docs: record XML upload activation

.project-docs/30-worklog/current-state.md

@@ -6,7 +6,7 @@ The controlled public-deployment source snapshot is published on `main` at `http
 
 ## Recently Completed
 
-- 2026-07-29: Fixed the direct Docker-image launch path so its default Web CMD explicitly includes `--enable-processing`, matching Compose. The controlled local launchd script was also updated and restarted: PID 50730 reports both database and processing ready, and a browser DOM check confirms the XML chooser is enabled. Added a regression test that opens only XML processing mutations; all 260 tests pass with 2 artifact-tool skips. Source CLI defaults and the runtime readiness gate remain fail-closed.
+- 2026-07-29: Fixed the direct Docker-image launch path so its default Web CMD explicitly includes `--enable-processing`, matching Compose, and published code commit `ad3d987`. The controlled local launchd script was also updated and restarted: PID 50730 reports both database and processing ready, and a browser DOM check confirms the XML chooser is enabled. Added a regression test that opens only XML processing mutations; all 260 tests pass with 2 artifact-tool skips. Source CLI defaults and the runtime readiness gate remain fail-closed.
 - 2026-07-29: Published the deployment-ready snapshot to the empty self-hosted repository as `main`, established upstream tracking and verified that the remote branch contains initial commit `a701de9`.
 - 2026-07-29: Added a Linux Dockerfile, Compose, Caddy TLS boundary, production env example and deployment runbook. The Web health gate requires both `database_ready` and `processing_ready`; the production command opens XML processing without changing the source default.
 - 2026-07-29: Added opt-in HTTPS `Secure` session cookies, made the booking fixture root portable, removed local paths/test endpoints/temporary tunnel names from the publishable snapshot, and verified 271 final candidate files (about 2.0 MiB) contain no detected secrets, symlinks or files larger than 1 MiB.

.project-docs/30-worklog/task-history.md

@@ -4,7 +4,7 @@
 
 | Date | Task | Outcome | Docs Updated |
 |---|---|---|---|
-| 2026-07-29 | Open XML processing in the Docker image and current local Web entry | Added `--enable-processing` to Dockerfile CMD so direct image launches match Compose; updated/restarted the controlled local launchd entry and verified database/processing health plus an enabled XML file chooser; kept source CLI/runtime readiness fail-closed; passed 260 tests with 2 expected skips | README/runbook, current state, architecture module map, deployment and local-runtime evidence/index, container-entry reflection, planning record |
+| 2026-07-29 | Open XML processing in the Docker image and current local Web entry | Added `--enable-processing` to Dockerfile CMD so direct image launches match Compose; updated/restarted the controlled local launchd entry and verified database/processing health plus an enabled XML file chooser; kept source CLI/runtime readiness fail-closed; passed 260 tests with 2 expected skips; pushed code commit `ad3d987` and verified the remote branch | README/runbook, current state, architecture module map, deployment and local-runtime evidence/index, container-entry reflection, planning record |
 | 2026-07-29 | Prepare and publish the project for controlled public-server deployment | Added Docker/Compose/Caddy deployment with XML processing explicitly enabled, HTTPS Secure cookies, Basic Auth/Bearer boundaries and a Chinese runbook; sanitized publishable history; 259 tests passed (2 skipped), all contracts/checksums and a 271-file secret/size/symlink scan passed; pushed `main` to the self-hosted repository and verified initial deployment commit `a701de9` | Current state, architecture, deployment evidence/index, commitments, module map |
 | 2026-07-29 | Restart the controlled ARR MCP public path | Restarted loopback MCP and fixed ngrok host; corrected exact public Host allowlisting after a diagnostic 421; public unauthorized requests now return 401 and authenticated one-tool discovery returns 200. Main upload remains disabled | Current state, E2E evidence/index, commitment, active planning record |
 | 2026-07-29 | Diagnose persistent SuperAgent MCP `failed` status | Confirmed the temporary MCP and ngrok processes had exited; public `/mcp` returns `ERR_NGROK_3200 endpoint offline` despite valid DNS/TLS. The stale platform config version 33 remains a second-stage issue after reachability is restored | Current state, E2E evidence/index, commitment, active planning record |

.project-docs/50-evidence/topics/2026-07-29-public-deployment-repository.md

@@ -17,7 +17,7 @@ Does the publishable source snapshot open XML processing through both supported
 ## Evidence
 
 - Files: `Dockerfile`, `compose.yaml`, `deploy/Caddyfile`, `deploy/.env.production.example`, `deploy/README.md`, `arr_web/app.py`, `arr_web/run.py`, `tests/test_arr_web.py`.
-- Git: initial deployment snapshot commit `a701de9f0eff7402fe1785c3b35de5652576152a` was pushed to `origin/main`; an independent `ls-remote` check is required after the documentation closeout commit as the final publication proof.
+- Git: initial deployment snapshot commit `a701de9f0eff7402fe1785c3b35de5652576152a` and XML-entry fix commit `ad3d9878c5aa8d956339ef6871322000e694f5ca` were pushed to `origin/main`; independent `ls-remote` returned the fix SHA before the documentation closeout commit.
 - Deployment command inspection: Dockerfile default Web CMD and Compose Web command both contain `--enable-processing`; Compose also contains `--secure-cookies`. Only Caddy maps host ports 80/443 in the documented Compose topology, while Web and MCP use internal `expose` ports.
 - Regression: `tests/test_deployment_entrypoints.py` parses the Dockerfile JSON CMD, requires `--enable-processing`, and rejects accidental enablement of monthly, company-report or legacy Agent-writeback mutations.
 - Tests: Python 3.12 full discovery ran 260 tests successfully; 2 environment-dependent artifact-tool tests were skipped.