docs(qa-checklist): attachments-storage maintenance — totalSize step fix, ADR-0104 D3 receipt clause, and the scratch authz fixture landed permanently

[huangyiirene]

Fixes#7671
Fixes#7669
Fixes#7670

Three packed checklist-maintenance cards from the attachments-storage QA run (#7635). All three land in one file — docs/qa/platform-checklist/areas/attachments-storage.json — which is why they were packed into one branch and one PR. Docs-only: no product code, no showcase seed code, no coverage.json.

Per-card ledger

Card	Landing site	Before	After
#7671	upload-session-abort · step 1	POST /upload/chunked { filename, mimeType, size, chunkSize }	…{ filename, mimeType, totalSize, chunkSize } + the 5 MiB chunkSize floor spelled out, and storage-routes.ts:274-281 added to source
#7669	inline-grid-receipt-cells · acceptance clause 3 (0-indexed, the batch-payload clause)	"receipt as a resolved stored-file object (absolute url) … receipt.name … an http(s) url"	the ADR-0104 D3 stored form: the bare opaque sys_file id, asserted together with the field-ownership stamp (ref_object/ref_id/ref_field/acl) that proves the reference is managed. Title, step text, a new negative, and source (ADR + storage-routes.ts) follow
#7670	new area-levelfixtures block + fixtures.provisioning on 3 items	the qa_vault/qa_shared/qa_nofiles + two-persona provisioning existed only as prose in run #7635; three items carried standing "not demonstrable on stock seeds" gaps	one replayable qa-scratch-authz recipe (6 ordered calls, each grounded at file:line), referenced by the three consuming items; their knownGaps restated as closed-by-recipe with the dogfood pin named as fallback

diff --stat: 1 file changed, 109 insertions(+), 21 deletions(-) — one file, 1:1 with the scope above.

#7671 — the step text was unrunnable, not merely imprecise

The chunked-init route destructures totalSize and answers 400 INVALID_REQUEST without it, so a runner following the old step could not open a session at all:

274: const { filename, mimeType, totalSize, chunkSize: reqChunkSize, scope, bucket, metadata } = req.body ?? {};
275: if (!filename || !mimeType || !totalSize) {
276: sendError(res, 400, 'INVALID_REQUEST', 'filename, mimeType, and totalSize are required');
280: const chunkSize = Math.max(reqChunkSize ?? 5242880, 5242880);

The 5 MiB floor is recorded in the same breath because it silently rewrites totalChunks when a caller asks for less — a runner computing chunk counts client-side would otherwise disagree with the server for reasons the checklist never mentioned.

⛔ Clause 4's failed/expired enforce-or-remove finding from the same run is not touched here — it belongs to #7667, which is not in this pack. Likewise #7668's stale-@objectstack/core pin problem on attach-requires-parent-edit clause 3.

#7669 — the checklist was wrong, the product is right

Run #7635 scored this clause partial against correct behaviour. Under ADR-0104 D3 (docs/adr/0104-field-runtime-value-shape-contract.md:211-224) the stored form of a file field is an opaque fileId string — "the inline {url, name, size} blob is retired from the write path" — while the resolved { id, name, size, mimeType, url } shape is the expanded form produced at read time, whose url is "derived, never stored". storage-routes.ts:250-252 documents the same id as "the value a file field stores as a reference (ADR-0104 D3)".

So the clause was asserting a contract the ADR had already retired. It now asserts what the run actually proved and what D3 actually requires. A new negative pins the drift itself, so a future run does not re-score the shipped shape as a defect:

⛔ NOT a failure: a batch carrying the bare id instead of {name, url}. That is the shipped contract (ADR-0104 D3) …

D3's parent-derived read gating is cross-referenced to download-authz-both-sides (which already carries the non-entitled personas) rather than duplicated here — the same "cross-reference, do not duplicate" discipline this item already applies to the ADR-0059 form-side guard.

#7670 — landed checklist-side, as the card scoped it

The card's ⛔ clause said to stop and fork-report if the right landing turned out to be showcase seed code. It did not: the run's own provisioning was pure runtime HTTP against a live app, so it lands as a replayable recipe, and no repo code is touched. (A seeded private files-enabled showcase object would be the better long-term fix and is recorded as such in read-inherits-parent-rls' knownGaps — it is a separate, product-side change, not this card.)

The recipe is written once at area level and referenced by items via fixtures.provisioning.use, because three (soon four) items need the identical twenty-call sequence and inlining it per item is how ledger entries drift apart. Every call carries its own source citation:

• install body { manifest, enableOnInstall?, overwrite? } — pinned in packages/client/src/client.test.ts:2144-2166; POST /api/v1/packages is the dispatcher install route (rest-route-ledger.ts:312)
• sharingModel top-level enum — packages/spec/src/data/object.zod.ts:1827 (ADR-0090 D4)
• enable.files default-false opt-in — object.zod.ts:281 ([objectui/framework] enable.files: generic Attachments related-list (Salesforce Notes & Attachments parity) #2727)
• ?package= read as query.package, threaded to saveMetaItem — packages/runtime/src/domains/meta.ts:262,319
• the PUT is manage_metadata-gated (ADR-0066 D1, finding: after ADR-0106, a restricted caller's GET → edit → PUT of an object schema DELETES the fields that were masked out of their read #6603) — a bare session is not enough, so that is a stated requires

Two gaps are recorded honestly rather than papered over: the SDK's meta.saveItem does not send ?package= (packages/client/src/index.ts:701-707), so steps 2-4 must be raw HTTP or the objects land outside the package; and the two personas' exact permission-set payloads were never captured by run #7635, so step 6 is specified by outcome (read-not-edit for A, baseline-only for B) with an instruction to verify the split independently before scoring any storage clause.

Gates

Gate	Result
pnpm check:platform-checklist	1 problem — the known pre-existing coverage.json · qa: UNCLASSIFIED (#7347). Identical on origin/main before any edit; recorded, not chased. No new problem introduced: revision/history pairing, id shape and clause/oracle structure all validate across the 5 revised items.
JSON validity	JSON.parse green; 8 items, all provisioning.use values resolve to the qa-scratch-authz key
revision / history	5 items bumped 1 → 2, each with a dated history entry per README.md lifecycle
pnpm check:nul-bytes	green — OK (scanned 7104 text files … no raw ASCII control bytes); plus a targeted control-byte self-scan of the edited file (clean)

Docs-only, releases nothing → no changeset; skip-changeset applies.

Note for the PM (not blocking)

The area-level fixtures block is a new shape for this ledger: README.md's "Item anatomy" documents fixtures only per-item, and the validator is presence-level so it neither blesses nor rejects the area-level form. It is self-documented by a $comment inside the block, but the convention arguably belongs in README.md alongside the item anatomy. That file was outside this pack's declared surface, so it was deliberately left alone rather than edited on the side.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
objectstack	Ignored		Aug 11, 2026 11:53am