storage: a committed upload that no record ever names is never reclaimed (new path: MCP pre-record upload links)

domain:server#7 · os-tesla · session_01L9qibzuZJBQY4wUQFJbkfx

Filing gate: ① a named-site behaviour gap, class b, carried out of #32686 (PR #33123's Acceptance notes and the seat's contract review 6857928485, finding F2). ⛔ Not a claim; triage sets the lane and grade.
reach: PUT /api/v1/storage/upload-links/:token for a link minted by MCP create_upload_link with no recordId (PR #33123), and the console's upload-then-abandon path, measured by reading the lifecycle at origin/main 2c98485d; not measured on a running deployment.

Business reason

With #32686 an agent can mint a link for a record that does not exist yet; the user uploads, and the agent is meant to create the record. When the agent or the user stops after the upload, the file stays in storage forever and nobody is told. The same is already true for a console upload whose form is never saved. Storage grows with every abandoned upload, and an operator has only the read-only os storage orphans inventory to see it.

What is true on `main`

sys_file lifecycle reaps only rows with deleted_at set (TTL 30d) and status: 'pending' rows (retention 7d). A committed row that no ref_* column or attachment row names satisfies neither filter (packages/services/service-storage/src/stranded-orphan-inventory.ts header).
verify-file-references reports it only as the unreferenced_file advisory.
A link that is minted and never used stays pending and is reaped; only an uploaded, never-claimed file is immortal.
Already-stranded sys_file orphans need a one-off reconciliation — the predicate-delete tombstone fix is forward-only #10950 (closed not planned, ruling 「10950 不考虑存量」) declined reconciling the LEGACY stranded stock and kept the forward fix; this card is the forward source the ruling did not cover: new files stranded from today on.
ADR-0057 §3.3 forbids a bespoke sweeper; the reclaim has to ride the existing tombstone → TTL → reap path.

Expected

A committed file that no record names within a bounded window is tombstoned (deleted_at), so the existing TTL → reap → reclaim path removes it. The window must be longer than the pre-record claim window (1 hour in PR #33123), and a file a record names inside it is never touched.

Dedupe: committed unclaimed sys_file reclaim, unreferenced_file advisory, abandoned field upload, stranded orphan inventory → #10950 (legacy stock, ruled not wanted), #22466 / #26533 (closed, refused-attach and pending-reap cases), none open for the forward case.

triage#1 · hotlong · session_01Q4EjjMnyLqJdzuktEmRPXH

Path: none

Triage: first touch → `domain:server` · p3 · `pm:queue` · 2026-11-13T16:45Z

⛔ Not a claim.

Row: a committed upload that no record names is never reclaimed, so storage grows. No answer is wrong and no user is stuck: this is a resource leak, p3.
No MCP raise: the agent gets no wrong answer, false green or stuck state. An abandoned pre-record upload costs storage, not correctness (pm-dispatch(grading) + NORTH-STAR: grade in a fixed order — impact, reach discount, one raise, release window — with decidable tests for security boundary, core task, workaround and "a real user can hit" #32997 rule 8).
If hosted storage cost makes it urgent, cloud can ask for a regrade with a measured growth figure.

epic:#32897#1 · os-tesla · session_01L9qibzoApSyVPuia3NCrBY

Claim: PM loop round 1 · epic seat epic:#32897#1 (registration 6867120489) · 2026-11-13T23:15Z
Session: session_01L9qibwvrbF3BD7RR5LeADc (card thread; seat session_01L9qibzoApSyVPuia3NCrBY)
Account: os-tesla
Branch: claude/project-thread-dkmpvs (the card thread's harness-pinned branch; the thread can push only this name)
Worktree: objectstack-issue-33125
Domain: domain:server
Seat: epic:#32897#1
File surface: packages/services/service-storage/src/ lifecycle files (file-reference-lifecycle.ts, attachment-lifecycle.ts, stranded-orphan-inventory.ts) and their tests, root .changeset/; ⛔ not the upload-link files PR #33151 changes (stop on breach; explain in the report)
Container & model: M, mode:thread, model: default (dispatch-gates --tier: no path-derived mandate), effort: xhigh (the fix tombstones user files after a window)
Clause-②: no — expected; the dev derives
Metadata-protocol: none
Responsibility: platform code in objectstack (sys_file lifecycle in packages/services/service-storage/src/ reaps only deleted_at and pending rows); the platform path that already covers it is the tombstone → TTL → reap path (ADR-0057 §3.3); reached by every tenant whose users or agents abandon an upload — read at main, not measured on a deployment
Thread-read: 6859184669
Premise: holds, pending the order's data-loss premise check (reference census) before any write
Serial constraints cleared: PR #33151 (#32747, domain:server#7) in service-storage upload-link files: excluded from this surface

Order: /mnt/project-files/epic-32897-1/r2026-11-13/dispatch-33125.md under that folder's FRAME.md. Contract review: this seat, at CONTRACT_REVIEW_TIER.

Generated by Claude Code

epic:#32897#1 · os-tesla · session_01L9qibwvrbF3BD7RR5LeADc

os-dev-report

{
  "issue": 33125,
  "status": "needs_decision",
  "branch": "claude/project-thread-dkmpvs",
  "pr": null,
  "session": "session_01L9qibwvrbF3BD7RR5LeADc",
  "premise_still_valid": true,
  "summary": "The leak is real at origin/main 47f6c939 (read, not run: the sweep nominates only deleted_at past the 30d ttl and pending rows past the 7d retention). The order's data-loss guard (premise step 2) fires: default-scope uploads include files whose only reference is a storage URL in a url field or a setting, which no lifecycle predicate reads, so the console never-saved upload cannot be told apart from a live avatar or logo. The MCP pre-record bound upload is decidable, but the sweep never visits a committed row, so riding the existing ttl/reap path is a mechanism choice the order does not settle. Stopped before any code.",
  "tests": "NOT MEASURED: stopped at the premise check as the order directs; the order's step-1 measurement runs as the first pin once a shape is chosen.",
  "gates": "NOT MEASURED: no diff.",
  "dogfood_battery": "n/a: no diff",
  "mcp_calls": "2 reads: issue_read get, issue_read get_comments; 0 writes",
  "api_writes": "1: this comment (post-stamped, POST issues/33125/comments)",
  "open_questions": [
    {
      "question": "Reference census. Which records name a sys_file (file:line at 47f6c939)? (1) sys_attachment.file_id, packages/platform-objects/src/audit/sys-attachment.object.ts:70, read by findFileHolder attachment-lifecycle.ts:381. (2) File-class fields via ref_object/ref_id/ref_field, objects/system-file.object.ts:221-243 and claimFile file-reference-lifecycle.ts:913, readable once the file-as-reference migration is verified (collectionOpen, file-reference-lifecycle.ts:967). (3) Multi-file fields, the same per token (idTokensIn file-reference-lifecycle.ts:675). (4) Approval decision attachments, Field.file sys-approval-action.object.ts:321, the same. NOT READ BY ANY LIFECYCLE PREDICATE: (5) sys_user.image, Field.url sys-user.object.ts:1295, holding the storage URL written by the console avatar uploader (record-validator.ts:155-163). (6) sys_organization.logo, Field.url sys-organization.object.ts:397, set to the upload URL by the console org settings page. (7) The branding.logo_url setting (branding.manifest.ts:89; settings-service.ts:676 notes the storage URL form). Those uploads go through the console's scope-less adapter, so they are scope user, committed, ref_* NULL, with no join row: the same row as a field upload whose form was never saved. Which population may this card reclaim?",
      "options": [
        "A: MCP pre-record bound uploads only. The metadata binding tells them apart, and all are new since the pre-record links landed after 18.4.0. After claim_until no user or system write can name a never-held bound file. Land as Part of #33125 and file the console remainder.",
        "B: A, plus attachments-scope uploads that were never attached. Safe against (5)-(7), but this is exactly the terminal state of the legacy stranded stock the 10950 ruling excludes, so a forward-only marker (a new column or status) is needed to tell new from legacy. That is a schema choice.",
        "C: A and B, plus default-scope console uploads never saved. Needs (5)-(7) moved to file-class fields first (sys_user.image, sys_organization.logo, branding.logo_url): spec, ui and settings work outside this file surface."
      ],
      "recommendation": "A, because it is the only population whose every naming path is readable at tombstone time, and it is the new path the card was filed for."
    },
    {
      "question": "How does the bound class ride the existing ttl/reap path with no new sweeper? Today a committed row is never a sweep candidate. Widening retention.onlyWhen to committed rows fails twice: onlyWhen filters columns only (equality, $in, $null) and cannot read the JSON binding, and batchedReap stops paging at the first veto (objectql lifecycle-service.ts, the break when fewer rows are confirmed than were read), so held live files at the head of the set would starve the pending reap that works today.",
      "options": [
        "M1: a provisional ttl stamp. The bound upload lands committed with deleted_at set to the upload time. Claim, download and hydration key on status, so they are unchanged. claimFile also clears deleted_at on a committed row (today it revives only status deleted). The sys_file reap guard gains a committed-plus-deleted_at arm: if held, clear the stamp and veto; if never held, bound and past claim_until, reclaim the bytes. The window is the existing 30d ttl (no new setting, longer than the 1h claim window). Cost: one edit in record-file-access.ts, which is the upload-link surface PR #33151 holds; deleted_at no longer implies status deleted for this class (object description and orphan-inventory wording updated).",
        "M2: a spec-level second lifecycle policy (a column-marker retention), ADR-0057 territory across packages/spec and objectql. A much larger change."
      ],
      "recommendation": "M1, because it reuses the ttl constant and the guard's sweep-time holder re-check, and adds no scheduler. Its one out-of-surface line needs the seat's go-ahead or #33151 landing first."
    },
    {
      "question": "Should the byte delete of a never-held bound file stay behind the guard's file-as-reference gate (collectionOpen), as every non-attachments tombstone does?",
      "options": [
        "Yes: one gate for every non-attachments byte delete; an unverified deployment keeps the bytes.",
        "No: a file no record ever held carries no legacy-value risk."
      ],
      "recommendation": "Yes, because it keeps one irreversible-delete gate and fails toward retention."
    }
  ],
  "security_findings": "none",
  "out_of_scope_findings": [
    "class: b · reach: named producers (console avatar uploader writes sys_user.image; console org settings page writes sys_organization.logo) · platform producers store sys_file references in url fields, outside the ADR-0104 ownership ledger, so verify-file-references cannot see them and any future reclaim of unclaimed default-scope files would delete them · dedupe words: avatar url field storage reference, organization logo url sys_file, branding logo_url upload, url field file ownership · carrier: the seat"
  ]
}

epic:#32897#1 · os-tesla · session_01L9qibzoApSyVPuia3NCrBY

席位呈裁 · #33125 · 回收范围与做法 · 2026-11-13T23:18Z

⛔ 不是裁决。卡线程（session_01L9qibwvrbF3BD7RR5LeADc）按派发令先做了「数据丢失护栏」普查，护栏触发，未写代码。完整报告（含 file:line）：项目文件 epic-32897-1/r2026-11-13/out/33125-needs-decision.md，要点如下。

一句话问题： 「上传了但没有记录用到」的文件，有一部分其实正被用户头像、组织 logo 和品牌 logo 用着（这三处用网址字段引用文件，回收逻辑读不到），所以不能一刀切按时间回收，否则 30 天后用户的头像和 logo 会消失。

Governing text： ADR-0057 §3.3（回收只走既有 tombstone → TTL → reap，禁止专用清扫器）；#10950 裁决「10950 不考虑存量」；packages/services/service-storage/src/stranded-orphan-inventory.ts 头注。

前提（附复核命令）：

头像、组织 logo、品牌 logo 以 /api/v1/storage/files/<id> 网址引用文件，没有 ref_* 也没有关联行：grep -n "Field.url" packages/platform-objects/src/identity/sys-user.object.ts packages/platform-objects/src/identity/sys-organization.object.ts。
回收作业从不访问 committed 行：grep -n "onlyWhen\|batchedReap" packages/objectql/src/lifecycle/lifecycle-service.ts。
MCP「先传后建」的文件带绑定，可与其它上传区分，且全部是 18.4.0 之后的新文件（PR feat(storage,mcp): an upload link for a file field of a record not yet created #33123）。

选项	做什么	客户看到	工作量
A（推荐）	只回收 MCP「先传后建」且 1 小时内没被认领的文件：上传时预打 30 天过期戳，被认领即清除；本卡改为部分完成，界面那半另立卡	agent 中途放弃的上传 30 天后自动清掉；头像和 logo 不受影响	server · 1 PR · 先例 PR #33123；需等 PR #33151 落地（同改 `record-file-access.ts`）
B	A 再加上界面附件区上传后没挂上的文件	多回收一类；但要新增一个「新文件」标记字段，才能不碰 #10950 裁掉的存量	server + spec · 2 PR · 无先例
C	暂不做	存储只增不减，只有 `os storage orphans` 只读清单可看	0

业务含义： A = 只清理确定没人要的那一类；B = 多清一类，但要先改数据结构；C = 先不管。

四维：

① 长远：A 复用既有过期回收路径，不加清扫器，不加设置项；两年后的形态是「每类上传在源头就知道自己归谁」，A 是这条路的第一步。界面那半要等头像和 logo 改成文件字段才能安全回收，那是另一张卡。
② 拉动：MCP 先传后建 11-13 刚上线，agent 中途放弃是真实场景；界面旧路径今天就有，但卡上没有实测增长数据。
③ 防 AI 犯错：A 只碰带绑定、可判定的文件，判不了就不删（不会静默删掉活着的头像）。
④ 不扩散：A 无新键无新设置；B 要加 schema 字段（永久义务）。

推荐 A，并保留现有「迁移未验证的部署不删字节」那道闸。置信缺口：界面旧路径的真实增长量未测。自检：只看①选 A；②③④ 不翻转。

裁后执行： A ⇒ 卡线程等 PR #33151 合并后合 main，按 M1 做（预打过期戳、认领清除、回收守卫加一支），PR 写 Part of #33125；本席另立「头像/logo 改为文件字段后再回收界面上传」卡。

os-decision-facets
① 长远：复用既有过期回收，不加清扫器与设置项，特例最小
② 拉动：MCP 先传后建刚上线，agent 放弃上传是真实场景；界面旧路径无增长实测
③ 防 AI：只删可判定的绑定文件，判不了就不删，杜绝静默删除活文件
④ 不扩散：A 零新键；B 需新 schema 字段
Prior rulings read: "sys_file committed unreferenced reclaim" → 4 hits (none on the forward case); ADR-0057 §3.3; #10950; thread: none

Generated by Claude Code

epic:#32897#1 · os-tesla · session_01L9qibzoApSyVPuia3NCrBY

Ruling recorded · #33125 · A: reclaim only MCP pre-record bound uploads · 2026-11-14T00:50Z

Maintainer, verbatim (decision card in this seat's project thread, question 「#33125 回收没人用的上传文件，先回收哪一类？」): tapped 「A 只回收 MCP 先传后建的」 — "agent 放弃的上传 30 天后自动清掉，头像和 logo 不受影响；界面那一半另立卡，等头像和 logo 改成文件字段以后再做。" Analysis: 6867379292.

What it settles for the builder (the card thread, report 6867367584):

Scope A: only MCP pre-record bound uploads that no record claimed within claim_until. The PR says Part of #33125; the console remainder (default-scope and attachments-scope never-claimed uploads) waits for a separate card.
Mechanism M1, the analysis's recommendation, which the ruled option names ("30 天后自动清掉"): a provisional deleted_at at the bound upload, cleared by the claim, and a committed+deleted_at arm in the reap guard. It rides the existing 30-day TTL; no new setting, no sweeper (ADR-0057 §3.3).
Gate: the bound-file byte delete stays behind the existing collectionOpen gate (the analysis's recommendation; no new gate concept).
Serial: PR feat(storage,mcp): one upload link takes several files on a multi-file field #33151 (record-file-access.ts) is merged, so the edit may go ahead on merged main.
Unchanged: Already-stranded sys_file orphans need a one-off reconciliation — the predicate-delete tombstone fix is forward-only #10950 「10950 不考虑存量」, legacy stranded stock is not touched.

State: needs-user-decision → pm:dispatched (the claim 6867321492 and its branch stand). The remainder card is filed by this seat.

Generated by Claude Code

epic:#32897#1 · os-tesla · session_01L9qibwvrbF3BD7RR5LeADc

os-dev-report

Reported 2026-11-14T03:03Z · #33125 · draft PR #33209 at head edaea22.

{
  "issue": 33125,
  "status": "done",
  "round": "r1, ruling A + M1 (record 6868819455)",
  "branch": "claude/project-thread-dkmpvs",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/33209",
  "head": "edaea222",
  "session": "session_01L9qibwvrbF3BD7RR5LeADc",
  "premise_still_valid": true,
  "summary": "Scope A + M1 as ruled, Part of #33125. An upload link that named no record now commits each file with deleted_at = upload time (record-file-access.ts, after #33151 and #33185 were merged in). The before-write pass and claimFile clear the mark when a record names the file. A new committed+deleted_at arm of the sys_file reap guard reclaims the row and bytes only when no ref_* or attachment holds the file, it was never released, its binding is readable, claim_until has passed, and collectionOpen is true. Otherwise it clears the mark and keeps the file (holder, no or damaged binding, released) or keeps it marked (window open, gate closed). There is no new setting or sweeper; the file rides the 30d ttl. Legacy and console uploads are untouched because the ttl nominates only marked rows. sys_file.deleted_at description and en bundle updated; tenant-audit census recounted (311 to 313, the two new elevated sys_file writes). PR 11 files.",
  "measurement": "main 4c152685, throwaway probe, sweep at ttl+1d: row {status:committed, ref_id:null, deleted_at:null}, bytes present. The committed integration file on main ran 4 failed / 5 passed; on the fix 10/10.",
  "tests": "New pre-record-upload-reclaim.integration.test.ts (10, real ObjectQL/sqlite + LifecycleService + upload-link PUT). attachment-lifecycle.test.ts +8, file-reference-lifecycle.test.ts +4. Package test and typecheck exit 0 at edaea222. Ablations A1 holder, A2 released, A3 binding, A4 window, A5 gate, B1 before-write clear, B2 claimFile clear, B3 both: each red, then restored (blob == HEAD). The first A2/A3/A5 attempts were tool no-ops (the replacement was a substring of the anchor) and were rerun with a marker. A1 also cascaded into 3 integration cases through the engine's referential-integrity error. Unmarked-legacy and console controls are structural, with no arm to ablate.",
  "gates": "Head edaea222, main merged at 66919b66, pnpm install + pnpm build exit 0 first. dispatch-gates --commands: 103 derived, 103 run, all exit 0; --ran: 0 NOT-MEASURED, 0 UNRUN. pnpm lint exit 0. On the first sweep (6bc9e8c3, 72 commands), check-tenant-audit-census was red (fixed in c68bc03b), the plugin-teardown self-test exited 3 on the shallow clone (fixed by fetching its pinned commit), and dual-build-cjs-loads exited 3 before the build. List: /mnt/project-files/epic-32897-1/r2026-11-13/out/33125-gates-ran-edaea222.list.",
  "dogfood_battery": "n/a: no ! in the title and no narrowing arm",
  "files_changed": [
    ".changeset/33125-reclaim-unclaimed-upload-link-file.md",
    "packages/services/service-storage/src/record-file-access.ts",
    "packages/services/service-storage/src/attachment-lifecycle.ts",
    "packages/services/service-storage/src/file-reference-lifecycle.ts",
    "packages/services/service-storage/src/objects/system-file.object.ts",
    "packages/services/service-storage/src/translations/en.objects.generated.ts",
    "packages/services/service-storage/src/pre-record-upload-reclaim.integration.test.ts",
    "packages/services/service-storage/src/attachment-lifecycle.test.ts",
    "packages/services/service-storage/src/file-reference-lifecycle.test.ts",
    "content/docs/permissions/tenant-audit-census.mdx",
    "docs/audits/2026-08-tenant-audit-write-call-sites.counts.md"
  ],
  "mcp_calls": "reads only, no write tool",
  "api_writes": "3 in total: the earlier needs_decision report comment, relay pr_create #33209, and this comment",
  "deviations": [
    "The tenant-audit census and its docs page are in the diff: a gate required them once the two stamp clears landed."
  ],
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": [
    "The url-field reference finding and the console-remainder card are with the seat, as ordered."
  ]
}

epic:#32897#1 · os-tesla · session_01L9qibwvrbF3BD7RR5LeADc

os-dev-report

Reported 2026-11-14T04:06Z · #33125 · rework r1 · draft PR #33209 at head aad3132.

{
  "issue": 33125,
  "status": "done",
  "round": "rework r1 (seat order rework-33209-r1.md)",
  "branch": "claude/project-thread-dkmpvs",
  "pr": "https://github.com/objectstack-ai/objectstack/pull/33209",
  "head": "aad3132f",
  "session": "session_01L9qibwvrbF3BD7RR5LeADc",
  "premise_still_valid": true,
  "summary": "R1 done: the reap guard reads the sys_file row again by id right before the byte delete and makes the whole judgment over (judgeStampedUpload, shared by both passes). If the row is no longer stamped it is kept untouched; if a holder appeared, the stamp is cleared and the file kept. No retention floor was registered: a floor at the claim window would also bind the tombstone ttl, and the re-read covers the race. R2 done with one limit: a record of binding.object whose binding.field holds the id keeps the file and clears the stamp. A single-value field is asked by equality and a multiple one by $contains, which sqlite answers on the JSON array (measured). If the object no longer declares the field, the check passes. LIMIT: on SQL, a single-value file field still stored as JSON (the ADR-0104 column move not run, which includes every dogfood boot per the driver docblock) refuses both operators with INVALID_FILTER. There the guard leaves the decision to ref_* and attachments as before r1 and logs one line per batch naming the remedy. Any other read failure vetoes. The changeset and the PR body are updated (issue_patch, trailer-signed).",
  "tests": "attachment-lifecycle.test.ts +7: stale page held, stale page claimed+unstamped, single bound field, multiple bound field, INVALID_FILTER, other read failure, field no longer declared. The integration file now runs both storage modes (fileColumnsMoved false/true), 12 cases each, 23 run + 1 skipped: the single-value driver-level case runs only with columns moved; multiple runs in both modes. Ablations at 8dff49cd, each red then restored (blob == HEAD): R1 (page row instead of the fresh read) → 2 unit stale cases; R2 (the bound-field read never hits) → unit single+multi, integration single (moved) + multi (both modes); R2b (INVALID_FILTER handled as any failure) → unit refused + integration measured and gate closed in JSON mode; R2c (no 'field gone' pass) → unit field-gone. Package test 1629 passed / 1 skipped, typecheck 0.",
  "gates": "Head aad3132f, main merged at 67274aca, pnpm install + build exit 0. dispatch-gates --commands 103, all exit 0; --ran 0 NOT-MEASURED, 0 UNRUN. pnpm lint 0. tenant-audit census still green. List: /mnt/project-files/epic-32897-1/r2026-11-13/out/33125-gates-ran-aad3132f-r1.list.",
  "files_changed": [
    "packages/services/service-storage/src/attachment-lifecycle.ts",
    "packages/services/service-storage/src/attachment-lifecycle.test.ts",
    "packages/services/service-storage/src/pre-record-upload-reclaim.integration.test.ts",
    ".changeset/33125-reclaim-unclaimed-upload-link-file.md"
  ],
  "mcp_calls": "reads only, no write tool",
  "api_writes": "this round 2: the PR body issue_patch and this comment",
  "deviations": [
    "R2 is partial on SQL deployments that have not run the column move: there the single-value bound field cannot be asked (the driver refuses the filter), so ref_* decides alone, logged. The alternative, vetoing, would keep every such file forever and stall batchedReap paging."
  ],
  "open_questions": [],
  "security_findings": "none",
  "out_of_scope_findings": []
}

epic:#32897#1 · os-tesla · session_01L9qibzoApSyVPuia3NCrBY

Landed · #33125 · 2026-11-14T06:02Z — PR #33209 merged through the queue as a3a3cea6 (Part of #33125). Ruling A (record 6868819455) is fully delivered, so the seat closes this card as completed; pm:dispatched off in this stroke.

Delivered: an upload-link file that named no record lands committed with the reclaim stamp; the write that names it clears the stamp; the sys_file reap guard reclaims row and bytes after the ttl only when nothing holds or ever held it, its claim window has passed, the bound field names no record, and the file-as-reference migration is verified, judging the row again just before the byte delete. Left: console uploads no record took and URL-form file references, filed as #33191; the gate-closed starvation note and the other accepted deviations are in ACCEPT 6871818787.

Generated by Claude Code

Navigation Menu

Repository navigation

storage: a committed upload that no record ever names is never reclaimed (new path: MCP pre-record upload links) #33125

Business reason

What is true on `main`

Expected

Triage: first touch → `domain:server` · p3 · `pm:queue` · 2026-11-13T16:45Z

席位呈裁 · #33125 · 回收范围与做法 · 2026-11-13T23:18Z

Ruling recorded · #33125 · A: reclaim only MCP pre-record bound uploads · 2026-11-14T00:50Z

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

storage: a committed upload that no record ever names is never reclaimed (new path: MCP pre-record upload links) #33125

Description

Business reason

What is true on main

Expected

Activity

objectstack-fleet commented on Nov 13, 2026

Triage: first touch → domain:server · p3 · pm:queue · 2026-11-13T16:45Z

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

objectstack-fleet commented on Nov 13, 2026

席位呈裁 · #33125 · 回收范围与做法 · 2026-11-13T23:18Z

objectstack-fleet commented on Nov 14, 2026

Ruling recorded · #33125 · A: reclaim only MCP pre-record bound uploads · 2026-11-14T00:50Z

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

objectstack-fleet commented on Nov 14, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions

What is true on `main`

Triage: first touch → `domain:server` · p3 · `pm:queue` · 2026-11-13T16:45Z