Workspace update streams API

Release capture accepts drafts: [{id,generation}] alongside selection_ids. Only saved, changed SQL-well drafts belonging to the capturing project administrator are eligible. Original inputs deduplicate by selection; each draft adds a derived result. Ten payloads, 16 MiB each, 64 MiB/package and existing storage limits apply. The source must still match the draft base; concurrent draft/selection changes fail. Drafts remain unchanged. Empty drafts field is omitted from command fingerprints to preserve pre-upgrade retries. This capability also uses existing release automation write scope; it is not exposed through desktop sessions.

Results have authority ophiolite:derived, key project:selection, revision payload SHA-256 and profile edited-wells/1. Parent reference/hash and draft ID/generation are in the manifest. Original authority and current retention/sharing policy still govern recipient reads. Inputs preserve original SQL scalar encodings and unmapped columns; results explicitly report projection losses. Neither capture nor approval writes upstream. Units/CRS remain declared, missing values remain distinct from zero.

Browser-only POST /api/subscriptions/{list,create,offer-preview,offer,subscribe,get, configure,unsubscribe} requires Origin/CSRF/session and current project membership. Create/offer require administration; only the stream creator may offer versions. Create takes name, kind (dataset/collection), release_id and command_id for retry. Offer takes stream_id, release_id and generation, and refuses changed result identity or mapped context. Duplicate snapshot offers are idempotent. offer-preview reports excluded_subscribers; a nonzero count requires acknowledge_exclusions on offer.

Subscribe is idempotent per account/stream, defaults review and approved_only=false. Configure takes generation, mode(review/follow/pin), approved_only. Unsubscribe requires current generation and no saved edits. Streams are explicit frozen package sequences, not live collection membership. Limits: 100 streams/project, 100 versions per stream, 100 subscriptions/account/project, one edited result with at most 200 wells per version. Other retained package inputs remain inspectable through Releases. Current head denial produces no fallback content; existing subscription lists show a generic unavailable row. No subscriber operation resolves an upstream principal. List gives each available stream a head with offered_by (the stream owner) and offered_at (seconds since the epoch; null for versions offered before 2026.10.41), and a top-level display.member_names for those people only. The unavailable row has no head.

Consumer operations: fetch(version; 0 means head), acknowledge(version, manifest_digest), apply(version,manifest_digest,generation,automatic=false), edit-save(version,generation,patches), discard(generation). Fetch verifies retained hashes but does not record receipt. Acknowledge records a client-reported delivery; apply requires that receipt and records a durable Workspace cursor. Applied does not prove external application consumption. Same-version apply retry preserves edits; older versions cannot roll back the cursor. Automatic apply requires latest version, follow mode and no saved patches. Since 2026.10.42 a browser session cannot subscribe or configure with follow (unless the subscription already follows) and cannot send automatic=true: 403 with Versions are not applied for you automatically. Choose Get when you want a newer one. Access keys and delegates are unchanged. A generation mismatch returns 409 for reload.

Get returns head state, delivery versions and the applied working table. Saved patches use Connector typed validation against retained bytes, never upstream reads. They are private, keyed by the applied version, and survive backup/restart. Discard explicitly loses those edits. Saving a working copy does not publish it onward. Every fetch/ack/apply checks snapshot or approved eligibility; approved_only requires approved. Request-review pauses delivery until approval; withdrawal stops it. Current sharing policy and project grants still apply. Inaccessible applied content is hidden, including its saved values. Recipient metadata may remain visible without payloads.

Activity profile workspace-subscription/1 contains IDs, state and version only. Delivery is client-reported, application is a server-recorded Workspace cursor change. Offer/receipt/apply events commit with their state changes. Existing exports cannot be recalled. The Workspace does not poll: it checks when a project opens and when the person chooses Check for updates, and applies only on Get; unsaved edits block Get for that copy and navigation warns. Expired sessions leave local edits in the open component; a browser reload after ignoring the warning loses unsaved edits. Save before leaving.