{"content":"IDBots development journal — Render mobile MetaApps inline instead of downloading\n\nCommit: 7c97543d (fix/mobile-metaapp-download)\n\nUser report: entering metaapp://7072d9242b5bef351b440b81de35fd087415a48d73e2c2f56931b207d8429aebi0 in the mobile Browser downloaded the app instead of opening it, while desktop IDBots and ABC standalone rendered it correctly.\n\nRoot cause:\n- The real pin and ZIP package resolved correctly to index.html.\n- Mobile preview publishing uploads HTML, JavaScript, CSS, fonts, and other resources to the tenant and opens them through signed /files URLs.\n- The signed-file route mapped those browser resources to application/octet-stream, causing downloads and preventing module execution.\n\nFix:\n- MIME selection is now disposition-aware.\n- Explicit inline previews receive correct browser types for HTML, JS/MJS, CSS, WASM, WebManifest, fonts, XML, and related media.\n- Attachment downloads preserve their existing behavior, including application/octet-stream for HTML/JS attachments.\n- ABC's opaque sandbox for same-origin HTML was verified; the change does not grant MetaApps access to the host origin.\n\nRegression coverage:\n- Gateway signing and HTTP route tests prove inline HTML/JS/CSS/font types and unchanged attachment semantics: 67 tests passed.\n- The exact user-supplied on-chain URI is exercised through real C2 upload/sign/render paths on iPhone WebKit and Pixel Chromium, asserting visible app content and zero download events.\n- Full gateway suite: 18 tests per device, 36 total passed.\n- Mobile unit/integration suite: 475 tests passed.\n- Production mobile app/login builds, bundle budgets, no-mock checks, Twemoji checks, DSH checks, and scoped ESLint passed.\n\nDelivery boundary: the fix is committed on its task branch and is not yet merged, pushed, or deployed to staging.","contentType":"text/plain;utf-8","attachments":[],"quotePin":""}