const reviewer = t.withIdentity(s.moderatorIdentity); const detail = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: intent.submissionId }); assert.ok(detail);
+    assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, { submissionId: intent.submissionId, expectedReviewVersion: detail.reviewVersion, decision: "approve", privateReason: "Migrated", idempotencyKey: "migrated-publish" })).operationState, "committed");
+    assert.equal((await t.run(ctx => ctx.db.query("profileAssets").first()))!.sourceUrl, existing ?? "https://artist.example/source");
+  });
+}
diff --git a/tests/web/contribution-batches.test.ts b/tests/web/contribution-batches.test.ts
index bf8c0cd4..0fb6cdb1 100644
--- a/tests/web/contribution-batches.test.ts
+++ b/tests/web/contribution-batches.test.ts
@@ -17,6 +17,7 @@ it("returns the same item receipt for first URL submission and authorized cross-
     process.env.VRDEX_MEDIA_CLEANUP_URL="https://example.test/api/internal/media-cleanup";
     process.env.VRDEX_MEDIA_CLEANUP_TOKEN="test";
     process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED="true";
+    process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED="true";
     const modules={...baseModules,"../../convex/contributionCapacity.ts":()=>import("./convex/contributionCapacity.ts"),"../../convex/contributionBatches.ts":()=>import("./convex/contributionBatches.ts"),"../../convex/contributionUploads.ts":()=>import("./convex/contributionUploads.ts")};
     const t=convexTest({schema,modules}),s=await seed(t);
     for(const client of ["first","second"])await t.run(ctx=>ctx.db.insert("oauthAccessTokens",{tokenId:client+"-token",clientId:client,subjectType:"user",userId:s.contributorUserId,resource:"https://example.test/mcp",scopes:["mcp:write","mcp:read","assets:contribute"],status:"active",issuedAt:Date.now(),expiresAt:Date.now()+3600000}));
diff --git a/tests/web/mcp-media-review.test.ts b/tests/web/mcp-media-review.test.ts
index 5763edea..e2575724 100644
--- a/tests/web/mcp-media-review.test.ts
+++ b/tests/web/mcp-media-review.test.ts
@@ -614,3 +614,9 @@ it("contribution handlers bind verified actor, exact command and strict receipt/
   await assert.rejects(() => invalid.contributionGet({ submissionId: "submission-1" }));
   await assert.rejects(() => invalid.contributionPlace({ ...base, action: "clear_primary" }));
 });
+it("known unavailable contribution returns the stable tool refusal", async () => {
+  const handlers = createMcpMediaReviewHandlers(dependencies({ query: async () => null }));
+  const result = await handlers.contributionGet({ submissionId: "submission-1" });
+  assert.equal(result.isError, true);
+  assert.deepEqual(result.content, [{ type: "text", text: "Contribution unavailable." }]);
+});

From e34483a687cee9e0da3571195f5a58cae53fa40a Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Tue, 13 Oct 2026 13:20:32 -0400
Subject: [PATCH 22/28] Fix rendered identity replacement and asset-backed
 expiry

---
 apps/web/e2e/image-readiness.ts               |   6 ++
 apps/web/e2e/image-readiness.visual.spec.ts   |  27 +++++
 apps/web/e2e/media-contribution.flow.spec.ts  |   5 +-
 .../e2e/trusted-publication.visual.spec.ts    |   7 ++
 .../media-contributions/publication-card.tsx  |   2 +-
 .../media-review/media-review-panel.tsx       |   2 +-
 .../trusted-publication.stories.tsx           |   6 +-
 convex/_mediaContributionCommands.ts          |   6 +-
 convex/_mediaReview.ts                        |  17 ++-
 convex/_mediaSubmissionCleanup.ts             |   5 +
 convex/profileMediaSubmissions.ts             |  12 ++-
 docs/engineering/media-review-commands.md     |   4 +
 .../media-contribution-commands.test.ts       | 101 ++++++++++++++++++
 13 files changed, 187 insertions(+), 13 deletions(-)
 create mode 100644 apps/web/e2e/image-readiness.ts
 create mode 100644 apps/web/e2e/image-readiness.visual.spec.ts
 create mode 100644 convex/_mediaSubmissionCleanup.ts

diff --git a/apps/web/e2e/image-readiness.ts b/apps/web/e2e/image-readiness.ts
new file mode 100644
index 00000000..11a15d82
--- /dev/null
+++ b/apps/web/e2e/image-readiness.ts
@@ -0,0 +1,6 @@
+import { expect, type Locator } from "@playwright/test";
+
+export async function expectDecodedImage(image: Locator, timeout = 15_000) {
+  await image.scrollIntoViewIfNeeded();
+  await expect.poll(() => image.evaluate((element: HTMLImageElement) => element.complete && element.naturalWidth > 0), { timeout }).toBe(true);
+}
diff --git a/apps/web/e2e/image-readiness.visual.spec.ts b/apps/web/e2e/image-readiness.visual.spec.ts
new file mode 100644
index 00000000..1d6fa14e
--- /dev/null
+++ b/apps/web/e2e/image-readiness.visual.spec.ts
@@ -0,0 +1,27 @@
+import sharp from "sharp";
+import { expect, test } from "@playwright/test";
+import { expectDecodedImage } from "./image-readiness";
+
+test("image readiness waits for loading then actual decoded pixels @storybook-visual", async ({ page }) => {
+  let release!: () => void;
+  const ready = new Promise<void>(resolve => { release = resolve; });
+  const bytes = await sharp({ create: { width: 48, height: 32, channels: 3, background: "#173e35" } }).png().toBuffer();
+  await page.route("https://image.example/slow.png", async route => { await ready; await route.fulfill({ contentType: "image/png", body: bytes }); });
+  await page.setContent('<div style="height:2000px"></div><img loading="lazy" src="https://image.example/slow.png">');
+  const image = page.locator("img");
+  await image.scrollIntoViewIfNeeded();
+  expect(await image.evaluate((element: HTMLImageElement) => element.complete && element.naturalWidth > 0)).toBe(false);
+  const check = expectDecodedImage(image);
+  release();
+  await check;
+  expect(await image.evaluate((element: HTMLImageElement) => element.naturalWidth)).toBe(48);
+});
+
+test("image readiness still fails for broken pixels @storybook-visual", async ({ page }) => {
+  await page.route("https://image.example/broken.png", route => route.fulfill({ status: 404, body: "missing" }));
+  await page.setContent('<img src="https://image.example/broken.png">');
+  let failure: unknown;
+  try { await expectDecodedImage(page.locator("img"), 600); } catch (error) { failure = error; }
+  expect(failure).toBeInstanceOf(Error);
+  expect(await page.locator("img").evaluate((element: HTMLImageElement) => element.naturalWidth)).toBe(0);
+});
diff --git a/apps/web/e2e/media-contribution.flow.spec.ts b/apps/web/e2e/media-contribution.flow.spec.ts
index a4b22a19..453a41c7 100644
--- a/apps/web/e2e/media-contribution.flow.spec.ts
+++ b/apps/web/e2e/media-contribution.flow.spec.ts
@@ -1,3 +1,4 @@
+import { expectDecodedImage } from "./image-readiness";
 import sharp from "sharp";
 import type { CommandReceipt, PublishedContributionDetail } from "@vrdex/api-contracts";
 import { createHash, randomBytes } from "node:crypto";
@@ -380,7 +381,7 @@ test("contributor A submits and distinct assigned reviewer B reviews media @medi
   const decoded = await sharp(await downloaded.body()).metadata();
   expect(decoded.width).toBeGreaterThan(0);
   expect(decoded.height).toBeGreaterThan(0);
-  expect(await pageB.locator(`img[src="${publishedFile}"]`).evaluate((image: HTMLImageElement) => image.complete && image.naturalWidth > 0)).toBe(true);
+  await expectDecodedImage(pageB.locator(`img[src="${publishedFile}"]`));
   const capturePicture = async (state: string) => {
     await pageB.goto(`/${profile.slug}`);
     for (const [size, width, height] of [["desktop", 1280, 900], ["mobile", 390, 844]] as const) {
@@ -635,7 +636,7 @@ test("contributor A submits and distinct assigned reviewer B reviews media @medi
   expect((await sharp(await rpcDownload.body()).metadata()).width).toBe(48);
   await pageB.goto(`/${profile.slug}`);
   await expect(pageB.locator(`img[src="${rpcFile}"]`)).toBeVisible();
-  expect(await pageB.locator(`img[src="${rpcFile}"]`).evaluate((image: HTMLImageElement) => image.complete && image.naturalWidth > 0)).toBe(true);
+  await expectDecodedImage(pageB.locator(`img[src="${rpcFile}"]`));
   const rpcManageInput = { submissionId: rpcSubmissionId, expectedContributionVersion: rpcDetail.contributionVersion, action: "update_metadata", metadata: { label: "Synthetic MCP title" }, idempotencyKey: `${runId}-rpc-title` };
   const rpcManaged = await call<UploadReceipt>(request, authA.access_token, "vrdex_media_contribution_manage", rpcManageInput);
   expect(rpcManaged.operationState).toBe("committed");
diff --git a/apps/web/e2e/trusted-publication.visual.spec.ts b/apps/web/e2e/trusted-publication.visual.spec.ts
index 2c7cd07a..ca44ae4f 100644
--- a/apps/web/e2e/trusted-publication.visual.spec.ts
+++ b/apps/web/e2e/trusted-publication.visual.spec.ts
@@ -147,3 +147,10 @@ for (const reload of [false, true]) {
     await captureStorybookScreenshot(page, testInfo, `concurrent-draft-${reload ? "restored" : "live"}`);
   });
 }
+
+test("provenance URL uses the neutral Source utility label @storybook-visual", async ({ page }, testInfo) => {
+  await gotoComponentStory(page, "account-trusted-publication--provenance-source");
+  await expect(page.getByRole("link", { name: "Source", exact: true })).toHaveAttribute("href", "https://photographer.example/press");
+  await expect(page.getByRole("link", { name: "Open source", exact: true })).toHaveCount(0);
+  await captureStorybookScreenshot(page, testInfo, "publication-provenance-source");
+});
diff --git a/apps/web/src/app/account/media-contributions/publication-card.tsx b/apps/web/src/app/account/media-contributions/publication-card.tsx
index 66efaccf..4f4d9cf8 100644
--- a/apps/web/src/app/account/media-contributions/publication-card.tsx
+++ b/apps/web/src/app/account/media-contributions/publication-card.tsx
@@ -67,7 +67,7 @@ export function PublicationCardView({ detail, submissionId = detail?.submissionI
     <dl className="grid gap-3 text-sm sm:grid-cols-2">
       <div><dt className="text-muted">Destination</dt><dd>Media kit</dd></div>
       <div><dt className="text-muted">Credit</dt><dd className="break-words">{detail.credit}</dd></div>
-      <div className="min-w-0 sm:col-span-2"><dt className="text-muted">Source</dt><dd className="break-words [overflow-wrap:anywhere]">{detail.sourceUrl ? <a href={detail.sourceUrl} rel="noreferrer" target="_blank" className="underline">{detail.sourceDescription || "Open source"}</a> : detail.sourceDescription}</dd></div>
+      <div className="min-w-0 sm:col-span-2"><dt className="text-muted">Source</dt><dd className="break-words [overflow-wrap:anywhere]">{detail.sourceUrl ? <a href={detail.sourceUrl} rel="noreferrer" target="_blank" className="underline">{detail.sourceDescription || "Source"}</a> : detail.sourceDescription}</dd></div>
     </dl>
     <div className="flex flex-wrap gap-2">
       <Button type="button" variant="primary" disabled={!ready || busy || pending !== null} onClick={() => void command()}>Publish</Button>
diff --git a/apps/web/src/app/account/media-review/media-review-panel.tsx b/apps/web/src/app/account/media-review/media-review-panel.tsx
index b8f47c23..08d8a221 100644
--- a/apps/web/src/app/account/media-review/media-review-panel.tsx
+++ b/apps/web/src/app/account/media-review/media-review-panel.tsx
@@ -222,7 +222,7 @@ export function ReviewCardView({
             rel="noreferrer"
             target="_blank"
           >
-            Open source
+            Source
           </a>
         ) : (
           <span className="max-w-full break-words text-sm [overflow-wrap:anywhere]">
diff --git a/apps/web/src/components/trusted-publication.stories.tsx b/apps/web/src/components/trusted-publication.stories.tsx
index 76dcc090..aa1155a4 100644
--- a/apps/web/src/components/trusted-publication.stories.tsx
+++ b/apps/web/src/components/trusted-publication.stories.tsx
@@ -37,7 +37,7 @@ const fixture: ReviewDetail = {
     contentSha256: "a".repeat(64),
   },
 };
-function Fixture({ loseResponse = false }: { loseResponse?: boolean }) {
+function Fixture({ loseResponse = false, urlOnly = false }: { loseResponse?: boolean; urlOnly?: boolean }) {
   const [lost, setLost] = useState(false);
 
   const [calls, setCalls] = useState<string[]>([]);
@@ -45,7 +45,7 @@ function Fixture({ loseResponse = false }: { loseResponse?: boolean }) {
     <main className="mx-auto max-w-4xl p-4">
       <h1 className="text-xl font-semibold">Fixture photographer</h1>
       <PublicationCardView
-        detail={fixture}
+        detail={urlOnly ? { ...fixture, sourceDescription: undefined, sourceUrl: "https://photographer.example/press" } : fixture}
         publish={async (input) => {
           setCalls((previous) => [
             ...previous,
@@ -216,3 +216,5 @@ function ConcurrentMetadataFixture() {
   </main>;
 }
 export const ConcurrentMetadata: Story = { render: () => <ConcurrentMetadataFixture /> };
+
+export const ProvenanceSource: StoryObj<typeof meta> = { args: { urlOnly: true } };
diff --git a/convex/_mediaContributionCommands.ts b/convex/_mediaContributionCommands.ts
index a2969c13..e353f982 100644
--- a/convex/_mediaContributionCommands.ts
+++ b/convex/_mediaContributionCommands.ts
@@ -28,8 +28,10 @@ async function contributionState(ctx: QueryCtx | MutationCtx, submissionId: stri
     asset.sourceSubmissionId !== submission._id || asset.profileId !== profile._id ||
     (!allowDeleted && asset.state !== "active") || asset.visibility !== "public" || asset.retiredAt !== undefined || asset.moderatorSuppressedAt !== undefined)
     throw new ConvexError({ code: "MEDIA_RESOURCE_UNAVAILABLE", message: "Published contribution unavailable." });
-  const placement = profile.profileType === "person" ? "profile_image" as const : "primary_logo" as const;
-  const snapshot = await reviewSnapshot(ctx, { ...submission, requestKind: "identity_placement", candidateAssetId: asset._id, requestedPlacement: placement }, profile);
+  const defaultPlacement = profile.profileType === "person" ? "profile_image" as const : "primary_logo" as const;
+  const identitySnapshot = await reviewSnapshot(ctx, { ...submission, requestKind: "identity_placement", candidateAssetId: asset._id, requestedPlacement: defaultPlacement }, profile);
+  const placement = identitySnapshot.effectiveIdentityPlacement ?? defaultPlacement;
+  const snapshot = placement === defaultPlacement ? identitySnapshot : await reviewSnapshot(ctx, { ...submission, requestKind: "identity_placement", candidateAssetId: asset._id, requestedPlacement: placement }, profile);
   const current = await ctx.db.query("profileAssetPlacements").withIndex("by_profileId_placement_state_position", q =>
     q.eq("profileId", profile._id).eq("placement", placement).eq("state", "active")).first();
   const access = await getAccountFeatureAccess(ctx.db, actor.user._id);
diff --git a/convex/_mediaReview.ts b/convex/_mediaReview.ts
index 238f676b..860d416e 100644
--- a/convex/_mediaReview.ts
+++ b/convex/_mediaReview.ts
@@ -1,3 +1,4 @@
+import { isAssetBackedPlacement } from "./_mediaSubmissionCleanup";
 import { transferPublishedCharge } from "./_contributionCapacity";
 import { ConvexError, v } from "convex/values";
 import type { Doc, Id } from "./_generated/dataModel";
@@ -136,7 +137,7 @@ export async function outwardReviewSnapshot(
   ctx: Pick<QueryCtx, "db">, submission: Doc<"profileMediaSubmissions">,
   profile: Doc<"profiles">, elevated = false,
 ) {
-  const { identityOccupied, ...snapshot } = await reviewSnapshot(ctx, submission, profile);
+  const { identityOccupied, effectiveIdentityPlacement, ...snapshot } = await reviewSnapshot(ctx, submission, profile);
   if (submission.requestKind !== "identity_placement") return { ...snapshot, currentPlacement: null };
   const placement = snapshot.currentPlacement;
   const asset = placement ? await ctx.db.get(placement.assetId) : null;
@@ -298,7 +299,7 @@ export async function applyReviewDecision(
       publicDisposition,
       privateReason,
       decisionProfileUpdatedAt: profile.updatedAt,
-      ...(submission.requestKind === "identity_placement" && submission.candidateAssetId !== undefined
+      ...(isAssetBackedPlacement(submission)
         ? {} : { blobDeleteAfter: now + PROFILE_MEDIA_SUBMISSION_RETENTION_MS }),
       updatedAt: now,
     });
@@ -315,6 +316,8 @@ export async function applyReviewDecision(
   if (submission.requestKind === "identity_placement" && submission.candidateAssetId) {
     const candidate = await ctx.db.get(submission.candidateAssetId);
     const snapshot = await reviewSnapshot(ctx, submission, profile);
+    if (snapshot.effectiveIdentityPlacement !== null && snapshot.effectiveIdentityPlacement !== submission.requestedPlacement)
+      throw new Error("The displayed identity placement changed. Refresh before deciding.");
     if (!snapshot.identityOccupied) throw new Error("Replacement requires an occupied identity placement.");
     if (!candidate || !snapshot.candidate.rendition) throw new Error("The placement candidate is unavailable.");
     if ((await publicationRestrictions(ctx, profile._id, candidate.contentSha256)).some(Boolean))
@@ -512,6 +515,9 @@ export async function reviewSnapshot(
     mediaKit.compactDisplay === "logo"
       ? (mediaKit.primaryLogo ?? mediaKit.profileImage)
       : (mediaKit.profileImage ?? mediaKit.primaryLogo);
+  const effectiveIdentityPlacement = effective
+    ? (effective === mediaKit.primaryLogo ? "primary_logo" as const : "profile_image" as const)
+    : null;
   const effectiveAsset = effective ? await ctx.db.get(effective.assetId) : null;
   const legacyUrl = isProfileFieldVisible(
     profile,
@@ -570,7 +576,7 @@ export async function reviewSnapshot(
     fieldVisibility: profile.fieldVisibility, identityDestinations: (profile.outboundLinks ?? []).flatMap(link => {
       const destination = parseProfileLinkDestination(link); return destination ? [destination.key] : [];
     }).sort(),
-    placement, currentImage, currentAutomaticImageUrl,
+    placement, currentImage, effectiveIdentityPlacement, currentAutomaticImageUrl,
     currentAsset: currentAsset && { id: currentAsset._id, credit: currentAsset.credit, sourceUrl: currentAsset.sourceUrl,
       state: currentAsset.state, visibility: currentAsset.visibility, retiredAt: currentAsset.retiredAt, moderatorSuppressedAt: currentAsset.moderatorSuppressedAt },
     identityPlacements: authoredPlacements.filter(row => row.placement === "profile_image" || row.placement === "primary_logo"),
@@ -629,12 +635,14 @@ export async function reviewSnapshot(
       artworkType: row.artworkType, observedAt: row.observedAt,
     })),
     currentImage: kitAsset ? undefined : currentImage,
+    effectiveIdentityPlacement: kitAsset ? undefined : effectiveIdentityPlacement,
     effectiveAsset: kitAsset ? undefined : effectiveAsset,
     revision: submission.reviewRevision ?? 0,
   });
   return {
     identityOccupied: authoredPlacements.some(row => row.placement === "profile_image" || row.placement === "primary_logo") || currentImage !== null,
     placementTargetVersion,
+    effectiveIdentityPlacement,
     reviewVersion,
     currentImage,
     currentPlacement:
@@ -735,6 +743,9 @@ export async function decideReviewCommand(
       submission.targetPlacementAssetId
   )
     code = "placement_changed";
+  else if (args.decision === "approve" && submission.requestKind === "identity_placement" && submission.candidateAssetId &&
+    snapshot.effectiveIdentityPlacement !== null && snapshot.effectiveIdentityPlacement !== submission.requestedPlacement)
+    code = "placement_changed";
   else if (args.decision === "approve" && submission.requestKind === "identity_placement" && submission.candidateAssetId && !snapshot.identityOccupied)
     code = "primary_empty";
   else if (args.decision === "reject" && args.publicReason === undefined)
diff --git a/convex/_mediaSubmissionCleanup.ts b/convex/_mediaSubmissionCleanup.ts
new file mode 100644
index 00000000..3f16b60f
--- /dev/null
+++ b/convex/_mediaSubmissionCleanup.ts
@@ -0,0 +1,5 @@
+import type { Doc } from "./_generated/dataModel";
+
+export function isAssetBackedPlacement(submission: Pick<Doc<"profileMediaSubmissions">, "requestKind" | "candidateAssetId" | "uploadIntentId">): boolean {
+  return submission.requestKind === "identity_placement" && submission.candidateAssetId !== undefined && submission.uploadIntentId === undefined;
+}
diff --git a/convex/profileMediaSubmissions.ts b/convex/profileMediaSubmissions.ts
index 4ee17965..0538c06d 100644
--- a/convex/profileMediaSubmissions.ts
+++ b/convex/profileMediaSubmissions.ts
@@ -1,3 +1,4 @@
+import { isAssetBackedPlacement } from "./_mediaSubmissionCleanup";
 import { assertLiveContributionToken } from "./_contributionAuth";
 import { publishedContributionDetail, contributionPlacementCommand, proposeContributionPlacement, contributionManageCommand } from "./_mediaContributionCommands";
 import { effectiveContributionPolicy, contributionChargeRefusal, registerLegacyContribution, reservationBytes } from "./_contributionCapacity";
@@ -1710,7 +1711,7 @@ async function withdrawSubmission(
   const now = Date.now();
   await ctx.db.patch(submission._id, {
     status: "withdrawn",
-    ...(submission.requestKind === "identity_placement" && submission.candidateAssetId !== undefined
+    ...(isAssetBackedPlacement(submission)
       ? {} : { blobDeleteAfter: now + PROFILE_MEDIA_SUBMISSION_RETENTION_MS }),
     updatedAt: now,
   });
@@ -1921,7 +1922,7 @@ export async function prepareDueBlobCleanupCore(ctx: MutationCtx, subject: AuthS
         if (submission.expiresAt > now || submission.blobDeleteAfter !== undefined) continue;
         await ctx.db.patch(submission._id, {
           status: "superseded",
-          blobDeleteAfter: submission.expiresAt + PROFILE_MEDIA_SUBMISSION_RETENTION_MS,
+          ...(isAssetBackedPlacement(submission) ? {} : { blobDeleteAfter: submission.expiresAt + PROFILE_MEDIA_SUBMISSION_RETENTION_MS }),
           updatedAt: now,
         });
         await ctx.db.insert("profileAuditEvents", {
@@ -1944,8 +1945,14 @@ export async function prepareDueBlobCleanupCore(ctx: MutationCtx, subject: AuthS
           .lte("blobDeleteAfter", now),
       )
       .take(200);
+    for (const submission of due) {
+      if (isAssetBackedPlacement(submission)) await ctx.db.patch(submission._id, {
+        blobDeleteAfter: undefined, blobCleanupToken: undefined, blobCleanupReservedAt: undefined, updatedAt: now,
+      });
+    }
     const eligible = due
       .filter((submission) =>
+        !isAssetBackedPlacement(submission) &&
         submission.blobDeleteAfter !== undefined &&
         submission.blobDeleteAfter <= now &&
         submission.legalHoldAt === undefined &&
@@ -1994,6 +2001,7 @@ export async function markBlobCleanupCompleteCore(ctx: MutationCtx, args: { item
       const submission = await ctx.db.get(id);
       if (
         submission === null ||
+        isAssetBackedPlacement(submission) ||
         submission.blobCleanupToken !== cleanupToken ||
         submission.blobDeleteAfter === undefined ||
         submission.legalHoldAt !== undefined ||
diff --git a/docs/engineering/media-review-commands.md b/docs/engineering/media-review-commands.md
index 2633195d..74240102 100644
--- a/docs/engineering/media-review-commands.md
+++ b/docs/engineering/media-review-commands.md
@@ -390,3 +390,7 @@ A replacement candidate inherits reviewer authority from its approved asset's or
 Queue projection reads at most 40 source revisions and eleven indexed, unexpired proposals of the requested open status per source asset. More than ten matching proposals fails closed instead of truncating unexpected overflow. Duplicate submission IDs are removed, foreign profile/submitter proposals are excluded, and each row passes current reviewer authority. This permits up to 440 projected rows on a source-revision page; the continuation cursor remains tied to the source revisions. Direct trusted contributions without a source collection retain distinct admin review and do not acquire an ordinary reviewer assignment automatically. A future assignment intake is needed for those contributions.
 
 Restriction versions track existence of each indexed restriction kind, using one bounded read per kind. Adding more history while the same restriction already exists does not invalidate inspection again; the first restriction changes the version and fresh approval still refuses. MCP contribution lookup returns the existing unavailable tool result only for known missing or unavailable resources. Token, scope and verification errors retain their authority failure.
+
+Replacement proposals bind the identity slot selected by the public compact-image resolver, including cross-type fallback and an explicit logo preference. Both identity slots remain occupied for empty-slot admission. Preference or visibility changes invalidate inspection. A fresh inspection or rebase cannot approve a candidate into a slot that no longer supplies the visible picture; it returns `placement_changed`. Request a new replacement against the current display in that case. Original upload-backed identity proposals and owner management retain their slot rules.
+
+Expiry of an existing-asset placement without its own upload records the expired disposition and audit without a blob cleanup reservation or deletion ledger. Rejection and withdrawal use the same exemption. Cleanup also removes stale pending reservations for these proposals and refuses completion, preserving the shared asset and future legal holds. Upload-backed legacy identity submissions retain their storage cleanup and deletion audit.
diff --git a/tests/backend/media-contribution-commands.test.ts b/tests/backend/media-contribution-commands.test.ts
index 63cf5e6e..5854c5e3 100644
--- a/tests/backend/media-contribution-commands.test.ts
+++ b/tests/backend/media-contribution-commands.test.ts
@@ -744,3 +744,104 @@ it("hidden fallback artwork leaves an empty replacement target", async () => {
   const d = await f.detail(); assert.equal(d.canProposePlacement, false);
   assert.equal((await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "hidden-fallback" })).code, "primary_empty");
 });
+
+for (const profileType of ["person", "community"] as const) for (const bothSlots of [false, true]) for (const logoPreferred of [false, true]) {
+  it(`replaces the resolved picture for ${profileType}, both slots ${bothSlots}, logo preference ${logoPreferred}`, async () => {
+    const f = await fixture(profileType); const d = await f.detail();
+    const renderedSlot = logoPreferred ? "primary_logo" : "profile_image";
+    await f.t.run(async ctx => {
+      const asset = (await ctx.db.get(d.assetId))!;
+      const { _id, _creationTime, sourceSubmissionId, ...fields } = asset;
+      for (const placement of ["profile_image", "primary_logo"] as const) {
+        if (!bothSlots && placement !== renderedSlot) continue;
+        const oldId = await ctx.db.insert("profileAssets", { ...fields, storageKey: `${placement}-old.webp`, source: "owner_authored" });
+        await selectProfileAssetIdentity(ctx.db, { profileId: f.s.profileId, assetId: oldId, placement, actorUserId: f.s.moderatorUserId, now: Date.now() });
+      }
+      await ctx.db.insert("profileAssetDisplayPreferences", { profileId: f.s.profileId, compactDisplay: logoPreferred ? "logo" : "profile_image", updatedAt: Date.now() });
+    });
+    const resolved = () => f.t.run(async ctx => {
+      const kit = await getPublicProfileMediaKit(ctx.db, (await ctx.db.get(f.s.profileId))!);
+      return kit.compactDisplay === "logo" ? kit.primaryLogo ?? kit.profileImage : kit.profileImage ?? kit.primaryLogo;
+    });
+    assert.notEqual((await resolved())?.assetId, d.assetId);
+    const fresh = await f.detail(); assert.equal(fresh.canProposePlacement, true);
+    const proposal = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: fresh.contributionVersion, idempotencyKey: "resolved" });
+    assert.equal(proposal.operationState, "committed");
+    const row = await f.t.run(ctx => ctx.db.get(ctx.db.normalizeId("profileMediaSubmissions", proposal.resourceId!)!));
+    assert.equal(row?.requestedPlacement, renderedSlot);
+    const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
+    const review = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: proposal.resourceId! }); assert.ok(review);
+    assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, { submissionId: proposal.resourceId!, expectedReviewVersion: review.reviewVersion, decision: "approve", privateReason: "Distinct replacement reviewed", idempotencyKey: "approve-resolved" })).operationState, "committed");
+    assert.equal((await resolved())?.assetId, d.assetId);
+  });
+}
+
+it("expires asset-backed proposals without deleting shared asset bytes or blocking a later hold", async () => {
+  const { prepareDueBlobCleanupCore, markBlobCleanupCompleteCore } = await import("../../convex/profileMediaSubmissions");
+  const f = await fixture(); await occupyFallback(f); const d = await f.detail();
+  const proposal = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "expire-existing" });
+  const id = await f.t.run(ctx => ctx.db.normalizeId("profileMediaSubmissions", proposal.resourceId!)!);
+  const asset = await f.t.run(ctx => ctx.db.get(d.assetId));
+  const subject = { tokenIdentifier: "test:operator", issuer: "test", subject: "operator" };
+  await f.t.run(ctx => ctx.db.patch(id, { expiresAt: Date.now() - 100 * 24 * 60 * 60 * 1000 }));
+  assert.deepEqual(await f.t.run(ctx => prepareDueBlobCleanupCore(ctx, subject)), []);
+  const expired = await f.t.run(ctx => ctx.db.get(id));
+  assert.equal(expired?.status, "superseded");
+  for (const key of ["blobDeleteAfter", "blobDeletedAt", "blobCleanupToken", "blobCleanupReservedAt"] as const) assert.equal(expired?.[key], undefined);
+  // A pre-fix stale reservation must not create a false deletion ledger either.
+  await f.t.run(ctx => ctx.db.patch(id, { blobDeleteAfter: 1, blobCleanupToken: "stale" }));
+  assert.deepEqual(await f.t.run(ctx => prepareDueBlobCleanupCore(ctx, subject)), []);
+  assert.equal((await f.t.run(ctx => markBlobCleanupCompleteCore(ctx, { items: [{ submissionId: id, cleanupToken: "stale" }] }, subject))).completed, 0);
+  await f.t.withIdentity(f.s.moderatorIdentity).mutation(api.profileMediaSubmissions.setBlobLegalHold, { submissionId: id, held: true, reason: "Preserve existing asset evidence" });
+  assert.ok((await f.t.run(ctx => ctx.db.get(id)))?.legalHoldAt);
+  assert.deepEqual(await f.t.run(ctx => ctx.db.get(d.assetId)), asset);
+  const audits = await f.t.run(ctx => ctx.db.query("profileAuditEvents").collect());
+  assert.equal(audits.filter(row => row.action === "profile_media_submission_expired").length, 1);
+  assert.equal(audits.filter(row => row.action === "profile_media_submission_blob_deleted").length, 0);
+  const kit = await f.t.run(async ctx => getPublicProfileMediaKit(ctx.db, (await ctx.db.get(f.s.profileId))!));
+  assert.ok(kit.galleryAssets.some(row => row.assetId === d.assetId));
+});
+
+it("expires upload-backed legacy identity proposals through the blob deletion ledger", async () => {
+  const { prepareDueBlobCleanupCore, markBlobCleanupCompleteCore } = await import("../../convex/profileMediaSubmissions");
+  const t = convexTest({ schema, modules }); const s = await seed(t); const { intent } = await createAndUpload(t, s);
+  await t.run(ctx => ctx.db.patch(intent.submissionId, { requestKind: "identity_placement", requestedPlacement: "profile_image", expiresAt: Date.now() - 100 * 24 * 60 * 60 * 1000 }));
+  const subject = { tokenIdentifier: "test:operator", issuer: "test", subject: "operator" };
+  const due = await t.run(ctx => prepareDueBlobCleanupCore(ctx, subject));
+  assert.equal(due.length, 1); assert.ok(due[0].storageKeys.length > 0);
+  assert.equal((await t.run(ctx => markBlobCleanupCompleteCore(ctx, { items: due }, subject))).completed, 1);
+  assert.ok((await t.run(ctx => ctx.db.get(intent.submissionId)))?.blobDeletedAt);
+  const audits = await t.run(ctx => ctx.db.query("profileAuditEvents").collect());
+  assert.equal(audits.filter(row => row.action === "profile_media_submission_expired").length, 1);
+  assert.equal(audits.filter(row => row.action === "profile_media_submission_blob_deleted").length, 1);
+});
+
+for (const change of ["preference", "visibility"] as const) {
+  it(`refuses approval into the old displayed slot after ${change}, fresh inspection and rebase`, async () => {
+    const f = await fixture("community"); const d = await f.detail();
+    await f.t.run(async ctx => {
+      const asset = (await ctx.db.get(d.assetId))!; const { _id, _creationTime, sourceSubmissionId, ...fields } = asset;
+      for (const placement of ["profile_image", "primary_logo"] as const) {
+        const old = await ctx.db.insert("profileAssets", { ...fields, storageKey: `${placement}.webp`, source: "owner_authored" });
+        await selectProfileAssetIdentity(ctx.db, { profileId: f.s.profileId, assetId: old, placement, actorUserId: f.s.moderatorUserId, now: Date.now() });
+      }
+    });
+    const fresh = await f.detail();
+    const proposal = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: fresh.contributionVersion, idempotencyKey: "before-display-change" });
+    const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
+    const before = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: proposal.resourceId! }); assert.ok(before);
+    await f.t.run(async ctx => {
+      if (change === "preference") await ctx.db.insert("profileAssetDisplayPreferences", { profileId: f.s.profileId, compactDisplay: "logo", updatedAt: Date.now() });
+      else await ctx.db.patch(f.s.profileId, { fieldVisibility: { avatarImageUrl: "private" } });
+    });
+    const changed = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: proposal.resourceId! }); assert.ok(changed);
+    assert.notEqual(changed.reviewVersion, before.reviewVersion);
+    assert.equal((await reviewer.mutation(api.profileMediaSubmissions.rebase, { submissionId: proposal.resourceId!, expectedReviewVersion: changed.reviewVersion, idempotencyKey: "rebase-display" })).operationState, "committed");
+    const rebased = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: proposal.resourceId! }); assert.ok(rebased);
+    const input = { submissionId: proposal.resourceId!, expectedReviewVersion: rebased.reviewVersion, decision: "approve" as const, privateReason: "Checked new display", idempotencyKey: "approve-old-slot" };
+    assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, input)).code, "placement_changed");
+    await assert.rejects(reviewer.mutation(api.profileMediaSubmissions.decide, { submissionId: proposal.resourceId!, decision: "approve", expectedProfileUpdatedAt: rebased.currentProfileUpdatedAt, privateReason: "Legacy boundary checked" }), /displayed identity placement changed/);
+    const kit = await f.t.run(async ctx => getPublicProfileMediaKit(ctx.db, (await ctx.db.get(f.s.profileId))!));
+    assert.notEqual((kit.compactDisplay === "logo" ? kit.primaryLogo ?? kit.profileImage : kit.profileImage ?? kit.primaryLogo)?.assetId, d.assetId);
+  });
+}

From 2133adacac465b47fc4276af244184ae6964d52a Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Tue, 13 Oct 2026 13:28:33 -0400
Subject: [PATCH 23/28] Refuse replacement of hidden-only identity placements

---
 convex/_mediaContributionCommands.ts          |  4 +-
 convex/_mediaReview.ts                        |  6 ++-
 docs/engineering/media-review-commands.md     |  2 +
 .../media-contribution-commands.test.ts       | 41 +++++++++++++++++++
 4 files changed, 49 insertions(+), 4 deletions(-)

diff --git a/convex/_mediaContributionCommands.ts b/convex/_mediaContributionCommands.ts
index e353f982..bd53eadf 100644
--- a/convex/_mediaContributionCommands.ts
+++ b/convex/_mediaContributionCommands.ts
@@ -64,7 +64,7 @@ export async function publishedContributionDetail(ctx: QueryCtx | MutationCtx, s
       creditUrl: metadata.creditUrl, sourceUrl: metadata.sourceUrl, sourceDescription: metadata.sourceDescription },
     canSelectPrimary: s.newPlacementAvailable && s.publisher && !s.snapshot.identityOccupied,
     canClearPrimary: s.submissionsEnabled && s.publisher && s.ownSelection,
-    canProposePlacement: s.newPlacementAvailable && s.publicUnclaimed && !s.restrictions.some(Boolean) && !s.ownSelection && s.snapshot.identityOccupied,
+    canProposePlacement: s.newPlacementAvailable && s.publicUnclaimed && !s.restrictions.some(Boolean) && !s.ownSelection && s.snapshot.currentImage !== null,
     canEditMetadata: s.ownKitOnly, canRemove: s.ownKitOnly && s.submission.legalHoldAt === undefined,
   };
 }
@@ -85,7 +85,7 @@ async function command(ctx: MutationCtx, input: ContributionCommandBase | Contri
     !s.publicUnclaimed ? "target_unavailable" : s.restrictions.some(Boolean) ? "publication_restricted" :
     !proposal && !s.publisher ? "publisher_required" : s.version !== args.expectedContributionVersion ? "contribution_changed" :
     (proposal || selecting) && !s.newPlacementAvailable ? "target_unavailable" :
-    proposal && !s.snapshot.identityOccupied ? "primary_empty" :
+    proposal && s.snapshot.currentImage === null ? "primary_empty" :
     !proposal && selecting && s.snapshot.identityOccupied ? "primary_occupied" :
     !proposal && !selecting && !s.ownSelection ? "selection_changed" : undefined;
   if (!code && proposal) {
diff --git a/convex/_mediaReview.ts b/convex/_mediaReview.ts
index 860d416e..aeda02cb 100644
--- a/convex/_mediaReview.ts
+++ b/convex/_mediaReview.ts
@@ -316,7 +316,8 @@ export async function applyReviewDecision(
   if (submission.requestKind === "identity_placement" && submission.candidateAssetId) {
     const candidate = await ctx.db.get(submission.candidateAssetId);
     const snapshot = await reviewSnapshot(ctx, submission, profile);
-    if (snapshot.effectiveIdentityPlacement !== null && snapshot.effectiveIdentityPlacement !== submission.requestedPlacement)
+    if ((snapshot.effectiveIdentityPlacement !== null && snapshot.effectiveIdentityPlacement !== submission.requestedPlacement ||
+      snapshot.effectiveIdentityPlacement === null && snapshot.currentImage === null && snapshot.identityOccupied))
       throw new Error("The displayed identity placement changed. Refresh before deciding.");
     if (!snapshot.identityOccupied) throw new Error("Replacement requires an occupied identity placement.");
     if (!candidate || !snapshot.candidate.rendition) throw new Error("The placement candidate is unavailable.");
@@ -744,7 +745,8 @@ export async function decideReviewCommand(
   )
     code = "placement_changed";
   else if (args.decision === "approve" && submission.requestKind === "identity_placement" && submission.candidateAssetId &&
-    snapshot.effectiveIdentityPlacement !== null && snapshot.effectiveIdentityPlacement !== submission.requestedPlacement)
+    (snapshot.effectiveIdentityPlacement !== null && snapshot.effectiveIdentityPlacement !== submission.requestedPlacement ||
+      snapshot.effectiveIdentityPlacement === null && snapshot.currentImage === null && snapshot.identityOccupied))
     code = "placement_changed";
   else if (args.decision === "approve" && submission.requestKind === "identity_placement" && submission.candidateAssetId && !snapshot.identityOccupied)
     code = "primary_empty";
diff --git a/docs/engineering/media-review-commands.md b/docs/engineering/media-review-commands.md
index 74240102..7dd952b7 100644
--- a/docs/engineering/media-review-commands.md
+++ b/docs/engineering/media-review-commands.md
@@ -394,3 +394,5 @@ Restriction versions track existence of each indexed restriction kind, using one
 Replacement proposals bind the identity slot selected by the public compact-image resolver, including cross-type fallback and an explicit logo preference. Both identity slots remain occupied for empty-slot admission. Preference or visibility changes invalidate inspection. A fresh inspection or rebase cannot approve a candidate into a slot that no longer supplies the visible picture; it returns `placement_changed`. Request a new replacement against the current display in that case. Original upload-backed identity proposals and owner management retain their slot rules.
 
 Expiry of an existing-asset placement without its own upload records the expired disposition and audit without a blob cleanup reservation or deletion ledger. Rejection and withdrawal use the same exemption. Cleanup also removes stale pending reservations for these proposals and refuses completion, preserving the shared asset and future legal holds. Upload-backed legacy identity submissions retain their storage cleanup and deletion audit.
+
+A hidden-only authored identity still blocks direct empty-slot selection, but it does not expose or admit a new replacement proposal without a visible picture. Existing-asset approval refuses a hidden-only target after inspection or rebase; visible legacy and automatic fallback images remain eligible replacement targets.
diff --git a/tests/backend/media-contribution-commands.test.ts b/tests/backend/media-contribution-commands.test.ts
index 5854c5e3..33b3e76f 100644
--- a/tests/backend/media-contribution-commands.test.ts
+++ b/tests/backend/media-contribution-commands.test.ts
@@ -845,3 +845,44 @@ for (const change of ["preference", "visibility"] as const) {
     assert.notEqual((kit.compactDisplay === "logo" ? kit.primaryLogo ?? kit.profileImage : kit.profileImage ?? kit.primaryLogo)?.assetId, d.assetId);
   });
 }
+
+it("refuses hidden-only managed replacement after fresh inspection and rebase at both approval boundaries", async () => {
+  const f = await fixture("community"); const d = await f.detail();
+  await f.t.run(async ctx => {
+    const asset = (await ctx.db.get(d.assetId))!; const { _id, _creationTime, sourceSubmissionId, ...fields } = asset;
+    const old = await ctx.db.insert("profileAssets", { ...fields, storageKey: "only-picture.webp", source: "owner_authored" });
+    await selectProfileAssetIdentity(ctx.db, { profileId: f.s.profileId, assetId: old, placement: "profile_image", actorUserId: f.s.moderatorUserId, now: Date.now() });
+  });
+  const fresh = await f.detail();
+  const proposal = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: fresh.contributionVersion, idempotencyKey: "before-hidden-only" });
+  const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
+  await f.t.run(ctx => ctx.db.patch(f.s.profileId, { fieldVisibility: { avatarImageUrl: "private" } }));
+  const changed = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: proposal.resourceId! }); assert.ok(changed);
+  assert.equal(changed.currentImage, null);
+  assert.equal((await reviewer.mutation(api.profileMediaSubmissions.rebase, { submissionId: proposal.resourceId!, expectedReviewVersion: changed.reviewVersion, idempotencyKey: "rebase-hidden-only" })).operationState, "committed");
+  const rebased = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: proposal.resourceId! }); assert.ok(rebased);
+  assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, { submissionId: proposal.resourceId!, expectedReviewVersion: rebased.reviewVersion, decision: "approve", privateReason: "Hidden only target checked", idempotencyKey: "refuse-hidden-only" })).code, "placement_changed");
+  await assert.rejects(reviewer.mutation(api.profileMediaSubmissions.decide, { submissionId: proposal.resourceId!, expectedProfileUpdatedAt: rebased.currentProfileUpdatedAt, decision: "approve", privateReason: "Hidden only legacy target checked" }), /displayed identity placement changed/);
+  const hidden = await f.detail();
+  assert.equal(hidden.canProposePlacement, false);
+  assert.equal(hidden.canSelectPrimary, false);
+  assert.equal((await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: hidden.contributionVersion, idempotencyKey: "new-hidden-only" })).code, "primary_empty");
+  assert.equal((await f.place("select_primary")).code, "primary_occupied");
+});
+
+it("keeps visible automatic artwork replacement valid with no managed rendered slot", async () => {
+  const f = await fixture();
+  await f.t.run(async ctx => {
+    const external = "usr_7023d326-083f-41fe-a3e9-27ea303b50c5";
+    await ctx.db.patch(f.s.profileId, { outboundLinks: [{ type: "vrchat_profile", label: "VRChat", url: `https://vrchat.com/home/user/${external}`, source: "community_submitted" }] });
+    await ctx.db.insert("profileLinkDestinations", { key: `vrchat_user:${external}`, kind: "vrchat_user", locator: external, provider: "vrchat", status: "resolved", artworkSourceUrl: "https://example.test/icon.webp", artworkType: "user_icon", observedAt: 1 });
+  });
+  const d = await f.detail(); assert.equal(d.canProposePlacement, true);
+  const p = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "automatic-control" });
+  const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
+  const review = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: p.resourceId! }); assert.ok(review);
+  assert.equal(review.currentImage?.kind, "automatic");
+  assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, { submissionId: p.resourceId!, expectedReviewVersion: review.reviewVersion, decision: "approve", privateReason: "Visible automatic control checked", idempotencyKey: "approve-automatic" })).operationState, "committed");
+  const kit = await f.t.run(async ctx => getPublicProfileMediaKit(ctx.db, (await ctx.db.get(f.s.profileId))!));
+  assert.equal(kit.profileImage?.assetId, d.assetId);
+});

From 786fa60d6581fd0605beeb428c0600fdbe4c302e Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Tue, 13 Oct 2026 13:35:53 -0400
Subject: [PATCH 24/28] fix(convex): regenerate media submission cleanup API
 types

---
 convex/_generated/api.d.ts | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/convex/_generated/api.d.ts b/convex/_generated/api.d.ts
index 830aedaa..9465a815 100644
--- a/convex/_generated/api.d.ts
+++ b/convex/_generated/api.d.ts
@@ -73,6 +73,7 @@ import type * as _mcpWriteReceipts from "../_mcpWriteReceipts.js";
 import type * as _mediaCleanupUrl from "../_mediaCleanupUrl.js";
 import type * as _mediaContributionCommands from "../_mediaContributionCommands.js";
 import type * as _mediaReview from "../_mediaReview.js";
+import type * as _mediaSubmissionCleanup from "../_mediaSubmissionCleanup.js";
 import type * as _oauth from "../_oauth.js";
 import type * as _oauthConsentTransactions from "../_oauthConsentTransactions.js";
 import type * as _previewPersistence from "../_previewPersistence.js";
@@ -263,6 +264,7 @@ declare const fullApi: ApiFromModules<{
   _mediaCleanupUrl: typeof _mediaCleanupUrl;
   _mediaContributionCommands: typeof _mediaContributionCommands;
   _mediaReview: typeof _mediaReview;
+  _mediaSubmissionCleanup: typeof _mediaSubmissionCleanup;
   _oauth: typeof _oauth;
   _oauthConsentTransactions: typeof _oauthConsentTransactions;
   _previewPersistence: typeof _previewPersistence;

From fec2860fa74753e017301197509ef82f22117f8e Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Tue, 13 Oct 2026 13:55:05 -0400
Subject: [PATCH 25/28] Fix guarded media migration and lifecycle cooldown

---
 apps/web/e2e/media-contribution.flow.spec.ts  |  2 +
 convex/mediaKitPublicationMigration.ts        | 13 ++++-
 docs/engineering/media-review-commands.md     |  4 +-
 scripts/media-kit-publication-migration.mjs   |  6 ++
 .../media-kit-publication-migration.test.ts   | 55 +++++++++++++++++++
 .../media-kit-publication-migration.test.ts   | 20 +++++++
 6 files changed, 95 insertions(+), 5 deletions(-)

diff --git a/apps/web/e2e/media-contribution.flow.spec.ts b/apps/web/e2e/media-contribution.flow.spec.ts
index 453a41c7..acf67a58 100644
--- a/apps/web/e2e/media-contribution.flow.spec.ts
+++ b/apps/web/e2e/media-contribution.flow.spec.ts
@@ -576,6 +576,8 @@ test("contributor A submits and distinct assigned reviewer B reviews media @medi
   const kitFile = `/api/v0/profiles/${profile.slug}/assets/${kitDetail.assetId}/file`;
   const kitCard = pageA.locator("section").filter({ has: pageA.locator(`img[src="${kitFile}"]`) });
   await expect(kitCard.getByRole("button", { name: "Select picture" })).toHaveCount(0);
+  // Replacement proposals share the contributor cooldown with the preceding upload.
+  await new Promise(resolve => setTimeout(resolve, 31_000));
   await kitCard.getByRole("button", { name: "Request replacement" }).click();
   await expect(kitCard.getByText("Submitted", { exact: true })).toBeVisible();
   expect((await request.post("/api/e2e/media", { headers, data: { op: "grant-publication-actors", runId, profileId } })).status()).toBe(200);
diff --git a/convex/mediaKitPublicationMigration.ts b/convex/mediaKitPublicationMigration.ts
index eb822c26..57243920 100644
--- a/convex/mediaKitPublicationMigration.ts
+++ b/convex/mediaKitPublicationMigration.ts
@@ -1,6 +1,7 @@
 import { ConvexError, v } from "convex/values";
 import { internalMutation, type MutationCtx } from "./_generated/server";
 import type { Doc } from "./_generated/dataModel";
+import { publicKitAvailable } from "./_mediaReview";
 
 async function eligible(ctx: MutationCtx, submission: Doc<"profileMediaSubmissions">) {
   const profile = await ctx.db.get(submission.profileId);
@@ -60,8 +61,14 @@ export const convertBatch = internalMutation({
       // ponytail: any profile metadata correction blocks initialization; asset-scoped audit index if needed.
       const audits = await Promise.all(["profile_media_contribution_metadata_updated", "profile_asset_metadata_updated"].map(action =>
         ctx.db.query("profileAuditEvents").withIndex("by_profileId_action", q => q.eq("profileId", s.profile._id).eq("action", action)).first()));
-      const approvalTime = submission.reviewedAt ?? (submission.publicationMethod === "trusted_publisher" ? submission.updatedAt : undefined);
-      if (legacy && approvalTime !== undefined && s.asset.updatedAt === approvalTime && !s.asset.sourceUrl && !s.asset.sourceDescription && submission.sourceDescription && !audits.some(Boolean))
+      const intent = submission.uploadIntentId ? await ctx.db.get(submission.uploadIntentId) : null;
+      // Consumption writes the asset's initial updatedAt and intent.consumedAt from
+      // the same input.now. Submission approval may use a later Date.now().
+      const untouchedPublication = intent?.state === "consumed" && intent.purpose === "community_proposal" &&
+        intent.targetSubmissionId === submission._id && intent.targetProfileId === s.profile._id &&
+        intent.storageKey === s.asset.storageKey && intent.contentSha256 === s.asset.contentSha256 &&
+        intent.consumedAt !== undefined && s.asset.updatedAt === intent.consumedAt;
+      if (legacy && untouchedPublication && !s.asset.sourceUrl && !s.asset.sourceDescription && submission.sourceDescription && !audits.some(Boolean))
         patch.sourceDescription = submission.sourceDescription;
       const retained = await gallery(ctx, s.asset, args.dryRun);
       if (Object.keys(patch).length && !args.dryRun) await ctx.db.patch(s.asset._id, patch);
@@ -77,7 +84,7 @@ export const correctPrimaryToKit = internalMutation({
     const submission = await ctx.db.get(args.submissionId);
     const s = submission ? await eligible(ctx, submission) : null;
     const placement = await ctx.db.get(args.expectedPlacementId);
-    if (!s || !placement || s.asset._id !== args.expectedAssetId || placement.assetId !== s.asset._id ||
+    if (!s || !publicKitAvailable(s.profile) || !placement || s.asset._id !== args.expectedAssetId || placement.assetId !== s.asset._id ||
       placement.profileId !== s.profile._id || placement.state !== "active" ||
       placement.placement !== (s.profile.profileType === "person" ? "profile_image" : "primary_logo") ||
       placement.updatedAt !== args.expectedPlacementUpdatedAt || (placement.selectionOperationId ?? null) !== args.expectedSelectionOperationId ||
diff --git a/docs/engineering/media-review-commands.md b/docs/engineering/media-review-commands.md
index 7dd952b7..3c54a31e 100644
--- a/docs/engineering/media-review-commands.md
+++ b/docs/engineering/media-review-commands.md
@@ -375,9 +375,9 @@ Deploy backend schema/functions before the matching website/MCP candidate. New i
 
 Run `node --import tsx scripts/media-kit-publication-migration.mjs --target <approved-target> --limit 40` for one dry-run batch. The wrapper defaults to dry-run; `--apply` explicitly enables writes. Record each report's scanned/changed/skipped/conflicts, continueCursor and isDone. Follow continueCursor until isDone. Preview the entire traversal first; restart with a null cursor for the separately authorized apply traversal, inspect conflicts, and stop on drift. Do not reuse a preview's final cursor as the apply starting point. Each transaction scans 1..40 submissions and checks at most two indexed approved-asset matches. An ambiguous link is a conflict, never guessed provenance.
 
-Conversion preserves primary placements, uploaded renditions/digests, historical assertions, receipts, reviewers, accounting and legal holds. It backfills only uniquely linked active public community assets on public, published, unclaimed profiles. Only untouched legacy metadata (asset updatedAt equals immutable approval time (reviewedAt, or the trusted-publisher approved submission updatedAt), no current source URL/description, no contributor or owner profile metadata-correction audit) can initialize the immutable approved description. Any correction audit on the profile conservatively skips initialization; current provenance and intentional clears stay intact. Retained gallery references do not republish private media.
+Conversion preserves primary placements, uploaded renditions/digests, historical assertions, receipts, reviewers, accounting and legal holds. It backfills only uniquely linked active public community assets on public, published, unclaimed profiles. Only untouched legacy metadata can initialize the immutable approved description. Its consumed community upload intent must match the submission, profile, storage key and digest, and the asset updatedAt must still equal intent consumedAt. Consumption writes both timestamps from one publication timestamp; submission approval timestamps can differ. Current source URL/description or any contributor or owner profile metadata-correction audit blocks initialization. Current provenance and intentional clears stay intact. Retained gallery references do not republish private media.
 
-Karly's approved submission handle is `x1747ftcbeq1k475kz4hqdn77d8fcz0r`. The correction is separate from generic conversion. A fresh authorized operator must resolve exact asset and placement IDs, the placement's own updatedAt and selectionOperationId. Never substitute profile or submission timestamps. Save those values with submissionId, expectedAssetId, expectedPlacementId, expectedPlacementUpdatedAt and expectedSelectionOperationId (explicit null for absent legacy provenance) in a local JSON file. Preview with `node --import tsx scripts/media-kit-publication-migration.mjs --target <approved-target> --correction-file <exact-preview.json>`. Apply requires separate exact-resource authorization and a fresh identical preview before adding `--apply`. Changed, reselected, duplicate, claimed, private, foreign, held or restricted resources refuse. The correction retires only the exact legacy primary placement and retains an active public gallery asset. It never selects a replacement picture or deletes bytes.
+Karly's approved submission handle is `x1747ftcbeq1k475kz4hqdn77d8fcz0r`. The correction is separate from generic conversion. A fresh authorized operator must resolve exact asset and placement IDs, the placement's own updatedAt and selectionOperationId. Never substitute profile or submission timestamps. Save those values with submissionId, expectedAssetId, expectedPlacementId, expectedPlacementUpdatedAt and expectedSelectionOperationId (explicit null for absent legacy provenance) in a local JSON file. Preview with `node --import tsx scripts/media-kit-publication-migration.mjs --target <approved-target> --correction-file <exact-preview.json>`. Apply requires separate exact-resource authorization and a fresh identical preview before adding `--apply`. Changed, reselected, duplicate, claimed, private, foreign, held or restricted resources refuse. A hidden media-kit field or disabled media-kit feature also refuses the exact correction. The correction retires only the exact legacy primary placement and retains an active public gallery asset. It never selects a replacement picture or deletes bytes.
 
 Kit approval authorizes publication into the public media kit. Placement approval authorizes explicit use of an already published candidate as the picture. Logical removal hides an item but retains storage/accounting/history. Permanent byte deletion remains governed by existing cleanup and legal-hold policy.
 
diff --git a/scripts/media-kit-publication-migration.mjs b/scripts/media-kit-publication-migration.mjs
index 51d34ecc..146f2435 100644
--- a/scripts/media-kit-publication-migration.mjs
+++ b/scripts/media-kit-publication-migration.mjs
@@ -8,6 +8,12 @@ import { readOption, unknownOption } from "./publish-seed-batch.mjs";
 export function migrationInput(args) {
   const values = ["--target", "--cursor", "--limit", "--correction-file"];
   if (unknownOption(args, [...values, "--apply"], values)) throw new Error("Unknown or repeated migration option.");
+  for (const name of values) {
+    const inline = name === "--target" ? args.find(arg => arg.startsWith("--target="))?.slice("--target=".length) : undefined;
+    if (!args.includes(name) && inline === undefined) continue;
+    const value = inline ?? readOption(args, name);
+    if (!value?.trim() || value.startsWith("--")) throw new Error(`Missing value for ${name}.`);
+  }
   const file = readOption(args, "--correction-file");
   const dryRun = !args.includes("--apply");
   if (file) return { operation: "correctPrimaryToKit", input: { ...JSON.parse(readFileSync(file, "utf8")), dryRun } };
diff --git a/tests/backend/media-kit-publication-migration.test.ts b/tests/backend/media-kit-publication-migration.test.ts
index ce841053..9ddf7d60 100644
--- a/tests/backend/media-kit-publication-migration.test.ts
+++ b/tests/backend/media-kit-publication-migration.test.ts
@@ -46,6 +46,7 @@ async function legacyFixture() {
       mimeType: "image/webp", byteSize: 512, contentSha256: "legacy-digest", visibility: "public", source: "community_submitted",
       uploadedBy: upload.requestedBy, uploadedAt: 10, updatedAt: 11, state: "active", credit: "Artist", label: "Image" });
     await ctx.db.patch(intent.submissionId, { status: "approved", requestKind: undefined, approvedAssetId: id, sourceUrl: undefined, sourceDescription: "Original photograph", reviewedAt: 11 });
+    await ctx.db.patch(intent.intentId, { state: "consumed", consumedAt: 11, updatedAt: 11, sourceUrl: undefined });
     return id;
   });
   const placementId = await t.run(ctx => ctx.db.insert("profileAssetPlacements", { profileId: s.profileId, assetId, placement: "profile_image", position: 0, state: "active", updatedAt: 12 }));
@@ -63,6 +64,60 @@ it("backfills unique public legacy provenance and gallery while preserving prima
   assert.equal((await f.t.run(ctx => ctx.db.get(f.placementId)))?.state, "active");
   assert.equal((await f.t.mutation(convert, { dryRun: false, cursor: null, limit: 40 })).changed, 0);
 });
+it("refuses exact correction when the public kit is hidden or disabled without changing any records", async () => {
+  for (const unavailable of ["hidden", "disabled"] as const) {
+    const f = await legacyFixture();
+    if (unavailable === "hidden") await f.t.run(ctx => ctx.db.patch(f.s.profileId, { fieldVisibility: { mediaKit: "private" } }));
+    const snapshot = () => f.t.run(async ctx => ({ profile: await ctx.db.get(f.s.profileId), asset: await ctx.db.get(f.assetId), placements: await ctx.db.query("profileAssetPlacements").collect() }));
+    const before = await snapshot();
+    if (unavailable === "disabled") process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "false";
+    try {
+      for (const dryRun of [true, false]) {
+        assert.deepEqual(await f.t.mutation(correct, { ...f.args, dryRun }), { changed: false, code: "resource_changed_or_protected" });
+        assert.deepEqual(await snapshot(), before);
+      }
+    } finally { process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true"; }
+  }
+});
+it("restores untouched legacy descriptions using consumption evidence despite differing approval timestamps", async () => {
+  for (const method of ["trusted_publisher", "independent_review"] as const) {
+    const f = await legacyFixture();
+    await f.t.run(ctx => ctx.db.patch(f.intent.submissionId, { publicationMethod: method, reviewedAt: method === "trusted_publisher" ? undefined : 5000, updatedAt: 5001 }));
+    const before = await f.t.run(ctx => ctx.db.get(f.intent.submissionId));
+    await f.t.mutation(convert, { dryRun: true, cursor: null, limit: 40 });
+    assert.equal((await f.t.run(ctx => ctx.db.get(f.assetId)))?.sourceDescription, undefined);
+    await f.t.mutation(convert, { dryRun: false, cursor: null, limit: 40 });
+    assert.equal((await f.t.run(ctx => ctx.db.get(f.assetId)))?.sourceDescription, "Original photograph", method);
+    assert.deepEqual(await f.t.run(ctx => ctx.db.get(f.intent.submissionId)), before);
+  }
+});
+it("retains generic public asset backfill when the kit is currently hidden or disabled", async () => {
+  for (const unavailable of ["hidden", "disabled"] as const) {
+    const f = await legacyFixture();
+    if (unavailable === "hidden") await f.t.run(ctx => ctx.db.patch(f.s.profileId, { fieldVisibility: { mediaKit: "private" } }));
+    if (unavailable === "disabled") process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "false";
+    try {
+      assert.equal((await f.t.mutation(convert, { dryRun: false, cursor: null, limit: 40 })).changed, 1);
+      assert.equal((await f.t.run(ctx => ctx.db.get(f.placementId)))?.state, "active");
+      assert.equal((await f.t.run(ctx => ctx.db.get(f.assetId)))?.sourceSubmissionId, f.intent.submissionId);
+    } finally { process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true"; }
+  }
+});
+it("skips description initialization without durable consumption linkage", async () => {
+  for (const condition of ["unconsumed", "foreign", "storage", "digest", "timestamp", "provenance"] as const) {
+    const f = await legacyFixture();
+    await f.t.run(async ctx => {
+      if (condition === "unconsumed") await ctx.db.patch(f.intent.intentId, { state: "uploaded" });
+      if (condition === "foreign") await ctx.db.patch(f.intent.intentId, { targetSubmissionId: undefined });
+      if (condition === "storage") await ctx.db.patch(f.intent.intentId, { storageKey: "different" });
+      if (condition === "digest") await ctx.db.patch(f.intent.intentId, { contentSha256: "different" });
+      if (condition === "timestamp") await ctx.db.patch(f.intent.intentId, { consumedAt: 12 });
+      if (condition === "provenance") await ctx.db.patch(f.assetId, { sourceDescription: "Current source" });
+    });
+    await f.t.mutation(convert, { dryRun: false, cursor: null, limit: 40 });
+    assert.equal((await f.t.run(ctx => ctx.db.get(f.assetId)))?.sourceDescription, condition === "provenance" ? "Current source" : undefined, condition);
+  }
+});
 it("refuses ambiguous asset provenance rather than choosing a submission", async () => {
   const f = await legacyFixture();
   await f.t.run(async ctx => { const { _id, _creationTime, ...fields } = (await ctx.db.get(f.intent.submissionId))!; await ctx.db.insert("profileMediaSubmissions", fields); });
diff --git a/tests/scripts/media-kit-publication-migration.test.ts b/tests/scripts/media-kit-publication-migration.test.ts
index 8c105a95..5cccfdad 100644
--- a/tests/scripts/media-kit-publication-migration.test.ts
+++ b/tests/scripts/media-kit-publication-migration.test.ts
@@ -1,5 +1,7 @@
 import assert from "node:assert/strict";
 import { it } from "node:test";
+import { spawnSync } from "node:child_process";
+import { fileURLToPath } from "node:url";
 import { migrationInput } from "../../scripts/media-kit-publication-migration.mjs";
 it("defaults bounded migration to dry-run and requires explicit apply", () => {
   assert.deepEqual(migrationInput([]), { operation: "convertBatch", input: { dryRun: true, cursor: null, limit: 40 } });
@@ -7,3 +9,21 @@ it("defaults bounded migration to dry-run and requires explicit apply", () => {
   assert.throws(() => migrationInput(["--limit", "41"]));
   assert.throws(() => migrationInput(["--oops"]));
 });
+it("malformed apply commands exit before target resolution or a Convex subprocess", () => {
+  const script = fileURLToPath(new URL("../../scripts/media-kit-publication-migration.mjs", import.meta.url));
+  for (const option of ["--target", "--cursor", "--limit", "--correction-file"]) {
+    const result = spawnSync(process.execPath, ["--import", "tsx", script, option, "--apply"], { encoding: "utf8", windowsHide: true });
+    assert.equal(result.status, 1);
+    assert.match(result.stderr, new RegExp(`Missing value for ${option}`));
+    assert.equal(result.stdout, "");
+    assert.doesNotMatch(result.stderr, /convex .*\(.*\), (dry-run|apply)/);
+  }
+});
+it("rejects every supplied value option without a nonempty value before choosing an operation", () => {
+  for (const option of ["--target", "--cursor", "--limit", "--correction-file"]) {
+    for (const args of [[option], [option, "--apply"], ["--apply", option], [option, ""], [option, "   ", "--apply"], [`${option}=`, "--apply"], [`${option}=--apply`]]) {
+      assert.throws(() => migrationInput(args), undefined, JSON.stringify(args));
+    }
+  }
+  for (const args of [["--apply", "--apply"], ["--cursor", "next", "--cursor", "again"], ["--target", "dev", "--target=prod"], ["--oops", "--apply"], ["--limit=1", "--apply"]]) assert.throws(() => migrationInput(args));
+});

From 1a26caaf85c05f36209b2a8e17892adae1c798e5 Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Tue, 13 Oct 2026 14:47:28 -0400
Subject: [PATCH 26/28] fix(media): preserve review and provenance boundaries

---
 .../profile-media-contribution-editor.tsx     |   2 +-
 convex/_mediaReview.ts                        |   2 +
 convex/_profileAssets.ts                      |   6 +-
 convex/profileMediaSubmissions.ts             | 146 +++++++++++--
 docs/engineering/media-review-commands.md     |  33 ++-
 packages/api-contracts/src/media-review.ts    |  10 +-
 .../api-contracts/tests/media-review.test.ts  |  13 ++
 tests/backend/contribution-uploads.test.ts    |  23 ++
 .../media-contribution-commands.test.ts       | 205 ++++++++++++++++++
 tests/backend/media-review-assignment.test.ts |  20 ++
 .../backend/profile-assets-management.test.ts |  20 ++
 .../backend/profile-media-submissions.test.ts |  21 ++
 .../media-contribution-legacy-source.test.ts  |  57 +++++
 13 files changed, 526 insertions(+), 32 deletions(-)
 create mode 100644 tests/web/media-contribution-legacy-source.test.ts

diff --git a/apps/web/src/app/_components/profile-media-contribution-editor.tsx b/apps/web/src/app/_components/profile-media-contribution-editor.tsx
index 0f7d7be1..9216ed46 100644
--- a/apps/web/src/app/_components/profile-media-contribution-editor.tsx
+++ b/apps/web/src/app/_components/profile-media-contribution-editor.tsx
@@ -169,7 +169,7 @@ export function ProfileMediaContributionEditorView({
           <div className="grid gap-4 sm:grid-cols-2">
             <Field>
               Source URL
-              <Input name="sourceUrl" placeholder="https://" required type="url" />
+              <Input maxLength={4096} name="sourceUrl" placeholder="https://" required type="url" />
             </Field>
             <Field>
               Credit
diff --git a/convex/_mediaReview.ts b/convex/_mediaReview.ts
index aeda02cb..d7f0b832 100644
--- a/convex/_mediaReview.ts
+++ b/convex/_mediaReview.ts
@@ -329,6 +329,8 @@ export async function applyReviewDecision(
       throw new Error("The profile media placement changed. Refresh before deciding.");
     if (await privateReplacementRequiresElevatedAccess(ctx, profile._id, snapshot.currentPlacement?.assetId, ownsProfile || access.superAdmin))
       throw new Error("Private replacement requires profile owner or admin access.");
+    if (!submission.uploadIntentId && !commandEvidence)
+      throw new ConvexError({ code: "MEDIA_REVIEW_VERSION_REQUIRED" });
     const operationId = commandEvidence?.operationId ?? crypto.randomUUID();
     if (submission.requestedPlacement !== "profile_image" && submission.requestedPlacement !== "primary_logo")
       throw new Error("Identity placement is invalid.");
diff --git a/convex/_profileAssets.ts b/convex/_profileAssets.ts
index cf17fed0..e894068b 100644
--- a/convex/_profileAssets.ts
+++ b/convex/_profileAssets.ts
@@ -478,9 +478,13 @@ export function normalizeProfileAssetSourceUrl(value: string | undefined): strin
       throw new Error("Profile media asset imports must not include URL credentials.");
     }
 
+    if (url.href.length > 4096) {
+      throw new ConvexError({ code: "MEDIA_SOURCE_URL_TOO_LONG" });
+    }
+
     return url.href;
   } catch (error) {
-    if (error instanceof Error && (error.message.includes("HTTPS") || error.message.includes("credentials"))) {
+    if (error instanceof ConvexError || (error instanceof Error && (error.message.includes("HTTPS") || error.message.includes("credentials")))) {
       throw error;
     }
 
diff --git a/convex/profileMediaSubmissions.ts b/convex/profileMediaSubmissions.ts
index 0538c06d..d7dad6d0 100644
--- a/convex/profileMediaSubmissions.ts
+++ b/convex/profileMediaSubmissions.ts
@@ -436,6 +436,7 @@ export const createUploadIntent = mutation({
     if (profile.updatedAt !== args.expectedProfileUpdatedAt) {
       throw new ConvexError({ code: "MEDIA_PROFILE_CHANGED", message: "Refresh profile" });
     }
+    const sourceUrl = normalizeProfileAssetSourceUrl(args.sourceUrl);
     const now = Date.now();
     if (
       (await openSubmissionCountForUser(ctx, user._id, now)) >= (await effectiveContributionPolicy(ctx.db, user._id)).limits.openActor) {
@@ -447,7 +448,6 @@ export const createUploadIntent = mutation({
     }
 
     await assertSubmissionRateLimits(ctx, user._id, profile._id, now);
-    const sourceUrl = normalizeProfileAssetSourceUrl(args.sourceUrl);
     const originalFileName = normalizeProfileAssetFileName(args.originalFileName);
     const credit = sanitizeProfileAssetCredit(args.credit);
     if (sourceUrl === undefined || originalFileName === undefined || credit === undefined) {
@@ -1528,6 +1528,40 @@ const reviewPageArgs = {
   status: v.optional(reviewQueueStatus),
   paginationOpts: paginationOptsValidator,
 };
+type BatchReviewCursor = {
+  nativeCursor: string | null;
+  revisionIds: string[];
+  submissionIds: string[] | null;
+  sourceIsDone: boolean;
+};
+function readBatchReviewIds(value: unknown, maximum: number): string[] {
+  if (!Array.isArray(value) || value.length > maximum) throw new Error();
+  const ids: string[] = [];
+  for (const id of value) {
+    if (typeof id !== "string" || !id || ids.includes(id)) throw new Error();
+    ids.push(id);
+  }
+  return ids;
+}
+function readBatchReviewCursor(cursor: string | null): BatchReviewCursor {
+  if (cursor === null) return { nativeCursor: null, revisionIds: [], submissionIds: null, sourceIsDone: false };
+  try {
+    const value: unknown = JSON.parse(cursor);
+    if (typeof value !== "object" || value === null ||
+      !("kind" in value) || value.kind !== "batch_review_v2" ||
+      !("nativeCursor" in value) || !(value.nativeCursor === null || typeof value.nativeCursor === "string") ||
+      !("revisionIds" in value) || !("submissionIds" in value) ||
+      !("sourceIsDone" in value) || typeof value.sourceIsDone !== "boolean" ||
+      Object.keys(value).length !== 5) throw new Error();
+    const revisionIds = readBatchReviewIds(value.revisionIds, 40);
+    const submissionIds = value.submissionIds === null ? null : readBatchReviewIds(value.submissionIds, 11);
+    if (submissionIds !== null && (!submissionIds.length || !revisionIds.length)) throw new Error();
+    return { nativeCursor: value.nativeCursor, revisionIds, submissionIds, sourceIsDone: value.sourceIsDone };
+  } catch { throw new Error("PAGE_CURSOR_INVALID"); }
+}
+function writeBatchReviewCursor(checkpoint: BatchReviewCursor) {
+  return JSON.stringify({ kind: "batch_review_v2", ...checkpoint });
+}
 async function authorizedReviewPage(
   ctx: QueryCtx,
   args: {
@@ -1542,7 +1576,8 @@ async function authorizedReviewPage(
     !Number.isInteger(args.paginationOpts.numItems) ||
     args.paginationOpts.numItems < 1 ||
     args.paginationOpts.numItems > 40 ||
-    (args.paginationOpts.cursor?.length ?? 0) > 8192
+    (args.paginationOpts.cursor?.length ?? 0) > 8192 ||
+    (args.paginationOpts.endCursor?.length ?? 0) > 8192
   )
     throw new Error("Invalid review page.");
   const status = args.status ?? "submitted";
@@ -1564,44 +1599,107 @@ async function authorizedReviewPage(
         !(await activeBatchAssignment(ctx, batch._id, currentActor.user._id)))
     )
       throw new Error("BATCH_UNAVAILABLE");
-    // Traverse immutable revisions through the batch index. Filter this bounded page,
-    // preserve its continuation even when no submission matches the status.
-    const revisions = await ctx.db
-      .query("contributionItemRevisions")
-      .withIndex("by_batch_key_revision", (q) => q.eq("batchId", batch._id))
-      .paginate(paginationOpts);
+    const checkpoint = readBatchReviewCursor(paginationOpts.cursor);
+    const end = paginationOpts.endCursor == null ? null : readBatchReviewCursor(paginationOpts.endCursor);
+    const { cursor: _cursor, endCursor: _endCursor, ...revisionOptions } = paginationOpts;
+    const loadRevision = async (value: string) => {
+      const id = ctx.db.normalizeId("contributionItemRevisions", value);
+      const revision = id ? await ctx.db.get(id) : null;
+      if (!revision || revision.batchId !== batch._id) throw new Error("PAGE_CURSOR_INVALID");
+      return revision;
+    };
+    if (end) await Promise.all(end.revisionIds.map(loadRevision));
+    // Capture one native source page. Freeze only its remaining revision IDs and
+    // the current source's remaining row IDs, then revalidate them on every call.
+    const revisions = checkpoint.revisionIds.length
+      ? { page: await Promise.all(checkpoint.revisionIds.map(loadRevision)),
+        isDone: checkpoint.sourceIsDone, continueCursor: checkpoint.nativeCursor ?? "",
+        splitCursor: null, pageStatus: null }
+      : await ctx.db.query("contributionItemRevisions")
+        .withIndex("by_batch_key_revision", q => q.eq("batchId", batch._id))
+        .paginate({ ...revisionOptions, cursor: checkpoint.nativeCursor,
+          ...(end ? { endCursor: end.nativeCursor } : {}) });
+    const pendingRevisions = [...revisions.page];
+    let pendingRows = checkpoint.submissionIds;
     const page = [];
-    const seen = new Set<string>();
-    for (const rev of revisions.page) {
+    let reachedEnd = false;
+    while (pendingRevisions.length) {
+      const rev = pendingRevisions[0];
+      if (page.length === args.paginationOpts.numItems) break;
+      if (end?.revisionIds[0] === rev._id && end.submissionIds === null) { reachedEnd = true; break; }
       const attempt = await ctx.db.query("contributionItemAttempts")
         .withIndex("by_revision", q => q.eq("revisionId", rev._id)).unique();
       const source = attempt?.submissionId ? await ctx.db.get(attempt.submissionId) : null;
-      if (!source || rev.actorUserId !== source.submitterUserId) continue;
+      if (!source || rev.actorUserId !== source.submitterUserId) {
+        pendingRevisions.shift(); pendingRows = null; continue;
+      }
+      // Assignment provenance must be unique, just as in reviewerContext.
+      const sourceAttempts = await ctx.db.query("contributionItemAttempts")
+        .withIndex("by_submissionId", q => q.eq("submissionId", source._id)).take(2);
+      if (sourceAttempts.length !== 1 || sourceAttempts[0].revisionId !== rev._id) {
+        pendingRevisions.shift(); pendingRows = null; continue;
+      }
       const candidate = source.approvedAssetId ? await ctx.db.get(source.approvedAssetId) : null;
-      const inherited = source.status === "approved" && source.requestKind !== "identity_placement" &&
+      const inheritedEligible = source.status === "approved" && source.requestKind !== "identity_placement" &&
         candidate && candidate.profileId === source.profileId && candidate.sourceSubmissionId === source._id &&
-        (status === "submitted" || status === "under_review")
-        ? await ctx.db.query("profileMediaSubmissions")
-          .withIndex("by_candidateAssetId_status_expiresAt", q => q.eq("candidateAssetId", candidate._id).eq("status", status).gt("expiresAt", Date.now()))
-          .take(11) : [];
-      // Open target capacity is ten; fail closed rather than truncate unexpected overflow.
-      if (inherited.length > 10) throw new Error("Replacement review queue exceeds target capacity.");
-      for (const submission of [source, ...inherited]) {
-        if (seen.has(submission._id) || submission.profileId !== source.profileId ||
-          submission.submitterUserId !== source.submitterUserId || submission.status !== status ||
-          (submission !== source && submission.requestKind !== "identity_placement") ||
+        (status === "submitted" || status === "under_review");
+      const linked = (row: Doc<"profileMediaSubmissions">) => row.profileId === source.profileId &&
+        row.submitterUserId === source.submitterUserId &&
+        (row._id === source._id || (row.requestKind === "identity_placement" && row.candidateAssetId === candidate?._id));
+      const loadRows = async (ids: string[]) => await Promise.all(ids.map(async value => {
+        const id = ctx.db.normalizeId("profileMediaSubmissions", value);
+        const row = id ? await ctx.db.get(id) : null;
+        if (!row || !linked(row)) throw new Error("PAGE_CURSOR_INVALID");
+        return row;
+      }));
+      let rows;
+      if (pendingRows !== null) rows = await loadRows(pendingRows);
+      else {
+        const inherited = inheritedEligible
+          ? await ctx.db.query("profileMediaSubmissions")
+            .withIndex("by_candidateAssetId_status_expiresAt", q => q.eq("candidateAssetId", candidate._id).eq("status", status).gt("expiresAt", Date.now()))
+            .take(11) : [];
+        // Open target capacity is ten; refuse unexpected overflow.
+        if (inherited.length > 10) throw new Error("Replacement review queue exceeds target capacity.");
+        rows = [source, ...inherited].filter(linked).sort((a, b) => a._id.localeCompare(b._id));
+      }
+      const endingRows = end?.revisionIds[0] === rev._id ? end.submissionIds : null;
+      if (endingRows !== null) await loadRows(endingRows);
+      let processed = 0;
+      for (const submission of rows) {
+        if (page.length === args.paginationOpts.numItems) break;
+        if (endingRows !== null && submission._id.localeCompare(endingRows[0]) >= 0) { reachedEnd = true; break; }
+        processed++;
+        if ((submission._id !== source._id && !inheritedEligible) || submission.status !== status ||
           (args.profileId && submission.profileId !== args.profileId) ||
           (["submitted", "under_review"].includes(status) && submission.expiresAt <= Date.now())) continue;
         const profile = await ctx.db.get(submission.profileId);
         if (!profile) continue;
         try { await reviewerContext(ctx, profile, currentActor, submission); }
         catch { continue; }
-        seen.add(submission._id);
         page.push(await reviewSubmission(ctx, submission, profile, access.superAdmin));
       }
+      pendingRows = rows.slice(processed).map(row => row._id);
+      if (reachedEnd) break;
+      if (pendingRows.length) break;
+      pendingRevisions.shift(); pendingRows = null;
+      if (endingRows !== null) { reachedEnd = true; break; }
     }
+    const next: BatchReviewCursor = reachedEnd && end ? end : {
+      nativeCursor: revisions.continueCursor, sourceIsDone: revisions.isDone,
+      revisionIds: pendingRevisions.map(rev => rev._id), submissionIds: pendingRows,
+    };
+    const paused = next.revisionIds.length > 0;
+    const reachedNativeEnd = !paused && end?.revisionIds.length === 0 && next.nativeCursor === end.nativeCursor;
     return {
-      ...writeScopedPagination(revisions,scope),
+      ...writeScopedPagination({ ...revisions,
+        isDone: reachedEnd || reachedNativeEnd || (!paused && revisions.isDone),
+        continueCursor: writeBatchReviewCursor(next),
+        splitCursor: paused || !revisions.splitCursor ? null : writeBatchReviewCursor({
+          nativeCursor: revisions.splitCursor, revisionIds: [], submissionIds: null, sourceIsDone: false,
+        }),
+        pageStatus: paused ? null : revisions.pageStatus,
+      }, scope),
       page,
     };
   }
diff --git a/docs/engineering/media-review-commands.md b/docs/engineering/media-review-commands.md
index 3c54a31e..f9c7f5e7 100644
--- a/docs/engineering/media-review-commands.md
+++ b/docs/engineering/media-review-commands.md
@@ -55,12 +55,29 @@ uses the same availability predicate to hide unavailable contribution intake.
 
 Existing-asset placement proposals recheck public-kit availability and current
 profile identity/dispute and content suppression/rejection restrictions at fresh
-approval, through both receipt and legacy decision wrappers. Profile restrictions
+approval through the review-version receipt command. The legacy decision refuses
+approval of proposals that reuse an existing asset without their own upload.
+Its `MEDIA_REVIEW_VERSION_REQUIRED` refusal requires fresh inspection followed by
+`decideWithReceipt` with the inspected version.
+Legacy upload-backed decisions and rejection retain their existing paths. Profile restrictions
 apply even without a content digest. Historical committed receipts retain their
 existing replay checks.
 
 Credit URL command contracts and form inputs allow at most 2,048 characters,
 matching backend credit validation. Source URLs retain their separate 4,096 limit.
+The shared source normalizer enforces that limit on the normalized URL, including
+percent-encoding expansion, before intake writes or metadata updates.
+`MEDIA_SOURCE_URL_TOO_LONG` identifies normalized overlength source URLs. Browser
+intake and metadata forms also cap raw input at 4,096 characters. MCP URL imports
+retain their stricter 2,048-character raw and normalized bounds; local-upload
+contracts retain their 2,048-character raw-input bound. URLs are never truncated.
+Authenticated detail read contracts preserve source URLs stored before those
+limits, including longer URLs. Write contracts remain bounded; historical
+provenance is not rewritten or erased during a read.
+Authenticated contributor, publisher and reviewer views retain private provenance.
+Anonymous kit/profile projections expose credit and credit URL, without source
+URLs or source descriptions, as required by the
+[source-provenance policy](../planning/trusted-contributor-lifecycle-research-2026-09-11.md).
 
 ## Decisions and retries
 
@@ -387,7 +404,19 @@ New replacement proposals require an occupied identity slot, including visible l
 
 A replacement candidate inherits reviewer authority from its approved asset's original submission and collection assignment. Current reviewer grant and assignment are required for queue, inspection and decision. Assigned website and MCP queues project the new proposal's submission ID; direct media review commands operate on that ID. Original collection revisions, attempts, receipts and audits remain unchanged. Collection item apply continues to refer to its original item, so review replacements through the media-review queue or exact media-review commands.
 
-Queue projection reads at most 40 source revisions and eleven indexed, unexpired proposals of the requested open status per source asset. More than ten matching proposals fails closed instead of truncating unexpected overflow. Duplicate submission IDs are removed, foreign profile/submitter proposals are excluded, and each row passes current reviewer authority. This permits up to 440 projected rows on a source-revision page; the continuation cursor remains tied to the source revisions. Direct trusted contributions without a source collection retain distinct admin review and do not acquire an ordinary reviewer assignment automatically. A future assignment intake is needed for those contributions.
+Assigned queue pages read at most the requested 1 to 40 indexed source revisions
+and eleven indexed, unexpired proposals of the requested open status per source.
+More than ten matching proposals fails closed. A page returns at most its requested
+number of rows. If sources expand beyond that limit, the scope-bound cursor saves
+remaining revision IDs and the current source's remaining submission IDs. Resuming
+does not skip unreturned proposals or shift an offset through changed statuses.
+Ordinary source pages retain their requested batch size. Filtered pages may contain fewer rows, including zero,
+so follow the cursor until `isDone`. Current status, expiry, profile/submitter
+links and reviewer authority are rechecked on each page. Nonunique source-attempt
+provenance is excluded rather than choosing an arbitrary assignment. Direct
+contributions without a source collection retain distinct admin review and do not
+acquire an ordinary reviewer assignment automatically. A future assignment intake
+is needed for those contributions.
 
 Restriction versions track existence of each indexed restriction kind, using one bounded read per kind. Adding more history while the same restriction already exists does not invalidate inspection again; the first restriction changes the version and fresh approval still refuses. MCP contribution lookup returns the existing unavailable tool result only for known missing or unavailable resources. Token, scope and verification errors retain their authority failure.
 
diff --git a/packages/api-contracts/src/media-review.ts b/packages/api-contracts/src/media-review.ts
index 54a06c10..7b6a6216 100644
--- a/packages/api-contracts/src/media-review.ts
+++ b/packages/api-contracts/src/media-review.ts
@@ -1,6 +1,8 @@
 import { z } from "zod";
 
 const boundedId = z.string().min(1).max(200);
+// Authenticated reads preserve provenance stored before normalized write limits.
+const retainedSourceUrlSchema = z.string();
 export const contributionCommandBaseSchema = z.strictObject({
   submissionId: boundedId,
   expectedContributionVersion: z.string().min(1).max(128),
@@ -32,7 +34,7 @@ export const publishedContributionDetailSchema = z.strictObject({
   metadata: z.strictObject({
     label: z.string().max(80), altText: z.string().max(180).optional(),
     credit: z.string().max(120), creditUrl: z.string().max(2048).optional(),
-    sourceUrl: z.string().max(4096).optional(), sourceDescription: z.string().max(1000).optional(),
+    sourceUrl: retainedSourceUrlSchema.optional(), sourceDescription: z.string().max(1000).optional(),
   }),
   canSelectPrimary: z.boolean(), canClearPrimary: z.boolean(), canProposePlacement: z.boolean(),
   canEditMetadata: z.boolean(), canRemove: z.boolean(),
@@ -105,7 +107,7 @@ export const reviewSnapshotSchema = z.strictObject({
       assetId: boundedId,
       placementId: boundedId,
       credit: z.string().max(1000).nullable(),
-      sourceUrl: z.string().max(4096).nullable(),
+      sourceUrl: retainedSourceUrlSchema.nullable(),
     })
     .nullable(),
   currentAvatarImageUrl: z.string().max(4096).nullable(),
@@ -117,7 +119,7 @@ export const reviewSnapshotSchema = z.strictObject({
         kind: z.literal("stored_candidate"),
       })
       .nullable(),
-    sourceUrl: z.string().max(4096).optional(),
+    sourceUrl: retainedSourceUrlSchema.optional(),
     sourceKind: z.enum(["url", "local"]).optional(),
     sourceDescription: z.string().max(1000).optional(),
     credit: z.string().max(1000),
@@ -155,7 +157,7 @@ export const reviewDetailSchema = z.strictObject({
     "withdrawn",
     "superseded",
   ]),
-  sourceUrl: z.string().max(4096).optional(),
+  sourceUrl: retainedSourceUrlSchema.optional(),
   sourceKind: z.enum(["url", "local"]).optional(),
   sourceDescription: z.string().max(1000).optional(),
   label: z.string().max(1000).optional(),
diff --git a/packages/api-contracts/tests/media-review.test.ts b/packages/api-contracts/tests/media-review.test.ts
index 8820a44e..ab924ee8 100644
--- a/packages/api-contracts/tests/media-review.test.ts
+++ b/packages/api-contracts/tests/media-review.test.ts
@@ -7,8 +7,21 @@ import {
   contributionPlacementCommandSchema,
   contributionManageCommandSchema,
   publishedContributionDetailSchema,
+  reviewSnapshotSchema,
 } from "../src/media-review";
 import { apiScopes } from "../src/auth";
+it("preserves historical long source URLs in authenticated detail reads while keeping metadata writes bounded", () => {
+  const sourceUrl = "https://legacy.example/source?signature=" + "a".repeat(5000);
+  const detail = { submissionId: "submission", assetId: "asset", profileId: "profile", profileSlug: "dj",
+    contributionVersion: "version", metadata: { label: "Image", credit: "Artist", sourceUrl },
+    canSelectPrimary: true, canClearPrimary: false, canProposePlacement: false, canEditMetadata: true, canRemove: true };
+  assert.equal(publishedContributionDetailSchema.parse(detail).metadata.sourceUrl, sourceUrl);
+  assert.equal(reviewSnapshotSchema.shape.candidate.shape.sourceUrl.parse(sourceUrl), sourceUrl);
+  assert.equal(reviewSnapshotSchema.shape.currentPlacement.unwrap().shape.sourceUrl.parse(sourceUrl), sourceUrl);
+  assert.equal(reviewDetailSchema.shape.sourceUrl.parse(sourceUrl), sourceUrl);
+  assert.equal(contributionManageCommandSchema.safeParse({ submissionId: "submission", expectedContributionVersion: "version",
+    idempotencyKey: "key", action: "update_metadata", metadata: { sourceUrl } }).success, false);
+});
 it("bounds contribution metadata patches and forbids byte, authority, target and placement changes", () => {
   const base = { submissionId: "submission", expectedContributionVersion: "version", idempotencyKey: "key" };
   assert.equal(contributionManageCommandSchema.safeParse({ ...base, action: "remove" }).success, true);
diff --git a/tests/backend/contribution-uploads.test.ts b/tests/backend/contribution-uploads.test.ts
index 8c368505..7a3ecd01 100644
--- a/tests/backend/contribution-uploads.test.ts
+++ b/tests/backend/contribution-uploads.test.ts
@@ -24,6 +24,27 @@ process.env.VRDEX_MEDIA_CLEANUP_URL =
 process.env.VRDEX_MEDIA_CLEANUP_TOKEN = "test-only";
 process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED = "true";
 process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true";
+it("refuses percent-encoded oversize local-upload provenance before quota or insertion", async () => {
+  for (const mode of ["contributor", "owner"] as const) {
+    const f = await fixture(mode);
+    const before = await f.t.run(async ctx => ({ reservations: await ctx.db.query("contributionUploadReservations").collect(),
+      intents: await ctx.db.query("profileAssetUploadIntents").collect(), submissions: await ctx.db.query("profileMediaSubmissions").collect() }));
+    const sourceUrl = "https://source.example/" + "é".repeat(800);
+    assert.ok(sourceUrl.length < 2048); assert.ok(new URL(sourceUrl).href.length > 4096);
+    await assert.rejects(f.t.mutation(internal.contributionUploads.begin, { ...f.input, sourceUrl, idempotencyKey: "oversize" }), /MEDIA_SOURCE_URL_TOO_LONG/);
+    assert.deepEqual(await f.t.run(async ctx => ({ reservations: await ctx.db.query("contributionUploadReservations").collect(),
+      intents: await ctx.db.query("profileAssetUploadIntents").collect(), submissions: await ctx.db.query("profileMediaSubmissions").collect() })), before);
+  }
+});
+it("round-trips a percent-encoded local source at the normalized 4096-character limit", async () => {
+  const sourceUrl = "https://source.example/" + "é".repeat(678) + "aaaaa";
+  assert.equal(new URL(sourceUrl).href.length, 4096);
+  const f = await fixture("contributor", undefined, "gallery", sourceUrl);
+  const normalized = new URL(sourceUrl).href;
+  assert.equal((await f.t.run(ctx => ctx.db.get(f.begun.intentId)))?.sourceUrl, normalized);
+  assert.equal((await f.t.run(ctx => ctx.db.query("profileMediaSubmissions").first()))?.sourceUrl, normalized);
+  assert.deepEqual(await f.t.mutation(internal.contributionUploads.begin, f.input), f.begun);
+});
 it("identifies the stored upload mode scope before claiming with an alternative grant", async () => {
   for (const mode of ["owner", "contributor"] as const) {
     const f = await fixture(mode);
@@ -136,6 +157,7 @@ async function fixture(
   mode: "owner" | "contributor" = "contributor",
   bytesRead?: number,
   placement: "profile_image" | "primary_logo" | "gallery" = "profile_image",
+  sourceUrl?: string,
 ) {
   const t = convexTest({
     schema,
@@ -186,6 +208,7 @@ async function fixture(
     sha256: "a".repeat(64),
     credit: "Artist",
     sourceDescription: "Artist supplied local image",
+    ...(sourceUrl === undefined ? {} : { sourceUrl }),
     idempotencyKey: "begin",
   };
   const begun = await t.mutation(internal.contributionUploads.begin, input);
diff --git a/tests/backend/media-contribution-commands.test.ts b/tests/backend/media-contribution-commands.test.ts
index 33b3e76f..ea443367 100644
--- a/tests/backend/media-contribution-commands.test.ts
+++ b/tests/backend/media-contribution-commands.test.ts
@@ -4,11 +4,42 @@ import { convexTest } from "convex-test";
 import { api, internal } from "../../convex/_generated/api";
 import { modules, schema, seed, createAndUpload } from "./_mediaReviewFixture";
 import { getProfileMediaVersion, getPublicProfileMediaKit, selectProfileAssetIdentity } from "../../convex/_profileAssets";
+import { publishedContributionDetailSchema, reviewDetailSchema } from "../../packages/api-contracts/src/media-review";
 
 process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED = "true";
 process.env.VRDEX_PROFILE_MEDIA_DIRECT_UPLOAD_ENABLED = "true";
 process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true";
 
+
+it("round-trips a normalized 4096-character source and refuses encoded oversize metadata without changing the asset", async () => {
+  const f = await fixture(); const before = await f.detail();
+  const prefix = "https://source.example/";
+  const exact = prefix + "a".repeat(4096 - prefix.length);
+  assert.equal((await f.actor.mutation(api.profileMediaSubmissions.manageContribution, {
+    submissionId: f.intent.submissionId, expectedContributionVersion: before.contributionVersion,
+    idempotencyKey: "max-source", action: "update_metadata", metadata: { sourceUrl: exact },
+  })).operationState, "committed");
+  const current = await f.detail();
+  assert.equal(publishedContributionDetailSchema.parse(current).metadata.sourceUrl, exact);
+  for (const sourceUrl of [prefix + "é".repeat(800), exact + "x"]) {
+    assert.ok(new URL(sourceUrl).href.length > 4096);
+    const args = { submissionId: f.intent.submissionId, expectedContributionVersion: current.contributionVersion,
+      idempotencyKey: sourceUrl === exact + "x" ? "raw-oversize" : "encoded-oversize",
+      action: "update_metadata" as const, metadata: { sourceUrl } };
+    if (sourceUrl.length > 4096) await assert.rejects(f.actor.mutation(api.profileMediaSubmissions.manageContribution, args));
+    else assert.equal((await f.actor.mutation(api.profileMediaSubmissions.manageContribution, args)).code, "invalid_metadata");
+    assert.deepEqual(await f.detail(), current);
+  }
+  await occupyFallback(f);
+  const fresh = await f.detail();
+  const proposal = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, {
+    submissionId: f.intent.submissionId, expectedContributionVersion: fresh.contributionVersion, idempotencyKey: "review-max-source",
+  });
+  const review = await f.t.withIdentity(f.s.moderatorIdentity).query(api.profileMediaSubmissions.reviewDetail, { submissionId: proposal.resourceId! });
+  assert.ok(review);
+  assert.equal(reviewDetailSchema.parse(review).candidate.sourceUrl, exact);
+});
+
 it("corrects own approved kit metadata without publisher authority and keeps evidence immutable", async () => {
   const f = await fixture();
   await f.t.run(ctx => ctx.db.patch(f.grant, { state: "revoked" }));
@@ -126,6 +157,59 @@ it("metadata correction invalidates inspected placement review and refreshes its
   assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, { submissionId: proposal.resourceId!, expectedReviewVersion: before.reviewVersion, decision: "approve", privateReason: "Checked", idempotencyKey: "stale" })).code, "review_changed");
 });
 
+for (const metadata of [{ credit: "Edited credit" }, { sourceUrl: "https://edited.example/source" },
+  { label: "Edited title" }, { altText: "Edited alt text" }]) {
+  it(`requires a review-version receipt for existing-asset legacy approval after ${Object.keys(metadata)[0]} changes`, async () => {
+    const f = await fixture(); await occupyFallback(f); const d = await f.detail();
+    const proposal = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, {
+      submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "proposal",
+    });
+    const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
+    const before = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: proposal.resourceId! });
+    assert.ok(before);
+    assert.equal((await f.actor.mutation(api.profileMediaSubmissions.manageContribution, {
+      submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion,
+      idempotencyKey: "edit", action: "update_metadata", metadata,
+    })).operationState, "committed");
+    await assert.rejects(reviewer.mutation(api.profileMediaSubmissions.decide, {
+      submissionId: proposal.resourceId!, expectedProfileUpdatedAt: before.currentProfileUpdatedAt,
+      decision: "approve", privateReason: "Inspected earlier",
+    }), /MEDIA_REVIEW_VERSION_REQUIRED/);
+    assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, {
+      submissionId: proposal.resourceId!, expectedReviewVersion: before.reviewVersion,
+      decision: "approve", privateReason: "Inspected earlier", idempotencyKey: "stale",
+    })).code, "review_changed");
+    const current = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: proposal.resourceId! });
+    assert.ok(current);
+    const args = { submissionId: proposal.resourceId!, expectedReviewVersion: current.reviewVersion,
+      decision: "approve" as const, privateReason: "Fresh inspection", idempotencyKey: "fresh" };
+    const receipt = await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, args);
+    assert.equal(receipt.operationState, "committed");
+    assert.deepEqual(await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, args), receipt);
+  });
+}
+
+it("keeps legacy rejection of an existing-asset proposal and real upload-backed approval", async () => {
+  const f = await fixture(); await occupyFallback(f); const d = await f.detail();
+  const proposal = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, {
+    submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "proposal",
+  });
+  const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
+  const detail = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: proposal.resourceId! });
+  assert.ok(detail);
+  assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decide, {
+    submissionId: proposal.resourceId!, expectedProfileUpdatedAt: detail.currentProfileUpdatedAt,
+    decision: "reject", privateReason: "Reviewed", publicDisposition: "Declined",
+  })).status, "rejected");
+  const t = convexTest({ schema, modules }); const s = await seed(t);
+  const { intent } = await createAndUpload(t, s);
+  await t.run(ctx => ctx.db.patch(intent.submissionId, { requestKind: "identity_placement" }));
+  assert.equal((await t.withIdentity(s.moderatorIdentity).mutation(api.profileMediaSubmissions.decide, {
+    submissionId: intent.submissionId, expectedProfileUpdatedAt: (await t.run(ctx => ctx.db.get(s.profileId)))!.updatedAt,
+    decision: "approve", privateReason: "Uploaded candidate inspected",
+  })).status, "approved");
+});
+
 async function fixture(profileType: "person" | "community" = "person", independentlyApproved = false) {
   const t = convexTest({ schema, modules });
   const s = await seed(t, profileType);
@@ -698,6 +782,127 @@ it("inherits only the original batch assignment for a candidate replacement", as
   await f.t.run(ctx => ctx.db.patch(assignment.id, { active: true }));
   assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, { submissionId: p.resourceId!, expectedReviewVersion: detail.reviewVersion, decision: "approve", privateReason: "Assigned replacement checked", idempotencyKey: "assigned-approve" })).operationState, "committed");
 });
+
+it("resumes bounded batch expansion across revisions without dropped or duplicate proposals and rechecks cursor authority", async () => {
+  const f = await fixture(); await occupyFallback(f); const d = await f.detail();
+  const proposed = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, {
+    submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "queue-proposal",
+  });
+  const other = await seed(f.t, "community");
+  const setup = await f.t.run(async ctx => {
+    const grants = await ctx.db.query("accountFeatureGrants").collect();
+    const grant = grants.find(g => g.userId === f.s.moderatorUserId)!;
+    await ctx.db.patch(grant._id, { feature: "media_reviewer" });
+    const batchId = await ctx.db.insert("contributionBatches", { actorUserId: f.s.contributorUserId,
+      idempotencyKey: "pagination", label: "Source", archived: false, rowCount: 3, createdAt: Date.now() });
+    const addRevision = async (itemKey: string, submissionId?: typeof f.intent.submissionId) => {
+      const revisionId = await ctx.db.insert("contributionItemRevisions", { actorUserId: f.s.contributorUserId,
+        batchId, itemKey, revision: 1, payload: "{}", bytes: 2, createdAt: Date.now() });
+      if (submissionId) await ctx.db.insert("contributionItemAttempts", { actorUserId: f.s.contributorUserId,
+        revisionId, oauthClientId: "client", submissionId, receipt: { operationId: itemKey, operationState: "committed" }, createdAt: Date.now() });
+    };
+    await addRevision("a-source", f.intent.submissionId);
+    await addRevision("b-nonmatching");
+    const proposalId = ctx.db.normalizeId("profileMediaSubmissions", proposed.resourceId!)!;
+    const { _id, _creationTime, ...proposal } = (await ctx.db.get(proposalId))!;
+    const ids = [proposalId];
+    for (let i = 0; i < 3; i++) ids.push(await ctx.db.insert("profileMediaSubmissions", { ...proposal, createdAt: Date.now() + i }));
+    await ctx.db.insert("profileMediaSubmissions", { ...proposal, status: "under_review" });
+    await ctx.db.insert("profileMediaSubmissions", { ...proposal, expiresAt: Date.now() - 1 });
+    const foreignId = await ctx.db.insert("profileMediaSubmissions", { ...proposal, profileId: other.profileId });
+    const { _id: sourceId, _creationTime: sourceTime, ...source } = (await ctx.db.get(f.intent.submissionId))!;
+    const secondSource = await ctx.db.insert("profileMediaSubmissions", { ...source, profileId: other.profileId });
+    const { _id: assetId, _creationTime: assetTime, ...asset } = (await ctx.db.get(d.assetId))!;
+    const secondAsset = await ctx.db.insert("profileAssets", { ...asset, profileId: other.profileId, sourceSubmissionId: secondSource });
+    await ctx.db.patch(secondSource, { approvedAssetId: secondAsset });
+    const secondProposal = await ctx.db.insert("profileMediaSubmissions", { ...proposal, profileId: other.profileId, candidateAssetId: secondAsset });
+    await addRevision("c-source", secondSource);
+    const assignment = await ctx.db.insert("contributionBatchReviewers", { batchId, reviewerUserId: f.s.moderatorUserId, active: true, expiresAt: Date.now() + 60000 });
+    return { batchId, assignment, grantId: grant._id, ids, secondProposal, foreignId };
+  });
+  const reviewer = f.t.withIdentity(f.s.moderatorIdentity);
+  const args = { batchId: setup.batchId, status: "submitted" as const, paginationOpts: { cursor: null, numItems: 1 } };
+  const first = await reviewer.query(api.profileMediaSubmissions.listForReview, args);
+  assert.equal(first.page.length, 1); assert.equal(first.isDone, false);
+  const full = await reviewer.query(api.profileMediaSubmissions.listForReview, { ...args, paginationOpts: { cursor: null, numItems: 20 } });
+  assert.deepEqual(full.page.map(row => row.submissionId).sort(), [...setup.ids, setup.secondProposal].sort());
+  assert.equal(full.isDone, true);
+  const buffered = await reviewer.query(api.profileMediaSubmissions.listForReview, { ...args, paginationOpts: { cursor: null, numItems: 3 } });
+  assert.equal(buffered.page.length, 3);
+  const bufferedIds = buffered.page.map(row => row.submissionId);
+  let bufferedPage = buffered;
+  for (let n = 0; !bufferedPage.isDone && n < 10; n++) {
+    bufferedPage = await reviewer.query(api.profileMediaSubmissions.listForReview, { ...args, paginationOpts: { cursor: bufferedPage.continueCursor, numItems: 1 } });
+    assert.ok(bufferedPage.page.length <= 1);
+    bufferedIds.push(...bufferedPage.page.map(row => row.submissionId));
+  }
+  assert.equal(bufferedPage.isDone, true);
+  assert.deepEqual([...bufferedIds].sort(), [...setup.ids, setup.secondProposal].sort());
+  assert.equal(new Set(bufferedIds).size, bufferedIds.length);
+  const bounded = await reviewer.query(api.profileMediaSubmissions.listForReview, {
+    ...args, paginationOpts: { ...args.paginationOpts, numItems: 40, endCursor: first.continueCursor },
+  });
+  assert.deepEqual(bounded.page, first.page); assert.equal(bounded.isDone, true);
+  const scope = JSON.parse(first.continueCursor);
+  const inner = JSON.parse(scope.cursor);
+  const foreignRevision = await f.t.run(async ctx => {
+    const batchId = await ctx.db.insert("contributionBatches", { actorUserId: f.s.contributorUserId,
+      idempotencyKey: "foreign-cursor", label: "Other", archived: false, rowCount: 1, createdAt: Date.now() });
+    return await ctx.db.insert("contributionItemRevisions", { actorUserId: f.s.contributorUserId,
+      batchId, itemKey: "other", revision: 1, payload: "{}", bytes: 2, createdAt: Date.now() });
+  });
+  for (const cursor of ["malformed", JSON.stringify({ ...scope, cursor: "{}" }),
+    JSON.stringify({ ...scope, cursor: JSON.stringify({ ...inner, revisionIds: [foreignRevision] }) }),
+    JSON.stringify({ ...scope, cursor: JSON.stringify({ ...inner, submissionIds: [...inner.submissionIds, ...inner.submissionIds] }) }),
+    JSON.stringify({ ...scope, cursor: JSON.stringify({ ...inner, submissionIds: [setup.foreignId] }) })])
+    await assert.rejects(reviewer.query(api.profileMediaSubmissions.listForReview, { ...args, paginationOpts: { cursor, numItems: 1 } }), /CURSOR/);
+  await assert.rejects(reviewer.query(api.profileMediaSubmissions.listForReview, {
+    ...args, paginationOpts: { cursor: null, numItems: 1,
+      endCursor: JSON.stringify({ ...scope, cursor: JSON.stringify({ ...inner, revisionIds: [foreignRevision] }) }) },
+  }), /CURSOR/);
+  for (const change of [{ status: "under_review" as const }, { profileId: other.profileId }])
+    await assert.rejects(reviewer.query(api.profileMediaSubmissions.listForReview, { ...args, ...change, paginationOpts: { cursor: first.continueCursor, numItems: 1 } }), /CURSOR/);
+  for (const numItems of [0, 41, 1.5])
+    await assert.rejects(reviewer.query(api.profileMediaSubmissions.listForReview, { ...args, paginationOpts: { cursor: null, numItems } }), /Invalid review page/);
+  const seen = first.page.map(row => row.submissionId);
+  let page = first;
+  for (let i = 0; !page.isDone && i < 12; i++) {
+    page = await reviewer.query(api.profileMediaSubmissions.listForReview, { ...args, paginationOpts: { cursor: page.continueCursor, numItems: 1 } });
+    assert.ok(page.page.length <= 1); seen.push(...page.page.map(row => row.submissionId));
+  }
+  assert.equal(page.isDone, true);
+  assert.deepEqual([...seen].sort(), [...setup.ids, setup.secondProposal].sort());
+  assert.equal(new Set(seen).size, seen.length);
+  const changing = setup.ids.filter(id => id !== first.page[0].submissionId);
+  await f.t.run(async ctx => {
+    await ctx.db.patch(first.page[0].submissionId, { status: "rejected" });
+    await ctx.db.patch(changing[0], { expiresAt: Date.now() - 1 });
+    await ctx.db.patch(changing[1], { status: "under_review" });
+  });
+  const resumed = await reviewer.query(api.profileMediaSubmissions.listForReview, { ...args, paginationOpts: { cursor: first.continueCursor, numItems: 40 } });
+  assert.deepEqual(resumed.page.map(row => row.submissionId), [changing[2]]);
+  const matching = await reviewer.query(api.profileMediaSubmissions.listForReview, {
+    ...args, profileId: f.s.profileId, paginationOpts: { cursor: null, numItems: 40 },
+  });
+  assert.deepEqual(matching.page.map(row => row.submissionId), [changing[2]]);
+  const otherStatus = await reviewer.query(api.profileMediaSubmissions.listForReview, {
+    ...args, status: "under_review", paginationOpts: { cursor: null, numItems: 40 },
+  });
+  assert.equal(otherStatus.page.length, 2);
+  await f.t.run(ctx => ctx.db.patch(setup.assignment, { active: false }));
+  await assert.rejects(reviewer.query(api.profileMediaSubmissions.listForReview, { ...args, paginationOpts: { cursor: first.continueCursor, numItems: 1 } }), /BATCH_UNAVAILABLE/);
+  await f.t.run(async ctx => { await ctx.db.patch(setup.assignment, { active: true }); await ctx.db.patch(setup.grantId, { state: "revoked" }); });
+  await assert.rejects(reviewer.query(api.profileMediaSubmissions.listForReview, { ...args, paginationOpts: { cursor: first.continueCursor, numItems: 1 } }), /BATCH_UNAVAILABLE/);
+  await f.t.run(async ctx => {
+    await ctx.db.patch(setup.grantId, { state: "active" });
+    const revisionId = await ctx.db.insert("contributionItemRevisions", { actorUserId: f.s.contributorUserId,
+      batchId: setup.batchId, itemKey: "duplicate-source", revision: 2, payload: "{}", bytes: 2, createdAt: Date.now() });
+    await ctx.db.insert("contributionItemAttempts", { actorUserId: f.s.contributorUserId, revisionId,
+      oauthClientId: "client", submissionId: f.intent.submissionId, receipt: { operationId: "duplicate", operationState: "committed" }, createdAt: Date.now() });
+  });
+  const uniqueOnly = await reviewer.query(api.profileMediaSubmissions.listForReview, { ...args, paginationOpts: { cursor: null, numItems: 40 } });
+  assert.deepEqual(uniqueOnly.page.map(row => row.submissionId), [setup.secondProposal]);
+});
 it("unbatched replacement refuses an ordinary reviewer and keeps distinct admin review", async () => {
   const f = await fixture(); await occupyFallback(f); const d = await f.detail();
   const p = await f.actor.mutation(api.profileMediaSubmissions.proposePlacement, { submissionId: f.intent.submissionId, expectedContributionVersion: d.contributionVersion, idempotencyKey: "unbatched" });
diff --git a/tests/backend/media-review-assignment.test.ts b/tests/backend/media-review-assignment.test.ts
index c74106a7..d658581c 100644
--- a/tests/backend/media-review-assignment.test.ts
+++ b/tests/backend/media-review-assignment.test.ts
@@ -710,6 +710,26 @@ it("binds review cursors to authenticated actors, batches and status filters", a
     /BATCH_UNAVAILABLE/,
   );
 });
+it("returns twenty ordinary assigned submissions in one requested source page", async () => {
+  const f = await fixture();
+  await f.t.run(async ctx => {
+    const { _id, _creationTime, ...fields } = (await ctx.db.get(f.intent.submissionId))!;
+    for (let n = 0; n < 19; n++) {
+      const submissionId = await ctx.db.insert("profileMediaSubmissions", { ...fields, createdAt: NOW + n });
+      const revisionId = await ctx.db.insert("contributionItemRevisions", {
+        actorUserId: f.s.contributorUserId, batchId: f.batchId, itemKey: `ordinary-${n}`, revision: 1,
+        payload: "{}", bytes: 2, createdAt: NOW,
+      });
+      await ctx.db.insert("contributionItemAttempts", { actorUserId: f.s.contributorUserId, revisionId,
+        oauthClientId: "fixture", submissionId, receipt: { operationId: `ordinary-${n}`, operationState: "committed" }, createdAt: NOW });
+    }
+  });
+  const page = await f.actor.query(api.profileMediaSubmissions.listForReview, {
+    batchId: f.batchId, paginationOpts: { cursor: null, numItems: 20 },
+  });
+  assert.equal(page.page.length, 20); assert.equal(page.isDone, true);
+  assert.equal(new Set(page.page.map(row => row.submissionId)).size, 20);
+});
 it("traverses past nonmatching indexed revisions instead of truncating the filtered queue", async () => {
   const f = await fixture();
   await f.t.run(async (ctx) => {
diff --git a/tests/backend/profile-assets-management.test.ts b/tests/backend/profile-assets-management.test.ts
index 666927b3..8bf00c32 100644
--- a/tests/backend/profile-assets-management.test.ts
+++ b/tests/backend/profile-assets-management.test.ts
@@ -398,6 +398,26 @@ describe("profile media-kit owner management", () => {
     );
   });
 
+  it("retains public credit while omitting private source provenance from anonymous profile and kit responses", async () => {
+    const seeded = await seedOwnedProfile(1);
+    await seeded.t.run(ctx => ctx.db.patch(seeded.assetIds[0]!, {
+      credit: "Public photographer", creditUrl: "https://photographer.example/",
+      sourceUrl: "https://discord.com/channels/private/message?signature=private-query",
+      sourceDescription: "Private source-message context",
+    }));
+    const kit = await seeded.t.query(api.profileAssets.listPublicBySlug, { slug: "media-owner" });
+    const profile = await seeded.t.query(api.profiles.getPublicBySlug, { slug: "media-owner" });
+    for (const response of [kit, profile]) {
+      assert.ok(response);
+      const serialized = JSON.stringify(response);
+      assert.ok(serialized.includes("Public photographer"));
+      assert.ok(serialized.includes("https://photographer.example/"));
+      assert.ok(!serialized.includes("private-query"));
+      assert.ok(!serialized.includes("Private source-message context"));
+      assert.ok(!serialized.includes("discord.com/channels/private"));
+    }
+  });
+
   it("releases a failed owner upload reservation for an immediate retry", async () => {
     const seeded = await seedOwnedProfile(11);
     const owner = seeded.t.withIdentity(seeded.ownerIdentity);
diff --git a/tests/backend/profile-media-submissions.test.ts b/tests/backend/profile-media-submissions.test.ts
index bebf88bb..95049637 100644
--- a/tests/backend/profile-media-submissions.test.ts
+++ b/tests/backend/profile-media-submissions.test.ts
@@ -16,6 +16,27 @@ process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true";
 import { modules, schema, NOW, FIRST_REVIEW_PAGE, TARGET_PROFILE_SNAPSHOT, seed, createAndUpload } from "./_mediaReviewFixture";
 
 describe("unclaimed-profile media submissions", () => {
+  it("bounds normalized browser source URLs before admission and round-trips the maximum accepted URL", async () => {
+    const t = convexTest({ schema, modules }); const seeded = await seed(t);
+    const actor = t.withIdentity(seeded.contributorIdentity);
+    const prefix = "https://source.example/";
+    const exact = prefix + "a".repeat(4096 - prefix.length);
+    const input = { profileId: seeded.profileId, requestedPlacement: "gallery" as const,
+      originalFileName: "artist.webp", mimeType: "image/webp", byteSize: 512,
+      sourceUrl: exact, credit: "Artist", expectedProfileUpdatedAt: NOW };
+    const before = await t.run(async ctx => ({ submissions: await ctx.db.query("profileMediaSubmissions").collect(),
+      intents: await ctx.db.query("profileAssetUploadIntents").collect(), reservations: await ctx.db.query("contributionUploadReservations").collect() }));
+    for (const sourceUrl of [exact + "a", prefix + "é".repeat(800)]) {
+      assert.ok(new URL(sourceUrl).href.length > 4096);
+      await assert.rejects(actor.mutation(api.profileMediaSubmissions.createUploadIntent, { ...input, sourceUrl }), /MEDIA_SOURCE_URL_TOO_LONG/);
+    }
+    assert.deepEqual(await t.run(async ctx => ({ submissions: await ctx.db.query("profileMediaSubmissions").collect(),
+      intents: await ctx.db.query("profileAssetUploadIntents").collect(), reservations: await ctx.db.query("contributionUploadReservations").collect() })), before);
+    const created = await actor.mutation(api.profileMediaSubmissions.createUploadIntent, input);
+    assert.equal((await t.run(ctx => ctx.db.get(created.submissionId)))?.sourceUrl, exact);
+    assert.equal((await t.run(ctx => ctx.db.get(created.intentId)))?.sourceUrl, exact);
+    assert.equal((await actor.query(api.profileMediaSubmissions.getMine, { submissionId: created.submissionId }))?.sourceUrl, exact);
+  });
   for (const disposition of ["reject", "withdraw"] as const) {
     it(`schedules retained upload bytes after ${disposition} of an upload-backed identity proposal`, async () => {
       const t = convexTest({ schema, modules });
diff --git a/tests/web/media-contribution-legacy-source.test.ts b/tests/web/media-contribution-legacy-source.test.ts
new file mode 100644
index 00000000..ab26cd12
--- /dev/null
+++ b/tests/web/media-contribution-legacy-source.test.ts
@@ -0,0 +1,57 @@
+import assert from "node:assert/strict";
+import { it } from "node:test";
+import { convexTest } from "convex-test";
+import { api, internal } from "../../convex/_generated/api";
+import { modules, schema, seed, createAndUpload } from "../backend/_mediaReviewFixture";
+import { publishedContributionDetailSchema } from "../../packages/api-contracts/src/media-review";
+import { createMcpMediaReviewHandlers } from "../../apps/web/src/lib/server/mcp-media-review";
+
+process.env.VRDEX_PROFILE_MEDIA_SUBMISSIONS_ENABLED = "true";
+process.env.VRDEX_PROFILE_MEDIA_DIRECT_UPLOAD_ENABLED = "true";
+process.env.VRDEX_PROFILE_MEDIA_KIT_ENABLED = "true";
+
+async function fixture() {
+  const t = convexTest({ schema, modules }); const s = await seed(t);
+  const { intent } = await createAndUpload(t, s);
+  const reviewer = t.withIdentity(s.moderatorIdentity);
+  const pending = await reviewer.query(api.profileMediaSubmissions.reviewDetail, { submissionId: intent.submissionId });
+  assert.ok(pending);
+  assert.equal((await reviewer.mutation(api.profileMediaSubmissions.decideWithReceipt, {
+    submissionId: intent.submissionId, expectedReviewVersion: pending.reviewVersion,
+    decision: "approve", privateReason: "Reviewed", idempotencyKey: "publish",
+  })).operationState, "committed");
+  const actor = t.withIdentity(s.contributorIdentity);
+  const detail = () => actor.query(api.profileMediaSubmissions.contributionDetail, { submissionId: intent.submissionId });
+  return { t, s, intent, actor, detail };
+}
+
+it("preserves an own published historical long source through authenticated MCP get while refusing new oversize writes", async () => {
+  const f = await fixture(); const d = await f.detail();
+  const sourceUrl = "https://legacy.example/source?signature=" + "a".repeat(5000);
+  await f.t.run(ctx => ctx.db.patch(d.assetId, { sourceUrl }));
+  const handlers = createMcpMediaReviewHandlers({
+    actorUserId: f.s.contributorUserId, now: () => Date.now(), verifyContributorEmail: async () => true,
+    query: async (name, args) => {
+      assert.equal(name, "contributionGet"); assert.equal(args.actorUserId, f.s.contributorUserId);
+      assert.equal(args.submissionId, f.intent.submissionId);
+      return await f.t.query(internal.profileMediaSubmissions.contributionDetailForMcpActor, {
+        submissionId: f.intent.submissionId, actorUserId: f.s.contributorUserId,
+        emailVerified: args.emailVerified === true,
+        emailVerificationAttestedAt: typeof args.emailVerificationAttestedAt === "number" ? args.emailVerificationAttestedAt : 0,
+      });
+    },
+    mutate: async () => { throw new Error("Oversize command must be refused before backend mutation."); },
+    readStoredObject: async () => null,
+  });
+  const result = await handlers.contributionGet({ submissionId: f.intent.submissionId });
+  assert.equal(result.isError, undefined);
+  assert.equal(publishedContributionDetailSchema.parse(result.structuredContent).metadata.sourceUrl, sourceUrl);
+  const before = await f.t.run(async ctx => ({ asset: await ctx.db.get(d.assetId),
+    reservations: await ctx.db.query("contributionUploadReservations").collect() }));
+  const current = await f.detail();
+  await assert.rejects(handlers.contributionManage({ submissionId: f.intent.submissionId,
+    expectedContributionVersion: current.contributionVersion, idempotencyKey: "legacy-oversize",
+    action: "update_metadata", metadata: { sourceUrl } }), /4096/);
+  assert.deepEqual(await f.t.run(async ctx => ({ asset: await ctx.db.get(d.assetId),
+    reservations: await ctx.db.query("contributionUploadReservations").collect() })), before);
+});

From 0959c3a28381ea83b67f55df0c011a0787d04f2f Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Tue, 13 Oct 2026 15:06:52 -0400
Subject: [PATCH 27/28] fix(media): bound native review endpoint reads

---
 convex/profileMediaSubmissions.ts             |  8 +-
 docs/engineering/media-review-commands.md     |  4 +-
 tests/backend/media-review-assignment.test.ts | 87 +++++++++++++++++++
 3 files changed, 97 insertions(+), 2 deletions(-)

diff --git a/convex/profileMediaSubmissions.ts b/convex/profileMediaSubmissions.ts
index d7dad6d0..e256f6f8 100644
--- a/convex/profileMediaSubmissions.ts
+++ b/convex/profileMediaSubmissions.ts
@@ -1599,6 +1599,12 @@ async function authorizedReviewPage(
         !(await activeBatchAssignment(ctx, batch._id, currentActor.user._id)))
     )
       throw new Error("BATCH_UNAVAILABLE");
+    const requestedReadLimit = paginationOpts.maximumRowsRead;
+    if (requestedReadLimit !== undefined && (!Number.isInteger(requestedReadLimit) || requestedReadLimit < 1))
+      throw new Error("Invalid review page.");
+    // endCursor overrides numItems in native pagination, so bound the source
+    // pipeline independently before capturing any remaining revision IDs.
+    const maximumRowsRead = Math.min(requestedReadLimit ?? 40, 40);
     const checkpoint = readBatchReviewCursor(paginationOpts.cursor);
     const end = paginationOpts.endCursor == null ? null : readBatchReviewCursor(paginationOpts.endCursor);
     const { cursor: _cursor, endCursor: _endCursor, ...revisionOptions } = paginationOpts;
@@ -1617,7 +1623,7 @@ async function authorizedReviewPage(
         splitCursor: null, pageStatus: null }
       : await ctx.db.query("contributionItemRevisions")
         .withIndex("by_batch_key_revision", q => q.eq("batchId", batch._id))
-        .paginate({ ...revisionOptions, cursor: checkpoint.nativeCursor,
+        .paginate({ ...revisionOptions, maximumRowsRead, cursor: checkpoint.nativeCursor,
           ...(end ? { endCursor: end.nativeCursor } : {}) });
     const pendingRevisions = [...revisions.page];
     let pendingRows = checkpoint.submissionIds;
diff --git a/docs/engineering/media-review-commands.md b/docs/engineering/media-review-commands.md
index f9c7f5e7..71ee55ff 100644
--- a/docs/engineering/media-review-commands.md
+++ b/docs/engineering/media-review-commands.md
@@ -404,8 +404,10 @@ New replacement proposals require an occupied identity slot, including visible l
 
 A replacement candidate inherits reviewer authority from its approved asset's original submission and collection assignment. Current reviewer grant and assignment are required for queue, inspection and decision. Assigned website and MCP queues project the new proposal's submission ID; direct media review commands operate on that ID. Original collection revisions, attempts, receipts and audits remain unchanged. Collection item apply continues to refer to its original item, so review replacements through the media-review queue or exact media-review commands.
 
-Assigned queue pages read at most the requested 1 to 40 indexed source revisions
+Assigned queue pages read at most 40 indexed source revisions
 and eleven indexed, unexpired proposals of the requested open status per source.
+Native `endCursor` ranges are subject to the same server row-read bound. Smaller
+positive integer `maximumRowsRead` hints remain effective; invalid hints refuse.
 More than ten matching proposals fails closed. A page returns at most its requested
 number of rows. If sources expand beyond that limit, the scope-bound cursor saves
 remaining revision IDs and the current source's remaining submission IDs. Resuming
diff --git a/tests/backend/media-review-assignment.test.ts b/tests/backend/media-review-assignment.test.ts
index d658581c..bee93c27 100644
--- a/tests/backend/media-review-assignment.test.ts
+++ b/tests/backend/media-review-assignment.test.ts
@@ -730,6 +730,93 @@ it("returns twenty ordinary assigned submissions in one requested source page",
   assert.equal(page.page.length, 20); assert.equal(page.isDone, true);
   assert.equal(new Set(page.page.map(row => row.submissionId)).size, 20);
 });
+async function addOrdinaryRangeSources(f: Awaited<ReturnType<typeof fixture>>, count: number, prefix: string) {
+  return await f.t.run(async ctx => {
+    const { _id, _creationTime, ...fields } = (await ctx.db.get(f.intent.submissionId))!;
+    const ids = [];
+    for (let n = 0; n < count; n++) {
+      const submissionId = await ctx.db.insert("profileMediaSubmissions", { ...fields, createdAt: NOW + n });
+      ids.push(submissionId);
+      const itemKey = `${prefix}-${String(n).padStart(3, "0")}`;
+      const revisionId = await ctx.db.insert("contributionItemRevisions", {
+        actorUserId: f.s.contributorUserId, batchId: f.batchId, itemKey,
+        revision: 1, payload: "{}", bytes: 2, createdAt: NOW,
+      });
+      await ctx.db.insert("contributionItemAttempts", { actorUserId: f.s.contributorUserId, revisionId,
+        oauthClientId: "fixture", submissionId, receipt: { operationId: itemKey, operationState: "committed" }, createdAt: NOW });
+    }
+    return ids;
+  });
+}
+for (const numItems of [1, 40]) {
+  it(`bounds a native eighty-row endpoint and traverses all eighty/81 assigned rows at page size ${numItems}`, async () => {
+    const f = await fixture();
+    const added = await addOrdinaryRangeSources(f, 80, "range");
+    const get = (cursor: string | null, size: number, endCursor?: string, maximumRowsRead?: number) =>
+      f.actor.query(api.profileMediaSubmissions.listForReview, { batchId: f.batchId,
+        paginationOpts: { cursor, numItems: size, ...(endCursor === undefined ? {} : { endCursor }),
+          ...(maximumRowsRead === undefined ? {} : { maximumRowsRead }) } });
+    const first = await get(null, 40); const second = await get(first.continueCursor, 40);
+    assert.equal(first.page.length, 40); assert.equal(second.page.length, 40);
+    const endpoint = second.continueCursor;
+    const ranged = await get(null, numItems, endpoint, 1000);
+    assert.equal(ranged.page.length, numItems);
+    const initialCheckpoint = JSON.parse(JSON.parse(ranged.continueCursor).cursor);
+    assert.equal(ranged.page.length + initialCheckpoint.revisionIds.length, 40);
+    const collect = async (endCursor?: string) => {
+      const ids = ranged.page.map(row => row.submissionId);
+      let page = ranged;
+      for (let n = 0; !page.isDone && n < 100; n++) {
+        const checkpoint = JSON.parse(JSON.parse(page.continueCursor).cursor);
+        assert.ok(checkpoint.revisionIds.length <= 40);
+        assert.ok(checkpoint.submissionIds === null || checkpoint.submissionIds.length <= 11);
+        assert.ok(page.continueCursor.length <= 8192);
+        page = await get(page.continueCursor, numItems, endCursor);
+        assert.ok(page.page.length <= numItems);
+        ids.push(...page.page.map(row => row.submissionId));
+      }
+      assert.equal(page.isDone, true);
+      assert.equal(new Set(ids).size, ids.length);
+      return ids;
+    };
+    assert.deepEqual((await collect(endpoint)).sort(), [...first.page, ...second.page].map(row => row.submissionId).sort());
+    assert.deepEqual((await collect()).sort(), [f.intent.submissionId, ...added].sort());
+    const smaller = await get(null, 40, endpoint, 3);
+    assert.equal(smaller.page.length, 3);
+    assert.equal(smaller.pageStatus, "SplitRequired"); assert.ok(smaller.splitCursor);
+    const left = await get(null, 40, smaller.splitCursor, 3);
+    const right = await get(smaller.splitCursor, 40, smaller.continueCursor, 3);
+    assert.deepEqual([...left.page, ...right.page].map(row => row.submissionId), smaller.page.map(row => row.submissionId));
+    for (const maximumRowsRead of [0, -1, 1.5, Number.NaN, Number.POSITIVE_INFINITY])
+      await assert.rejects(get(null, numItems, endpoint, maximumRowsRead), /Invalid review page/);
+    await f.t.run(ctx => ctx.db.patch(f.assignmentId, { active: false }));
+    await assert.rejects(get(ranged.continueCursor, numItems, endpoint), /BATCH_UNAVAILABLE/);
+  });
+  it(`bounds and completes a captured endpoint after its twenty-row range grows to 81 rows at page size ${numItems}`, async () => {
+    const f = await fixture();
+    await addOrdinaryRangeSources(f, 20, "stable");
+    const get = (cursor: string | null, size: number, endCursor?: string) =>
+      f.actor.query(api.profileMediaSubmissions.listForReview, { batchId: f.batchId,
+        paginationOpts: { cursor, numItems: size, ...(endCursor === undefined ? {} : { endCursor }) } });
+    const initial = await get(null, 20);
+    assert.equal(initial.page.length, 20); assert.equal(initial.isDone, false);
+    const growth = await addOrdinaryRangeSources(f, 61, "growth");
+    const ids = [];
+    let cursor: string | null = null;
+    let done = false;
+    for (let n = 0; !done && n < 100; n++) {
+      const page = await get(cursor, numItems, initial.continueCursor);
+      assert.ok(page.page.length <= numItems);
+      const checkpoint = JSON.parse(JSON.parse(page.continueCursor).cursor);
+      assert.ok(checkpoint.revisionIds.length <= 40);
+      assert.ok(checkpoint.submissionIds === null || checkpoint.submissionIds.length <= 11);
+      ids.push(...page.page.map(row => row.submissionId));
+      cursor = page.continueCursor; done = page.isDone;
+    }
+    assert.equal(done, true); assert.equal(ids.length, 81); assert.equal(new Set(ids).size, 81);
+    assert.deepEqual(ids.sort(), [...initial.page.map(row => row.submissionId), ...growth].sort());
+  });
+}
 it("traverses past nonmatching indexed revisions instead of truncating the filtered queue", async () => {
   const f = await fixture();
   await f.t.run(async (ctx) => {

From 4aca25eab443d5b007a7370b7052304ec66c0f6b Mon Sep 17 00:00:00 2001
From: BASICBIT <basic.bit.1001@gmail.com>
Date: Tue, 13 Oct 2026 15:19:37 -0400
Subject: [PATCH 28/28] test: assert exact public media asset credits

---
 tests/backend/profile-assets-management.test.ts | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/tests/backend/profile-assets-management.test.ts b/tests/backend/profile-assets-management.test.ts
index 8bf00c32..c6f4df39 100644
--- a/tests/backend/profile-assets-management.test.ts
+++ b/tests/backend/profile-assets-management.test.ts
@@ -409,9 +409,11 @@ describe("profile media-kit owner management", () => {
     const profile = await seeded.t.query(api.profiles.getPublicBySlug, { slug: "media-owner" });
     for (const response of [kit, profile]) {
       assert.ok(response);
+      const asset = response.mediaKit.assets.find((asset) => asset.assetId === seeded.assetIds[0]);
+      assert.ok(asset);
+      assert.equal(asset.credit, "Public photographer");
+      assert.equal(asset.creditUrl, "https://photographer.example/");
       const serialized = JSON.stringify(response);
-      assert.ok(serialized.includes("Public photographer"));
-      assert.ok(serialized.includes("https://photographer.example/"));
       assert.ok(!serialized.includes("private-query"));
       assert.ok(!serialized.includes("Private source-message context"));
       assert.ok(!serialized.includes("discord.com/channels/private"));