qa(checklist): attachments-storage — 18 ledger edits from the 18.2.0 release sweep (#25807)

Filing gate: maintainer-directed task. Filed by the 18.2.0 release-assessment thread · session_01G3h9iZTpL8aCiXbfsp8H5u. ⛔ Not a claim, ⛔ not dispatched.

Maintainer's words (project thread, 2026-10-25, verbatim): 22:54Z 「约 300 条清单准确性问题：是不是应该开卡？」, then 22:55Z 「写issue，不派发」.

Parent: wave anchor #25807 (18.2.0 release test sweep). RUNNER's extraction obligation parks checklist-accuracy findings on the anchor; the maintainer asked for them as issues, so the wave's findings are split into one card per ledger file and the anchor links each card. This is not a release blocker, so it carries no target:v18.

Reader who acts: the lane owning docs/qa/platform-checklist/** (domain:devx). Dedupe (open and closed): no card holds these lines; the 18.0 precedent closed its accuracy rows on its anchor #24579.

Wanted

For each line below, edit docs/qa/platform-checklist/areas/attachments-storage.json: revise the item's text, bump its revision, and append a history entry citing the run record the line comes from. Keep pnpm check:platform-checklist green. A line that turns out to describe a product defect rather than stale text gets its own card instead of a ledger edit.

Findings (18)

From #25815 — `release-18.2.0-tier1`, 156 items, at `6679644a`, pin `b41ed7f68956` (clause labels: aK = acceptance[K], nK = negative[K])

attachments-storage.attach-requires-parent-edit a2: the uploader legs of '(a) granted member: uploader may delete…' are an admin (who edits everything) and memberA on att_case (public_read_write, so memberA edits it); 'the uploader succeeds even without parent edit' is not driven
attachments-storage.attach-requires-parent-edit n1: none of the refused-attach cases ((b), (item 3), ([objectui/framework] enable.files: generic Attachments related-list (Salesforce Notes & Attachments parity) #2727)) re-reads sys_attachment for a row the refusal left
attachments-storage.chunked-upload-integrity a1: the clause names details.missingChunks [1] (chunk 1 not sent); the dogfood pin withholds chunk 0 and asserts [0] — same behaviour, the clause's literal does not match the pin's fixture.
attachments-storage.download-authz-both-sides a2: ref claims 'the uploader/entitled 200' covers clause 2; the owner case is the admin, who also owns/reads the parent, so the uploader-bypass-against-unreadable-parent leg and the 'url serves the bytes' leg are unasserted
attachments-storage.inline-grid-receipt-cells a2: the spec does not capture the /api/v1/storage/* upload requests; storage routing is inferred from the file door returning the uploaded bytes
attachments-storage.inline-grid-receipt-cells a3: the spec never reads the sys_file row (status 'committed', ref_object/ref_id/ref_field, acl 'private') nor asserts the batch response succeeded — only the request payload and GET /storage/files/:id
attachments-storage.inline-grid-receipt-cells n1: a data: URL would satisfy typeof==='string' && !contains('receipt.png'); the n1 guard rests on the follow-up storage GET answering 200 with the PNG bytes
attachments-storage.orphan-tombstone-reap a1: the dogfood sweep is lifecycle.sweep() called in-process after HTTP-driven setup (no door exists for it); the failed-byte-delete-leaves-the-row leg and its warn log are pinned only in attachment-lifecycle.test.ts with a fake engine.
attachments-storage.presigned-upload-roundtrip ref is bare: attachments-permission-matrix is a permission-matrix file whose uploadFile helper drives presign/PUT/complete but asserts only statuses; a0–a3's field, pending→committed, byte-equality and 302 halves are unpinned
attachments-storage.presigned-upload-roundtrip a4: the anonymous case asserts 401 + AUTH_REQUIRED but never counts sys_file rows around the attempt
attachments-storage.read-inherits-parent-rls a3: the probe half (D5 classes, warning text, probe-failure deny) is in-process/unit only; the item states it is unreachable from a run, so scoring it from those pins follows the item's own verify — note the warning's exact '[storage] attachment read visibility' text is asserted only at unit
attachments-storage.sys-file-status-pipeline a2: the live-holder half is scored, as the item directs, from tombstone-download-live-reference.test.ts, a unit test (mock HTTP server + fake engine); the live holder-less 404 FILE_NOT_FOUND and the post-re-attach /url 200 legs have no pin.
attachments-storage.sys-file-status-pipeline a1: tombstone-download-live-reference.test.ts 'leaves pending refused — only the tombstone limb widened' is a unit route test; the api-oracle 404 FILE_NOT_FOUND has no HTTP pin.
attachments-storage.upload-limits-scope-and-ownership a1–a3: storage-limits, upload-scope-vocabulary and upload-door-ownership call registered RouteHandlers with hand-built IHttpRequest/IHttpResponse — no HTTP adapter; a1's 'takes effect without restart' is at the plugin/kernel, not a served request
attachments-storage.upload-limits-scope-and-ownership a5: both hydrate pins are engine-level; no pin reads a copied file id over /data
attachments-storage.upload-session-abort a2/a3/n0/n1: packages/services/service-storage/src/attachment-lifecycle.test.ts › createUploadSessionReapGuard ('does NOT abort a completed session', 'reaps a session with no backend_upload_id without calling abort', 'VETOES on abort failure...', 'reaps the row when the adapter cannot abort at all') asserts these at unit layer but is not in the ref
attachments-storage.upload-session-abort a5: packages/services/service-storage/src/storage-routes.test.ts ('stamps expired and 410s a chunk PUT / a completion past the session deadline', 'does not expire a session still inside its deadline') asserts the 410 at route-handler unit layer, not in the ref (would not score the api oracle)
attachments-storage.upload-session-abort bare ref names only the dogfood matrix file; it scores a1 alone

Acceptance

Every line above is either applied (item revised, revision bumped, history cites the record) or answered on this card with the reason it was not.
pnpm check:platform-checklist is green.
The PR links this card and [sweep] v18.2.0 release test sweep #25807.

Generated by Claude Code

Claim: PM loop round 1 · 2026-10-26T12:20Z
Session: session_01Q4MDXRbEJCNdPAP4SiXwp9 (devx seat 2) · card thread session_01VZNpUpuT1YtHY5bfFn3xN8
Account: os-steve
Branch: claude/project-thread-p2gu77 (the harness-pinned branch of the card thread; it names no issue, so this claim is the identity record; amended on spawn)
Worktree: objectstack-issue-25839
Domain: domain:devx
Seat: domain:devx#2 (seat post #20163)
File surface: docs/qa/platform-checklist/areas/attachments-storage.json only (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default tier (TIER_DEFAULT, from dispatch-gates --tier: no path-derived mandate), effort: high
Clause-②: no
Metadata-protocol: none
Responsibility: n/a — not a defect card
Thread-read: none
Premise: holds (action surface git log origin/main on the file since filing: no commit; the dev re-reads each line against main first)
Serial constraints cleared: own ledger file only; seat 1 holds #25835 / #25836 on other files; #26035 left the retired objectui pin wording in these files to these cards; no other Claim: names this file

Generated by Claude Code

os-dev-report

{
  "issue": 25839,
  "status": "done",
  "branch": "claude/project-thread-p2gu77",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/26124",
  "head": "75c55dcc",
  "session": "session_01VZNpUpuT1YtHY5bfFn3xN8",
  "premise_still_valid": true,
  "summary": "All 18 findings of Tier 1 record #25815 applied to docs/qa/platform-checklist/areas/attachments-storage.json: 10 items, each revision +1 and one history row (ref #25839). Every line was stale text re-read against the pins on main f6c61932; none is a product defect. Per the seat's follow-up, inline-grid-receipt-cells now names its spec at ui/e2e/live/grid-file-upload.spec.ts instead of the objectui repo.",
  "files_changed": [
    "docs/qa/platform-checklist/areas/attachments-storage.json"
  ],
  "line_budget": "91 additions + 31 deletions = 122 changed lines vs the 3000 human-merge threshold: under (PR #26124 at 75c55dcc)",
  "gates": {
    "head": "75c55dcc",
    "derived": "node scripts/pm/dispatch-gates.mjs --commands --repo objectstack-ai/objectstack: 13 families",
    "ran": [
      "node scripts/check-ci-filter-parity.mjs :: exit 0",
      "node scripts/check-closing-keyword-parity.mjs :: exit 0",
      "node scripts/check-closing-keyword-parity.mjs --self-test :: exit 0",
      "node scripts/check-comment-mask-corpus.mjs :: exit 0",
      "pnpm --filter @objectstack/lint run check:doc-formula-expressions :: exit 0",
      "pnpm check:cross-package-test-inputs :: exit 0",
      "pnpm check:doc-authoring :: exit 0",
      "pnpm check:driver-memory-census :: exit 0",
      "pnpm check:gitlink-declared :: exit 0",
      "pnpm check:nul-bytes :: exit 0",
      "pnpm check:platform-checklist :: exit 0",
      "pnpm check:refd-timer-probe :: exit 0",
      "pnpm check:watch-hint-literal :: exit 0"
    ],
    "reconciliation": "dispatch-gates --ran: 13 derived, 13 run, 0 NOT-MEASURED (a derived zero, all 13 with an exit code)",
    "platform_checklist": "check-platform-checklist: OK — 16 areas, 329 items (324 active, 1 planned)",
    "ci": "in_progress at report time; not awaited"
  },
  "deviations": [
    "check:doc-formula-expressions first exited 3 (prerequisite: @objectstack/formula and @objectstack/lint unbuilt); after turbo build of both under os-verify-lock (VERDICT command-exit 0) it exited 0",
    "origin/main merged once before pr_create (f36e1015 then amended to 9bb722d0, trailer pair added): main had moved access-security.json and ai.json; no conflict",
    "no subscribe_pr_activity and no MCP reviewer request: the dispatch forbids GitHub MCP writes; the PR assignee rides pr_create"
  ],
  "mcp_calls": "11 — reads only: issue_read x8 (25839 get + 4 get_comments, 26052, 26035, 25850), search_pull_requests x1, pull_request_read x2 (26101 get_diff, 26124 get)",
  "api_writes": "2 — relay fleet-write: pr_create (POST pulls + assignees + labels skip-changeset, read-back identical) and this os-dev-report comment; plus 3 git pushes",
  "out_of_scope_findings": [
    "carrier: devx seat (#25850 / #26035) · RUNNER.md's standing fact on objectui-pinned automation still says this repo holds none of those specs and builds no console bundle; both stale since the ui/ import. #26101 kept its items' objectui-only framing in step with it, this PR re-pointed inline-grid-receipt-cells to ui/ per the seat; the two cards now differ until RUNNER.md moves · noted, not filed"
  ]
}

Generated by Claude Code

devx seat 2 · review: ACCEPT → PR #26124 comment 6416701808. Landing: ready + merge queue once every check on the reviewed head is green or skipped.

Generated by Claude Code

Navigation Menu

Repository navigation

qa(checklist): attachments-storage — 18 ledger edits from the 18.2.0 release sweep (#25807) #25839

Wanted

Findings (18)

From #25815 — `release-18.2.0-tier1`, 156 items, at `6679644a`, pin `b41ed7f68956` (clause labels: aK = acceptance[K], nK = negative[K])

Acceptance

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

qa(checklist): attachments-storage — 18 ledger edits from the 18.2.0 release sweep (#25807) #25839

Description

Wanted

Findings (18)

From #25815 — release-18.2.0-tier1, 156 items, at 6679644a, pin b41ed7f68956 (clause labels: aK = acceptance[K], nK = negative[K])

Acceptance

Activity

objectstack-fleet commented on Oct 26, 2026

objectstack-fleet commented on Oct 26, 2026

objectstack-fleet commented on Oct 26, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

From #25815 — `release-18.2.0-tier1`, 156 items, at `6679644a`, pin `b41ed7f68956` (clause labels: aK = acceptance[K], nK = negative[K])