finding(qa): attachments-storage checklist quotes the pre-#10170 create-only `enable.files` wording, and appears to probe FILES_DISABLED on create only

[os-elon]

Found while implementing #10336 (bringing the enable.files / enable.feeds .describe() strings up to the enforced contract, PR #10733). Filed rather than fixed: the checklist is outside that card's declared file surface, and the second half below is a coverage question rather than a mechanical text swap.

What is there

docs/qa/platform-checklist/areas/attachments-storage.json builds a purpose-made qa_nofiles fixture as the FILES_DISABLED probe target, and its step-4 source field cites the spec verbatim:

packages/spec/src/data/object.zod.ts:281 — enable.files defaults to false; 'true surfaces the panel and permits attachments targeting this object; otherwise creation is rejected'

Two separable things follow from #10170 (PR #10332), which registered both capability gates on beforeUpdate as well as beforeInsert:

1. The quoted string is stale. PR docs(spec): re-derive two stale contract statements in object.zod.ts against the behaviour that landed (#10526, #10336) #10733 rewrites that describe string, so the quotation no longer matches its cited source line. Same shape as the re-quoting done in Two verbatim-quoted lint hint blocks go stale after #6673 — re-quote the corrected "stored text field" wording #6925.
2. The area appears not to exercise the update verb at all. grep over attachments-storage.json returns zero hits for 10170, re-point, or repoint, and no step issues an update against sys_attachment that re-points parent_object onto a walled object. The 403 FILES_DISABLED deny side looks to be probed on create only, which is precisely the half that was already enforced before enforceFilesCapability / enforceFeedsCapability are beforeInsert-only — a re-point via update dodges the capability opt-in on the NEW parent object #10170.

The feeds side is worth the same look: FEEDS_DISABLED appears in docs/qa/platform-checklist/areas/records-forms.json, and whether that area covers a thread_id re-thread was not checked here.

Why it is worth recording

The gates' whole point after #10170 is that the flag is a property of the target object, not of the verb — enable.files says whether attachments may target this object at all. A checklist that only probes create keeps passing while the update-verb enforcement it is supposed to cover could regress silently, and the stale citation is what would make a reader conclude the create-only scope was intentional.

Nothing is broken today and no behaviour depends on this — it is a checklist accuracy/coverage item, which is why it is finding and not queued.

Suggested shape

Re-quote the step-4 source against the post-#10733 describe string, and decide whether the area gains a step that re-points an existing sys_attachment onto qa_nofiles and expects 403 FILES_DISABLED (plus the matching re-thread probe for feeds). The fixtures the area already lands (qa_vault / qa_shared / qa_nofiles, #7670) look sufficient for it without new setup.

Backlinks: #10170 (registers the update-verb enforcement), #10336 / PR #10733 (the describe-string fix that stales the quote), #7671 (prior checklist-maintenance card for this same area).

---

Generated by Claude Code

[huangyiirene]

Triage (finding round): promoted → pm:queue, domain:devx, type Task. Both halves in one card: re-quote the step-4 source against the post-#10733 describe string, and add the update-verb probe (re-point an existing sys_attachment onto qa_nofiles, expect 403 FILES_DISABLED) — the flag being a property of the target object, not the verb, is the whole point of #10170, and a create-only probe keeps passing while that enforcement regresses. Include the feeds-side look (FEEDS_DISABLED re-thread in records-forms.json); if it needs new fixtures, report rather than widen. Checklist edits owe revision bump + history entry per the area README. Serial note: attachments-storage.json is the #10663 QA-run lane's hot shared file — check the seat post's serial queue before dispatch.

---

Generated by Claude Code