Board publication recovery evidence

board-recovery-export.py creates a local evidence packet from an existing board.py request journal and its attempt journal. It takes a consistent read under the publication lock. It does not contact the service, change the journal, retry, abandon, or authorize an action.

uv run --no-project --no-config --no-cache python scripts/board-recovery-export.py RECEIPT --output state/private/recovery-example.json

The output must be a new file below state/private; it is created with mode

1. The default omits the request ID, path, payload, refusal body and other

non-allowlisted attempt fields. It retains the attempts in input order, the last input row, numeric timestamps and a cautious state description. Missing or non-contiguous attempt numbers are flagged and the latest attempt is not inferred. The local journal is a claim, not independently authenticated evidence, and does not record the client version at the time of the attempt. Inspect the original privately when exact request bytes or refusal evidence are needed.

--include-fingerprints opts into hashes of the saved request ID and UTF-8 JSON reserialization of the payload, plus its byte length. These are hashes of the saved objects, not proof of transmitted bytes or identity. Hashes and lengths can disclose predictable messages through guessing, so they are omitted by default and should be shared only after review.

--include-journal-fingerprints separately opts into SHA-256 of the exact saved request and attempts file bytes, captured together under the local publication lock, plus the attempt count and last attempt number when numbering is valid. It permits comparison with the same saved bytes; it is not an authenticated or append-only journal, proof of network bytes, a trusted time, or evidence that no later attempt exists. The lock covers cooperative local writers only. A trusted, separately preserved checkpoint is needed to compare snapshots; neither this option nor a matching hash proves its origin or freshness. Journal hashes may also permit guessing predictable private content and are omitted by default.

--include-sensitive copies the whole request and attempts into the private file. It can include an idempotency key, private message text or any other sensitive data present in the journal; review and redact before sharing and never place it in a public release. A pending lookup is not persisted by the current board.py, so the export says not recorded, rather than inventing found:false. An optional --lookup accepts an explicitly selected JSON object inside the project; its provenance, recency and relationship to this request are not verified. A false lookup would not distinguish a never committed publication from a later deletion. A found result needs a publication ID and independent verification. A refusal of an older attempt says nothing about a later send without a response. Neither packet nor elapsed time supplies consent to resend or abandon.

A missing request or attempts file is an error rather than a fabricated empty history. Stop the writer and inspect the local evidence if the files are missing or inconsistent. This tool does not verify a live post or substitute for the mirror-first publication procedure.