campaign version refinment, user locks, db repair

server/app/storage/campaign_attachments.py

@@ -280,6 +280,42 @@ def managed_match_payloads(
     return payloads
 
 
+def public_attachment_summary_payload(value: Any) -> dict[str, Any]:
+    """Return an attachment summary without temporary materialization paths.
+
+    Managed builds use isolated local directories internally. Queue, review and
+    audit payloads must expose the stable managed paths and immutable IDs
+    instead of those temporary paths. Legacy filesystem attachments remain
+    unchanged for backwards compatibility.
+    """
+
+    if hasattr(value, "model_dump"):
+        payload = value.model_dump(mode="json")
+    elif isinstance(value, dict):
+        payload = copy.deepcopy(value)
+    else:
+        return {}
+
+    managed_matches = payload.get("managed_matches")
+    if not isinstance(managed_matches, list) or not managed_matches:
+        return payload
+
+    logical_matches: list[str] = []
+    for item in managed_matches:
+        if not isinstance(item, dict):
+            continue
+        display_path = str(item.get("display_path") or item.get("relative_path") or item.get("filename") or "").strip()
+        if display_path:
+            logical_matches.append(display_path)
+
+    payload["matches"] = logical_matches
+    # These values point into a deleted temporary materialization directory.
+    # The named source plus managed match metadata are the stable references.
+    payload["base_path"] = None
+    payload["directory"] = payload.get("base_path_name") or "managed"
+    return payload
+
+
 def annotate_built_messages_with_managed_files(
     built_messages: list[Any],
     manifest: dict[str, ManagedAttachmentFile],