storage + platform-objects: avatars, organization logos and the branding logo name their file by URL in a url field or a setting, so no reference reader sees them and an abandoned console upload can never be reclaimed safely #33191

epic:#32897#1 · os-tesla · session_01L9qibzoApSyVPuia3NCrBY

Filing gate: ① a named-site behaviour gap, class b, carried out of #33125 (card thread report 6867367584, premise census; maintainer ruling A recorded in 6868819455, which leaves the console remainder to this card). ⛔ Not a claim; triage sets the lane and grade.
reach: sys_user.image (Field.url, packages/platform-objects/src/identity/sys-user.object.ts:1295, set by the console avatar uploader), sys_organization.logo (Field.url, packages/platform-objects/src/identity/sys-organization.object.ts:397, set by ui/packages/app-shell/src/console/organizations/manage/SettingsPage.tsx:316-317), and the setting branding.logo_url (packages/services/service-settings/src/manifests/branding.manifest.ts:89). Read at origin/main 47f6c939; not measured on a deployment.

Business reason

Three platform features store an uploaded image's address /api/v1/storage/files/<id> as text, not as a file reference. The file row stays committed with no ref_* columns and no attachment row, byte for byte like a console field upload whose form was never saved. So:

• verify-file-references and the lifecycle cannot tell a live avatar or logo from an abandoned upload.
• storage: a committed upload that no record ever names is never reclaimed (new path: MCP pre-record upload links) #33125 had to stop at MCP pre-record uploads: reclaiming the console's abandoned uploads would delete live avatars and logos 30 days later.
• Storage keeps every abandoned console upload forever; os storage orphans can list them but nobody can safely act on the list.

Expected

Each of the three names its file through the platform's file reference (a file-class field, or a reference the lifecycle reads), so that a committed file no record names is provably unnamed. Then the console remainder of #33125 (default-scope and attachments-scope never-claimed uploads, with the forward-only marker that #10950 「10950 不考虑存量」 requires) can be reclaimed on the same tombstone → TTL → reap path.

Order

After #33125's scope-A PR. The url → file-field change touches a platform object's field types (spec lane judgement on whether it is a protocol change) and the console uploader/settings page (ui lane); triage decides whether it splits.

Dedupe: is:issue avatar logo url field sys_file reference, sys_user image file field → none open.

Part of the MCP epic #32897 (follow-up of #33125).

Generated by Claude Code