From 311f6070dc8950a75133567a9eff724e975593b6 Mon Sep 17 00:00:00 2001
From: Erik Le Blansch <58982453+erikleblansch@users.noreply.github.com>
Date: Fri, 2 Oct 2026 23:23:10 +0200
Subject: [PATCH 1/7] cloud: upload new owner files through encrypted core
 fragment storage

---
 .github/workflows/quality.yml              |   2 +
 README.md                                  |   7 +
 docs/ARCHITECTURE.md                       |   7 +
 docs/OWNER_UPLOADS.md                      | 114 ++++++++
 docs/RECOVERY_WEB.md                       |   5 +
 patches/opencloud-web-owner-recovery.patch | 142 ++++++++--
 scripts/cloud-serve.mjs                    |  23 +-
 scripts/private_file.py                    |  31 ++-
 scripts/recovery-web-assets.mjs            |  11 +-
 scripts/smoke_owner_upload_ui.py           | 271 +++++++++++++++++++
 scripts/upload_lock.py                     |  25 ++
 src/owner-uploads.mjs                      | 263 +++++++++++++++++++
 src/private-catalog.mjs                    |  39 ++-
 src/private-dav-server.mjs                 |  41 ++-
 src/private-file.mjs                       |  20 +-
 src/recovery-web-metadata.mjs              |  13 +-
 test/cloud-serve.test.mjs                  |  34 +++
 test/owner-uploads.test.mjs                | 291 +++++++++++++++++++++
 test/recovery-web-assets.test.mjs          |  23 ++
 test/test_owner_upload_ui.py               | 117 +++++++++
 20 files changed, 1422 insertions(+), 57 deletions(-)
 create mode 100644 docs/OWNER_UPLOADS.md
 create mode 100644 scripts/smoke_owner_upload_ui.py
 create mode 100644 scripts/upload_lock.py
 create mode 100644 src/owner-uploads.mjs
 create mode 100644 test/owner-uploads.test.mjs
 create mode 100644 test/test_owner_upload_ui.py

diff --git a/.github/workflows/quality.yml b/.github/workflows/quality.yml
index dd803d7..dc8cdf8 100644
--- a/.github/workflows/quality.yml
+++ b/.github/workflows/quality.yml
@@ -22,6 +22,8 @@ jobs:
           node-version: '24.19.0'
       - name: Check the actual DAV adapter against synthetic HTTP fixtures
         run: node --test test/*.test.mjs
+      - name: Check owner-upload driver boundaries without starting a browser
+        run: python3 -B test/test_owner_upload_ui.py
       - name: Check provenance and whitespace
         run: |
           python3 -m json.tool third_party/opencloud-source.json > /dev/null
diff --git a/README.md b/README.md
index 48e77ed..dece4c9 100644
--- a/README.md
+++ b/README.md
@@ -19,6 +19,13 @@ trial also passes: original Files navigation and two verified downloads with the
 source and one provider offline. This is not a replacement account service,
 writable synchronization or second-device recovery.
 
+The next executable slice adds an explicitly enabled **owner-private upload
+space** beside the unchanged read-only imports. The connector now supports new
+file upload, encryption, core fragment deposit, durable catalog publication and
+restart/download; its targeted tests use real HTTP/GPG with an explicit storage
+fixture. The updated original Files/Uppy connection still needs a new native
+build and joined live-peer upload proof. [Upload setup and limits →](docs/OWNER_UPLOADS.md)
+
 ## One core, private files
 
 OpenCloud supplies the familiar file experience; VOLPAROSSA supplies shared
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index ac0e03b..8dced1f 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -49,6 +49,13 @@ substitute for the live file-access path.
 
 [Encrypted catalog and source-off read service](OFFLINE_READ.md)
 
+The next [owner-private upload slice](OWNER_UPLOADS.md) retains that immutable
+selection and adds a separate, explicitly enrolled new-file space. Its existing
+Uppy/DAV PUT path encrypts before core fragment deposit and publishes a durable
+catalog entry only after confirmation. This is not permission to modify the
+original account or an implementation of shared synchronization; native UI/peer
+upload evidence is still open.
+
 ## Backend functions that must not disappear
 
 OpenCloud storage and application services have separate responsibilities:
diff --git a/docs/OWNER_UPLOADS.md b/docs/OWNER_UPLOADS.md
new file mode 100644
index 0000000..4f2a87a
--- /dev/null
+++ b/docs/OWNER_UPLOADS.md
@@ -0,0 +1,114 @@
+# Owner-private uploads while the original server is off
+
+This developing slice adds a **separate, explicitly enabled owner upload space**
+to the existing recovery service. It does not turn imported read-only files into
+writable OpenCloud accounts. It accepts new files only: no overwrites, folder
+creation, rename, delete, sharing or synchronization back to the original server.
+
+The original OpenCloud Files **Files Upload** action and Uppy raw DAV `PUT` path
+are reused. A local authenticated upload is privately staged, encrypted with the
+existing GPG helper, then submitted to the shared core's fragment create/deposit
+operations. The core still chooses fragment placement and uniform redundancy;
+Cloud adds neither a copy-count option nor a second storage ledger.
+
+```text
+Original Files Upload / authenticated DAV PUT
+  -> owner-private temporary file -> authenticated encrypted bundle
+  -> core fragment journal -> confirmed redundant deposit
+  -> durable catalog commit -> visible new file
+  -> later GET -> core fragment restore -> verified local decrypt -> download
+```
+
+## Explicit setup
+
+Keep the existing [read-service configuration](OFFLINE_READ.md), selected catalog
+and owner token. Add an upload space whose name does not collide with an imported
+space:
+
+```json
+"ownerUploads": {
+  "directory": "/absolute/private/owner-uploads",
+  "space": "My uploads",
+  "storageConfig": "/absolute/private/upload-storage-template.json"
+}
+```
+
+Create the upload directory mode **0700**, separate from the existing private work
+directory. Keep the storage template mode **0600** in an owner-only directory.
+It uses the existing [core storage configuration](PRIVATE_FILES.md), but **omit
+`stateDirectory`**: each uploaded file receives an opaque owner journal directory.
+Keep `copies` absent. Configure the existing core binary, protected control socket,
+owner identity/passphrase file, fragment size/lifetime/deadline and **3–8 distinct
+provider keys with their explicit grants**. Invalid grants or insufficient core
+capacity remain visible failures, not admission to other peers.
+
+Start with the existing `cloud-serve.mjs --config …` command. `ownerUploads` is
+absent by default and cannot enable cross-origin browser writes. The listener
+remains loopback-only; every private operation needs the configured owner bearer.
+Neither the configuration nor DAV input can supply executable hooks or arbitrary
+local source/destination paths. Original Files requires a **new source build of
+the updated pinned patch**; an older build report is correctly refused.
+
+The new UI label distinguishes owner-private uploads from imported read-only
+files. Uploads use the existing Uppy engine, one file at a time; unsupported
+folder/shortcut creation is hidden in this mode. The upload-enabled service and
+UI use a bounded 30-minute default deadline. The original read-only service keeps
+its two-minute default. Explicit service deadlines may still cancel an upload.
+
+## Publication, retry and recovery
+
+`PUT` returns **201 only after confirmed storage and durable catalog publication**.
+The owner directory holds opaque object names, private recovery bundles, encrypted
+single-file catalogs and core journals. File names and plaintext hashes remain
+inside authenticated encryption, not filenames or public receipts. The new
+file receipt is version 2 with `owner-upload-snapshot` provenance; old version-1
+DAV import receipts keep their original source/version checks. Relabeling an
+upload as a DAV import fails authenticated restoration.
+
+After an incomplete deposit, the file is not listed and its journal/ciphertext
+remain retained. An **explicit retry of the same name and exact file bytes**
+resumes that existing operation; different bytes are refused. There is no automatic
+fresh archive or origin fallback. A committed name cannot be overwritten, even
+when a client requests overwrite. If a response is lost after commit, re-list the
+space: a repeated `PUT` gets 412 rather than creating another stored copy.
+
+After service restart, committed catalogs become visible again. Every download
+still restores through the core, verifies the encrypted object and authenticated
+content, then removes temporary plaintext. Reads neither consume a backup nor
+substitute local ciphertext. Retained grants, charges and recovery state must not
+be deleted to make an incomplete operation look finished.
+
+Only one service may mutate an upload workspace at once, enforced by a supervised
+owner lock. At most 256 upload objects are retained, including interrupted stages.
+The existing `maxOpenBytes` bounds each encrypted file and concurrent restored
+ciphertext; small encryption/metadata overhead is included. It is not a disk quota:
+upload staging, ciphertext, restore staging and owner journals use additional local
+space. Forced process termination may leave private staging; this slice does not
+claim secure erasure or automatic abandoned-operation retirement.
+
+## Evidence and remaining scope
+
+Targeted tests exercise real HTTP, GPG encryption, encrypted catalogs, durable
+publication, restart, repeated verified downloads after local ciphertext removal,
+incomplete-deposit resumption, cancellation and unchanged imported permissions.
+The explicitly staged, hash-verified OpenCloud Web8 SDK also passes actual `PUT`,
+returned file-ID resolution, listing, verified read and overwrite refusal against
+this service. Only the storage-provider boundary is an explicit in-memory
+core-contract fixture. The updated patch applies to pinned OpenCloud Web8 source. **A newly built native
+Files upload joined to real protected peers has not yet been demonstrated.**
+
+The prepared disposable-guest driver `scripts/smoke_owner_upload_ui.py` uses the
+original Files file input and Uppy upload, then reloads and reauthenticates. Its
+separate download phase opens a fresh browser and verifies two native downloads.
+The core acceptance parent must supply the real service and independently prove
+the source is off, encrypted fragment deposits, service restart, provider
+withdrawal, charges and final retirement. The driver reports only closed UI and
+browser-cleanup observations; its boundary tests are **not an executed native
+upload or peer-storage result**. Ordinary read-only mode still hides the upload
+button; the explicit owner-upload mode retains the original per-space upload
+permission check, without granting writes to imported spaces.
+
+Owner keys/catalogs/journals still live on the owner's device. Cross-device recovery,
+shared accounts, concurrent editors, automatic repair/renewal and general writable
+synchronization remain separate work. Existing successful read-only UI/peer trials
+do not prove this new upload path or full server-independent OpenCloud operation.
diff --git a/docs/RECOVERY_WEB.md b/docs/RECOVERY_WEB.md
index 6c47d52..9dd9c33 100644
--- a/docs/RECOVERY_WEB.md
+++ b/docs/RECOVERY_WEB.md
@@ -6,6 +6,11 @@ new OpenCloud account, an OIDC impersonation or a replacement for writable
 OpenCloud synchronization. The normal upstream authentication path stays intact
 when this mode is not selected.
 
+The optional [owner-upload extension](OWNER_UPLOADS.md) adds a separate writable
+space for new private files. Imported selections remain read only. The native
+upload patch requires a new source build and joined upload proof; the successful
+read-only trials below remain bound to their original sources and patch.
+
 The browser receives only the owner's selected catalog. Storage peers still
 receive encrypted fragments, not filenames, private tokens or decryption keys.
 The recovery token remains in browser memory, not a URL or local/session storage.
diff --git a/patches/opencloud-web-owner-recovery.patch b/patches/opencloud-web-owner-recovery.patch
index aa59509..34b23ee 100644
--- a/patches/opencloud-web-owner-recovery.patch
+++ b/patches/opencloud-web-owner-recovery.patch
@@ -10,19 +10,19 @@ index abfb288..e605f4c 100644
 +import { useConfigStore, useExtensionRegistry, useMessages, useUserStore } from '../piniaStores'
  import { Resource, SpaceResource } from '@opencloud-eu/web-client'
  import { useGetMatchingSpace } from '../spaces'
- 
+
 @@ -17,6 +17,7 @@ export const useDownloadFile = (options?: DownloadFileOptions) => {
    const { $gettext } = useGettext()
    const userStore = useUserStore()
    const extensionRegistry = useExtensionRegistry()
 +  const configStore = useConfigStore()
- 
+
    const downloadFile = async (
      space: SpaceResource = null,
 @@ -28,6 +29,19 @@ export const useDownloadFile = (options?: DownloadFileOptions) => {
          space = getMatchingSpace(file)
        }
- 
+
 +      if (configStore.options.volparossaOwnerRecovery === true) {
 +        if (version || file.isFolder) throw new Error('Recovery supports selected current files only')
 +        const response = await clientService.webdav.getFileContents(
@@ -57,12 +57,13 @@ diff --git a/packages/web-pkg/src/composables/piniaStores/config/types.ts b/pack
 index 23c6c51..37be332 100644
 --- a/packages/web-pkg/src/composables/piniaStores/config/types.ts
 +++ b/packages/web-pkg/src/composables/piniaStores/config/types.ts
-@@ -26,6 +26,8 @@ const ScriptConfigSchema = z.object({
+@@ -26,6 +26,9 @@ const ScriptConfigSchema = z.object({
  export type ScriptConfig = z.infer<typeof ScriptConfigSchema>
- 
+
  const OptionsConfigSchema = z.object({
 +  // Explicit owner-local recovery mode; never an upstream OIDC/account identity.
 +  volparossaOwnerRecovery: z.boolean().optional(),
++  volparossaOwnerUploads: z.boolean().optional(),
    announcement: z
      .object({
        bannerText: z.string().optional(),
@@ -76,7 +77,7 @@ index ca69b9d..b48d6e2 100644
        <oc-list class="user-menu-list">
 -        <template v-if="!user?.onPremisesSamAccountName">
 +        <template v-if="configStore.options.volparossaOwnerRecovery">
-+          <li class="p-2">Private recovery · Read only</li>
++          <li class="p-2">{{ configStore.options.volparossaOwnerUploads ? 'Owner-private uploads · Imported files read only' : 'Private recovery · Read only' }}</li>
 +          <li>
 +            <oc-button id="volparossa-recovery-close" appearance="raw" @click="authService.logoutUser()">
 +              Close recovery
@@ -100,9 +101,9 @@ index ca69b9d..b48d6e2 100644
  const authService = useAuthService()
  const authStore = useAuthStore()
 +const configStore = useConfigStore()
- 
+
  const { user } = storeToRefs(userStore)
- 
+
 diff --git a/packages/web-runtime/src/index.ts b/packages/web-runtime/src/index.ts
 index 9e584c0..7bc90c5 100644
 --- a/packages/web-runtime/src/index.ts
@@ -135,7 +136,7 @@ index 9e584c0..7bc90c5 100644
 +  const heading = document.createElement('h1')
 +  heading.textContent = 'Private recovery · OpenCloud Files'
 +  const explanation = document.createElement('p')
-+  explanation.textContent = 'Read selected private files through your local VOLPAROSSA service. This is not an OpenCloud account login and does not grant sharing or write access.'
++  explanation.textContent = config.options.volparossaOwnerUploads ? 'Read selected files and upload new files to your separate owner-private space. This is not an OpenCloud account login and does not grant sharing or original account writes.' : 'Read selected private files through your local VOLPAROSSA service. This is not an OpenCloud account login and does not grant sharing or write access.'
 +  const form = document.createElement('form')
 +  const label = document.createElement('label')
 +  label.textContent = 'Local recovery access token'
@@ -173,7 +174,7 @@ index 9e584c0..7bc90c5 100644
 +        if (!response.ok) throw new Error('Access refused')
 +        const session = await response.json()
 +        if (session.version !== 1 || session.authority !== 'owner-local-catalog'
-+            || session.readOnly !== true || session.upstreamAccount !== false
++            || session.readOnly !== (config.options.volparossaOwnerUploads !== true) || session.upstreamAccount !== false
 +            || session.owner?.id !== 'volparossa-owner-recovery'
 +            || session.owner?.displayName !== 'Private recovery') throw new Error('Wrong authority')
 +        user.setUser({ id: session.owner.id, displayName: session.owner.displayName })
@@ -193,15 +194,15 @@ index 9e584c0..7bc90c5 100644
 +    })
 +  })
 +}
- 
+
  export const bootstrapApp = async (configurationPath: string, appsReadyCallback: () => void) => {
    const pinia = createPinia()
 @@ -73,6 +153,7 @@ export const bootstrapApp = async (configurationPath: string, appsReadyCallback:
    const gettext = announceGettext({ app, availableLanguages: supportedLanguages })
- 
+
    const clientService = announceClientService({ app, configStore, authStore })
 +  await initializeOwnerRecovery(configStore, authStore, userStore)
- 
+
    // Registered here (not at router module load) so the guard can receive the
    // `clientService` it needs to lazy-load mount-point spaces. Registering it
 @@ -118,7 +199,9 @@ export const bootstrapApp = async (configurationPath: string, appsReadyCallback:
@@ -214,7 +215,7 @@ index 9e584c0..7bc90c5 100644
 +    ]),
      ...(configStore.apps.includes('external') ? [appProviderService.loadData()] : [])
    ])
- 
+
 diff --git a/packages/web-runtime/src/services/auth/authService.ts b/packages/web-runtime/src/services/auth/authService.ts
 index d6ea81c..949ab11 100644
 --- a/packages/web-runtime/src/services/auth/authService.ts
@@ -236,7 +237,7 @@ index d6ea81c..949ab11 100644
          clientService: this.clientService,
 @@ -392,6 +400,11 @@ export class AuthService implements AuthServiceInterface {
    }
- 
+
    public async logoutUser() {
 +    if (this.configStore.options.volparossaOwnerRecovery === true) {
 +      this.resetStateAfterUserLogout()
@@ -246,3 +247,114 @@ index d6ea81c..949ab11 100644
      const endSessionEndpoint = await this.userManager.metadataService?.getEndSessionEndpoint()
      if (!endSessionEndpoint) {
        await this.userManager.removeUser()
+diff --git a/packages/web-app-files/src/components/CreateOrUploadMenu.vue b/packages/web-app-files/src/components/CreateOrUploadMenu.vue
+--- a/packages/web-app-files/src/components/CreateOrUploadMenu.vue
++++ b/packages/web-app-files/src/components/CreateOrUploadMenu.vue
+@@ -9,6 +9,7 @@
+     padding-size="small"
+   >
+     <oc-list
++      v-if="!configStore.options.volparossaOwnerUploads"
+       id="create-list"
+       :class="areFileExtensionsShown ? 'sm:min-w-xs' : null"
+       class="py-2 sm:first:pt-0 sm:last:pb-0"
+@@ -33,7 +34,7 @@
+       <li>
+         <resource-upload btn-class="w-full" :btn-label="$gettext('Files Upload')" />
+       </li>
+-      <li>
++      <li v-if="!configStore.options.volparossaOwnerUploads">
+         <resource-upload
+           btn-class="w-full"
+           :btn-label="$gettext('Folder Upload')"
+@@ -105,7 +106,7 @@
+         </oc-button>
+       </li>
+     </oc-list>
+-    <oc-list class="py-2 sm:first:pt-0 sm:last:pb-0 border-t">
++    <oc-list v-if="!configStore.options.volparossaOwnerUploads" class="py-2 sm:first:pt-0 sm:last:pb-0 border-t">
+       <li>
+         <oc-button
+           id="new-shortcut-btn"
+@@ -128,7 +129,7 @@
+ </template>
+
+ <script setup lang="ts">
+-import { FileAction, useResourcesStore, useUserStore, useSpacesStore } from '@opencloud-eu/web-pkg'
++import { FileAction, useResourcesStore, useUserStore, useSpacesStore, useConfigStore } from '@opencloud-eu/web-pkg'
+
+ import { computed, unref, useId } from 'vue'
+ import { Resource } from '@opencloud-eu/web-client'
+@@ -151,6 +152,7 @@ const { toggle } = defineProps<{
+ }>()
+
+ const userStore = useUserStore()
++const configStore = useConfigStore()
+ const language = useGettext()
+ const { $gettext } = language
+
+@@ -177,6 +179,7 @@ const { actions: createNewFileActions } = useFileActionsCreateNewFile({ space: curre
+
+ const { getExtensionActions } = useFileActions()
+ const extensionActions = computed(() => {
++  if (configStore.options.volparossaOwnerUploads) return []
+   return getExtensionActions(uploadMenuExtensionPoint.id)
+ })
+
+@@ -187,6 +190,7 @@ const visibleCreateNewFileActions = computed(() => {
+ })
+
+ const createFileActionsGroups = computed((): FileAction[][] => {
++  if (configStore.options.volparossaOwnerUploads) return []
+   const result: FileAction[][] = []
+   const externalFileActions = unref(visibleCreateNewFileActions).filter(
+     ({ isExternal }) => isExternal
+diff --git a/packages/web-pkg/src/composables/upload/useUpload.ts b/packages/web-pkg/src/composables/upload/useUpload.ts
+--- a/packages/web-pkg/src/composables/upload/useUpload.ts
++++ b/packages/web-pkg/src/composables/upload/useUpload.ts
+@@ -7,7 +7,7 @@ import {
+   OcUppyMeta,
+   UppyService
+ } from '../../services/uppy/uppyService'
+-import { useAuthStore, useCapabilityStore } from '../piniaStores'
++import { useAuthStore, useCapabilityStore, useConfigStore } from '../piniaStores'
+ import { XHRUploadOptions } from '@uppy/xhr-upload'
+ import { useClientService } from '../clientService'
+ import { useGettext } from 'vue3-gettext'
+@@ -20,6 +20,7 @@ export function useUpload(options: UploadOptions) {
+   const authStore = useAuthStore()
+   const clientService = useClientService()
+   const language = useGettext()
++  const configStore = useConfigStore()
+
+   const isTusSupported = computed(() => capabilityStore.tusMaxChunkSize > 0)
+
+@@ -78,7 +79,8 @@ export function useUpload(options: UploadOptions) {
+
+   const xhrOptions = computed<XHRUploadOptions<OcUppyMeta, OcUppyBody>>(() => {
+     return {
+-      timeout: 60000,
++      timeout: configStore.options.volparossaOwnerUploads ? 1800000 : 60000,
++      ...(configStore.options.volparossaOwnerUploads ? { limit: 1 } : {}),
+       endpoint: '',
+       headers: (file) => ({
+         'x-oc-mtime': ((file?.data as File)?.lastModified / 1000).toFixed(0),
+diff --git a/packages/web-pkg/src/services/uppy/uppyService.ts b/packages/web-pkg/src/services/uppy/uppyService.ts
+--- a/packages/web-pkg/src/services/uppy/uppyService.ts
++++ b/packages/web-pkg/src/services/uppy/uppyService.ts
+@@ -208,13 +208,14 @@ export class UppyService {
+     this.uppy.use(Tus, tusPluginOptions)
+   }
+
+-  useXhr({ headers, timeout, endpoint }: XHRUploadOptions<OcUppyMeta, OcUppyBody>) {
++  useXhr({ headers, timeout, endpoint, limit }: XHRUploadOptions<OcUppyMeta, OcUppyBody>) {
+     const xhrPluginOptions: XHRUploadOptions<OcUppyMeta, OcUppyBody> = {
+       endpoint,
+       method: 'put',
+       headers,
+       formData: false,
+       timeout,
++      ...(limit === undefined ? {} : { limit }),
+       getResponseData() {
+         return {}
+       }
diff --git a/scripts/cloud-serve.mjs b/scripts/cloud-serve.mjs
index 32f9f25..2da4a02 100644
--- a/scripts/cloud-serve.mjs
+++ b/scripts/cloud-serve.mjs
@@ -7,13 +7,14 @@ import { readPrivateJSON } from '../src/private-file.mjs';
 import { openPrivateCatalog } from '../src/private-catalog.mjs';
 import { startPrivateDavServer } from '../src/private-dav-server.mjs';
 import { loadRecoveryWebAssets } from './recovery-web-assets.mjs';
+import { openOwnerUploads } from '../src/owner-uploads.mjs';
 
 export class CloudServeError extends Error {
   constructor(code) { super(code); this.name = 'CloudServeError'; this.code = code; }
 }
 const fail = () => { throw new CloudServeError('INVALID_PRIVATE_READ_CONFIGURATION'); };
 const FIELDS = new Set(['version', 'catalog', 'workDirectory', 'bearerToken', 'port',
-  'allowedOrigins', 'maxOpenBytes', 'maxConcurrent', 'requestTimeoutMs', 'maxRangeBytes', 'webDist']);
+  'allowedOrigins', 'maxOpenBytes', 'maxConcurrent', 'requestTimeoutMs', 'maxRangeBytes', 'webDist', 'ownerUploads']);
 const REQUIRED = ['version', 'catalog', 'workDirectory', 'bearerToken'];
 function integer(value, minimum, maximum) {
   if (!Number.isSafeInteger(value) || value < minimum || value > maximum) fail();
@@ -42,14 +43,22 @@ export function validateConfiguration(value) {
   if (value.webDist !== undefined && (typeof value.webDist !== 'string'
     || !value.webDist.startsWith('/') || /[\x00-\x1f\x7f]/u.test(value.webDist)
     || allowedOrigins.length > 0)) fail();
+  if (value.ownerUploads !== undefined && (!value.ownerUploads || typeof value.ownerUploads !== 'object'
+    || Object.keys(value.ownerUploads).sort().join(',') !== 'directory,space,storageConfig'
+    || !['directory', 'storageConfig'].every(key => typeof value.ownerUploads[key] === 'string'
+      && value.ownerUploads[key].startsWith('/') && !/[\x00-\x1f\x7f]/u.test(value.ownerUploads[key]))
+    || typeof value.ownerUploads.space !== 'string' || !value.ownerUploads.space
+    || ['.', '..'].includes(value.ownerUploads.space) || /[\\/\x00-\x1f\x7f]/u.test(value.ownerUploads.space)
+    || Buffer.byteLength(value.ownerUploads.space) > 1024 || allowedOrigins.length)) fail();
   return Object.freeze({
     version: 1, catalog: value.catalog, workDirectory: value.workDirectory,
     bearerToken: value.bearerToken, allowedOrigins: Object.freeze([...allowedOrigins]),
     ...(value.webDist !== undefined ? { webDist: value.webDist } : {}),
+    ...(value.ownerUploads !== undefined ? { ownerUploads: Object.freeze({ ...value.ownerUploads }) } : {}),
     port: integer(value.port ?? 0, 0, 65535),
     maxOpenBytes: integer(value.maxOpenBytes ?? 256 * 1024 ** 2, 1, 8 * 1024 ** 3),
     maxConcurrent: integer(value.maxConcurrent ?? 2, 1, 16),
-    requestTimeoutMs: integer(value.requestTimeoutMs ?? 120000, 100, 3600000),
+    requestTimeoutMs: integer(value.requestTimeoutMs ?? (value.ownerUploads ? 1800000 : 120000), 100, 3600000),
     maxRangeBytes: integer(value.maxRangeBytes ?? 16 * 1024 ** 2, 1, 16 * 1024 ** 2),
   });
 }
@@ -63,7 +72,7 @@ export function parseArguments(args) {
 }
 
 export async function startCloudService(value, {
-  signal, openCatalog = openPrivateCatalog, startServer = startPrivateDavServer,
+  signal, openCatalog = openPrivateCatalog, startServer = startPrivateDavServer, openUploads = openOwnerUploads,
 } = {}) {
   // The optional factories are module test seams, never executable configuration.
   const config = validateConfiguration(value);
@@ -87,17 +96,19 @@ export async function startCloudService(value, {
     if (cancel.signal.aborted) throw new CloudServeError('CANCELLED');
     backend = await openCatalog({ catalog: config.catalog, workDirectory: config.workDirectory,
       maxOpenBytes: config.maxOpenBytes, maxOpenFiles: config.maxConcurrent }, { signal: cancel.signal });
+    if (config.ownerUploads) backend = await openUploads({ ...config.ownerUploads, workDirectory: config.workDirectory,
+      maxFileBytes: config.maxOpenBytes }, { base: backend, signal: cancel.signal });
     if (cancel.signal.aborted) throw new CloudServeError('CANCELLED');
     server = await startServer({ backend, bearerToken: config.bearerToken, port: config.port,
       allowedOrigins: config.allowedOrigins, maxConcurrent: config.maxConcurrent,
       requestTimeoutMs: config.requestTimeoutMs, maxRangeBytes: config.maxRangeBytes,
       maxFileBytes: config.maxOpenBytes,
       ...(config.webDist ? { recoveryWeb: {
-        assetsFactory: origin => loadRecoveryWebAssets({ distDirectory: config.webDist, origin }),
+        assetsFactory: origin => loadRecoveryWebAssets({ distDirectory: config.webDist, origin, ownerUploads: !!config.ownerUploads }),
       } } : {}),
     });
     if (cancel.signal.aborted) throw new CloudServeError('CANCELLED');
-    return Object.freeze({ origin: server.origin, baseURL: server.baseURL, close });
+    return Object.freeze({ origin: server.origin, baseURL: server.baseURL, readOnly: !config.ownerUploads, close });
   } catch (error) { await close(); throw error; }
 }
 
@@ -115,7 +126,7 @@ if (import.meta.url === pathToFileURL(process.argv[1] ?? '').href) {
   try {
     service = await run(process.argv.slice(2), { signal: cancel.signal });
     console.log(JSON.stringify({ version: 1, kind: 'volparossa-cloud-private-read',
-      state: 'listening', origin: service.origin, readOnly: true, loopbackOnly: true,
+      state: 'listening', origin: service.origin, readOnly: service.readOnly, loopbackOnly: true,
       originalServerFallback: false, openCloudAccountService: false }));
     await new Promise(resolve => {
       if (cancel.signal.aborted) resolve();
diff --git a/scripts/private_file.py b/scripts/private_file.py
index fa17e6f..9a248c0 100644
--- a/scripts/private_file.py
+++ b/scripts/private_file.py
@@ -63,6 +63,15 @@ def pairs(items):
 
 
 def source_metadata(value):
+    if isinstance(value, dict) and value.get('kind') == 'owner-upload':
+        require(set(value) == {'kind', 'space', 'name', 'size', 'sha256', 'lastModified'}
+                and all(isinstance(value[key], str) and 0 < len(value[key].encode()) <= 1024
+                    and value[key] not in ('.', '..') and not re.search(r'[\\/\x00-\x1f\x7f]', value[key])
+                    for key in ('space', 'name'))
+                and type(value['size']) is int and 0 <= value['size'] <= MAX_BYTES
+                and isinstance(value['sha256'], str) and re.fullmatch('[0-9a-f]{64}', value['sha256'])
+                and value['lastModified'] is None, 'UPLOAD_METADATA_INVALID')
+        return value
     require(isinstance(value, dict) and set(value) == {'url', 'size', 'etag', 'lastModified'}, 'SOURCE_METADATA_INVALID')
     require(type(value['size']) is int and 0 <= value['size'] <= MAX_BYTES
             and isinstance(value['url'], str) and 0 < len(value['url']) <= 16384
@@ -73,10 +82,11 @@ def source_metadata(value):
 
 
 def receipt(value):
-    require(isinstance(value, dict) and set(value) == RECEIPT_KEYS and value['version'] == 1
+    require(isinstance(value, dict) and set(value) == RECEIPT_KEYS
+            and (value['version'], value['source_consistency']) in (
+                (1, 'strong-etag-conditional-ranges'), (2, 'owner-upload-snapshot'))
             and value['kind'] == 'volparossa-cloud-private-file' and value['cipher_file'] == 'file.pgp'
             and value['encryption'] == 'OpenPGP-AES256'
-            and value['source_consistency'] == 'strong-etag-conditional-ranges'
             and type(value['cipher_bytes']) is int and 1 <= value['cipher_bytes'] <= MAX_BYTES + 1024**2
             and re.fullmatch('[0-9a-f]{64}', value['cipher_sha256']), 'RECEIPT_INVALID')
     return value
@@ -119,6 +129,8 @@ def create(source, metadata, output):
                             reader = CRYPTO.HashedReader(input_file)
                             archive.addfile(member, reader)
                             require(input_file.read(1) == b'', 'SOURCE_SIZE_CHANGED')
+                            if selected.get('kind') == 'owner-upload':
+                                require(reader.hash.hexdigest() == selected['sha256'], 'UPLOAD_SOURCE_CHANGED')
                             manifest = CRYPTO.canonical(dict(version=1, kind='volparossa-cloud-file-content',
                                 source=selected, content_sha256=reader.hash.hexdigest(), content_bytes=info.st_size))
                             require(len(manifest) <= MAX_METADATA, 'METADATA_LIMIT')
@@ -129,9 +141,10 @@ def create(source, metadata, output):
                 encrypted.flush()
                 os.fsync(encrypted.fileno())
         digest, length = hash_file(cipher, MAX_BYTES + 1024**2)
-        result = receipt(dict(version=1, kind='volparossa-cloud-private-file', cipher_file='file.pgp',
+        upload = selected.get('kind') == 'owner-upload'
+        result = receipt(dict(version=2 if upload else 1, kind='volparossa-cloud-private-file', cipher_file='file.pgp',
             cipher_sha256=digest, cipher_bytes=length, encryption='OpenPGP-AES256',
-            source_consistency='strong-etag-conditional-ranges'))
+            source_consistency='owner-upload-snapshot' if upload else 'strong-etag-conditional-ranges'))
         CRYPTO.private_write(staging / 'receipt.json', CRYPTO.canonical(result) + b'\n')
         publish(staging, target)
         return result
@@ -140,7 +153,7 @@ def create(source, metadata, output):
             shutil.rmtree(staging)
 
 
-def unpack(source, staging):
+def unpack(source, staging, owner_upload):
     with tarfile.open(fileobj=source, mode='r|') as archive:
         member = archive.next()
         require(member is not None and member.name == 'content.bin' and member.isreg()
@@ -168,7 +181,11 @@ def unpack(source, staging):
                 and value['version'] == 1 and value['kind'] == 'volparossa-cloud-file-content'
                 and value['content_bytes'] == expected_bytes
                 and value['content_sha256'] == digest.hexdigest(), 'CONTENT_MANIFEST_MISMATCH')
-        require(source_metadata(value['source'])['size'] == expected_bytes, 'CONTENT_SOURCE_MISMATCH')
+        selected = source_metadata(value['source'])
+        require((selected.get('kind') == 'owner-upload') == owner_upload, 'CONTENT_SOURCE_MISMATCH')
+        require(selected['size'] == expected_bytes, 'CONTENT_SOURCE_MISMATCH')
+        if selected.get('kind') == 'owner-upload':
+            require(selected['sha256'] == digest.hexdigest(), 'UPLOAD_SOURCE_CHANGED')
         require(archive.next() is None, 'UNEXPECTED_ARCHIVE_ENTRY')
         CRYPTO.private_write(staging / 'metadata.json', CRYPTO.canonical(value) + b'\n')
     # Consume the GPG stream completely before awaiting its authenticated terminal status.
@@ -199,7 +216,7 @@ def restore(bundle, cipher_path, output):
             with CRYPTO.private_agent(parent) as home:
                 with CRYPTO.crypt_process(home, key, encrypt=False, output=subprocess.PIPE,
                         timeout_seconds=3600, input_stream=cipher) as process:
-                    length = unpack(process.stdout, staging)
+                    length = unpack(process.stdout, staging, expected['version'] == 2)
         # No plaintext output becomes visible at the requested path before GOODMDC,
         # exact ciphertext identity and the encrypted content manifest all agree.
         publish(staging, target)
diff --git a/scripts/recovery-web-assets.mjs b/scripts/recovery-web-assets.mjs
index e2cf329..d8e24d5 100644
--- a/scripts/recovery-web-assets.mjs
+++ b/scripts/recovery-web-assets.mjs
@@ -12,7 +12,7 @@ const TYPES = { '.html': 'text/html; charset=utf-8', '.js': 'text/javascript; ch
   '.jpg': 'image/jpeg', '.jpeg': 'image/jpeg', '.gif': 'image/gif', '.ico': 'image/x-icon',
   '.woff': 'font/woff', '.woff2': 'font/woff2', '.ttf': 'font/ttf', '.txt': 'text/plain; charset=utf-8' };
 
-export async function loadRecoveryWebAssets({ distDirectory, origin }) {
+export async function loadRecoveryWebAssets({ distDirectory, origin, ownerUploads = false }) {
   const url = new URL(origin);
   require(url.origin === origin && url.protocol === 'http:' && url.hostname === '127.0.0.1'
     && isAbsolute(distDirectory) && await realpath(distDirectory) === distDirectory);
@@ -48,13 +48,14 @@ export async function loadRecoveryWebAssets({ distDirectory, origin }) {
   const json = value => ({ data: Buffer.from(JSON.stringify(value)), contentType: 'application/json' });
   assets.set('/config.json', json({ server: origin, theme: origin + '/recovery-theme.json',
     apps: ['files'], external_apps: [], scripts: [], styles: [], customTranslations: [],
-    options: { volparossaOwnerRecovery: true, tokenStorageLocal: false,
-      disabledExtensions: ['com.github.opencloud-eu.web.files.floating-action-button'],
+    options: { volparossaOwnerRecovery: true, ...(ownerUploads ? { volparossaOwnerUploads: true } : {}), tokenStorageLocal: false,
+      disabledExtensions: ownerUploads ? [] : ['com.github.opencloud-eu.web.files.floating-action-button'],
       disableFeedbackLink: true, disableSponsorLink: true, contextHelpers: false,
-      announcement: { bannerText: 'VOLPAROSSA · Private read-only recovery · Selected files only' },
+      announcement: { bannerText: ownerUploads ? 'VOLPAROSSA · Owner-private uploads · Imported files remain read only'
+        : 'VOLPAROSSA · Private read-only recovery · Selected files only' },
       embed: { enabled: false, delegateAuthentication: false } } }));
   assets.set('/recovery-theme.json', json({ common: { name: 'VOLPAROSSA Private Recovery',
-    slogan: 'Selected private files · Read only', logo: '/img/opencloud-icon.png',
+    slogan: ownerUploads ? 'Owner-private files · No original account writes' : 'Selected private files · Read only', logo: '/img/opencloud-icon.png',
     logoMobile: '/img/opencloud-icon.png', shareRoles: {}, urls: {} }, clients: { web: { defaults: {},
     themes: [{ label: 'Light', isDark: false }, { label: 'Dark', isDark: true }] } } }));
   return assets;
diff --git a/scripts/smoke_owner_upload_ui.py b/scripts/smoke_owner_upload_ui.py
new file mode 100644
index 0000000..e727247
--- /dev/null
+++ b/scripts/smoke_owner_upload_ui.py
@@ -0,0 +1,271 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-3.0-only
+"""Original Files/Uppy upload or reopened download in an explicit disposable guest.
+
+The parent owns the real Cloud service, source shutdown, encrypted storage,
+provider withdrawal and service restart. This driver never replaces that backend.
+Private bearer input stays on stdin; output contains closed observations only.
+"""
+import argparse
+import hashlib
+import json
+import os
+from pathlib import Path
+import re
+import runpy
+import signal
+import socket
+import stat
+import subprocess
+import sys
+import tempfile
+import time
+
+SOURCE = Path('/opt/volparossa-cloud')
+RUNTIME = SOURCE / 'build/firefox-esr'
+SPACE = 'owner-uploads'
+NAME = 'private-upload.bin'
+CONTENT = bytes(range(256)) * (262144 // 256) + b'U'
+CONTENT_SHA = hashlib.sha256(CONTENT).hexdigest()
+STAGES = frozenset(('input', 'browser_start', 'locked_ui', 'wrong_token', 'unlock',
+    'upload_menu', 'file_selection', 'upload_commit', 'reload', 'original_download_1',
+    'original_download_2', 'logout', 'cleanup'))
+
+
+def require(value):
+    if not value:
+        raise ValueError('Owner upload UI boundary failed')
+
+
+def settings(value):
+    require(type(value) is dict and set(value) == {'origin', 'bearerToken', 'expectedBytes', 'expectedSha256'})
+    require(type(value['origin']) is str and re.fullmatch(r'http://127\.0\.0\.1:[1-9][0-9]{0,4}', value['origin']))
+    require(1 <= int(value['origin'].rsplit(':', 1)[1]) <= 65535)
+    require(type(value['bearerToken']) is str and re.fullmatch(r'[A-Za-z0-9_-]{43}', value['bearerToken']))
+    require(type(value['expectedBytes']) is int and value['expectedBytes'] == len(CONTENT))
+    require(value['expectedSha256'] == CONTENT_SHA)
+    return value
+
+
+def read_frame(stream):
+    size = bytearray()
+    while True:
+        byte = stream.recv(1)
+        require(bool(byte))
+        if byte == b':':
+            break
+        require(byte.isdigit() and len(size) < 8)
+        size.extend(byte)
+    require(bool(size))
+    length = int(size)
+    require(0 < length <= 4 * 1024**2)
+    data = bytearray()
+    while len(data) < length:
+        part = stream.recv(length - len(data))
+        require(bool(part))
+        data.extend(part)
+    return json.loads(data)
+
+
+def command(work, original_command):
+    # Reuse the original smoke's owner-isolated Firefox mount plan. The reviewed
+    # guest parent pins this runtime; no executable is fetched or chosen by input.
+    result = original_command(work, '/runtime/firefox-esr')
+    index = result.index('--clearenv')
+    result[index:index] = ['--ro-bind', str(RUNTIME), '/runtime']
+    return result
+
+
+def private_directory(path):
+    info = path.lstat()
+    require(path.is_absolute() and path.resolve() == path and stat.S_ISDIR(info.st_mode)
+        and info.st_uid == os.geteuid() and stat.S_IMODE(info.st_mode) == 0o700)
+
+
+def preferences(port):
+    return {'marionette.port': port, 'marionette.enabled': True,
+        'browser.shell.checkDefaultBrowser': False, 'browser.startup.homepage': 'about:blank',
+        'browser.startup.page': 0, 'browser.aboutwelcome.enabled': False,
+        'datareporting.policy.dataSubmissionEnabled': False, 'toolkit.telemetry.enabled': False,
+        'browser.safebrowsing.downloads.enabled': False, 'browser.safebrowsing.malware.enabled': False,
+        'browser.safebrowsing.phishing.enabled': False, 'app.update.enabled': False,
+        'extensions.update.enabled': False, 'extensions.getAddons.cache.enabled': False,
+        'network.captive-portal-service.enabled': False, 'network.connectivity-service.enabled': False,
+        'network.dns.disablePrefetch': True, 'network.prefetch-next': False, 'network.predictor.enabled': False,
+        'network.proxy.type': 1, 'network.proxy.http': '127.0.0.1', 'network.proxy.http_port': 1,
+        'network.proxy.ssl': '127.0.0.1', 'network.proxy.ssl_port': 1,
+        'network.proxy.no_proxies_on': '127.0.0.1,localhost',
+        'browser.download.folderList': 2, 'browser.download.dir': '/state/downloads',
+        'browser.download.useDownloadDir': True, 'browser.download.alwaysOpenPanel': False,
+        'browser.helperApps.neverAsk.saveToDisk': 'application/octet-stream', 'pdfjs.disabled': True}
+
+
+def run(mode, root, value):
+    require(mode in ('upload', 'download'))
+    require(socket.gethostname() == 'volparossa-alpha' and os.geteuid() != 0)
+    private_directory(root)
+    value = settings(value)
+    base = runpy.run_path(str(SOURCE / 'scripts/smoke_web_ui.py'))
+
+    class Marionette(base['Marionette']):
+        def read(self):
+            return read_frame(self.sock)
+
+        def wait(self, script, seconds=120):
+            deadline = time.monotonic() + seconds
+            while time.monotonic() < deadline:
+                result = self.script(script)
+                if result:
+                    return result
+                time.sleep(.2)
+            # Do not inherit the synthetic-only driver's page/error dump.
+            raise TimeoutError('Owner upload UI condition timeout')
+
+    report = dict(version=1, kind='cloud-owner-upload-original-ui', mode=mode, success=False,
+        stage='input', original_files_ui=True, synthetic_backend=False,
+        original_file_input_used=False, upload_201_observed=False, uploaded_file_listed=False,
+        reload_reauthenticated=False, file_downloads_verified=0, wrong_token_denied=False,
+        logout_relocks=False, token_absent_from_url_and_web_storage=False,
+        browser_stopped_and_joined=False, private_profile_removed=False,
+        browser_version=None, bytes=len(CONTENT), sha256=CONTENT_SHA,
+        peer_storage_proven=False, service_restart_owned_by_parent=True,
+        source_shutdown_owned_by_parent=True, owner_secrets_exported=False)
+    browser = client = work = None
+    try:
+        with tempfile.TemporaryDirectory(prefix='owner-ui-', dir=root) as temporary:
+            work = Path(temporary)
+            for name in ('profile', 'downloads', 'uploads', 'home', 'cache'):
+                (work / name).mkdir(mode=0o700)
+            with socket.socket() as probe:
+                probe.bind(('127.0.0.1', 0))
+                port = probe.getsockname()[1]
+            (work / 'profile/user.js').write_text(''.join('user_pref(' + json.dumps(key) + ', '
+                + json.dumps(val) + ');\n' for key, val in preferences(port).items()))
+            try:
+                report['stage'] = 'browser_start'
+                browser = subprocess.Popen(command(work, base['firefox_command']), stdin=subprocess.DEVNULL,
+                    stdout=subprocess.DEVNULL, stderr=subprocess.DEVNULL, start_new_session=True,
+                    env={'PATH': '/usr/bin:/bin', 'LC_ALL': 'C'})
+                client = Marionette(port)
+                caps = client.session.get('capabilities', {})
+                require(caps.get('browserName') == 'firefox' and caps.get('browserVersion') == '140.16.0')
+                report['browser_version'] = '140.16.0'
+                report['stage'] = 'locked_ui'
+                target = value['origin'] + '/#/files/spaces/project/' + SPACE
+                client.call('WebDriver:Navigate', {'url': target})
+                client.wait("return !!document.getElementById('volparossa-recovery-token')")
+                submit = "document.getElementById('volparossa-recovery-token').value=arguments[0];document.querySelector('#volparossa-owner-recovery form').requestSubmit();"
+                report['stage'] = 'wrong_token'
+                client.script(submit, ['wrong-token-that-is-at-least-32-characters'])
+                client.wait("return document.querySelector('#volparossa-owner-recovery [role=status]')?.textContent.includes('failed')")
+                require(client.script("return !document.querySelector('[data-test-resource-name=\"private-upload.bin\"]')"))
+                report['wrong_token_denied'] = True
+                report['stage'] = 'unlock'
+                client.script(submit, [value['bearerToken']])
+                client.wait("return !document.getElementById('volparossa-owner-recovery') && [...document.querySelectorAll('[id^=app-floating-action-button-]')].some(e=>!e.disabled)")
+                listed = "return !!document.querySelector('[data-test-resource-name=\"private-upload.bin\"]')"
+                if mode == 'upload':
+                    require(not client.script(listed))
+                    report['stage'] = 'upload_menu'
+                    client.click('[id^=app-floating-action-button-]')
+                    client.wait("return !!document.getElementById('files-file-upload-input')")
+                    require(client.script("return !document.getElementById('files-folder-upload-input') && !document.getElementById('new-folder-btn') && !document.getElementById('new-shortcut-btn')"))
+                    # Observe only the real native Uppy XHR's bounded completion
+                    # facts; this observer does not issue or replace any request.
+                    client.script("window.__vpUpload={puts:0,created:0};const open=XMLHttpRequest.prototype.open;XMLHttpRequest.prototype.open=function(method,url,...rest){if(method.toUpperCase()==='PUT'){window.__vpUpload.puts++;this.addEventListener('loadend',()=>{if(this.status===201)window.__vpUpload.created++},{once:true})}return open.call(this,method,url,...rest)};")
+                    with (work / 'uploads' / NAME).open('xb') as output:
+                        os.fchmod(output.fileno(), 0o600)
+                        output.write(CONTENT)
+                    report['stage'] = 'file_selection'
+                    element = client.call('WebDriver:FindElement', {'using': 'css selector', 'value': '#files-file-upload-input'})
+                    element = element.get('value', element)
+                    client.call('WebDriver:ElementSendKeys', {'id': element['element-6066-11e4-a52e-4f735466cecf'],
+                        'text': '/state/uploads/' + NAME})
+                    report['original_file_input_used'] = True
+                    report['stage'] = 'upload_commit'
+                    client.wait("return window.__vpUpload?.created===1", seconds=1800)
+                    require(client.script("return window.__vpUpload.puts===1 && window.__vpUpload.created===1"))
+                    report['upload_201_observed'] = True
+                    client.wait(listed)
+                    report['uploaded_file_listed'] = True
+                    report['stage'] = 'reload'
+                    client.call('WebDriver:Refresh')
+                    client.wait("return !!document.getElementById('volparossa-recovery-token')")
+                    client.script(submit, [value['bearerToken']])
+                    client.wait(listed)
+                    report['reload_reauthenticated'] = True
+                else:
+                    client.wait(listed)
+                    report['uploaded_file_listed'] = True
+                    require(not list((work / 'uploads').iterdir()))
+                    for number in (1, 2):
+                        report['stage'] = f'original_download_{number}'
+                        downloaded = work / 'downloads' / NAME
+                        require(not downloaded.exists())
+                        client.script("document.querySelector('[data-test-resource-name=\"private-upload.bin\"]').closest('a,button').click();")
+                        client.wait("return [...document.querySelectorAll('button')].some(e=>e.textContent.trim()==='Download')")
+                        client.click('.oc-modal-body-actions-confirm')
+                        deadline = time.monotonic() + 900
+                        while time.monotonic() < deadline:
+                            if downloaded.exists() and downloaded.stat().st_size == len(CONTENT):
+                                break
+                            require(browser.poll() is None)
+                            time.sleep(.2)
+                        info = downloaded.lstat()
+                        require(stat.S_ISREG(info.st_mode) and info.st_uid == os.geteuid()
+                            and info.st_nlink == 1 and info.st_size == len(CONTENT))
+                        require(hashlib.sha256(downloaded.read_bytes()).hexdigest() == CONTENT_SHA)
+                        downloaded.unlink()
+                        require(not list((work / 'downloads').iterdir()))
+                        report['file_downloads_verified'] += 1
+                report['stage'] = 'logout'
+                require(client.script("return !location.href.includes(arguments[0]) && !JSON.stringify(localStorage).includes(arguments[0]) && !JSON.stringify(sessionStorage).includes(arguments[0])", [value['bearerToken']]))
+                report['token_absent_from_url_and_web_storage'] = True
+                client.click('#_userMenuButton')
+                client.wait("return !!document.getElementById('volparossa-recovery-close')")
+                client.click('#volparossa-recovery-close')
+                client.wait("return !!document.getElementById('volparossa-recovery-token')")
+                report['logout_relocks'] = True
+                report['success'] = True
+            finally:
+                if client is not None:
+                    try:
+                        client.call('WebDriver:DeleteSession')
+                    except (OSError, RuntimeError, ValueError):
+                        pass
+                    client.sock.close()
+                if browser is not None:
+                    if browser.poll() is None:
+                        os.killpg(browser.pid, signal.SIGTERM)
+                    try:
+                        browser.wait(timeout=15)
+                    except subprocess.TimeoutExpired:
+                        os.killpg(browser.pid, signal.SIGKILL)
+                        browser.wait(timeout=5)
+                    report['browser_stopped_and_joined'] = browser.poll() is not None
+    except (ValueError, TypeError, KeyError, OSError, RuntimeError, subprocess.SubprocessError):
+        report['success'] = False
+    finally:
+        report['private_profile_removed'] = work is not None and not work.exists()
+        report['success'] = report['success'] and report['browser_stopped_and_joined'] and report['private_profile_removed']
+        if report['success']:
+            report['stage'] = 'cleanup'
+    return report
+
+
+if __name__ == '__main__':
+    def interrupted(_signal, _frame):
+        raise ValueError('Owner upload UI interrupted')
+    for signum in (signal.SIGTERM, signal.SIGINT, signal.SIGHUP):
+        signal.signal(signum, interrupted)
+    try:
+        parser = argparse.ArgumentParser(description=__doc__)
+        parser.add_argument('mode', choices=('upload', 'download'))
+        parser.add_argument('private_parent', type=Path)
+        parser.add_argument('--yes', required=True, action='store_true')
+        args = parser.parse_args()
+        result = run(args.mode, args.private_parent, settings(json.loads(sys.stdin.buffer.read(4097))))
+    except (ValueError, TypeError, KeyError, OSError, RuntimeError, subprocess.SubprocessError):
+        result = dict(version=1, kind='cloud-owner-upload-ui-input-failure', success=False, stage='input')
+    print(json.dumps(result, sort_keys=True))
+    raise SystemExit(0 if result['success'] else 1)
diff --git a/scripts/upload_lock.py b/scripts/upload_lock.py
new file mode 100644
index 0000000..bae0a50
--- /dev/null
+++ b/scripts/upload_lock.py
@@ -0,0 +1,25 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-3.0-only
+"""Hold a Linux owner-workspace lock until the supervised parent's pipe closes."""
+import fcntl
+import os
+from pathlib import Path
+import stat
+import sys
+
+try:
+    root = Path(sys.argv[1])
+    info = root.lstat()
+    if root.resolve(strict=True) != root or not stat.S_ISDIR(info.st_mode) or info.st_uid != os.getuid() or stat.S_IMODE(info.st_mode) != 0o700:
+        raise ValueError()
+    fd = os.open(root / 'LOCK', os.O_RDWR | os.O_CREAT | os.O_NOFOLLOW | os.O_NONBLOCK, 0o600)
+    with os.fdopen(fd, 'rb') as held:
+        info = os.fstat(held.fileno())
+        if not stat.S_ISREG(info.st_mode) or info.st_uid != os.getuid() or info.st_nlink != 1 or stat.S_IMODE(info.st_mode) != 0o600:
+            raise ValueError()
+        fcntl.flock(held.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
+        os.write(1, b'LOCKED\n')
+        while os.read(0, 1):
+            pass
+except (OSError, ValueError, IndexError):
+    sys.exit(1)
diff --git a/src/owner-uploads.mjs b/src/owner-uploads.mjs
new file mode 100644
index 0000000..cee4562
--- /dev/null
+++ b/src/owner-uploads.mjs
@@ -0,0 +1,263 @@
+// SPDX-License-Identifier: GPL-3.0-only
+// Explicit owner-only new files; existing recovery catalogs never become writable.
+import { spawn } from 'node:child_process';
+import { createHash, randomBytes } from 'node:crypto';
+import { lstat, mkdir, mkdtemp, open, readdir, realpath, rename, rm } from 'node:fs/promises';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { CoreStorage } from '../vendor/volparossa-image/core-storage.mjs';
+import { readPrivateJSON, sealOwnerUpload } from './private-file.mjs';
+import { openPrivateCatalog, sealPrivateCatalogEntries } from './private-catalog.mjs';
+import { recoveryResourceId, recoverySpaceId } from './private-resource-id.mjs';
+
+export class OwnerUploadError extends Error {
+  constructor(code, status = 503) { super(code); this.code = code; this.status = status; }
+}
+const check = (value, code, status) => { if (!value) throw new OwnerUploadError(code, status); };
+const nameValid = value => typeof value === 'string' && Buffer.byteLength(value) > 0
+  && Buffer.byteLength(value) <= 1024 && !['.', '..'].includes(value) && !/[\\/\x00-\x1f\x7f]/u.test(value);
+const hash = bytes => createHash('sha256').update(bytes).digest('hex');
+const absent = async path => { try { await lstat(path); return false; } catch (error) { if (error.code === 'ENOENT') return true; throw error; } };
+async function privateDirectory(path) {
+  const info = await lstat(path);
+  check(info.isDirectory() && info.uid === process.getuid() && (info.mode & 0o7777) === 0o700
+    && await realpath(path) === path, 'PRIVATE_UPLOAD_DIRECTORY_REQUIRED');
+}
+async function writeNew(path, value) {
+  const fd = await open(path, 'wx', 0o600);
+  try { await fd.writeFile(JSON.stringify(value) + '\n'); await fd.sync(); }
+  finally { await fd.close(); }
+}
+async function syncDirectory(path) { const fd = await open(path, 'r'); try { await fd.sync(); } finally { await fd.close(); } }
+async function publishReady(directory, value) {
+  const ready = join(directory, 'READY.json');
+  const staged = join(directory, `.READY-${randomBytes(16).toString('hex')}.tmp`);
+  // The exclusive owner-workspace lock covers this absent check and rename.
+  // A crash while writing/fsyncing may leave only an ignored private stage,
+  // never a partial final marker that prevents the whole workspace reopening.
+  check(await absent(ready), 'UPLOAD_COMMIT_EXISTS');
+  try {
+    await writeNew(staged, value);
+    await rename(staged, ready);
+    await syncDirectory(directory);
+  } finally { await rm(staged, { force: true }); }
+}
+function lockWorkspace(directory) {
+  return new Promise((resolve, reject) => {
+    const child = spawn('/usr/bin/python3', ['-I', '-B', fileURLToPath(new URL('../scripts/upload_lock.py', import.meta.url)), directory],
+      { shell: false, env: { LANG: 'C.UTF-8', LC_ALL: 'C.UTF-8' }, stdio: ['pipe', 'pipe', 'ignore'] });
+    let ready = false, closed = false, resolveClosed;
+    const ended = new Promise(resolve => { resolveClosed = resolve; });
+    const timer = setTimeout(() => { child.kill('SIGKILL'); reject(new OwnerUploadError('UPLOAD_LOCK_TIMEOUT')); }, 5000);
+    child.stdin.on('error', () => {});
+    child.on('error', () => { clearTimeout(timer); reject(new OwnerUploadError('UPLOAD_LOCK_FAILED')); });
+    child.on('close', code => {
+      closed = true; clearTimeout(timer); resolveClosed(code);
+      if (!ready) reject(new OwnerUploadError('UPLOAD_WORKSPACE_BUSY', 409));
+    });
+    let bytes = '';
+    child.stdout.on('data', part => {
+      bytes += part.toString('ascii');
+      if (bytes === 'LOCKED\n' && !ready) {
+        ready = true; clearTimeout(timer);
+        resolve({ active: () => !closed, close: async () => {
+          child.stdin.end();
+          const deadline = setTimeout(() => child.kill('SIGKILL'), 5000);
+          try { check(await ended === 0, 'UPLOAD_LOCK_CLEANUP_FAILED'); } finally { clearTimeout(deadline); }
+        } });
+      } else if (bytes.length >= 7) { child.kill('SIGKILL'); reject(new OwnerUploadError('UPLOAD_LOCK_FAILED')); }
+    });
+  });
+}
+
+export async function openOwnerUploads({ directory, space, storageConfig, workDirectory,
+  maxFileBytes = 256 * 1024 ** 2 }, { base, signal, storageFactory = path => CoreStorage.open(path) } = {}) {
+  check(nameValid(space) && directory !== workDirectory && Number.isSafeInteger(maxFileBytes) && maxFileBytes > 0 && maxFileBytes <= 8 * 1024 ** 3,
+    'INVALID_UPLOAD_CONFIGURATION');
+  await privateDirectory(directory);
+  await privateDirectory(workDirectory);
+  check(await base.stat([space], { signal }) === null, 'UPLOAD_SPACE_COLLIDES');
+  const template = await readPrivateJSON(storageConfig);
+  check(template?.version === 1 && !Object.hasOwn(template, 'stateDirectory') && !Object.hasOwn(template, 'copies'),
+    'INVALID_UPLOAD_STORAGE_TEMPLATE');
+  const lock = await lockWorkspace(directory);
+  const entries = new Map();
+  let busy = false, closed = false, cleanupFailed = false, controller, closing, openBytes = 0;
+  const pending = new Set();
+  const active = requestSignal => { check(!closed && !cleanupFailed && lock.active(), 'UPLOAD_WORKSPACE_CLOSED'); signal?.throwIfAborted(); requestSignal?.throwIfAborted(); };
+  const published = () => [...entries.values()].filter(entry => entry.ready);
+  const rootStat = () => ({ kind: 'directory', size: 0, lastModified: null,
+    etag: `"vp-upload-${hash(JSON.stringify(published().map(entry => [entry.name, entry.stat.etag]).sort()))}"` });
+  async function loadEntry(id) {
+    const root = join(directory, id);
+    await privateDirectory(root);
+    if (await absent(join(root, 'catalog'))) {
+      check(await absent(join(root, 'READY.json')), 'INVALID_UPLOAD_COMMIT');
+      return; // A pre-publication interrupted owner stage remains retained.
+    }
+    const backend = await openPrivateCatalog({ catalog: join(root, 'catalog'), workDirectory,
+      maxOpenBytes: maxFileBytes }, { signal, storageFactory });
+    try {
+      const listed = await backend.list([space], { signal });
+      check(listed.length === 1 && listed[0].kind === 'file' && nameValid(listed[0].name)
+        && !entries.has(listed[0].name), 'INVALID_UPLOAD_CATALOG');
+      const entry = { id, root, backend, name: listed[0].name, stat: listed[0], ready: false };
+      const receipt = await readPrivateJSON(join(root, 'catalog/receipt.json'));
+      entry.catalogHash = receipt.cipher_sha256;
+      if (!await absent(join(root, 'READY.json'))) {
+        const ready = await readPrivateJSON(join(root, 'READY.json'));
+        check(Object.keys(ready).sort().join(',') === 'catalogSha256,version' && ready.version === 1
+          && ready.catalogSha256 === entry.catalogHash, 'INVALID_UPLOAD_COMMIT');
+        entry.ready = true;
+      }
+      entries.set(entry.name, entry);
+      return entry;
+    } catch (error) { await backend.close(); throw error; }
+  }
+  try {
+    const names = await readdir(directory);
+    check(names.length <= 257 && names.every(name => name === 'LOCK' || /^object-[0-9a-f]{32}$/u.test(name)), 'UPLOAD_WORKSPACE_BOUND');
+    for (const name of names.filter(name => name !== 'LOCK').sort()) await loadEntry(name);
+  } catch (error) { await Promise.allSettled([...entries.values()].map(entry => entry.backend.close())); await lock.close(); throw error; }
+
+  async function upload(parts, body, { signal: requestSignal, length } = {}) {
+    active(requestSignal);
+    check(parts.length === 2 && parts[0] === space && nameValid(parts[1]), 'UPLOAD_TARGET_NOT_AUTHORIZED', 403);
+    check(!entries.get(parts[1])?.ready, 'UPLOAD_ALREADY_EXISTS', 412);
+    check(!busy, 'UPLOAD_BUSY', 409);
+    check(length === undefined || Number.isSafeInteger(length) && length >= 0 && length <= maxFileBytes, 'UPLOAD_TOO_LARGE', 413);
+    busy = true;
+    controller = new AbortController();
+    const cancel = () => controller.abort();
+    requestSignal?.addEventListener('abort', cancel, { once: true });
+    signal?.addEventListener('abort', cancel, { once: true });
+    let stage;
+    try {
+      stage = await mkdtemp(join(workDirectory, 'upload-body-'));
+      const plain = join(stage, 'body');
+      let size = 0;
+      const digest = createHash('sha256');
+      const plainFile = await open(plain, 'wx', 0o600);
+      try {
+        for await (const data of body) {
+          active(requestSignal); controller.signal.throwIfAborted();
+          size += data.length;
+          check(size <= maxFileBytes, 'UPLOAD_TOO_LARGE', 413);
+          digest.update(data); await plainFile.writeFile(data);
+        }
+        check(length === undefined || length === size, 'UPLOAD_LENGTH_MISMATCH', 400);
+        await plainFile.sync();
+      } finally { await plainFile.close(); }
+      const sha256 = digest.digest('hex');
+      let entry = entries.get(parts[1]);
+      if (entry) {
+        check(entry.stat.size === size && entry.stat.etag === `"vp-${sha256}"`, 'PENDING_UPLOAD_DIFFERS', 409);
+      } else {
+        check((await readdir(directory)).filter(name => name !== 'LOCK').length < 256, 'UPLOAD_WORKSPACE_BOUND', 507);
+        const id = `object-${randomBytes(16).toString('hex')}`;
+        const root = join(directory, id);
+        await mkdir(root, { mode: 0o700 }); await syncDirectory(directory);
+        const bundle = join(root, 'bundle');
+        const config = join(root, 'core.json');
+        const receipt = await sealOwnerUpload({ source: plain, space, name: parts[1], size, sha256, output: bundle }, { signal: controller.signal });
+        // The read budget covers ciphertext, including its encrypted metadata.
+        check(receipt.cipher_bytes <= maxFileBytes, 'UPLOAD_TOO_LARGE', 413);
+        await writeNew(config, { ...template, stateDirectory: join(root, 'journal') });
+        await sealPrivateCatalogEntries([{ segments: parts, bundle, config, size, sha256,
+          cipherSha256: receipt.cipher_sha256, cipherBytes: receipt.cipher_bytes, lastModified: null }],
+        join(root, 'catalog'), { signal: controller.signal });
+        await syncDirectory(root);
+        entry = await loadEntry(id);
+      }
+      active(requestSignal); controller.signal.throwIfAborted();
+      const core = await storageFactory(join(entry.root, 'core.json'));
+      const receipt = await readPrivateJSON(join(entry.root, 'bundle/receipt.json'));
+      const input = join(entry.root, 'bundle/file.pgp');
+      const planned = await absent(join(entry.root, 'journal'))
+        ? await core.create({ input, sha256: receipt.cipher_sha256, alreadyEncrypted: true }, { signal: controller.signal })
+        : await core.status({ signal: controller.signal });
+      if (planned.local_process_joined !== true) cleanupFailed = true;
+      check(planned.status === 'complete' && planned.local_process_joined === true, 'UPLOAD_PLAN_INCOMPLETE');
+      const deposited = await core.deposit({ input, alreadyEncrypted: true }, { signal: controller.signal });
+      if (deposited.local_process_joined !== true) cleanupFailed = true;
+      check(deposited.status === 'complete' && deposited.local_process_joined === true
+        && deposited.storage?.fully_redundant_from_retained_receipts === true, 'UPLOAD_STORAGE_INCOMPLETE');
+      active(requestSignal); controller.signal.throwIfAborted();
+      await publishReady(entry.root, { version: 1, catalogSha256: entry.catalogHash });
+      entry.ready = true;
+      return entry.stat;
+    } finally {
+      try { if (stage) await rm(stage, { recursive: true }); }
+      catch (error) { cleanupFailed = true; throw error; }
+      finally {
+        requestSignal?.removeEventListener('abort', cancel);
+        signal?.removeEventListener('abort', cancel);
+        busy = false; controller = null;
+      }
+    }
+  }
+  const backend = {
+    ownerUploadSpace: space,
+    async canUpload(parts) { active(); return parts.length === 1 && parts[0] === space; },
+    async stat(parts, options) {
+      active(options?.signal);
+      if (parts.length === 0) return { ...(await base.stat([], options)), etag: rootStat().etag };
+      if (parts[0] !== space) return base.stat(parts, options);
+      return parts.length === 1 ? rootStat() : parts.length === 2 && entries.get(parts[1])?.ready ? entries.get(parts[1]).stat : null;
+    },
+    async list(parts, options) {
+      active(options?.signal);
+      if (!parts.length) return [...await base.list([], options), { name: space, ...rootStat() }];
+      if (parts[0] !== space) return base.list(parts, options);
+      check(parts.length === 1, 'UPLOAD_NOT_DIRECTORY', 404);
+      return published().map(entry => entry.stat).sort((a, b) => a.name.localeCompare(b.name));
+    },
+    async resolveResourceId(id, options) {
+      active(options?.signal);
+      if ([recoverySpaceId(space), recoveryResourceId([space])].includes(id)) return [space];
+      for (const entry of published()) if (id === recoveryResourceId([space, entry.name])) return [space, entry.name];
+      return base.resolveResourceId(id, options);
+    },
+    async open(parts, options) {
+      active(options?.signal);
+      const selected = parts[0] !== space ? base : entries.get(parts[1])?.ready && parts.length === 2
+        ? entries.get(parts[1]).backend : null;
+      check(selected, 'UPLOAD_NOT_FOUND', 404);
+      const entry = await selected.stat(parts, options);
+      check(entry?.kind === 'file', 'UPLOAD_NOT_FOUND', 404);
+      const charge = await selected.materializationBytes(parts, options);
+      check(Number.isSafeInteger(charge) && charge > 0 && openBytes + charge <= maxFileBytes, 'UPLOAD_READ_CAPACITY');
+      openBytes += charge;
+      let opened;
+      try { opened = await selected.open(parts, options); }
+      catch (error) { openBytes -= charge; throw error; }
+      let disposing;
+      return Object.freeze({ ...opened, dispose() {
+        if (!disposing) disposing = (async () => {
+          try { await opened.dispose(); }
+          finally { openBytes -= charge; }
+        })();
+        return disposing;
+      } });
+    },
+    put(parts, body, options) {
+      const operation = upload(parts, body, options);
+      pending.add(operation);
+      operation.finally(() => pending.delete(operation)).catch(() => {});
+      return operation;
+    },
+    close() {
+      if (!closing) {
+        closed = true; controller?.abort();
+        closing = (async () => {
+          await Promise.allSettled([...pending]);
+          const results = await Promise.allSettled([base.close(), ...[...entries.values()].map(entry => entry.backend.close())]);
+          await lock.close();
+          check(!cleanupFailed && results.every(result => result.status === 'fulfilled'), 'UPLOAD_CLEANUP_FAILED');
+        })();
+      }
+      return closing;
+    },
+  };
+  return Object.freeze(backend);
+}
diff --git a/src/private-catalog.mjs b/src/private-catalog.mjs
index 55943e1..41edc6b 100644
--- a/src/private-catalog.mjs
+++ b/src/private-catalog.mjs
@@ -83,9 +83,11 @@ async function fileReceipt(bundle) {
   await directory(bundle);
   const value = await readPrivateJSON(join(bundle, 'receipt.json'), 4096);
   check(object(value, ['version', 'kind', 'cipher_file', 'cipher_sha256', 'cipher_bytes', 'encryption', 'source_consistency'])
-    && value.version === 1 && value.kind === 'volparossa-cloud-private-file' && value.cipher_file === 'file.pgp'
+    && ((value.version === 1 && value.source_consistency === 'strong-etag-conditional-ranges')
+      || (value.version === 2 && value.source_consistency === 'owner-upload-snapshot'))
+    && value.kind === 'volparossa-cloud-private-file' && value.cipher_file === 'file.pgp'
     && HASH.test(value.cipher_sha256) && integer(value.cipher_bytes, 1, MAX_CIPHER)
-    && value.encryption === 'OpenPGP-AES256' && value.source_consistency === 'strong-etag-conditional-ranges',
+    && value.encryption === 'OpenPGP-AES256',
   'INVALID_FILE_RECEIPT');
   return value;
 }
@@ -180,12 +182,20 @@ async function materialize(selection, workDirectory, expected, { signal, storage
       && metadata.version === 1 && metadata.kind === 'volparossa-cloud-file-content'
       && metadata.content_bytes === result.bytes && HASH.test(metadata.content_sha256), 'INVALID_SOURCE_METADATA');
     const source = metadata.source;
-    check(object(source, ['url', 'etag', 'size', 'lastModified']) && source.size === result.bytes,
-      'INVALID_SOURCE_METADATA');
-    const sourceURL = new URL(source.url);
-    check(!sourceURL.username && !sourceURL.password && !sourceURL.search && !sourceURL.hash
-      && sourceURL.pathname.startsWith('/dav/spaces/'), 'INVALID_SOURCE_METADATA');
-    const sourceSegments = sourceURL.pathname.slice('/dav/spaces/'.length).split('/').map(decodeURIComponent);
+    let sourceSegments;
+    if (receipt.version === 2) {
+      check(object(source, ['kind', 'space', 'name', 'size', 'sha256', 'lastModified'])
+        && source.kind === 'owner-upload' && source.size === result.bytes
+        && source.sha256 === metadata.content_sha256 && source.lastModified === null, 'INVALID_SOURCE_METADATA');
+      sourceSegments = [source.space, source.name];
+    } else {
+      check(object(source, ['url', 'etag', 'size', 'lastModified']) && source.size === result.bytes,
+        'INVALID_SOURCE_METADATA');
+      const sourceURL = new URL(source.url);
+      check(!sourceURL.username && !sourceURL.password && !sourceURL.search && !sourceURL.hash
+        && sourceURL.pathname.startsWith('/dav/spaces/'), 'INVALID_SOURCE_METADATA');
+      sourceSegments = sourceURL.pathname.slice('/dav/spaces/'.length).split('/').map(decodeURIComponent);
+    }
     check(pathKey(segments(sourceSegments, true)) === pathKey(selection.segments), 'SOURCE_SELECTION_MISMATCH');
     const entry = { ...selection, size: result.bytes, sha256: metadata.content_sha256,
       cipherSha256: receipt.cipher_sha256, cipherBytes: receipt.cipher_bytes, lastModified: modified(source.lastModified) };
@@ -247,6 +257,14 @@ function validateIndex(value) {
     return Object.freeze({ ...entry, segments: segments(entry.segments, true) });
   });
 }
+
+/** Trusted owner-upload code supplies entries; this grants no source-account rights. */
+export async function sealPrivateCatalogEntries(entries, output, { signal } = {}) {
+  const value = { version: 1, kind: 'volparossa-cloud-private-catalog-index', entries };
+  validateIndex(value);
+  await fresh(output);
+  return crypto('seal', ['--output', output], Buffer.from(JSON.stringify(value)), signal);
+}
 function indexTree(entries) {
   const nodes = new Map([[pathKey([]), { kind: 'directory', children: new Map() }]]);
   for (const entry of entries) {
@@ -308,6 +326,11 @@ export async function openPrivateCatalog({ catalog, workDirectory, maxOpenBytes
       return key === undefined ? null : Object.freeze(JSON.parse(key));
     },
     async stat(parts, { signal } = {}) { return lookup(parts, signal)?.stat ?? null; },
+    async materializationBytes(parts, { signal } = {}) {
+      const node = lookup(parts, signal);
+      check(node?.kind === 'file', 'NOT_A_FILE');
+      return node.entry.cipherBytes;
+    },
     async list(parts, { signal } = {}) {
       const node = lookup(parts, signal);
       check(node?.kind === 'directory', node ? 'NOT_A_DIRECTORY' : 'NOT_FOUND');
diff --git a/src/private-dav-server.mjs b/src/private-dav-server.mjs
index 9f5d725..4c1c02f 100644
--- a/src/private-dav-server.mjs
+++ b/src/private-dav-server.mjs
@@ -1,5 +1,6 @@
 // SPDX-License-Identifier: GPL-3.0-only
-// Explicit owner-local, read-only transport. The backend owns catalog authority
+// Explicit owner-local transport, read-only unless a separate owner upload space
+// is configured. The backend owns catalog authority
 // and verified restoration; this module never discovers peers or falls back to an origin.
 // Protocol references: RFC 4918 sections 9.1/13; RFC 9110 sections 13.2/14.
 import http from 'node:http';
@@ -9,6 +10,7 @@ import { lstat, open, realpath } from 'node:fs/promises';
 import { isAbsolute, normalize } from 'node:path';
 import { pipeline } from 'node:stream/promises';
 import { RecoveryMetadataError, recoveryMetadata } from './recovery-web-metadata.mjs';
+import { OwnerUploadError } from './owner-uploads.mjs';
 import { isRecoveryResourceId, isRecoverySpaceId, recoveryResourceId, recoverySpaceId } from './private-resource-id.mjs';
 export { recoveryResourceId } from './private-resource-id.mjs';
 
@@ -108,7 +110,7 @@ function properties(body) {
   check(select.children.length === 0);
   return { mode: select.name, names: allProperties() };
 }
-function responseXML(segments, entry, requested) {
+function responseXML(segments, entry, requested, upload = false) {
   const href = PREFIX + segments.map(encodeURIComponent).join('/') + (entry.kind === 'directory' && segments.length ? '/' : '');
   const values = { displayname: xml(segments.at(-1) ?? ''),
     resourcetype: entry.kind === 'directory' ? '<d:collection/>' : '',
@@ -120,7 +122,7 @@ function responseXML(segments, entry, requested) {
     name: xml(segments.at(-1) ?? ''),
     // OpenCloud's R flag means shareable, not readable. An empty set retains
     // ordinary reading without offering upload, rename, delete or sharing.
-    permissions: '' };
+    permissions: upload ? 'C' : '' };
   const good = [], missing = [];
   for (const [ns, name] of requested.names) {
     const source = ns === 'DAV:' ? values : ns === OC ? owncloud : {};
@@ -201,6 +203,7 @@ export async function startPrivateDavServer({ backend, bearerToken, port = 0, al
     && integer(port, 0, 65535) && integer(maxConcurrent, 1, 32)
     && integer(requestTimeoutMs, 10, 3600000) && integer(maxRangeBytes, 1, 64 * 1024 ** 2)
     && integer(maxFileBytes, 1, 8 * 1024 ** 3) && Array.isArray(allowedOrigins) && allowedOrigins.length <= 16
+    && (typeof backend.put !== 'function' || allowedOrigins.length === 0)
     && (recoveryWeb === null || recoveryWeb && typeof recoveryWeb.assetsFactory === 'function'));
   const origins = new Set(allowedOrigins.map(value => {
     const url = new URL(value);
@@ -208,6 +211,7 @@ export async function startPrivateDavServer({ backend, bearerToken, port = 0, al
     return value;
   }));
   const secret = Buffer.from(`Bearer ${bearerToken}`);
+  const allow = typeof backend.put === 'function' ? ALLOW + ', PUT' : ALLOW;
   const tasks = new Set(), controllers = new Set();
   let origin, closing = false, cleanupFailure, ready = false, assets;
   const fail = (res, status) => {
@@ -262,13 +266,13 @@ export async function startPrivateDavServer({ backend, bearerToken, port = 0, al
           const names = (req.headers['access-control-request-headers'] ?? '').toLowerCase().split(',').map(v => v.trim()).filter(Boolean);
           check(names.every(v => ['authorization', 'content-type', 'depth', 'range', 'if-match', 'if-none-match'].includes(v)), 403);
           check(!req.headers['transfer-encoding'] && !Number(req.headers['content-length'] ?? 0));
-          res.writeHead(204, { 'Access-Control-Allow-Methods': ALLOW,
+          res.writeHead(204, { 'Access-Control-Allow-Methods': allow,
             'Access-Control-Allow-Headers': names.join(', '), 'Cache-Control': 'no-store' });
           res.end(); return;
         }
         const token = Buffer.from(req.headers.authorization ?? '');
         check(token.length === secret.length && timingSafeEqual(token, secret), 401);
-        check((webMetadata ? ['GET'] : ['OPTIONS', 'PROPFIND', 'HEAD', 'GET']).includes(req.method), 405);
+        check((webMetadata ? ['GET'] : allow.split(', ')).includes(req.method), 405);
         // Conditional forms outside this narrow read-only contract cannot
         // silently authorize a different version or force full materialization.
         check(req.headers['if-range'] === undefined && req.headers.if === undefined);
@@ -276,7 +280,7 @@ export async function startPrivateDavServer({ backend, bearerToken, port = 0, al
         timer = setTimeout(() => { controller.abort(); fail(res, 504); }, requestTimeoutMs);
         req.once('aborted', () => controller.abort());
         res.once('close', () => { if (!res.writableFinished) controller.abort(); });
-        const body = await requestBody(req, req.method, controller.signal);
+        const body = req.method === 'PUT' ? null : await requestBody(req, req.method, controller.signal);
         controller.signal.throwIfAborted();
         res.setHeader('Cache-Control', 'private, no-store');
         res.setHeader('X-Content-Type-Options', 'nosniff');
@@ -288,12 +292,12 @@ export async function startPrivateDavServer({ backend, bearerToken, port = 0, al
           res.writeHead(200, { 'Content-Type': 'application/json', 'Content-Length': data.length });
           res.end(data); return;
         }
-        if (req.method === 'OPTIONS') { res.writeHead(204, { Allow: ALLOW, DAV: '1' }); res.end(); return; }
+        if (req.method === 'OPTIONS') { res.writeHead(204, { Allow: allow, DAV: '1' }); res.end(); return; }
         const requested = req.method === 'PROPFIND' ? properties(body) : null;
         if (requested) check(['0', '1'].includes(req.headers.depth), 403);
         // The original Files UI navigates by resource ID. Resolve only IDs in
         // this unlocked catalog, after authentication; never ask the origin.
-        if ((segments.length === 1 && isRecoveryResourceId(segments[0])
+        if (((segments.length === 1 || req.method === 'PUT' && segments.length === 2) && isRecoveryResourceId(segments[0])
           || isRecoverySpaceId(segments[0]))
           && typeof backend.resolveResourceId === 'function') {
           const resolved = await backend.resolveResourceId(segments[0], { signal: controller.signal });
@@ -307,7 +311,7 @@ export async function startPrivateDavServer({ backend, bearerToken, port = 0, al
             check(segments.length <= 32);
           } else {
             check(recoveryResourceId(resolved) === segments[0], 503);
-            segments = resolved;
+            segments = req.method === 'PUT' ? [...resolved, ...segments.slice(1)] : resolved;
           }
         }
         const raw = await backend.stat(segments, { signal: controller.signal });
@@ -315,6 +319,19 @@ export async function startPrivateDavServer({ backend, bearerToken, port = 0, al
         const entry = raw === null ? null : metadata(raw, maxFileBytes);
         if (entry) res.setHeader('ETag', entry.etag);
         conditions(req.headers, entry, req.method);
+        if (req.method === 'PUT') {
+          check(!entry, 412); // Explicitly new files only, even if the UI requested overwrite.
+          check(segments.length === 2 && await backend.canUpload?.(segments.slice(0, -1)), 403);
+          const encodedLength = req.headers['content-length'];
+          check(encodedLength === undefined || /^(0|[1-9][0-9]*)$/u.test(encodedLength));
+          const length = encodedLength === undefined ? undefined : Number(encodedLength);
+          check(length === undefined || integer(length, 0, maxFileBytes), 413);
+          check(req.headers['transfer-encoding'] === undefined || req.headers['transfer-encoding'] === 'chunked');
+          const stored = metadata(await backend.put(segments, req, { signal: controller.signal, length }), maxFileBytes);
+          controller.signal.throwIfAborted();
+          res.writeHead(201, { ETag: stored.etag, 'Oc-Fileid': recoveryResourceId(segments), 'Content-Length': '0' });
+          res.end(); return;
+        }
         check(entry, 404);
         if (requested) {
           check(req.headers.range === undefined);
@@ -330,8 +347,10 @@ export async function startPrivateDavServer({ backend, bearerToken, port = 0, al
               entries.push([[...segments, name], metadata(child, maxFileBytes)]);
             }
           }
+          const responses = await Promise.all(entries.map(async ([path, value]) =>
+            responseXML(path, value, requested, await backend.canUpload?.(path) === true)));
           const data = Buffer.from('<?xml version="1.0" encoding="utf-8"?><d:multistatus xmlns:d="DAV:">'
-            + entries.map(([path, value]) => responseXML(path, value, requested)).join('') + '</d:multistatus>');
+            + responses.join('') + '</d:multistatus>');
           check(data.length <= 1024 ** 2, 503);
           res.writeHead(207, { 'Content-Type': 'application/xml; charset=utf-8', 'Content-Length': data.length });
           res.end(data); return;
@@ -367,7 +386,7 @@ export async function startPrivateDavServer({ backend, bearerToken, port = 0, al
         if (length === 0) res.end();
         else await pipeline(file.createReadStream({ autoClose: false, ...selected }), res, { signal: controller.signal });
       } catch (error) {
-        fail(res, error instanceof Rejected || error instanceof RecoveryMetadataError
+        fail(res, error instanceof Rejected || error instanceof RecoveryMetadataError || error instanceof OwnerUploadError
           ? error.status : controller.signal.aborted ? 504 : 503);
       } finally {
         clearTimeout(timer);
diff --git a/src/private-file.mjs b/src/private-file.mjs
index f40d2c8..6b7859e 100644
--- a/src/private-file.mjs
+++ b/src/private-file.mjs
@@ -66,10 +66,12 @@ async function writePrivate(value, data) {
 function receipt(value) {
   check(value && typeof value === 'object' && !Array.isArray(value)
     && Object.keys(value).length === RECEIPT_KEYS.length && RECEIPT_KEYS.every(key => Object.hasOwn(value, key))
-    && value.version === 1 && value.kind === 'volparossa-cloud-private-file' && value.cipher_file === 'file.pgp'
+    && ((value.version === 1 && value.source_consistency === 'strong-etag-conditional-ranges')
+      || (value.version === 2 && value.source_consistency === 'owner-upload-snapshot'))
+    && value.kind === 'volparossa-cloud-private-file' && value.cipher_file === 'file.pgp'
     && HASH.test(value.cipher_sha256) && Number.isSafeInteger(value.cipher_bytes)
     && value.cipher_bytes > 0 && value.cipher_bytes <= MAX_BYTES + 1024 ** 2
-    && value.encryption === 'OpenPGP-AES256' && value.source_consistency === 'strong-etag-conditional-ranges',
+    && value.encryption === 'OpenPGP-AES256',
   'INVALID_RECEIPT');
   return Object.freeze(value);
 }
@@ -177,6 +179,20 @@ export async function restorePrivateFile({ bundle, cipher, output }, { signal }
   return Object.freeze(result);
 }
 
+/** A newly received owner file, not a fabricated DAV import or upstream permission. */
+export async function sealOwnerUpload({ source, space, name, size, sha256, output }, { signal } = {}) {
+  await fresh(output);
+  const stage = await mkdtemp(join(dirname(output), 'upload-metadata-'));
+  try {
+    const metadata = join(stage, 'metadata.json');
+    await writePrivate(metadata, JSON.stringify({ kind: 'owner-upload', space, name, size, sha256, lastModified: null }));
+    const result = receipt(await helper(['encrypt', '--source', source, '--metadata', metadata, '--output', output], signal));
+    check(result.version === 2, 'INVALID_UPLOAD_RECEIPT');
+    await verifiedCipher(join(output, 'file.pgp'), result);
+    return result;
+  } finally { await rm(stage, { recursive: true }); }
+}
+
 export async function storePrivateFile(operation, { config, bundle }, {
   signal, storageFactory = path => CoreStorage.open(path),
 } = {}) {
diff --git a/src/recovery-web-metadata.mjs b/src/recovery-web-metadata.mjs
index 0a9fe6c..8359a79 100644
--- a/src/recovery-web-metadata.mjs
+++ b/src/recovery-web-metadata.mjs
@@ -46,7 +46,8 @@ export async function recoveryMetadata(target, { origin, backend, resourceId, si
   signal.throwIfAborted();
   if (url.pathname === '/volparossa/recovery/session') {
     query(url);
-    return { version: 1, authority: 'owner-local-catalog', readOnly: true, upstreamAccount: false, owner: OWNER };
+    return { version: 1, authority: 'owner-local-catalog', readOnly: !backend.ownerUploadSpace,
+      ...(backend.ownerUploadSpace ? { ownerUploads: true } : {}), upstreamAccount: false, owner: OWNER };
   }
   if (url.pathname === '/ocs/v1.php/cloud/capabilities') {
     query(url, { format: ['json'] });
@@ -58,11 +59,15 @@ export async function recoveryMetadata(target, { origin, backend, resourceId, si
     // the drive collection. This local read-only authority grants no roles.
     return [];
   }
+  const actions = name => name === backend.ownerUploadSpace ? ['libre.graph/driveItem/upload/create'] : [];
   const drive = entry => ({ id: recoverySpaceId(entry.name), name: entry.name, driveType: 'project',
-    driveAlias: `project/${entry.name}`, description: 'Owner-selected private recovery; read only',
+    driveAlias: `project/${entry.name}`, description: entry.name === backend.ownerUploadSpace
+      ? 'Owner-private new files; no upstream account writes' : 'Owner-selected private recovery; read only',
     // A personal drive would cause the original client to offer upload solely
     // from owner identity. Projects retain its normal permission checks.
     owner: { user: OWNER }, root: { id: resourceId([entry.name]), permissions: [] },
+    // No invented remaining network quota: the core authorizes actual capacity.
+    ...(entry.name === backend.ownerUploadSpace ? { quota: {} } : {}),
     webUrl: `${origin}/dav/spaces/${encodeURIComponent(entry.name)}/`,
   });
   if (url.pathname === '/graph/v1beta1/me/drives') {
@@ -94,7 +99,9 @@ export async function recoveryMetadata(target, { origin, backend, resourceId, si
     const entry = await backend.stat(parts, { signal });
     signal.throwIfAborted();
     check(entry?.kind === 'directory', 404);
-    return match[2] ? { value: [], '@libre.graph.permissions.actions.allowedValues': [],
+    // Original Files reads allowedActions here. Do not invent a collaborator,
+    // sharing role, original account permission or upstream owner identity.
+    return match[2] ? { value: [], '@libre.graph.permissions.actions.allowedValues': actions(parts[0]),
       '@libre.graph.permissions.roles.allowedValues': [], '@odata.count': 0 } : drive({ name: parts[0] });
   }
   throw new RecoveryMetadataError(404);
diff --git a/test/cloud-serve.test.mjs b/test/cloud-serve.test.mjs
index 19206c7..6de9b6c 100644
--- a/test/cloud-serve.test.mjs
+++ b/test/cloud-serve.test.mjs
@@ -40,6 +40,40 @@ test('original web UI is explicitly selected and cannot add cross-origin access'
   }
 });
 
+test('separate owner upload enrollment is explicit and cannot grant cross-origin or upstream writes', () => {
+  const ownerUploads = { directory: '/private/uploads', space: 'My uploads', storageConfig: '/private/core-template.json' };
+  assert.equal(Object.hasOwn(validateConfiguration(CONFIG), 'ownerUploads'), false);
+  const configured = validateConfiguration({ ...CONFIG, ownerUploads });
+  assert.deepEqual(configured.ownerUploads, ownerUploads);
+  assert.equal(configured.requestTimeoutMs, 1800000);
+  for (const changed of [{ ...ownerUploads, overwrite: true }, { ...ownerUploads, space: '../Imported' },
+    { ...ownerUploads, directory: 'relative' }, { ...ownerUploads, copies: 1 }]) {
+    assert.throws(() => validateConfiguration({ ...CONFIG, ownerUploads: changed }));
+  }
+  assert.throws(() => validateConfiguration({ ...CONFIG, ownerUploads, allowedOrigins: ['https://ui.example.test'] }));
+});
+
+test('owner upload backend wraps but does not replace the original catalog authority', async () => {
+  const ownerUploads = { directory: '/private/uploads', space: 'My uploads', storageConfig: '/private/core-template.json' };
+  const base = { async close() {} }, wrapped = { async close() {} };
+  const service = await startCloudService({ ...CONFIG, ownerUploads }, {
+    openCatalog: async () => base,
+    openUploads: async (options, context) => {
+      assert.equal(context.base, base);
+      assert.equal(options.storageConfig, ownerUploads.storageConfig);
+      assert.equal(Object.hasOwn(options, 'bearerToken'), false);
+      return wrapped;
+    },
+    startServer: async options => {
+      assert.equal(options.backend, wrapped);
+      assert.equal(options.requestTimeoutMs, 1800000);
+      return { origin: 'http://127.0.0.1:12345', async close() {} };
+    },
+  });
+  assert.equal(service.readOnly, false);
+  await service.close();
+});
+
 test('explicit web selection reaches only the reviewed asset loader factory', async () => {
   const service = await startCloudService({ ...CONFIG, webDist: '/private/web-dist' }, {
     openCatalog: async () => ({ close: async () => {} }),
diff --git a/test/owner-uploads.test.mjs b/test/owner-uploads.test.mjs
new file mode 100644
index 0000000..f432ba0
--- /dev/null
+++ b/test/owner-uploads.test.mjs
@@ -0,0 +1,291 @@
+// SPDX-License-Identifier: GPL-3.0-only
+// Real HTTP, GPG, encrypted catalogs and restart. ONLY the core storage boundary
+// is a synthetic contract fixture: this is not native Uppy or overlay peer proof.
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import fs, { chmod, lstat, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises';
+import { syncBuiltinESMExports } from 'node:module';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import test from 'node:test';
+import { openOwnerUploads } from '../src/owner-uploads.mjs';
+import { startPrivateDavServer } from '../src/private-dav-server.mjs';
+import { recoverySpaceId, recoveryResourceId } from '../src/private-resource-id.mjs';
+import { restorePrivateFile } from '../src/private-file.mjs';
+import { checkedSDK } from './fixtures/checked-sdk.mjs';
+
+const ROOT = fileURLToPath(new URL('..', import.meta.url));
+const TOKEN = 'synthetic-owner-upload-token-1234567890';
+const SPACE = 'Owner uploads';
+const BODY = Buffer.from('Synthetic private file; not a real owner document.\n');
+const hash = value => createHash('sha256').update(value).digest('hex');
+const directory = { kind: 'directory', size: 0, lastModified: null, etag: '"original-catalog"' };
+function base() {
+  return {
+    async stat(parts) { return parts.length === 0 || parts.length === 1 && parts[0] === 'Imported' ? directory : null; },
+    async list(parts) { return parts.length ? [] : [{ name: 'Imported', ...directory }]; },
+    async resolveResourceId() { return null; },
+    async open() { throw Error('The synthetic read-only base has no file content'); },
+    async close() {},
+  };
+}
+async function fixture(t) {
+  await mkdir(join(ROOT, 'build'), { recursive: true, mode: 0o700 });
+  const root = await mkdtemp(join(ROOT, 'build', 'upload-test-'));
+  await chmod(root, 0o700);
+  const workDirectory = join(root, 'work'), directory = join(root, 'uploads');
+  for (const path of [workDirectory, directory]) await mkdir(path, { mode: 0o700 });
+  const storageConfig = join(root, 'core-template.json');
+  await writeFile(storageConfig, JSON.stringify({ version: 1, providers: [1, 2, 3].map(n => ({
+    key: String(n).repeat(64), grant: join(root, `synthetic-grant-${n}`),
+  })) }), { mode: 0o600 });
+  const remote = new Map(), calls = [];
+  let backend, server, failure = false, hold;
+  const storageFactory = async path => {
+    const config = JSON.parse(await readFile(path));
+    assert.equal(config.providers.length, 3);
+    assert.equal(Object.hasOwn(config, 'copies'), false);
+    return {
+      async create(request) {
+        calls.push(['create', path]);
+        assert.equal(request.alreadyEncrypted, true);
+        const cipher = await readFile(request.input);
+        assert.equal(hash(cipher), request.sha256);
+        assert.equal(cipher.includes(BODY), false);
+        await mkdir(config.stateDirectory, { mode: 0o700 });
+        return { status: 'complete', local_process_joined: true };
+      },
+      async status() { calls.push(['status', path]); return { status: 'complete', local_process_joined: true }; },
+      async deposit(request, { signal }) {
+        calls.push(['deposit', path]);
+        assert.equal(request.alreadyEncrypted, true);
+        if (hold) await hold(signal);
+        if (failure) return { status: 'incomplete', local_process_joined: true };
+        remote.set(path, await readFile(request.input));
+        return { status: 'complete', local_process_joined: true,
+          storage: { fully_redundant_from_retained_receipts: true } };
+      },
+      async restore(request) {
+        calls.push(['restore', path]);
+        assert.equal(hash(remote.get(path)), request.sha256);
+        await writeFile(request.output, remote.get(path), { mode: 0o600, flag: 'wx' });
+        return { status: 'complete', restore_verified: true, local_process_joined: true };
+      },
+    };
+  };
+  const config = { directory, space: SPACE, storageConfig, workDirectory, maxFileBytes: 1024 ** 2 };
+  async function start() {
+    backend = await openOwnerUploads(config, { base: base(), storageFactory });
+    server = await startPrivateDavServer({ backend, bearerToken: TOKEN, recoveryWeb: {
+      assetsFactory: async () => new Map([['/', { data: Buffer.from('Synthetic public asset'), contentType: 'text/plain' }]]),
+    } });
+  }
+  async function stop() {
+    try { await server?.close(); } finally { await backend?.close(); }
+    server = undefined; backend = undefined;
+  }
+  t.after(async () => { await stop(); await rm(root, { recursive: true }); });
+  const request = (path, method = 'GET', body, headers = {}) => fetch(server.origin + path, {
+    method, headers: { Authorization: `Bearer ${TOKEN}`, ...headers }, ...(body !== undefined ? { body } : {}),
+  });
+  const filePath = name => `/dav/spaces/${recoverySpaceId(SPACE)}/${encodeURIComponent(name)}`;
+  return { root, directory, workDirectory, config, remote, calls, start, stop, request, filePath, storageFactory,
+    get backend() { return backend; }, get origin() { return server.origin; },
+    set failure(value) { failure = value; }, set hold(value) { hold = value; } };
+}
+
+test('owner upload -> encrypted core CONTRACT storage -> committed catalog -> restart -> verified download',
+  { timeout: 90000 }, async t => {
+    const f = await fixture(t);
+    await f.start();
+    const filename = 'Private α notes.txt';
+    assert.equal((await f.request(f.filePath(filename), 'PUT', BODY, { Authorization: 'Bearer invalid' })).status, 401);
+    assert.equal((await f.request('/dav/spaces/Imported/no.txt', 'PUT', BODY)).status, 403);
+    assert.equal(f.calls.length, 0);
+    const response = await f.request(f.filePath(filename), 'PUT', BODY, { 'If-None-Match': '*' });
+    assert.equal(response.status, 201);
+    assert.equal(response.headers.get('etag'), `"vp-${hash(BODY)}"`);
+    assert.equal(response.headers.get('oc-fileid'), recoveryResourceId([SPACE, filename]));
+    assert.equal((await f.request(f.filePath(filename), 'PUT', BODY)).status, 412);
+    assert.deepEqual(f.calls.map(([operation]) => operation), ['create', 'deposit']);
+    const session = await (await f.request('/volparossa/recovery/session')).json();
+    assert.equal(session.readOnly, false);
+    assert.equal(session.ownerUploads, true);
+    assert.equal(session.upstreamAccount, false);
+    const drives = await (await f.request('/graph/v1beta1/me/drives')).json();
+    const uploaded = drives.value.find(drive => drive.name === SPACE);
+    assert.deepEqual(uploaded.quota, {});
+    assert.deepEqual(uploaded.root.permissions, []);
+    const permissions = await (await f.request(`/graph/v1beta1/drives/${uploaded.id}/root/permissions`)).json();
+    assert.deepEqual(permissions.value, []);
+    assert.deepEqual(permissions['@libre.graph.permissions.actions.allowedValues'], ['libre.graph/driveItem/upload/create']);
+    assert.deepEqual(drives.value.find(drive => drive.name === 'Imported').root.permissions, []);
+    const listing = await (await f.request(`/dav/spaces/${recoverySpaceId(SPACE)}/`, 'PROPFIND', '', { Depth: '1' })).text();
+    assert.ok(listing.includes('Private α notes.txt'));
+    assert.ok(listing.includes('<p:permissions xmlns:p="http://owncloud.org/ns">C</p:permissions>'));
+    const ids = (await readdir(f.directory)).filter(name => name !== 'LOCK');
+    assert.equal(ids.length, 1);
+    const object = join(f.directory, ids[0]);
+    const receipt = JSON.parse(await readFile(join(object, 'bundle/receipt.json')));
+    assert.equal(receipt.version, 2);
+    assert.equal(receipt.source_consistency, 'owner-upload-snapshot');
+    for (const path of ['catalog/catalog.pgp', 'catalog/receipt.json', 'bundle/file.pgp', 'bundle/receipt.json', 'READY.json']) {
+      const data = await readFile(join(object, path));
+      assert.equal(data.includes(Buffer.from(filename)), false);
+      assert.equal(data.includes(BODY), false);
+      assert.equal(data.includes(Buffer.from(TOKEN)), false);
+      assert.equal((await lstat(join(object, path))).mode & 0o777, 0o600);
+    }
+    await assert.rejects(openOwnerUploads(f.config, { base: base(), storageFactory: f.storageFactory }), { code: 'UPLOAD_WORKSPACE_BUSY' });
+    await f.stop();
+    await rm(join(object, 'bundle/file.pgp')); // Every read must use the core, not a local ciphertext fallback.
+    await f.start();
+    for (let i = 0; i < 2; i++) {
+      const download = await f.request(f.filePath(filename));
+      assert.equal(download.status, 200);
+      assert.deepEqual(Buffer.from(await download.arrayBuffer()), BODY);
+    }
+    assert.deepEqual(f.calls.map(([operation]) => operation), ['create', 'deposit', 'restore', 'restore']);
+    assert.equal(f.remote.size, 1); // Reads are non-consuming.
+    await f.stop();
+    assert.deepEqual(await readdir(f.workDirectory), []);
+  });
+
+test('incomplete deposit stays invisible; explicit identical retry resumes same retained operation after restart',
+  { timeout: 90000 }, async t => {
+    const f = await fixture(t);
+    await f.start(); f.failure = true;
+    assert.equal((await f.request(f.filePath('pending.txt'), 'PUT', BODY)).status, 503);
+    assert.equal((await f.request(f.filePath('pending.txt'))).status, 404);
+    assert.deepEqual(await f.backend.list([SPACE]), []);
+    assert.equal(f.remote.size, 0);
+    const ids = await readdir(f.directory);
+    await f.stop(); await f.start();
+    assert.equal((await f.request(f.filePath('pending.txt'), 'PUT', 'Different data')).status, 409);
+    f.failure = false;
+    assert.equal((await f.request(f.filePath('pending.txt'), 'PUT', BODY)).status, 201);
+    assert.deepEqual(await readdir(f.directory), ids);
+    assert.deepEqual(f.calls.map(([op]) => op), ['create', 'deposit', 'status', 'deposit']);
+    assert.equal(new Set(f.calls.map(([, config]) => config)).size, 1);
+    assert.deepEqual(Buffer.from(await (await f.request(f.filePath('pending.txt'))).arrayBuffer()), BODY);
+  });
+
+test('interrupted READY staging preserves healthy files and the pending operation can resume after restart',
+  { timeout: 90000 }, async t => {
+    const f = await fixture(t);
+    await f.start();
+    assert.equal((await f.request(f.filePath('healthy.txt'), 'PUT', BODY)).status, 201);
+    const healthy = (await readdir(f.directory)).find(name => name.startsWith('object-'));
+    const originalReady = await readFile(join(f.directory, healthy, 'READY.json'));
+    // Inject a real partial write failure at the actual publication operation,
+    // not at the core contract. Before the fix this leaves corrupt READY.json;
+    // the same failure now touches only an unpublished temporary marker.
+    const originalOpen = fs.open;
+    let interrupted = 0;
+    fs.open = async (path, ...args) => {
+      const handle = await originalOpen(path, ...args);
+      if (typeof path === 'string' && /\/(?:READY\.json|\.READY-[0-9a-f]{32}\.tmp)$/u.test(path)
+        && args[0] === 'wx') {
+        interrupted++;
+        const originalWrite = handle.writeFile.bind(handle);
+        handle.writeFile = async () => {
+          await originalWrite('{"version":');
+          throw Object.assign(new Error('synthetic marker write interrupted'), { code: 'ENOSPC' });
+        };
+      }
+      return handle;
+    };
+    syncBuiltinESMExports();
+    try { assert.equal((await f.request(f.filePath('pending.txt'), 'PUT', BODY)).status, 503); }
+    finally { fs.open = originalOpen; syncBuiltinESMExports(); }
+    assert.equal(interrupted, 1);
+    const ids = (await readdir(f.directory)).filter(name => name.startsWith('object-')).sort();
+    const pending = ids.find(name => name !== healthy);
+    const pendingRoot = join(f.directory, pending);
+    // Retained state from interruption before the atomic final-marker rename:
+    // even an empty/partial private stage must not be interpreted as READY.
+    const partial = join(pendingRoot, `.READY-${'a'.repeat(32)}.tmp`);
+    await writeFile(partial, '{"version":', { flag: 'wx', mode: 0o600 });
+    await assert.rejects(lstat(join(pendingRoot, 'READY.json')), { code: 'ENOENT' });
+    await f.stop(); await f.start();
+    assert.deepEqual(Buffer.from(await (await f.request(f.filePath('healthy.txt'))).arrayBuffer()), BODY);
+    assert.equal((await f.request(f.filePath('pending.txt'))).status, 404);
+    assert.deepEqual((await f.backend.list([SPACE])).map(entry => entry.name), ['healthy.txt']);
+    assert.deepEqual(await readFile(join(f.directory, healthy, 'READY.json')), originalReady);
+    const before = f.calls.length;
+    assert.equal((await f.request(f.filePath('pending.txt'), 'PUT', BODY)).status, 201);
+    assert.deepEqual(f.calls.slice(before).map(([operation]) => operation), ['status', 'deposit']);
+    assert.deepEqual((await readdir(f.directory)).filter(name => name.startsWith('object-')).sort(), ids);
+    const ready = JSON.parse(await readFile(join(pendingRoot, 'READY.json')));
+    assert.equal(ready.version, 1);
+    assert.equal(ready.catalogSha256, JSON.parse(await readFile(join(pendingRoot, 'catalog/receipt.json'))).cipher_sha256);
+    assert.equal((await lstat(join(pendingRoot, 'READY.json'))).nlink, 1);
+    await f.stop(); await f.start();
+    assert.deepEqual(Buffer.from(await (await f.request(f.filePath('pending.txt'))).arrayBuffer()), BODY);
+    assert.deepEqual(Buffer.from(await (await f.request(f.filePath('healthy.txt'))).arrayBuffer()), BODY);
+  });
+
+test('owner-upload receipt cannot be relabeled as an upstream-authorized DAV import',
+  { timeout: 90000 }, async t => {
+    const f = await fixture(t);
+    await f.start();
+    assert.equal((await f.request(f.filePath('private.txt'), 'PUT', BODY)).status, 201);
+    const id = (await readdir(f.directory)).find(name => name.startsWith('object-'));
+    const bundle = join(f.directory, id, 'bundle');
+    const receipt = JSON.parse(await readFile(join(bundle, 'receipt.json')));
+    await writeFile(join(bundle, 'receipt.json'), JSON.stringify({ ...receipt,
+      version: 1, source_consistency: 'strong-etag-conditional-ranges' }), { mode: 0o600 });
+    await assert.rejects(restorePrivateFile({ bundle, cipher: join(bundle, 'file.pgp'), output: join(f.root, 'forged-restore') }), { code: 'CRYPTO_FAILED' });
+    await assert.rejects(lstat(join(f.root, 'forged-restore')), { code: 'ENOENT' });
+  });
+
+test('cancellation joins pending core request, retains its journal, removes staging and never commits catalog',
+  { timeout: 90000 }, async t => {
+    const f = await fixture(t);
+    await f.start();
+    let entered;
+    const started = new Promise(resolve => { entered = resolve; });
+    let joined = false;
+    f.hold = signal => new Promise((_resolve, reject) => {
+      entered();
+      signal.addEventListener('abort', () => { joined = true; reject(new Error('synthetic cancelled core')); }, { once: true });
+    });
+    const controller = new AbortController();
+    const operation = f.backend.put([SPACE, 'cancelled.txt'], [BODY], { signal: controller.signal });
+    const failed = assert.rejects(operation, /synthetic cancelled core/u);
+    await started;
+    controller.abort();
+    await failed;
+    assert.equal(joined, true);
+    assert.deepEqual(await f.backend.list([SPACE]), []);
+    assert.deepEqual(await readdir(f.workDirectory), []);
+    const id = (await readdir(f.directory)).find(name => name.startsWith('object-'));
+    assert.equal((await lstat(join(f.directory, id, 'journal'))).isDirectory(), true);
+    await assert.rejects(lstat(join(f.directory, id, 'READY.json')), { code: 'ENOENT' });
+    await f.stop();
+  });
+
+test('actual pinned OpenCloud SDK uploads and resolves returned file ID, then reads through encrypted storage CONTRACT', {
+  skip: !process.env.VOLPAROSSA_CLOUD_WEB_SDK && 'explicit pinned SDK staging required; no downloads', timeout: 90000,
+}, async t => {
+  const { webdav } = await checkedSDK(process.env.VOLPAROSSA_CLOUD_WEB_SDK);
+  const f = await fixture(t);
+  await f.start();
+  const client = webdav(f.origin, () => ({ Authorization: `Bearer ${TOKEN}` }));
+  const space = { id: recoverySpaceId(SPACE), webDavPath: `spaces/${recoverySpaceId(SPACE)}`, driveType: 'project' };
+  const name = 'SDK α upload.txt';
+  const created = await client.putFileContents(space, {
+    fileName: name, parentFolderId: recoveryResourceId([SPACE]), content: BODY.toString(),
+  });
+  assert.equal(created.name, name);
+  assert.equal(created.id, recoveryResourceId([SPACE, name]));
+  assert.equal(created.etag, `"vp-${hash(BODY)}"`);
+  const files = await client.listFiles(space);
+  assert.equal(files.children.length, 1);
+  assert.equal(files.children[0].name, name);
+  const read = await client.getFileContents(space, { fileId: created.id }, { responseType: 'arraybuffer' });
+  assert.deepEqual(Buffer.from(read.body), BODY);
+  await assert.rejects(client.putFileContents(space, { path: name, content: 'replacement', overwrite: true }),
+    error => error.statusCode === 412);
+  assert.deepEqual(f.calls.map(([op]) => op), ['create', 'deposit', 'restore']);
+});
diff --git a/test/recovery-web-assets.test.mjs b/test/recovery-web-assets.test.mjs
index 2270620..e9ac64a 100644
--- a/test/recovery-web-assets.test.mjs
+++ b/test/recovery-web-assets.test.mjs
@@ -38,6 +38,9 @@ test('only verified assets and public recovery configuration enter map', async (
     const config = JSON.parse(assets.get('/config.json').data);
     assert.deepEqual(config.apps, ['files']);
     assert.equal(config.options.volparossaOwnerRecovery, true);
+    assert.equal(Object.hasOwn(config.options, 'volparossaOwnerUploads'), false);
+    assert.deepEqual(config.options.disabledExtensions,
+      ['com.github.opencloud-eu.web.files.floating-action-button']);
     assert.equal(config.options.tokenStorageLocal, false);
     assert.equal(JSON.stringify(config).includes('bearer'), false);
     assert.deepEqual(config.external_apps, []);
@@ -45,6 +48,26 @@ test('only verified assets and public recovery configuration enter map', async (
   } finally { await f.close(); }
 });
 
+test('explicit upload mode remains Files-only, owner-scoped and distinct from read-only imported files', async () => {
+  const f = await fixture();
+  try {
+    const assets = await loadRecoveryWebAssets({ distDirectory: f.directory, origin: 'http://127.0.0.1:45678', ownerUploads: true });
+    const config = JSON.parse(assets.get('/config.json').data);
+    assert.equal(config.options.volparossaOwnerRecovery, true);
+    assert.equal(config.options.volparossaOwnerUploads, true);
+    // The pinned Files application exposes CreateOrUploadMenu through this FAB.
+    // Enabling it is not upload authority: each space still checks canUpload.
+    assert.deepEqual(config.options.disabledExtensions, []);
+    assert.deepEqual(config.apps, ['files']);
+    assert.match(config.options.announcement.bannerText, /Imported files remain read only/u);
+    assert.equal(JSON.stringify(config).includes('bearer'), false);
+    const patch = await readFile(new URL('../patches/opencloud-web-owner-recovery.patch', import.meta.url), 'utf8');
+    assert.match(patch, /limit: 1/u);
+    assert.match(patch, /v-if="!configStore.options.volparossaOwnerUploads"/u);
+    assert.match(patch, /session.readOnly !== \(config.options.volparossaOwnerUploads !== true\)/u);
+  } finally { await f.close(); }
+});
+
 test('changed assets and mismatched build evidence are refused', async () => {
   const f = await fixture();
   try {
diff --git a/test/test_owner_upload_ui.py b/test/test_owner_upload_ui.py
new file mode 100644
index 0000000..4ff1123
--- /dev/null
+++ b/test/test_owner_upload_ui.py
@@ -0,0 +1,117 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-3.0-only
+"""Driver boundary checks only: no browser, model, peer or native-upload proof."""
+import hashlib
+import json
+import os
+from pathlib import Path
+import runpy
+import socket
+import tempfile
+import unittest
+from unittest import mock
+
+ROOT = Path(__file__).resolve().parents[1]
+UI = runpy.run_path(str(ROOT / 'scripts/smoke_owner_upload_ui.py'))
+BASE = runpy.run_path(str(ROOT / 'scripts/smoke_web_ui.py'))
+
+
+def settings():
+    return dict(origin='http://127.0.0.1:35431', bearerToken='a' * 43,
+        expectedBytes=262145,
+        expectedSha256='9012cf78cb493db125d4a0f4f761ae8cb021c5ed16b5085bf32cd4252be575f6')
+
+
+class OwnerUploadUIBoundary(unittest.TestCase):
+    def test_exact_independently_derived_fixture_and_loopback_input(self):
+        body = bytes(range(256)) * 1024 + b'U'
+        self.assertEqual(UI['CONTENT'], body)
+        self.assertEqual(UI['CONTENT_SHA'], hashlib.sha256(body).hexdigest())
+        self.assertEqual(UI['settings'](settings()), settings())
+        for change in (dict(origin='https://example.com'), dict(origin='http://127.0.0.1:99999'),
+                       dict(origin='http://localhost:35431'), dict(bearerToken='a' * 42),
+                       dict(expectedBytes=True), dict(expectedBytes=786433),
+                       dict(expectedSha256='1' * 64), dict(executable='/private/forbidden')):
+            with self.subTest(fields=tuple(change)), self.assertRaises(ValueError):
+                UI['settings'](dict(settings(), **change))
+
+    def test_frame_bounds_and_eof_do_not_turn_into_hanging_browser_wait(self):
+        for wire, expected in ((b'2:{}', {}), (b'6:[1,2', None), (b'99999999:', None),
+                               (b':', None), (b'x:', None), (b'2:', None)):
+            left, right = socket.socketpair()
+            with self.subTest(wire=wire), left, right:
+                right.sendall(wire)
+                right.shutdown(socket.SHUT_WR)
+                if expected is None:
+                    with self.assertRaises(ValueError):
+                        UI['read_frame'](left)
+                else:
+                    self.assertEqual(UI['read_frame'](left), expected)
+
+    def test_only_fresh_profile_and_pinned_runtime_are_mounted(self):
+        work = Path('/private-owner/new-ui-profile')
+        argv = UI['command'](work, BASE['firefox_command'])
+        mounts = [argv[n + 1:n + 3] for n, value in enumerate(argv) if value == '--bind']
+        self.assertEqual(mounts, [[str(work), '/state']])
+        self.assertIn('--clearenv', argv)
+        self.assertIn('/opt/volparossa-cloud/build/firefox-esr', argv)
+        self.assertIn('/runtime/firefox-esr', argv)
+        for forbidden in ('/private-owner', '/opt/volparossa-cloud', '/run/volparossa/control.sock'):
+            self.assertNotIn(forbidden, argv)
+        prefs = UI['preferences'](12345)
+        self.assertFalse(prefs['toolkit.telemetry.enabled'])
+        self.assertEqual(prefs['network.proxy.http_port'], 1)
+        self.assertEqual(prefs['browser.download.dir'], '/state/downloads')
+
+    def test_guest_guard_runs_before_any_browser_or_temporary_work(self):
+        with mock.patch.object(UI['socket'], 'gethostname', return_value='not-a-disposable-guest'), \
+             mock.patch.object(UI['subprocess'], 'Popen') as launch, \
+             mock.patch.object(UI['tempfile'], 'TemporaryDirectory') as directory:
+            with self.assertRaises(ValueError):
+                UI['run']('upload', Path('/no-work'), settings())
+            launch.assert_not_called()
+            directory.assert_not_called()
+
+    def test_browser_start_failure_is_closed_and_cleanup_is_retained(self):
+        class FailedMarionette:
+            def __init__(self, _port):
+                raise RuntimeError('PRIVATE_SENTINEL_NOT_EXPORTED')
+
+        browser = mock.Mock()
+        browser.poll.return_value = 1
+        base = dict(Marionette=FailedMarionette, firefox_command=BASE['firefox_command'])
+        # This is deliberately a failed synthetic protocol seam, not a successful
+        # browser run. It exercises the real exception/finally and closed report.
+        with tempfile.TemporaryDirectory() as temporary, \
+             mock.patch.object(UI['socket'], 'gethostname', return_value='volparossa-alpha'), \
+             mock.patch.object(UI['os'], 'geteuid', return_value=os.getuid() or 12345), \
+             mock.patch.dict(UI['run'].__globals__, {'private_directory': lambda _path: None}), \
+             mock.patch.object(UI['runpy'], 'run_path', return_value=base), \
+             mock.patch.object(UI['subprocess'], 'Popen', return_value=browser):
+            report = UI['run']('upload', Path(temporary), settings())
+            self.assertEqual(list(Path(temporary).iterdir()), [])
+        self.assertFalse(report['success'])
+        self.assertEqual(report['stage'], 'browser_start')
+        self.assertTrue(report['browser_stopped_and_joined'])
+        self.assertTrue(report['private_profile_removed'])
+        self.assertFalse(report['peer_storage_proven'])
+        self.assertFalse(report['upload_201_observed'])
+        self.assertEqual(report['file_downloads_verified'], 0)
+        self.assertNotIn('PRIVATE_SENTINEL', json.dumps(report))
+        self.assertNotIn(settings()['bearerToken'], json.dumps(report))
+        browser.wait.assert_called_once_with(timeout=15)
+
+    def test_native_file_input_and_download_are_not_replaced_by_fixture_requests(self):
+        source = (ROOT / 'scripts/smoke_owner_upload_ui.py').read_text()
+        for required in ('WebDriver:ElementSendKeys', '#files-file-upload-input',
+                         "'.oc-modal-body-actions-confirm'", 'WebDriver:Refresh',
+                         "peer_storage_proven=False", "source_shutdown_owned_by_parent=True",
+                         'sys.stdin.buffer.read(4097)'):
+            self.assertIn(required, source)
+        for forbidden in ('web-ui-fixture.mjs', 'synthetic_page_debug', 'synthetic_ui_errors',
+                          'browser.log', 'fetch(', '.send('):
+            self.assertNotIn(forbidden, source)
+
+
+if __name__ == '__main__':
+    unittest.main()

From 3e3d6587012ed46d200218e4447506300f8a4f18 Mon Sep 17 00:00:00 2001
From: Erik Le Blansch <58982453+erikleblansch@users.noreply.github.com>
Date: Sat, 3 Oct 2026 00:48:59 +0200
Subject: [PATCH 2/7] fix: canonicalize reviewed OpenCloud web patch

---
 .gitattributes                             |   3 +
 patches/opencloud-web-owner-recovery.patch | 253 +++++++++++----------
 test/test_web_ui_patch.py                  | 125 ++++++++++
 3 files changed, 256 insertions(+), 125 deletions(-)
 create mode 100644 .gitattributes
 create mode 100644 test/test_web_ui_patch.py

diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..cd8b04d
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,3 @@
+# Canonical unified diffs retain a space prefix on empty context lines; the
+# builder compares this patch byte-for-byte with git diff --binary HEAD.
+patches/opencloud-web-owner-recovery.patch whitespace=-blank-at-eol
diff --git a/patches/opencloud-web-owner-recovery.patch b/patches/opencloud-web-owner-recovery.patch
index 34b23ee..46d2e1a 100644
--- a/patches/opencloud-web-owner-recovery.patch
+++ b/patches/opencloud-web-owner-recovery.patch
@@ -1,3 +1,66 @@
+diff --git a/packages/web-app-files/src/components/CreateOrUploadMenu.vue b/packages/web-app-files/src/components/CreateOrUploadMenu.vue
+index ddd56a3..85b5a80 100644
+--- a/packages/web-app-files/src/components/CreateOrUploadMenu.vue
++++ b/packages/web-app-files/src/components/CreateOrUploadMenu.vue
+@@ -9,6 +9,7 @@
+     padding-size="small"
+   >
+     <oc-list
++      v-if="!configStore.options.volparossaOwnerUploads"
+       id="create-list"
+       :class="areFileExtensionsShown ? 'sm:min-w-xs' : null"
+       class="py-2 sm:first:pt-0 sm:last:pb-0"
+@@ -33,7 +34,7 @@
+       <li>
+         <resource-upload btn-class="w-full" :btn-label="$gettext('Files Upload')" />
+       </li>
+-      <li>
++      <li v-if="!configStore.options.volparossaOwnerUploads">
+         <resource-upload
+           btn-class="w-full"
+           :btn-label="$gettext('Folder Upload')"
+@@ -96,7 +97,7 @@
+         </oc-button>
+       </li>
+     </oc-list>
+-    <oc-list class="py-2 sm:first:pt-0 sm:last:pb-0 border-t">
++    <oc-list v-if="!configStore.options.volparossaOwnerUploads" class="py-2 sm:first:pt-0 sm:last:pb-0 border-t">
+       <li>
+         <oc-button
+           id="new-shortcut-btn"
+@@ -115,7 +116,7 @@
+ </template>
+ 
+ <script setup lang="ts">
+-import { FileAction, useResourcesStore, useUserStore, useSpacesStore } from '@opencloud-eu/web-pkg'
++import { FileAction, useResourcesStore, useUserStore, useSpacesStore, useConfigStore } from '@opencloud-eu/web-pkg'
+ 
+ import { computed, unref, useId } from 'vue'
+ import { Resource } from '@opencloud-eu/web-client'
+@@ -136,6 +137,7 @@ const { toggle } = defineProps<{
+ }>()
+ 
+ const userStore = useUserStore()
++const configStore = useConfigStore()
+ const language = useGettext()
+ const { $gettext } = language
+ 
+@@ -161,6 +163,7 @@ const { actions: createNewFileActions } = useFileActionsCreateNewFile({ space: c
+ 
+ const { getExtensionActions } = useFileActions()
+ const extensionActions = computed(() => {
++  if (configStore.options.volparossaOwnerUploads) return []
+   return getExtensionActions(uploadMenuExtensionPoint.id)
+ })
+ 
+@@ -171,6 +174,7 @@ const visibleCreateNewFileActions = computed(() => {
+ })
+ 
+ const createFileActionsGroups = computed((): FileAction[][] => {
++  if (configStore.options.volparossaOwnerUploads) return []
+   const result: FileAction[][] = []
+   const externalFileActions = unref(visibleCreateNewFileActions).filter(
+     ({ isExternal }) => isExternal
 diff --git a/packages/web-pkg/src/composables/download/useDownloadFile.ts b/packages/web-pkg/src/composables/download/useDownloadFile.ts
 index abfb288..e605f4c 100644
 --- a/packages/web-pkg/src/composables/download/useDownloadFile.ts
@@ -10,19 +73,19 @@ index abfb288..e605f4c 100644
 +import { useConfigStore, useExtensionRegistry, useMessages, useUserStore } from '../piniaStores'
  import { Resource, SpaceResource } from '@opencloud-eu/web-client'
  import { useGetMatchingSpace } from '../spaces'
-
+ 
 @@ -17,6 +17,7 @@ export const useDownloadFile = (options?: DownloadFileOptions) => {
    const { $gettext } = useGettext()
    const userStore = useUserStore()
    const extensionRegistry = useExtensionRegistry()
 +  const configStore = useConfigStore()
-
+ 
    const downloadFile = async (
      space: SpaceResource = null,
 @@ -28,6 +29,19 @@ export const useDownloadFile = (options?: DownloadFileOptions) => {
          space = getMatchingSpace(file)
        }
-
+ 
 +      if (configStore.options.volparossaOwnerRecovery === true) {
 +        if (version || file.isFolder) throw new Error('Recovery supports selected current files only')
 +        const response = await clientService.webdav.getFileContents(
@@ -54,12 +117,12 @@ index abfb288..e605f4c 100644
      }
    }
 diff --git a/packages/web-pkg/src/composables/piniaStores/config/types.ts b/packages/web-pkg/src/composables/piniaStores/config/types.ts
-index 23c6c51..37be332 100644
+index 23c6c51..34d97f0 100644
 --- a/packages/web-pkg/src/composables/piniaStores/config/types.ts
 +++ b/packages/web-pkg/src/composables/piniaStores/config/types.ts
 @@ -26,6 +26,9 @@ const ScriptConfigSchema = z.object({
  export type ScriptConfig = z.infer<typeof ScriptConfigSchema>
-
+ 
  const OptionsConfigSchema = z.object({
 +  // Explicit owner-local recovery mode; never an upstream OIDC/account identity.
 +  volparossaOwnerRecovery: z.boolean().optional(),
@@ -67,8 +130,59 @@ index 23c6c51..37be332 100644
    announcement: z
      .object({
        bannerText: z.string().optional(),
+diff --git a/packages/web-pkg/src/composables/upload/useUpload.ts b/packages/web-pkg/src/composables/upload/useUpload.ts
+index b467888..8c22ec5 100644
+--- a/packages/web-pkg/src/composables/upload/useUpload.ts
++++ b/packages/web-pkg/src/composables/upload/useUpload.ts
+@@ -7,7 +7,7 @@ import {
+   OcUppyMeta,
+   UppyService
+ } from '../../services/uppy/uppyService'
+-import { useAuthStore, useCapabilityStore } from '../piniaStores'
++import { useAuthStore, useCapabilityStore, useConfigStore } from '../piniaStores'
+ import { XHRUploadOptions } from '@uppy/xhr-upload'
+ import { useClientService } from '../clientService'
+ import { useGettext } from 'vue3-gettext'
+@@ -21,6 +21,7 @@ export function useUpload(options: UploadOptions) {
+   const authStore = useAuthStore()
+   const clientService = useClientService()
+   const language = useGettext()
++  const configStore = useConfigStore()
+ 
+   const isTusSupported = computed(() => capabilityStore.tusMaxChunkSize > 0)
+ 
+@@ -78,7 +79,8 @@ export function useUpload(options: UploadOptions) {
+ 
+   const xhrOptions = computed<XHRUploadOptions<OcUppyMeta, OcUppyBody>>(() => {
+     return {
+-      timeout: 60000,
++      timeout: configStore.options.volparossaOwnerUploads ? 1800000 : 60000,
++      ...(configStore.options.volparossaOwnerUploads ? { limit: 1 } : {}),
+       endpoint: '',
+       headers: (file) => ({
+         'x-oc-mtime': ((file?.data as File)?.lastModified / 1000).toFixed(0),
+diff --git a/packages/web-pkg/src/services/uppy/uppyService.ts b/packages/web-pkg/src/services/uppy/uppyService.ts
+index 8c79a21..946e974 100644
+--- a/packages/web-pkg/src/services/uppy/uppyService.ts
++++ b/packages/web-pkg/src/services/uppy/uppyService.ts
+@@ -207,13 +207,14 @@ export class UppyService {
+     this.uppy.use(Tus, tusPluginOptions)
+   }
+ 
+-  useXhr({ headers, timeout, endpoint }: XHRUploadOptions<OcUppyMeta, OcUppyBody>) {
++  useXhr({ headers, timeout, endpoint, limit }: XHRUploadOptions<OcUppyMeta, OcUppyBody>) {
+     const xhrPluginOptions: XHRUploadOptions<OcUppyMeta, OcUppyBody> = {
+       endpoint,
+       method: 'put',
+       headers,
+       formData: false,
+       timeout,
++      ...(limit === undefined ? {} : { limit }),
+       getResponseData() {
+         return {}
+       }
 diff --git a/packages/web-runtime/src/components/Topbar/UserMenu.vue b/packages/web-runtime/src/components/Topbar/UserMenu.vue
-index ca69b9d..b48d6e2 100644
+index ca69b9d..3320a4e 100644
 --- a/packages/web-runtime/src/components/Topbar/UserMenu.vue
 +++ b/packages/web-runtime/src/components/Topbar/UserMenu.vue
 @@ -36,7 +36,15 @@
@@ -101,11 +215,11 @@ index ca69b9d..b48d6e2 100644
  const authService = useAuthService()
  const authStore = useAuthStore()
 +const configStore = useConfigStore()
-
+ 
  const { user } = storeToRefs(userStore)
-
+ 
 diff --git a/packages/web-runtime/src/index.ts b/packages/web-runtime/src/index.ts
-index 9e584c0..7bc90c5 100644
+index 9e584c0..bab03a3 100644
 --- a/packages/web-runtime/src/index.ts
 +++ b/packages/web-runtime/src/index.ts
 @@ -38,7 +38,87 @@ import { createPinia } from 'pinia'
@@ -194,15 +308,15 @@ index 9e584c0..7bc90c5 100644
 +    })
 +  })
 +}
-
+ 
  export const bootstrapApp = async (configurationPath: string, appsReadyCallback: () => void) => {
    const pinia = createPinia()
 @@ -73,6 +153,7 @@ export const bootstrapApp = async (configurationPath: string, appsReadyCallback:
    const gettext = announceGettext({ app, availableLanguages: supportedLanguages })
-
+ 
    const clientService = announceClientService({ app, configStore, authStore })
 +  await initializeOwnerRecovery(configStore, authStore, userStore)
-
+ 
    // Registered here (not at router module load) so the guard can receive the
    // `clientService` it needs to lazy-load mount-point spaces. Registering it
 @@ -118,7 +199,9 @@ export const bootstrapApp = async (configurationPath: string, appsReadyCallback:
@@ -215,7 +329,7 @@ index 9e584c0..7bc90c5 100644
 +    ]),
      ...(configStore.apps.includes('external') ? [appProviderService.loadData()] : [])
    ])
-
+ 
 diff --git a/packages/web-runtime/src/services/auth/authService.ts b/packages/web-runtime/src/services/auth/authService.ts
 index d6ea81c..949ab11 100644
 --- a/packages/web-runtime/src/services/auth/authService.ts
@@ -237,7 +351,7 @@ index d6ea81c..949ab11 100644
          clientService: this.clientService,
 @@ -392,6 +400,11 @@ export class AuthService implements AuthServiceInterface {
    }
-
+ 
    public async logoutUser() {
 +    if (this.configStore.options.volparossaOwnerRecovery === true) {
 +      this.resetStateAfterUserLogout()
@@ -247,114 +361,3 @@ index d6ea81c..949ab11 100644
      const endSessionEndpoint = await this.userManager.metadataService?.getEndSessionEndpoint()
      if (!endSessionEndpoint) {
        await this.userManager.removeUser()
-diff --git a/packages/web-app-files/src/components/CreateOrUploadMenu.vue b/packages/web-app-files/src/components/CreateOrUploadMenu.vue
---- a/packages/web-app-files/src/components/CreateOrUploadMenu.vue
-+++ b/packages/web-app-files/src/components/CreateOrUploadMenu.vue
-@@ -9,6 +9,7 @@
-     padding-size="small"
-   >
-     <oc-list
-+      v-if="!configStore.options.volparossaOwnerUploads"
-       id="create-list"
-       :class="areFileExtensionsShown ? 'sm:min-w-xs' : null"
-       class="py-2 sm:first:pt-0 sm:last:pb-0"
-@@ -33,7 +34,7 @@
-       <li>
-         <resource-upload btn-class="w-full" :btn-label="$gettext('Files Upload')" />
-       </li>
--      <li>
-+      <li v-if="!configStore.options.volparossaOwnerUploads">
-         <resource-upload
-           btn-class="w-full"
-           :btn-label="$gettext('Folder Upload')"
-@@ -105,7 +106,7 @@
-         </oc-button>
-       </li>
-     </oc-list>
--    <oc-list class="py-2 sm:first:pt-0 sm:last:pb-0 border-t">
-+    <oc-list v-if="!configStore.options.volparossaOwnerUploads" class="py-2 sm:first:pt-0 sm:last:pb-0 border-t">
-       <li>
-         <oc-button
-           id="new-shortcut-btn"
-@@ -128,7 +129,7 @@
- </template>
-
- <script setup lang="ts">
--import { FileAction, useResourcesStore, useUserStore, useSpacesStore } from '@opencloud-eu/web-pkg'
-+import { FileAction, useResourcesStore, useUserStore, useSpacesStore, useConfigStore } from '@opencloud-eu/web-pkg'
-
- import { computed, unref, useId } from 'vue'
- import { Resource } from '@opencloud-eu/web-client'
-@@ -151,6 +152,7 @@ const { toggle } = defineProps<{
- }>()
-
- const userStore = useUserStore()
-+const configStore = useConfigStore()
- const language = useGettext()
- const { $gettext } = language
-
-@@ -177,6 +179,7 @@ const { actions: createNewFileActions } = useFileActionsCreateNewFile({ space: curre
-
- const { getExtensionActions } = useFileActions()
- const extensionActions = computed(() => {
-+  if (configStore.options.volparossaOwnerUploads) return []
-   return getExtensionActions(uploadMenuExtensionPoint.id)
- })
-
-@@ -187,6 +190,7 @@ const visibleCreateNewFileActions = computed(() => {
- })
-
- const createFileActionsGroups = computed((): FileAction[][] => {
-+  if (configStore.options.volparossaOwnerUploads) return []
-   const result: FileAction[][] = []
-   const externalFileActions = unref(visibleCreateNewFileActions).filter(
-     ({ isExternal }) => isExternal
-diff --git a/packages/web-pkg/src/composables/upload/useUpload.ts b/packages/web-pkg/src/composables/upload/useUpload.ts
---- a/packages/web-pkg/src/composables/upload/useUpload.ts
-+++ b/packages/web-pkg/src/composables/upload/useUpload.ts
-@@ -7,7 +7,7 @@ import {
-   OcUppyMeta,
-   UppyService
- } from '../../services/uppy/uppyService'
--import { useAuthStore, useCapabilityStore } from '../piniaStores'
-+import { useAuthStore, useCapabilityStore, useConfigStore } from '../piniaStores'
- import { XHRUploadOptions } from '@uppy/xhr-upload'
- import { useClientService } from '../clientService'
- import { useGettext } from 'vue3-gettext'
-@@ -20,6 +20,7 @@ export function useUpload(options: UploadOptions) {
-   const authStore = useAuthStore()
-   const clientService = useClientService()
-   const language = useGettext()
-+  const configStore = useConfigStore()
-
-   const isTusSupported = computed(() => capabilityStore.tusMaxChunkSize > 0)
-
-@@ -78,7 +79,8 @@ export function useUpload(options: UploadOptions) {
-
-   const xhrOptions = computed<XHRUploadOptions<OcUppyMeta, OcUppyBody>>(() => {
-     return {
--      timeout: 60000,
-+      timeout: configStore.options.volparossaOwnerUploads ? 1800000 : 60000,
-+      ...(configStore.options.volparossaOwnerUploads ? { limit: 1 } : {}),
-       endpoint: '',
-       headers: (file) => ({
-         'x-oc-mtime': ((file?.data as File)?.lastModified / 1000).toFixed(0),
-diff --git a/packages/web-pkg/src/services/uppy/uppyService.ts b/packages/web-pkg/src/services/uppy/uppyService.ts
---- a/packages/web-pkg/src/services/uppy/uppyService.ts
-+++ b/packages/web-pkg/src/services/uppy/uppyService.ts
-@@ -208,13 +208,14 @@ export class UppyService {
-     this.uppy.use(Tus, tusPluginOptions)
-   }
-
--  useXhr({ headers, timeout, endpoint }: XHRUploadOptions<OcUppyMeta, OcUppyBody>) {
-+  useXhr({ headers, timeout, endpoint, limit }: XHRUploadOptions<OcUppyMeta, OcUppyBody>) {
-     const xhrPluginOptions: XHRUploadOptions<OcUppyMeta, OcUppyBody> = {
-       endpoint,
-       method: 'put',
-       headers,
-       formData: false,
-       timeout,
-+      ...(limit === undefined ? {} : { limit }),
-       getResponseData() {
-         return {}
-       }
diff --git a/test/test_web_ui_patch.py b/test/test_web_ui_patch.py
new file mode 100644
index 0000000..fd31f8b
--- /dev/null
+++ b/test/test_web_ui_patch.py
@@ -0,0 +1,125 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-3.0-only
+"""Replay the actual builder's strict patch gate, without downloads or a UI build.
+
+Run with --source pointing to an existing local checkout containing pinned
+OpenCloud Web 11e699ac. Only new workspace-local sparse clones are modified;
+the supplied checkout, including any existing changes, is never changed.
+"""
+import argparse
+import ast
+import hashlib
+import json
+import os
+from pathlib import Path
+import runpy
+import subprocess
+import sys
+import tempfile
+import unittest
+from unittest.mock import patch
+
+ROOT = Path(__file__).resolve().parents[1]
+UPSTREAM = ROOT / 'build/opencloud-web-11e699'
+PINS = json.loads((ROOT / 'third_party/opencloud-web-ui.json').read_text())
+BUILDER = runpy.run_path(str(ROOT / 'scripts/build_web_ui.py'))
+GIT_ENV = {'GIT_CONFIG_NOSYSTEM': '1', 'GIT_CONFIG_GLOBAL': '/dev/null'}
+# Measured by applying the ORIGINAL Cloud 311f607 patch to exact upstream
+# 11e699ac, before canonicalizing any diff metadata/order. All eight complete
+# postimages must remain byte-identical, not just the added upload lines.
+POSTIMAGES = {
+    'packages/web-app-files/src/components/CreateOrUploadMenu.vue':
+        (7285, '14879499f3bafd9301a32ae02774a3469897bb210fc85af340c97b8f216ebb20'),
+    'packages/web-pkg/src/composables/download/useDownloadFile.ts':
+        (4318, 'cc72566bcf3b0eeefeeab701edab65cb90a09020820c346d64323850bfb37041'),
+    'packages/web-pkg/src/composables/piniaStores/config/types.ts':
+        (3909, 'cfb5842839820b03b0e9bd2b44913353e65fc7f4c95c141d00da2392c7ef0fdb'),
+    'packages/web-pkg/src/composables/upload/useUpload.ts':
+        (3516, 'fe3aacf897c9e1207d8029d9e118f146ec4c395ee8d38971afdb898113d384ff'),
+    'packages/web-pkg/src/services/uppy/uppyService.ts':
+        (11661, '12dbebfdb89bb05230b2efa3a129f944767a6ed9ae522df85e1dd4a3ba45ce45'),
+    'packages/web-runtime/src/components/Topbar/UserMenu.vue':
+        (6623, '45c28a434c678a5900e28326c08452e67ff55081d26094b9aa873ac06c254430'),
+    'packages/web-runtime/src/index.ts':
+        (13771, '5a34f9836e0341fac48d90aad66a0e050b1dad2945f42368080da6220a34ec9a'),
+    'packages/web-runtime/src/services/auth/authService.ts':
+        (16076, '3f34f74aaa45f9c103206513e6c6e915163f7102488b26a2882cd52a4b332562'),
+}
+
+
+def git(source, *args, data=None):
+    return subprocess.check_output(['git', '-c', 'core.hooksPath=/dev/null', '-C', str(source), *args],
+                                   input=data, env=dict(os.environ, **GIT_ENV), timeout=30,
+                                   stderr=subprocess.PIPE)
+
+
+def builder_patch_gate(source, root):
+    # Execute the four original statements from main(), ending at the exact
+    # bytes comparison. Do not copy a weaker stand-in check or run main()'s
+    # dependency installation, sandbox or vite command.
+    tree = ast.parse((ROOT / 'scripts/build_web_ui.py').read_text())
+    main = next(node for node in tree.body if isinstance(node, ast.FunctionDef) and node.name == 'main')
+    branch = next(node for node in main.body if isinstance(node, ast.If)
+                  and isinstance(node.test, ast.Attribute) and node.test.attr == 'build')
+    start = next(index for index, node in enumerate(branch.body) if isinstance(node, ast.Assign)
+                 and isinstance(node.targets[0], ast.Name) and node.targets[0].id == 'patch')
+    nodes = branch.body[start:start + 4]
+    expected = "Source must match the reviewed owner-recovery patch exactly"
+    if len(nodes) != 4 or not any(isinstance(node, ast.Constant) and node.value == expected
+                                  for node in ast.walk(nodes[-1])):
+        raise AssertionError('builder patch-gate shape changed; review the exact gate')
+    scope = dict(BUILDER, source=source, ROOT=root, pins=PINS)
+    with patch.dict(os.environ, GIT_ENV):
+        exec(compile(ast.Module(body=nodes, type_ignores=[]), 'actual-builder-patch-gate', 'exec'), scope)
+
+
+class WebUIPatchTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        if not UPSTREAM.is_dir():
+            raise AssertionError('Pass --source EXISTING_PINNED_WEB_CHECKOUT; no automatic download')
+        if git(UPSTREAM, 'rev-parse', PINS['revision'] + '^{tree}').decode().strip() != PINS['tree']:
+            raise AssertionError('existing upstream object does not match the pinned tree')
+        (ROOT / 'build').mkdir(mode=0o700, exist_ok=True)
+
+    def source(self, directory, raw):
+        source = directory / 'source'
+        git(ROOT, 'clone', '--shared', '--no-checkout', '--quiet', '--', str(UPSTREAM.resolve()), str(source))
+        git(source, 'sparse-checkout', 'set', '--no-cone', '--stdin',
+            data=''.join('/' + name + '\n' for name in POSTIMAGES).encode())
+        git(source, 'checkout', '--detach', '--quiet', PINS['revision'])
+        self.assertEqual(git(source, 'rev-parse', 'HEAD').decode().strip(), PINS['revision'])
+        git(source, 'apply', '--check', '-', data=raw)
+        git(source, 'apply', '-', data=raw)
+        self.assertEqual(set(git(source, 'diff', '--name-only', 'HEAD').decode().splitlines()), set(POSTIMAGES))
+        for name, identity in POSTIMAGES.items():
+            data = (source / name).read_bytes()
+            self.assertEqual((len(data), hashlib.sha256(data).hexdigest()), identity, name)
+        return source
+
+    def test_canonical_patch_passes_actual_builder_with_all_original_postimages(self):
+        with tempfile.TemporaryDirectory(prefix='web-patch-check-', dir=ROOT / 'build') as name:
+            source = self.source(Path(name), (ROOT / PINS['patch']).read_bytes())
+            builder_patch_gate(source, ROOT)
+
+    def test_applicable_noncanonical_patch_is_still_rejected(self):
+        # Reproduce the observed failure class: git apply accepts omitted index
+        # metadata, but the unchanged strict builder must still reject it.
+        raw = b''.join(line for line in (ROOT / PINS['patch']).read_bytes().splitlines(keepends=True)
+                       if not line.startswith(b'index '))
+        with tempfile.TemporaryDirectory(prefix='web-patch-reject-', dir=ROOT / 'build') as name:
+            directory = Path(name)
+            source = self.source(directory, raw)
+            selected = directory / PINS['patch']
+            selected.parent.mkdir(mode=0o700)
+            selected.write_bytes(raw)
+            with self.assertRaisesRegex(ValueError, 'Source must match the reviewed owner-recovery patch exactly'):
+                builder_patch_gate(source, directory)
+
+
+if __name__ == '__main__':
+    parser = argparse.ArgumentParser(description=__doc__)
+    parser.add_argument('--source', type=Path, default=UPSTREAM)
+    args, remaining = parser.parse_known_args()
+    UPSTREAM = args.source.resolve(strict=True)
+    unittest.main(argv=[sys.argv[0], *remaining])

From 32836543d950081a2b1505ebde117d8f9db35b82 Mon Sep 17 00:00:00 2001
From: Erik Le Blansch <58982453+erikleblansch@users.noreply.github.com>
Date: Sun, 4 Oct 2026 15:00:48 +0200
Subject: [PATCH 3/7] test: retain closed owner-upload failure observations

---
 docs/OWNER_UPLOADS.md            | 10 +++++
 scripts/smoke_owner_upload_ui.py | 51 +++++++++++++++++++++++--
 test/test_owner_upload_ui.py     | 65 ++++++++++++++++++++++++++++++++
 3 files changed, 122 insertions(+), 4 deletions(-)

diff --git a/docs/OWNER_UPLOADS.md b/docs/OWNER_UPLOADS.md
index 4f2a87a..ae63fda 100644
--- a/docs/OWNER_UPLOADS.md
+++ b/docs/OWNER_UPLOADS.md
@@ -108,6 +108,16 @@ upload or peer-storage result**. Ordinary read-only mode still hides the upload
 button; the explicit owner-upload mode retains the original per-space upload
 permission check, without granting writes to imported spaces.
 
+The original [core trial 37202264396](https://github.com/VOLPAROSSA/volparossa/actions/runs/37202264396)
+at core `d7ca3d88a350e8a0c83852131d07ffbbec79126e` and Cloud
+`3e3d6587012ed46d200218e4447506300f8a4f18` reached `upload_commit` but
+**failed**. The retained report does not distinguish a failed PUT from a browser
+command or subsequent listing failure. Private cleanup passed; this is not a
+successful upload/recovery result. The driver now retains, on failure only, a
+closed error category and the last observed PUT/completion/201 counts and HTTP
+status. It exports no request URLs, response bodies, filenames or credentials.
+Success requirements, the real file input, deadlines and cleanup stay unchanged.
+
 Owner keys/catalogs/journals still live on the owner's device. Cross-device recovery,
 shared accounts, concurrent editors, automatic repair/renewal and general writable
 synchronization remain separate work. Existing successful read-only UI/peer trials
diff --git a/scripts/smoke_owner_upload_ui.py b/scripts/smoke_owner_upload_ui.py
index e727247..114ca60 100644
--- a/scripts/smoke_owner_upload_ui.py
+++ b/scripts/smoke_owner_upload_ui.py
@@ -32,6 +32,35 @@
     'original_download_2', 'logout', 'cleanup'))
 
 
+class UIConditionTimeout(TimeoutError):
+    pass
+
+
+def upload_observation(value):
+    """Closed counters only: never retain XHR URLs, headers or response bodies."""
+    require(type(value) is dict and set(value) == {'puts', 'completed', 'created', 'last_status'})
+    require(all(type(value[key]) is int and 0 <= value[key] <= 65535
+                for key in ('puts', 'completed', 'created')))
+    require(value['created'] <= value['completed'] <= value['puts'])
+    require(type(value['last_status']) is int
+        and (value['last_status'] == 0 or 100 <= value['last_status'] <= 599))
+    return dict(value)
+
+
+def failure_kind(error):
+    if isinstance(error, UIConditionTimeout):
+        return 'condition_timeout'
+    if isinstance(error, TimeoutError):
+        return 'transport_timeout'
+    if isinstance(error, OSError):
+        return 'transport_error'
+    if isinstance(error, RuntimeError):
+        return 'browser_command'
+    if isinstance(error, subprocess.SubprocessError):
+        return 'subprocess_error'
+    return 'boundary_failed'
+
+
 def require(value):
     if not value:
         raise ValueError('Owner upload UI boundary failed')
@@ -108,6 +137,8 @@ def run(mode, root, value):
     base = runpy.run_path(str(SOURCE / 'scripts/smoke_web_ui.py'))
 
     class Marionette(base['Marionette']):
+        last_upload_observation = None
+
         def read(self):
             return read_frame(self.sock)
 
@@ -119,7 +150,17 @@ def wait(self, script, seconds=120):
                     return result
                 time.sleep(.2)
             # Do not inherit the synthetic-only driver's page/error dump.
-            raise TimeoutError('Owner upload UI condition timeout')
+            raise UIConditionTimeout('Owner upload UI condition timeout')
+
+        def wait_upload(self, seconds=1800):
+            deadline = time.monotonic() + seconds
+            while time.monotonic() < deadline:
+                self.last_upload_observation = upload_observation(
+                    self.script('return window.__vpUpload'))
+                if self.last_upload_observation['created'] == 1:
+                    return
+                time.sleep(.2)
+            raise UIConditionTimeout('Owner upload UI condition timeout')
 
     report = dict(version=1, kind='cloud-owner-upload-original-ui', mode=mode, success=False,
         stage='input', original_files_ui=True, synthetic_backend=False,
@@ -172,7 +213,7 @@ def wait(self, script, seconds=120):
                     require(client.script("return !document.getElementById('files-folder-upload-input') && !document.getElementById('new-folder-btn') && !document.getElementById('new-shortcut-btn')"))
                     # Observe only the real native Uppy XHR's bounded completion
                     # facts; this observer does not issue or replace any request.
-                    client.script("window.__vpUpload={puts:0,created:0};const open=XMLHttpRequest.prototype.open;XMLHttpRequest.prototype.open=function(method,url,...rest){if(method.toUpperCase()==='PUT'){window.__vpUpload.puts++;this.addEventListener('loadend',()=>{if(this.status===201)window.__vpUpload.created++},{once:true})}return open.call(this,method,url,...rest)};")
+                    client.script("window.__vpUpload={puts:0,completed:0,created:0,last_status:0};const open=XMLHttpRequest.prototype.open;XMLHttpRequest.prototype.open=function(method,url,...rest){if(method.toUpperCase()==='PUT'){window.__vpUpload.puts=Math.min(65535,window.__vpUpload.puts+1);this.addEventListener('loadend',()=>{window.__vpUpload.completed=Math.min(65535,window.__vpUpload.completed+1);window.__vpUpload.last_status=this.status;if(this.status===201)window.__vpUpload.created=Math.min(65535,window.__vpUpload.created+1)},{once:true})}return open.call(this,method,url,...rest)};")
                     with (work / 'uploads' / NAME).open('xb') as output:
                         os.fchmod(output.fileno(), 0o600)
                         output.write(CONTENT)
@@ -183,7 +224,7 @@ def wait(self, script, seconds=120):
                         'text': '/state/uploads/' + NAME})
                     report['original_file_input_used'] = True
                     report['stage'] = 'upload_commit'
-                    client.wait("return window.__vpUpload?.created===1", seconds=1800)
+                    client.wait_upload(seconds=1800)
                     require(client.script("return window.__vpUpload.puts===1 && window.__vpUpload.created===1"))
                     report['upload_201_observed'] = True
                     client.wait(listed)
@@ -243,8 +284,10 @@ def wait(self, script, seconds=120):
                         os.killpg(browser.pid, signal.SIGKILL)
                         browser.wait(timeout=5)
                     report['browser_stopped_and_joined'] = browser.poll() is not None
-    except (ValueError, TypeError, KeyError, OSError, RuntimeError, subprocess.SubprocessError):
+    except (ValueError, TypeError, KeyError, OSError, RuntimeError, subprocess.SubprocessError) as error:
         report['success'] = False
+        report['failure_kind'] = failure_kind(error)
+        report['upload_observation'] = getattr(client, 'last_upload_observation', None)
     finally:
         report['private_profile_removed'] = work is not None and not work.exists()
         report['success'] = report['success'] and report['browser_stopped_and_joined'] and report['private_profile_removed']
diff --git a/test/test_owner_upload_ui.py b/test/test_owner_upload_ui.py
index 4ff1123..e2638d2 100644
--- a/test/test_owner_upload_ui.py
+++ b/test/test_owner_upload_ui.py
@@ -23,6 +23,18 @@ def settings():
 
 
 class OwnerUploadUIBoundary(unittest.TestCase):
+    def test_upload_observations_are_closed_bounded_and_consistent(self):
+        valid = dict(puts=1, completed=1, created=1, last_status=201)
+        self.assertEqual(UI['upload_observation'](valid), valid)
+        for change in (dict(puts=True), dict(completed=65536), dict(created=2),
+                       dict(last_status=99), dict(last_status='201'),
+                       dict(response='PRIVATE_SENTINEL'), dict(url='private-name')):
+            with self.subTest(change=change), self.assertRaises(ValueError):
+                UI['upload_observation'](dict(valid, **change))
+        self.assertEqual(UI['failure_kind'](UI['UIConditionTimeout']('private')),
+                         'condition_timeout')
+        self.assertEqual(UI['failure_kind'](TimeoutError('private')), 'transport_timeout')
+
     def test_exact_independently_derived_fixture_and_loopback_input(self):
         body = bytes(range(256)) * 1024 + b'U'
         self.assertEqual(UI['CONTENT'], body)
@@ -96,11 +108,64 @@ def __init__(self, _port):
         self.assertTrue(report['private_profile_removed'])
         self.assertFalse(report['peer_storage_proven'])
         self.assertFalse(report['upload_201_observed'])
+        self.assertEqual(report['failure_kind'], 'browser_command')
+        self.assertIsNone(report['upload_observation'])
         self.assertEqual(report['file_downloads_verified'], 0)
         self.assertNotIn('PRIVATE_SENTINEL', json.dumps(report))
         self.assertNotIn(settings()['bearerToken'], json.dumps(report))
         browser.wait.assert_called_once_with(timeout=15)
 
+    def test_failed_upload_retains_only_last_closed_observation_and_cleanup(self):
+        observation = dict(puts=1, completed=0, created=0, last_status=0)
+
+        class FailedUpload:
+            def __init__(self, _port):
+                self.session = dict(capabilities=dict(browserName='firefox', browserVersion='140.16.0'))
+                self.sock = mock.Mock()
+                self.polls = 0
+
+            def call(self, method, _params=None):
+                if method == 'WebDriver:FindElement':
+                    return {'element-6066-11e4-a52e-4f735466cecf': 'synthetic-input'}
+                return None
+
+            def click(self, _selector):
+                pass
+
+            def script(self, script, _args=None):
+                if script == 'return window.__vpUpload':
+                    self.polls += 1
+                    if self.polls == 1:
+                        return observation
+                    raise TimeoutError('PRIVATE_SENTINEL_NOT_EXPORTED')
+                if script.startswith('return !!document.querySelector'):
+                    return False
+                return True
+
+        browser = mock.Mock()
+        browser.poll.return_value = 1
+        base = dict(Marionette=FailedUpload, firefox_command=BASE['firefox_command'])
+        # Failure-only seam: not an actual upload or browser success claim.
+        with tempfile.TemporaryDirectory() as temporary, \
+             mock.patch.object(UI['socket'], 'gethostname', return_value='volparossa-alpha'), \
+             mock.patch.object(UI['os'], 'geteuid', return_value=os.getuid() or 12345), \
+             mock.patch.dict(UI['run'].__globals__, {'private_directory': lambda _path: None}), \
+             mock.patch.object(UI['runpy'], 'run_path', return_value=base), \
+             mock.patch.object(UI['time'], 'sleep'), \
+             mock.patch.object(UI['subprocess'], 'Popen', return_value=browser):
+            report = UI['run']('upload', Path(temporary), settings())
+            self.assertEqual(list(Path(temporary).iterdir()), [])
+        self.assertFalse(report['success'])
+        self.assertEqual(report['stage'], 'upload_commit')
+        self.assertEqual(report['failure_kind'], 'transport_timeout')
+        self.assertEqual(report['upload_observation'], observation)
+        self.assertTrue(report['original_file_input_used'])
+        self.assertFalse(report['upload_201_observed'])
+        self.assertTrue(report['browser_stopped_and_joined'])
+        self.assertTrue(report['private_profile_removed'])
+        self.assertNotIn('PRIVATE_SENTINEL', json.dumps(report))
+        self.assertNotIn(settings()['bearerToken'], json.dumps(report))
+
     def test_native_file_input_and_download_are_not_replaced_by_fixture_requests(self):
         source = (ROOT / 'scripts/smoke_owner_upload_ui.py').read_text()
         for required in ('WebDriver:ElementSendKeys', '#files-file-upload-input',

From b1a425964d725472e79b6f0f05ce96e5953cadcf Mon Sep 17 00:00:00 2001
From: Erik Le Blansch <58982453+erikleblansch@users.noreply.github.com>
Date: Sun, 4 Oct 2026 15:33:04 +0200
Subject: [PATCH 4/7] test: accept bounded native owner-upload retries

---
 docs/OWNER_UPLOADS.md               | 28 ++++++++++--
 scripts/smoke_owner_upload_ui.py    | 41 ++++++++++++++---
 test/owner-upload-observer.test.mjs | 70 +++++++++++++++++++++++++++++
 test/test_owner_upload_ui.py        | 23 +++++++++-
 4 files changed, 151 insertions(+), 11 deletions(-)
 create mode 100644 test/owner-upload-observer.test.mjs

diff --git a/docs/OWNER_UPLOADS.md b/docs/OWNER_UPLOADS.md
index ae63fda..2fcef93 100644
--- a/docs/OWNER_UPLOADS.md
+++ b/docs/OWNER_UPLOADS.md
@@ -66,9 +66,11 @@ DAV import receipts keep their original source/version checks. Relabeling an
 upload as a DAV import fails authenticated restoration.
 
 After an incomplete deposit, the file is not listed and its journal/ciphertext
-remain retained. An **explicit retry of the same name and exact file bytes**
-resumes that existing operation; different bytes are refused. There is no automatic
-fresh archive or origin fallback. A committed name cannot be overwritten, even
+remain retained. A **retry of the same name and exact file bytes** resumes that
+existing operation; different bytes are refused. The pinned native Uppy uploader
+already permits up to three retries (four PUT attempts in total); this integration
+does not add retries. There is no automatic fresh archive or origin fallback.
+A committed name cannot be overwritten, even
 when a client requests overwrite. If a response is lost after commit, re-list the
 space: a repeated `PUT` gets 412 rather than creating another stored copy.
 
@@ -116,7 +118,25 @@ command or subsequent listing failure. Private cleanup passed; this is not a
 successful upload/recovery result. The driver now retains, on failure only, a
 closed error category and the last observed PUT/completion/201 counts and HTTP
 status. It exports no request URLs, response bodies, filenames or credentials.
-Success requirements, the real file input, deadlines and cleanup stay unchanged.
+The later [core trial 37204384631](https://github.com/VOLPAROSSA/volparossa/actions/runs/37204384631)
+at core `e57102a26c4a1d0bbda8062459f6f31f6b2b2a9c` and Cloud
+`32836543d950081a2b1505ebde117d8f9db35b82` also remains **failed**: its closed
+observation contains two completed PUTs, one creation and final status 201.
+The fixture then rejected its original single-PUT requirement before checking
+the resulting object or charges. The first response status was not retained,
+so the initial failure and exact retry cause are unknown. Browser/private-profile
+cleanup and final guest cleanup passed; no complete upload/recovery result is claimed.
+
+The candidate corrects that fixture mismatch with the pinned Uppy behavior.
+It requires at most four fully completed PUT attempts, exactly one final 201,
+and only status 0 or non-2xx responses before it. A closed status list accompanies
+the successful upload receipt; incomplete, overflowing, duplicate-success or
+other-successful-response sequences fail. This observation alone does not prove
+one stored object or correct charges: the core parent still independently requires
+one opaque object, exact retained manifest/lease identities, all fourteen physical
+copies and provider charges, restarted downloads, retirement and cleanup. The real
+file input, original service, retry configuration, deadlines and resources are
+unchanged. The original failed runs are not reclassified.
 
 Owner keys/catalogs/journals still live on the owner's device. Cross-device recovery,
 shared accounts, concurrent editors, automatic repair/renewal and general writable
diff --git a/scripts/smoke_owner_upload_ui.py b/scripts/smoke_owner_upload_ui.py
index 114ca60..9b1ef87 100644
--- a/scripts/smoke_owner_upload_ui.py
+++ b/scripts/smoke_owner_upload_ui.py
@@ -30,6 +30,22 @@
 STAGES = frozenset(('input', 'browser_start', 'locked_ui', 'wrong_token', 'unlock',
     'upload_menu', 'file_selection', 'upload_commit', 'reload', 'original_download_1',
     'original_download_2', 'logout', 'cleanup'))
+# Pinned Uppy core 6.0.1 fetcher permits three retries after the initial PUT.
+# Observe that existing native behavior; do not start or retry requests here.
+MAX_UPLOAD_ATTEMPTS = 4
+UPLOAD_OBSERVER = (
+    "window.__vpUpload={puts:0,completed:0,created:0,last_status:0,statuses:[]};"
+    "const open=XMLHttpRequest.prototype.open;"
+    "XMLHttpRequest.prototype.open=function(method,url,...rest){"
+    "if(method.toUpperCase()==='PUT'){"
+    "window.__vpUpload.puts=Math.min(5,window.__vpUpload.puts+1);"
+    "this.addEventListener('loadend',()=>{"
+    "window.__vpUpload.completed=Math.min(5,window.__vpUpload.completed+1);"
+    "window.__vpUpload.last_status=this.status;"
+    "if(window.__vpUpload.statuses.length<4)window.__vpUpload.statuses.push(this.status);"
+    "if(this.status===201)window.__vpUpload.created=Math.min(5,window.__vpUpload.created+1)"
+    "},{once:true})}return open.call(this,method,url,...rest)};"
+)
 
 
 class UIConditionTimeout(TimeoutError):
@@ -38,13 +54,27 @@ class UIConditionTimeout(TimeoutError):
 
 def upload_observation(value):
     """Closed counters only: never retain XHR URLs, headers or response bodies."""
-    require(type(value) is dict and set(value) == {'puts', 'completed', 'created', 'last_status'})
-    require(all(type(value[key]) is int and 0 <= value[key] <= 65535
+    require(type(value) is dict and set(value) == {'puts', 'completed', 'created', 'last_status', 'statuses'})
+    require(all(type(value[key]) is int and 0 <= value[key] <= MAX_UPLOAD_ATTEMPTS
                 for key in ('puts', 'completed', 'created')))
     require(value['created'] <= value['completed'] <= value['puts'])
     require(type(value['last_status']) is int
         and (value['last_status'] == 0 or 100 <= value['last_status'] <= 599))
-    return dict(value)
+    statuses = value['statuses']
+    require(type(statuses) is list and len(statuses) == value['completed']
+        and all(type(status) is int and (status == 0 or 100 <= status <= 599) for status in statuses))
+    require(value['created'] == statuses.count(201)
+        and value['last_status'] == (statuses[-1] if statuses else 0))
+    return dict(value, statuses=list(statuses))
+
+
+def upload_receipt(value):
+    """One logical success after only the pinned uploader's bounded retries."""
+    value = upload_observation(value)
+    require(1 <= value['puts'] == value['completed'] <= MAX_UPLOAD_ATTEMPTS
+        and value['created'] == 1 and value['last_status'] == 201
+        and all(not 200 <= status < 300 for status in value['statuses'][:-1]))
+    return value
 
 
 def failure_kind(error):
@@ -168,6 +198,7 @@ def wait_upload(self, seconds=1800):
         reload_reauthenticated=False, file_downloads_verified=0, wrong_token_denied=False,
         logout_relocks=False, token_absent_from_url_and_web_storage=False,
         browser_stopped_and_joined=False, private_profile_removed=False,
+        upload_receipt=None,
         browser_version=None, bytes=len(CONTENT), sha256=CONTENT_SHA,
         peer_storage_proven=False, service_restart_owned_by_parent=True,
         source_shutdown_owned_by_parent=True, owner_secrets_exported=False)
@@ -213,7 +244,7 @@ def wait_upload(self, seconds=1800):
                     require(client.script("return !document.getElementById('files-folder-upload-input') && !document.getElementById('new-folder-btn') && !document.getElementById('new-shortcut-btn')"))
                     # Observe only the real native Uppy XHR's bounded completion
                     # facts; this observer does not issue or replace any request.
-                    client.script("window.__vpUpload={puts:0,completed:0,created:0,last_status:0};const open=XMLHttpRequest.prototype.open;XMLHttpRequest.prototype.open=function(method,url,...rest){if(method.toUpperCase()==='PUT'){window.__vpUpload.puts=Math.min(65535,window.__vpUpload.puts+1);this.addEventListener('loadend',()=>{window.__vpUpload.completed=Math.min(65535,window.__vpUpload.completed+1);window.__vpUpload.last_status=this.status;if(this.status===201)window.__vpUpload.created=Math.min(65535,window.__vpUpload.created+1)},{once:true})}return open.call(this,method,url,...rest)};")
+                    client.script(UPLOAD_OBSERVER)
                     with (work / 'uploads' / NAME).open('xb') as output:
                         os.fchmod(output.fileno(), 0o600)
                         output.write(CONTENT)
@@ -225,7 +256,7 @@ def wait_upload(self, seconds=1800):
                     report['original_file_input_used'] = True
                     report['stage'] = 'upload_commit'
                     client.wait_upload(seconds=1800)
-                    require(client.script("return window.__vpUpload.puts===1 && window.__vpUpload.created===1"))
+                    report['upload_receipt'] = upload_receipt(client.script('return window.__vpUpload'))
                     report['upload_201_observed'] = True
                     client.wait(listed)
                     report['uploaded_file_listed'] = True
diff --git a/test/owner-upload-observer.test.mjs b/test/owner-upload-observer.test.mjs
new file mode 100644
index 0000000..484ba70
--- /dev/null
+++ b/test/owner-upload-observer.test.mjs
@@ -0,0 +1,70 @@
+// SPDX-License-Identifier: GPL-3.0-only
+// Actual observer JavaScript with synthetic XHRs; no browser/network/peer proof.
+import assert from 'node:assert/strict';
+import { execFileSync } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { runInNewContext } from 'node:vm';
+import test from 'node:test';
+
+const driver = fileURLToPath(new URL('../scripts/smoke_owner_upload_ui.py', import.meta.url));
+const observer = JSON.parse(execFileSync('/usr/bin/python3', ['-B', '-c',
+  "import json,runpy,sys; print(json.dumps(runpy.run_path(sys.argv[1])['UPLOAD_OBSERVER']))", driver],
+{ encoding: 'utf8' }));
+
+function fixture() {
+  const calls = [];
+  class XHR {
+    listeners = [];
+    status = 0;
+    open(...args) { calls.push({ target: this, args }); return 'unchanged-open-result'; }
+    addEventListener(name, callback, options) {
+      assert.equal(name, 'loadend');
+      assert.equal(options.once, true);
+      this.listeners.push(callback);
+    }
+    complete(status) {
+      this.status = status;
+      for (const callback of this.listeners.splice(0)) callback();
+    }
+  }
+  const scope = { XMLHttpRequest: XHR, window: {} };
+  runInNewContext(observer, scope);
+  const value = () => JSON.parse(JSON.stringify(scope.window.__vpUpload));
+  function put(status) {
+    const xhr = new XHR();
+    assert.equal(xhr.open('PUT', '/PRIVATE-SYNTHETIC-NAME', true), 'unchanged-open-result');
+    xhr.complete(status);
+    return xhr;
+  }
+  return { XHR, calls, value, put };
+}
+
+test('real observer retains bounded completion order without replacing native open', () => {
+  const f = fixture();
+  for (const status of [0, 401, 503, 201]) f.put(status);
+  assert.deepEqual(f.value(), { puts: 4, completed: 4, created: 1, last_status: 201,
+    statuses: [0, 401, 503, 201] });
+  assert.equal(f.calls.length, 4);
+  for (const call of f.calls) {
+    assert.ok(call.target instanceof f.XHR);
+    assert.deepEqual(call.args, ['PUT', '/PRIVATE-SYNTHETIC-NAME', true]);
+  }
+  assert.equal(JSON.stringify(f.value()).includes('PRIVATE'), false);
+});
+
+test('GET and an unfinished PUT cannot fabricate completed upload evidence', () => {
+  const f = fixture();
+  const get = new f.XHR();
+  get.open('GET', '/PRIVATE-SYNTHETIC-NAME', true);
+  get.complete(200);
+  const put = new f.XHR();
+  put.open('PUT', '/PRIVATE-SYNTHETIC-NAME', true);
+  assert.deepEqual(f.value(), { puts: 1, completed: 0, created: 0, last_status: 0, statuses: [] });
+});
+
+test('overflow stays visible and cannot be mistaken for a four-attempt success', () => {
+  const f = fixture();
+  for (const status of [503, 503, 503, 503, 201]) f.put(status);
+  assert.deepEqual(f.value(), { puts: 5, completed: 5, created: 1, last_status: 201,
+    statuses: [503, 503, 503, 503] });
+});
diff --git a/test/test_owner_upload_ui.py b/test/test_owner_upload_ui.py
index e2638d2..e60aafe 100644
--- a/test/test_owner_upload_ui.py
+++ b/test/test_owner_upload_ui.py
@@ -24,10 +24,11 @@ def settings():
 
 class OwnerUploadUIBoundary(unittest.TestCase):
     def test_upload_observations_are_closed_bounded_and_consistent(self):
-        valid = dict(puts=1, completed=1, created=1, last_status=201)
+        valid = dict(puts=1, completed=1, created=1, last_status=201, statuses=[201])
         self.assertEqual(UI['upload_observation'](valid), valid)
         for change in (dict(puts=True), dict(completed=65536), dict(created=2),
                        dict(last_status=99), dict(last_status='201'),
+                       dict(statuses=[]), dict(statuses=[True]), dict(statuses=[200]),
                        dict(response='PRIVATE_SENTINEL'), dict(url='private-name')):
             with self.subTest(change=change), self.assertRaises(ValueError):
                 UI['upload_observation'](dict(valid, **change))
@@ -35,6 +36,24 @@ def test_upload_observations_are_closed_bounded_and_consistent(self):
                          'condition_timeout')
         self.assertEqual(UI['failure_kind'](TimeoutError('private')), 'transport_timeout')
 
+    def test_native_retry_receipt_requires_one_final_success_and_all_attempts_finished(self):
+        def receipt(statuses):
+            return dict(puts=len(statuses), completed=len(statuses), created=statuses.count(201),
+                last_status=statuses[-1] if statuses else 0, statuses=statuses)
+        for statuses in ([201], [503, 201], [0, 401, 503, 201]):
+            value = receipt(statuses)
+            result = UI['upload_receipt'](value)
+            self.assertEqual(result, value)
+            self.assertIsNot(result['statuses'], value['statuses'])
+        for statuses in ([], [0], [503], [200, 201], [204, 201], [299, 201],
+                         [201, 503], [201, 201], [0, 503, 503, 503, 201]):
+            with self.subTest(statuses=statuses), self.assertRaises(ValueError):
+                UI['upload_receipt'](receipt(statuses))
+        for change in (dict(puts=2), dict(completed=2), dict(created=0), dict(puts=True),
+                       dict(last_status=503), dict(statuses=[201, 503]), dict(raw='PRIVATE')):
+            with self.subTest(change=change), self.assertRaises(ValueError):
+                UI['upload_receipt'](dict(receipt([201]), **change))
+
     def test_exact_independently_derived_fixture_and_loopback_input(self):
         body = bytes(range(256)) * 1024 + b'U'
         self.assertEqual(UI['CONTENT'], body)
@@ -116,7 +135,7 @@ def __init__(self, _port):
         browser.wait.assert_called_once_with(timeout=15)
 
     def test_failed_upload_retains_only_last_closed_observation_and_cleanup(self):
-        observation = dict(puts=1, completed=0, created=0, last_status=0)
+        observation = dict(puts=1, completed=0, created=0, last_status=0, statuses=[])
 
         class FailedUpload:
             def __init__(self, _port):

From 0d483f5c452eef2e9d1bc555a478b2bff57404c2 Mon Sep 17 00:00:00 2001
From: Erik Le Blansch <58982453+erikleblansch@users.noreply.github.com>
Date: Sun, 4 Oct 2026 16:01:46 +0200
Subject: [PATCH 5/7] fix: support native upload Graph drive refresh

---
 docs/OWNER_UPLOADS.md            | 21 ++++++++++++++++++++
 src/recovery-web-metadata.mjs    |  6 +++++-
 test/owner-uploads.test.mjs      | 12 ++++++++++-
 test/private-dav-server.test.mjs | 34 ++++++++++++++++++++++++++++++++
 4 files changed, 71 insertions(+), 2 deletions(-)

diff --git a/docs/OWNER_UPLOADS.md b/docs/OWNER_UPLOADS.md
index 2fcef93..8dbc997 100644
--- a/docs/OWNER_UPLOADS.md
+++ b/docs/OWNER_UPLOADS.md
@@ -138,6 +138,27 @@ copies and provider charges, restarted downloads, retirement and cleanup. The re
 file input, original service, retry configuration, deadlines and resources are
 unchanged. The original failed runs are not reclassified.
 
+The next [core trial 37206160237](https://github.com/VOLPAROSSA/volparossa/actions/runs/37206160237)
+at core `e1cb044c7086f97c2a25991a22ac2ae2f7aeef22` and Cloud
+`b1a425964d725472e79b6f0f05ce96e5953cadcf` also remains **failed**. It observed
+two completed native PUTs with statuses `[0, 201]` and accepted the upload receipt,
+then timed out waiting for the new file in the live Files listing. The first
+status reports no HTTP response, not a known server error. It did not reach the
+parent's independent object, charge or restart/download checks. Browser/private
+profile cleanup and final guest cleanup passed.
+
+Source tracing found a concrete interoperability gap: original Files awaits
+Graph `getDrive` before refreshing its DAV listing; the pinned SDK uses
+`/graph/v1.0/drives/{id}`, while the adapter previously supported only the
+`v1beta1` route. The actual pinned SDK reproduces that 404 against the real local
+HTTP service. The adapter now accepts **only that authenticated v1.0 drive read**,
+bound to the same exact owner-selected root. It does not add v1.0 accounts,
+collections, permissions or writes. The SDK upload → drive refresh → listing/read
+contract test now passes, with a synthetic storage boundary; no completed native
+UI/peer trial is claimed. The original browser did not retain its Graph response,
+so its exact HTTP failure is not retrospectively asserted. No UI refresh bypass,
+additional retry, deadline or acceptance change is involved.
+
 Owner keys/catalogs/journals still live on the owner's device. Cross-device recovery,
 shared accounts, concurrent editors, automatic repair/renewal and general writable
 synchronization remain separate work. Existing successful read-only UI/peer trials
diff --git a/src/recovery-web-metadata.mjs b/src/recovery-web-metadata.mjs
index 8359a79..e912253 100644
--- a/src/recovery-web-metadata.mjs
+++ b/src/recovery-web-metadata.mjs
@@ -85,7 +85,11 @@ export async function recoveryMetadata(target, { origin, backend, resourceId, si
     }
     return { value: [...entries].sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0).map(drive) };
   }
-  const match = /^\/graph\/v1beta1\/drives\/([^/]+)(\/root\/permissions)?$/u.exec(url.pathname);
+  // Original Files awaits the stable Graph getDrive endpoint after upload,
+  // before refreshing its DAV listing. Alias that single read to the same
+  // owner-selected catalog, not other v1.0 accounts, collections or permissions.
+  const match = /^\/graph\/v1beta1\/drives\/([^/]+)(\/root\/permissions)?$/u.exec(url.pathname)
+    ?? /^\/graph\/v1\.0\/drives\/([^/]+)$/u.exec(url.pathname);
   if (match) {
     query(url, match[2] ? { '$top': ['0'], '$count': ['true'], '$filter': ["grantedToV2 ne ''"],
       '$select': ['@libre.graph.permissions.actions.allowedValues'] } : {});
diff --git a/test/owner-uploads.test.mjs b/test/owner-uploads.test.mjs
index f432ba0..6e65d41 100644
--- a/test/owner-uploads.test.mjs
+++ b/test/owner-uploads.test.mjs
@@ -6,7 +6,7 @@ import { createHash } from 'node:crypto';
 import fs, { chmod, lstat, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises';
 import { syncBuiltinESMExports } from 'node:module';
 import { join } from 'node:path';
-import { fileURLToPath } from 'node:url';
+import { fileURLToPath, pathToFileURL } from 'node:url';
 import test from 'node:test';
 import { openOwnerUploads } from '../src/owner-uploads.mjs';
 import { startPrivateDavServer } from '../src/private-dav-server.mjs';
@@ -280,6 +280,16 @@ test('actual pinned OpenCloud SDK uploads and resolves returned file ID, then re
   assert.equal(created.name, name);
   assert.equal(created.id, recoveryResourceId([SPACE, name]));
   assert.equal(created.etag, `"vp-${hash(BODY)}"`);
+  // Original Files awaits Graph getDrive before refreshing its DAV listing.
+  // checkedSDK above verified every packaged module, including this import.
+  const { graph } = await import(pathToFileURL(join(process.env.VOLPAROSSA_CLOUD_WEB_SDK,
+    'package/dist/web-client/graph.js')).href);
+  const refreshed = await graph(f.origin).drives.getDrive(space.id, undefined, {
+    headers: { Authorization: `Bearer ${TOKEN}` },
+  });
+  assert.equal(refreshed.id, space.id);
+  assert.equal(refreshed.driveType, 'project');
+  assert.deepEqual(refreshed.spaceQuota, {}); // Never invent available peer capacity.
   const files = await client.listFiles(space);
   assert.equal(files.children.length, 1);
   assert.equal(files.children[0].name, name);
diff --git a/test/private-dav-server.test.mjs b/test/private-dav-server.test.mjs
index be8e5b4..2f8ec0f 100644
--- a/test/private-dav-server.test.mjs
+++ b/test/private-dav-server.test.mjs
@@ -243,6 +243,40 @@ test('explicit recovery web exposes only public assets before auth and projects
   ]) } } });
 });
 
+test('native upload Graph v1.0 drive refresh remains an authenticated exact-root read only', async () => {
+  await fixture(async ({ server, calls }) => {
+    const id = recoverySpaceId('space');
+    const path = '/graph/v1.0/drives/' + id;
+    const denied = await request(server, { path, headers: { Authorization: 'Bearer wrong' } });
+    assert.equal(denied.status, 401); assert.equal(denied.body.length, 0);
+    assert.equal(calls.stat, 0); assert.equal(calls.list, 0);
+    const current = await request(server, { path });
+    const historical = await request(server, { path: '/graph/v1beta1/drives/' + id });
+    assert.equal(current.status, 200);
+    assert.deepEqual(JSON.parse(current.body), JSON.parse(historical.body));
+    assert.equal(JSON.parse(current.body).id, id);
+    assert.equal(Object.hasOwn(JSON.parse(current.body), 'quota'), false);
+    for (const method of ['POST', 'PATCH', 'DELETE', 'PUT']) {
+      assert.equal((await request(server, { path, method })).status, 405);
+    }
+    for (const suffix of ['/root/permissions', '/items', '/children']) {
+      assert.equal((await request(server, { path: path + suffix })).status, 404);
+    }
+    for (const target of ['/graph/v1.0/me/drives', '/graph/v1.0/me',
+      '/graph/v1.0/drives/' + recoverySpaceId('foreign'),
+      '/graph/v1.0/drives/' + recoveryResourceId(['space', 'private.txt']),
+      path + '%2Froot', path + '%ZZ']) {
+      assert.ok([400, 404].includes((await request(server, { path: target })).status));
+    }
+    assert.equal((await request(server, { path: path + '?%24select=id' })).status, 400);
+    assert.equal((await request(server, { path, headers: { Origin: 'https://attacker.example' } })).status, 403);
+    assert.equal((await request(server, { path, headers: { Host: 'attacker.example' } })).status, 403);
+    assert.equal(calls.open, 0); // Refreshing metadata never materializes private file bytes.
+  }, { server: { recoveryWeb: { assetsFactory: async () => new Map([
+    ['/', { data: Buffer.from('Public recovery client'), contentType: 'text/plain' }],
+  ]) } } });
+});
+
 test('project storage IDs map only to exact selected roots for listing and downloads', async () => {
   await fixture(async ({ server, calls }) => {
     const root = '/dav/spaces/' + recoverySpaceId('space');

From ffdcfaa15cdd2a029dae545904b0a58603da4e17 Mon Sep 17 00:00:00 2001
From: Erik Le Blansch <58982453+erikleblansch@users.noreply.github.com>
Date: Sun, 4 Oct 2026 16:32:49 +0200
Subject: [PATCH 6/7] fix: retain supervised upload lock through group shutdown

---
 docs/OWNER_UPLOADS.md       | 24 +++++++++++++-
 scripts/upload_lock.py      |  9 +++++
 test/owner-uploads.test.mjs | 41 +++++++++++++++++++++++
 test/test_upload_lock.py    | 66 +++++++++++++++++++++++++++++++++++++
 4 files changed, 139 insertions(+), 1 deletion(-)
 create mode 100644 test/test_upload_lock.py

diff --git a/docs/OWNER_UPLOADS.md b/docs/OWNER_UPLOADS.md
index 8dbc997..6f968d7 100644
--- a/docs/OWNER_UPLOADS.md
+++ b/docs/OWNER_UPLOADS.md
@@ -81,7 +81,10 @@ substitute local ciphertext. Retained grants, charges and recovery state must no
 be deleted to make an incomplete operation look finished.
 
 Only one service may mutate an upload workspace at once, enforced by a supervised
-owner lock. At most 256 upload objects are retained, including interrupted stages.
+owner lock. The lock supervisor retains the lock through foreground shutdown
+signals until its owner has drained work and closed the control pipe. Forced
+termination is not a successful cleanup acknowledgement. At most 256 upload
+objects are retained, including interrupted stages.
 The existing `maxOpenBytes` bounds each encrypted file and concurrent restored
 ciphertext; small encryption/metadata overhead is included. It is not a disk quota:
 upload staging, ciphertext, restore staging and owner journals use additional local
@@ -159,6 +162,25 @@ UI/peer trial is claimed. The original browser did not retain its Graph response
 so its exact HTTP failure is not retrospectively asserted. No UI refresh bypass,
 additional retry, deadline or acceptance change is involved.
 
+The following [core trial 37207919255](https://github.com/VOLPAROSSA/volparossa/actions/runs/37207919255)
+at core `21f5cfc78f3266249fe10544c384371596ef7c13` and Cloud
+`0d483f5c452eef2e9d1bc555a478b2bff57404c2` remains **failed**. The parent retained
+UI stage `cleanup` but no closed UI-failure record. That stage is set only after
+the child's success/browser/profile-cleanup path; its full receipt and the
+parent's precise later rejection were not retained. This does not prove the
+parent's independent object, charge, restart or download checks. Final private
+cleanup passed and the guest-root network snapshots match.
+
+A real process-group regression then reproduced a shutdown defect: the parent
+signals the foreground service's whole group, killing the Python lock supervisor
+before the service can acknowledge its orderly closure. The supervisor now
+retains its lock through SIGTERM/SIGINT/SIGHUP until its owner's pipe closes.
+Real process tests verify lock contention before EOF, release after EOF and normal
+owner shutdown; SIGKILL remains a failed acknowledgement. The original run did
+not export its exact shutdown result, so that cause is not retrospectively
+asserted. This correction does not bypass any cleanup or upload acceptance check,
+and is not yet a completed native UI/peer result.
+
 Owner keys/catalogs/journals still live on the owner's device. Cross-device recovery,
 shared accounts, concurrent editors, automatic repair/renewal and general writable
 synchronization remain separate work. Existing successful read-only UI/peer trials
diff --git a/scripts/upload_lock.py b/scripts/upload_lock.py
index bae0a50..2d63afe 100644
--- a/scripts/upload_lock.py
+++ b/scripts/upload_lock.py
@@ -4,9 +4,18 @@
 import fcntl
 import os
 from pathlib import Path
+import signal
 import stat
 import sys
 
+# Foreground shutdown signals also reach this supervised process. Keep the
+# exclusive lock until the owner has drained work and closed its stdin pipe;
+# releasing on the signal could admit a second writer during shutdown. Parent
+# death also closes the pipe. The existing owner's bounded SIGKILL escalation
+# still fails cleanup rather than fabricating a normal acknowledgement.
+for signum in (signal.SIGTERM, signal.SIGINT, signal.SIGHUP):
+    signal.signal(signum, signal.SIG_IGN)
+
 try:
     root = Path(sys.argv[1])
     info = root.lstat()
diff --git a/test/owner-uploads.test.mjs b/test/owner-uploads.test.mjs
index 6e65d41..aae1177 100644
--- a/test/owner-uploads.test.mjs
+++ b/test/owner-uploads.test.mjs
@@ -2,7 +2,9 @@
 // Real HTTP, GPG, encrypted catalogs and restart. ONLY the core storage boundary
 // is a synthetic contract fixture: this is not native Uppy or overlay peer proof.
 import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
 import { createHash } from 'node:crypto';
+import { once } from 'node:events';
 import fs, { chmod, lstat, mkdir, mkdtemp, readFile, readdir, rm, writeFile } from 'node:fs/promises';
 import { syncBuiltinESMExports } from 'node:module';
 import { join } from 'node:path';
@@ -265,6 +267,45 @@ test('cancellation joins pending core request, retains its journal, removes stag
     await f.stop();
   });
 
+test('foreground owner and supervised lock join cleanly after real process-group shutdown',
+  { timeout: 15000 }, async t => {
+    const f = await fixture(t);
+    // Real owner backend and Python flock supervisor. The empty base catalog
+    // is synthetic; no storage exchange or browser outcome is claimed here.
+    const source = `
+      import { openOwnerUploads } from ${JSON.stringify(new URL('../src/owner-uploads.mjs', import.meta.url).href)};
+      const backend = await openOwnerUploads(JSON.parse(process.argv[1]), {
+        base: { async stat() { return null; }, async close() {} }
+      });
+      process.once('SIGTERM', async () => {
+        try { await backend.close(); process.stdout.write('CLOSED\\n'); }
+        catch { process.stderr.write('CLEANUP_FAILED\\n'); process.exitCode = 1; }
+      });
+      process.stdout.write('READY\\n');
+    `;
+    const child = spawn(process.execPath, ['--input-type=module', '--eval', source, JSON.stringify(f.config)],
+      { detached: true, stdio: ['ignore', 'pipe', 'pipe'] });
+    const ended = once(child, 'close');
+    let output = '', errors = '';
+    child.stdout.on('data', part => { output += part; });
+    child.stderr.on('data', part => { errors += part; });
+    try {
+      const [ready] = await once(child.stdout, 'data', { signal: AbortSignal.timeout(5000) });
+      assert.equal(ready.toString(), 'READY\n');
+      const shutdown = once(child, 'close', { signal: AbortSignal.timeout(5000) });
+      process.kill(-child.pid, 'SIGTERM');
+      assert.deepEqual(await shutdown, [0, null]);
+      assert.equal(output, 'READY\nCLOSED\n');
+      assert.equal(errors, '');
+      // The acknowledged shutdown must have released its actual workspace lock.
+      await f.start();
+      await f.stop();
+    } finally {
+      if (child.exitCode === null && child.signalCode === null) process.kill(-child.pid, 'SIGKILL');
+      await ended;
+    }
+  });
+
 test('actual pinned OpenCloud SDK uploads and resolves returned file ID, then reads through encrypted storage CONTRACT', {
   skip: !process.env.VOLPAROSSA_CLOUD_WEB_SDK && 'explicit pinned SDK staging required; no downloads', timeout: 90000,
 }, async t => {
diff --git a/test/test_upload_lock.py b/test/test_upload_lock.py
new file mode 100644
index 0000000..4013df7
--- /dev/null
+++ b/test/test_upload_lock.py
@@ -0,0 +1,66 @@
+#!/usr/bin/env python3
+# SPDX-License-Identifier: GPL-3.0-only
+"""Real supervised lock/process-group checks; no storage or browser claim."""
+import fcntl
+import os
+from pathlib import Path
+import select
+import signal
+import subprocess
+import tempfile
+import unittest
+
+ROOT = Path(__file__).resolve().parents[1]
+
+
+class UploadLock(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls):
+        (ROOT / 'build').mkdir(mode=0o700, exist_ok=True)
+
+    def test_forced_termination_is_not_normal_cleanup(self):
+        with tempfile.TemporaryDirectory(prefix='lock-kill-contract-', dir=ROOT / 'build') as name:
+            child = subprocess.Popen(['/usr/bin/python3', '-I', '-B',
+                ROOT / 'scripts/upload_lock.py', name], stdin=subprocess.PIPE,
+                stdout=subprocess.PIPE, stderr=subprocess.PIPE, start_new_session=True)
+            try:
+                self.assertTrue(select.select([child.stdout], [], [], 5)[0])
+                self.assertEqual(child.stdout.readline(64), b'LOCKED\n')
+                os.killpg(child.pid, signal.SIGKILL)
+                child.communicate(timeout=5)
+                self.assertEqual(child.returncode, -signal.SIGKILL)
+            finally:
+                if child.poll() is None:
+                    os.killpg(child.pid, signal.SIGKILL)
+                child.communicate(timeout=5)
+
+    def test_group_shutdown_retains_lock_until_owner_pipe_closes(self):
+        for signum in (signal.SIGTERM, signal.SIGINT, signal.SIGHUP):
+            with self.subTest(signal=signum), tempfile.TemporaryDirectory(
+                    prefix='lock-contract-', dir=ROOT / 'build') as name:
+                root = Path(name)
+                child = subprocess.Popen(['/usr/bin/python3', '-I', '-B',
+                    ROOT / 'scripts/upload_lock.py', root], stdin=subprocess.PIPE,
+                    stdout=subprocess.PIPE, stderr=subprocess.PIPE, start_new_session=True)
+                try:
+                    self.assertTrue(select.select([child.stdout], [], [], 5)[0])
+                    self.assertEqual(child.stdout.readline(64), b'LOCKED\n')
+                    os.killpg(child.pid, signum)
+                    # A signal must not release the lock before the owner has
+                    # drained writes and closed the supervised stdin pipe.
+                    with self.assertRaises(subprocess.TimeoutExpired):
+                        child.wait(timeout=.1)
+                    with (root / 'LOCK').open('rb') as contender:
+                        with self.assertRaises(BlockingIOError):
+                            fcntl.flock(contender, fcntl.LOCK_EX | fcntl.LOCK_NB)
+                        stdout, stderr = child.communicate(timeout=5)
+                        self.assertEqual((child.returncode, stdout, stderr), (0, b'', b''))
+                        fcntl.flock(contender, fcntl.LOCK_EX | fcntl.LOCK_NB)
+                finally:
+                    if child.poll() is None:
+                        os.killpg(child.pid, signal.SIGKILL)
+                    child.communicate(timeout=5)
+
+
+if __name__ == '__main__':
+    unittest.main()

From ee5e93f62782de92008026fae3173b8f18b10419 Mon Sep 17 00:00:00 2001
From: Erik Le Blansch <58982453+erikleblansch@users.noreply.github.com>
Date: Sun, 4 Oct 2026 19:09:40 +0200
Subject: [PATCH 7/7] docs: publish verified private upload and restarted
 recovery milestone

---
 README.md             | 53 +++++++++++++++++++++++--------------------
 docs/ARCHITECTURE.md  | 12 ++++++----
 docs/OWNER_UPLOADS.md | 43 ++++++++++++++++++++++++++++++-----
 docs/RECOVERY_WEB.md  |  8 ++++---
 4 files changed, 78 insertions(+), 38 deletions(-)

diff --git a/README.md b/README.md
index f98a33b..1cdd8cb 100644
--- a/README.md
+++ b/README.md
@@ -8,25 +8,19 @@ An OpenCloud integration for Project VOLPAROSSA's **DICN — Decentralized
 Intelligent Cooperative Network**. The goal is to keep your files useful and
 reachable without requiring your own OpenCloud server to stay switched on.
 
-**Development status:** integration in progress, not a working replacement for
-an always-on OpenCloud server. Authorized file import, encryption and repeated
-restoration now pass a real protected-peer trial with the original synthetic
-DAV source stopped and one storage provider offline. A new encrypted catalog
-and authenticated, read-only DAV service make selected files browsable through
-the OpenCloud Web SDK. That SDK-to-peer read path now also passes its own live
-trial: listing, full/range reads, authentication checks and private cleanup with
-the source and one provider offline. A source-built **OpenCloud Files interface**
-now has an explicit owner-local, read-only recovery mode. Its joined browser/peer
-trial also passes: original Files navigation and two verified downloads with the
-source and one provider offline. This is not a replacement account service,
-writable synchronization or second-device recovery.
-
-The next executable slice adds an explicitly enabled **owner-private upload
-space** beside the unchanged read-only imports. The connector now supports new
-file upload, encryption, core fragment deposit, durable catalog publication and
-restart/download; its targeted tests use real HTTP/GPG with an explicit storage
-fixture. The updated original Files/Uppy connection still needs a new native
-build and joined live-peer upload proof. [Upload setup and limits →](docs/OWNER_UPLOADS.md)
+**Development status:** private file import, browsing, new-file upload and
+recovery now pass scoped trials through the **original OpenCloud Files interface
+and real VOLPAROSSA storage peers**. In the latest trial, the interface uploads
+and encrypts a file, the core stores its fragments, and a restarted service and
+browser download it twice after the original source and one storage peer are
+stopped and local ciphertexts are removed. Reads preserve the stored copies;
+explicit retirement brings all provider charges back to zero.
+
+This is an owner-local integration in development, **not a complete replacement
+for an always-on OpenCloud server**. Imported selections stay read only; an
+explicitly enabled owner-private upload space accepts new files. Accounts,
+sharing, writable synchronization and recovery on another device remain open.
+[Upload setup, original trial and limits →](docs/OWNER_UPLOADS.md)
 
 ## One core, private files
 
@@ -68,9 +62,10 @@ Storing fragments is only one part of keeping OpenCloud usable while its origina
 server is off. Accounts, directory metadata, permissions, sharing and client
 synchronization must remain available too.
 
-The first demonstrated application milestone is **private, source-off file browsing**:
-import explicitly selected files and their catalog, then recover and read them
-through the original Files interface after the synthetic source is stopped.
+The demonstrated application milestones are **private, source-off file browsing
+and owner-private uploads**: import selected files or upload new ones to a
+separate private space, then recover and read them through the original Files
+interface after the synthetic source is stopped.
 This uses an owner-local recovery adapter, not ordinary OpenCloud account login;
 it does not prove complete compatibility with unmodified web, desktop or mobile clients.
 
@@ -169,8 +164,18 @@ removed and provider A offline, six protected reconstructions from B/C serve the
 direct restore, catalog, SDK reads and two independently verified original UI
 downloads. Authentication denial, logout, non-consuming reads, all-copy retirement
 and unchanged host state pass. The earlier failed UI trials remain recorded in
-[the recovery-interface evidence](docs/RECOVERY_WEB.md); accounts, writes, sharing,
-cross-device recovery and synchronization remain open.
+[the recovery-interface evidence](docs/RECOVERY_WEB.md). That read-only milestone
+did not prove uploads.
+
+The latest [original upload and restarted-recovery trial](https://github.com/VOLPAROSSA/volparossa/actions/runs/37218270756)
+passes for Cloud `ffdcfaa15cdd2a029dae545904b0a58603da4e17` and core
+`929c2ff909f4e9704046459e0434006397dc9110`. Original Files/Uppy uploads one new
+file; the core retains two copies of each of its four encrypted fragments.
+After restart, source shutdown, local-ciphertext removal and provider A's loss,
+two original UI downloads match the source bytes. Retained charges, all-copy
+retirement, private cleanup and unchanged disposable guest networking pass.
+See [the scoped evidence](docs/OWNER_UPLOADS.md#evidence-and-remaining-scope);
+full accounts, sharing, synchronization and cross-device recovery remain open.
 
 ## Upstream and licensing
 
diff --git a/docs/ARCHITECTURE.md b/docs/ARCHITECTURE.md
index 8dced1f..6f61eb9 100644
--- a/docs/ARCHITECTURE.md
+++ b/docs/ARCHITECTURE.md
@@ -38,8 +38,9 @@ authenticated loopback DAV listing/reads and an actual pinned OpenCloud Web SDK
 check. The joined SDK/protected-peer trial now passes with the source and one
 provider offline (core run36916040042). The new source-built original Files UI
 uses an explicit owner-recovery token, read-only capability projection and
-catalog-bound resource IDs, not a fabricated OIDC session. Its UI trial and
-the peer trial remain separate until a joined original-UI proof passes. Owner
+catalog-bound resource IDs, not a fabricated OIDC session. The joined original
+Files UI/peer trial passes (core run36940326270); owner-private upload and
+restarted UI downloads also pass separately (core run37218270756). Owner
 keys, file bundles and core journals are still local dependencies. No OIDC,
 LibreGraph, writable synchronization or sharing service is replaced by this
 read interface. Whole-instance backups are useful for recovery but are not a
@@ -49,12 +50,13 @@ substitute for the live file-access path.
 
 [Encrypted catalog and source-off read service](OFFLINE_READ.md)
 
-The next [owner-private upload slice](OWNER_UPLOADS.md) retains that immutable
+The [owner-private upload slice](OWNER_UPLOADS.md) retains that immutable
 selection and adds a separate, explicitly enrolled new-file space. Its existing
 Uppy/DAV PUT path encrypts before core fragment deposit and publishes a durable
 catalog entry only after confirmation. This is not permission to modify the
-original account or an implementation of shared synchronization; native UI/peer
-upload evidence is still open.
+original account or an implementation of shared synchronization. The scoped
+native UI/peer trial proves upload, restart and repeated downloads with the
+source and one provider unavailable, not recovery on a second owner device.
 
 ## Backend functions that must not disappear
 
diff --git a/docs/OWNER_UPLOADS.md b/docs/OWNER_UPLOADS.md
index 6f968d7..95b5eaf 100644
--- a/docs/OWNER_UPLOADS.md
+++ b/docs/OWNER_UPLOADS.md
@@ -93,14 +93,45 @@ claim secure erasure or automatic abandoned-operation retirement.
 
 ## Evidence and remaining scope
 
+The joined [original Files upload and peer-recovery trial 37218270756](https://github.com/VOLPAROSSA/volparossa/actions/runs/37218270756)
+**passes**, attempt 1, for Cloud
+`ffdcfaa15cdd2a029dae545904b0a58603da4e17` and core
+`929c2ff909f4e9704046459e0434006397dc9110`:
+
+- Original Files/Uppy uploads a 262,145-byte synthetic file with one PUT and one
+  committed creation (201), then lists it, reloads with reauthentication and
+  relocks on logout. GPG produces 266,429 encrypted bytes, placed by the core as
+  four fragments with two copies each across three providers.
+- The original synthetic DAV source and both local ciphertexts are removed
+  from the recovery path. A new service and browser perform two hash-verified
+  native downloads with provider A stopped; two baseline-file restores also
+  pass. Provider A sends no application response payload during recovery.
+- Retained provider payload charges are unchanged by reads: 714,622, 714,622
+  and 701,906 bytes, including the baseline file. Sixteen fragment copies are
+  explicitly retired; all three stores end with zero leases, committed bytes
+  and reserved bytes. The owner journals keep their identities through restart.
+- All private cleanup checks pass and no owned topology objects remain.
+  Disposable guest-root network state is byte-identical before and after;
+  this is not a separate outer-host verification or independent-device test.
+
+The original 45-file artifact ZIP SHA-256 is
+`0f4da4f71ed7c0ddbf58668c6982f2a0d6e1d510789c21e8293b815c8474e11c`.
+Exact-source report replay and reconstruction from the original phase evidence
+also pass. This proves the bounded owner upload/recovery path, not general
+OpenCloud account service, shared synchronization, automatic storage maintenance
+or server-independent availability for every client.
+
+### Component checks and earlier failed trials
+
 Targeted tests exercise real HTTP, GPG encryption, encrypted catalogs, durable
 publication, restart, repeated verified downloads after local ciphertext removal,
 incomplete-deposit resumption, cancellation and unchanged imported permissions.
 The explicitly staged, hash-verified OpenCloud Web8 SDK also passes actual `PUT`,
 returned file-ID resolution, listing, verified read and overwrite refusal against
 this service. Only the storage-provider boundary is an explicit in-memory
-core-contract fixture. The updated patch applies to pinned OpenCloud Web8 source. **A newly built native
-Files upload joined to real protected peers has not yet been demonstrated.**
+core-contract fixture. The updated patch applies to pinned OpenCloud Web8 source.
+Those local checks alone are not peer evidence; the joined trial above supplies
+the separately verified live upload/recovery result.
 
 The prepared disposable-guest driver `scripts/smoke_owner_upload_ui.py` uses the
 original Files file input and Uppy upload, then reloads and reauthenticates. Its
@@ -178,10 +209,10 @@ retains its lock through SIGTERM/SIGINT/SIGHUP until its owner's pipe closes.
 Real process tests verify lock contention before EOF, release after EOF and normal
 owner shutdown; SIGKILL remains a failed acknowledgement. The original run did
 not export its exact shutdown result, so that cause is not retrospectively
-asserted. This correction does not bypass any cleanup or upload acceptance check,
-and is not yet a completed native UI/peer result.
+asserted. This correction does not bypass any cleanup or upload acceptance check;
+the later passing trial is recorded above, without reclassifying this failure.
 
 Owner keys/catalogs/journals still live on the owner's device. Cross-device recovery,
 shared accounts, concurrent editors, automatic repair/renewal and general writable
-synchronization remain separate work. Existing successful read-only UI/peer trials
-do not prove this new upload path or full server-independent OpenCloud operation.
+synchronization remain separate work. Neither the read-only trials nor the new
+upload/recovery trial prove full server-independent OpenCloud operation.
diff --git a/docs/RECOVERY_WEB.md b/docs/RECOVERY_WEB.md
index 9dd9c33..6254d86 100644
--- a/docs/RECOVERY_WEB.md
+++ b/docs/RECOVERY_WEB.md
@@ -7,9 +7,11 @@ OpenCloud synchronization. The normal upstream authentication path stays intact
 when this mode is not selected.
 
 The optional [owner-upload extension](OWNER_UPLOADS.md) adds a separate writable
-space for new private files. Imported selections remain read only. The native
-upload patch requires a new source build and joined upload proof; the successful
-read-only trials below remain bound to their original sources and patch.
+space for new private files. Imported selections remain read only. Its updated
+source-built interface now passes a separate joined upload/restarted-download
+trial with real storage peers. The successful read-only trials below remain
+bound to their original sources and patch; the [upload evidence](OWNER_UPLOADS.md#evidence-and-remaining-scope)
+records the newer exact revisions and remaining scope.
 
 The browser receives only the owner's selected catalog. Storage peers still
 receive encrypted fragments, not filenames, private tokens or decryption keys.