feat(mcp): read_file and create_upload_link read and attach a record's files - #31009

📓 Docs Drift Check

This PR changes 3 package(s): @objectstack/mcp, @objectstack/runtime, @objectstack/service-storage, touching 204 documentable anchor(s). ⚠️ 1 changed file(s) yielded no anchor (packages/mcp/package.json), so the pages documenting them are NOT COVERED by this run — this is not a clean bill of health for those files.

81 hand-written doc(s) name something this change touched — list omitted above 15 rows. Re-derive on the tree named below: node scripts/docs-audit/affected-docs.mjs --json 41dc302496e48ed23d3dcd23f61d6365448237eb.

⛔ 19 release-owned page(s) also affected — read-only, see AGENTS.md Documentation Guardrails.

# while this PR is open — GitHub drops the merge commit once it closes
git fetch origin 0881527c35341632639f21511b66942077b32d19 && git checkout 0881527c35341632639f21511b66942077b32d19
# afterwards, rebuild it from the two parents, which stay fetchable
git fetch origin 41dc302496e48ed23d3dcd23f61d6365448237eb 57724d86781f4f40c6f3f26b3c53fd6842e8a626 && git checkout -B drift-repro 41dc302496e48ed23d3dcd23f61d6365448237eb && git merge --no-ff 57724d86781f4f40c6f3f26b3c53fd6842e8a626

node scripts/docs-audit/affected-docs.mjs --json 41dc302496e48ed23d3dcd23f61d6365448237eb

Advisory only, and a precision-first one (#9192): a page is listed because it names a
symbol, wire route or SDK method this diff touched — not because it mentions a changed
package. Each row says which anchor put it there, so a wrong row is reportable rather than
merely annoying. To re-verify, run the docs-accuracy-audit workflow scoped to these files:
node scripts/docs-audit/affected-docs.mjs 41dc302496e48ed23d3dcd23f61d6365448237eb → pass the list as
args.docs, on the commit named under Which tree this was computed on.

domain:server#2 · os-tesla · session_01L9qibyvxbrLP4jm4PargoH

Contract review

Served-tier: CONTRACT_REVIEW_TIER
Head-sha: 67847d9c089ce3e923d9102b042916a824e548f3
Local-runs: none
Scope: the widening face and its security face — packages/services/service-storage/src/record-file-access.ts (new, the verbs and the link door), storage-routes.ts (the two upload-links routes, mintDownloadUrl, DEFAULT_DOWNLOAD_TTL, the filename and media-type readers, relayUploadLinkRefusal), metadata-store.ts (updateFileIfUnchanged), upload-link-page.ts, upload-link-wire.ts, storage-route-ledger.ts, storage-service-plugin.ts (bindRecordFileAccess, resolveUploadLinkDoor), file-attachment-service.ts (the five delegating verbs); packages/mcp/src/mcp-http-tools.ts (registerFileTools), file-content.ts (new), skill-md.ts, package.json (unpdf 1.9.1); packages/runtime/src/domains/mcp.ts (resolveMcpRecordFileService, recordFileMembers, publicOrigin, absoluteUrl); the five suites (record-file-access.integration.test.ts 21, mcp-file-tools.test.ts 21, mcp-record-file-bridge.test.ts 5, showcase-mcp-record-files.dogfood.test.ts, the route-count, ledger, unknown-argument and skill-surface pins, the authz-conformance GATE_PIN regex); .changeset/30892-mcp-read-file-upload-link.md (the ② input); the prose faces content/docs/ai/connect-mcp.mdx, plugin-endpoints.mdx, system-context.mdx row 47e, the tenant-audit census and its counts ledger; pnpm-lock.yaml (three unpdf hunks) + cited on origin/main: storage-routes.ts 700–760 (refuseHeldSession, mountFamilyRoute, the ADR-0069 gate), 298–380 (StorageUploadSession, resolveSession), 2009 (buildKey); storage-service-plugin.ts 1149–1227 (composeStorageRoutes: the one place resolveSession is wired, buildAuthSessionResolver); metadata-store.ts 125–160 (StorageWriteContext, writeOptionsFor, systemByIdWriteOptionsFor), 519–600 (getFile system by-id read, updateFile, deleteFile); attachment-access-hooks.ts 405–470 (mayEditAttachmentParent, parentUpdateAdmits, the degraded read); file-attachment-service.ts 224–260 (assertMayAttach); objects/system-file.object.ts 55–72, 118–126, 196–200, 266–270 (which sys_file columns are readonly: the storage-owned five, the reference columns and owner_id; name and metadata are not); sys-file-storage-owned-columns.ts header (the create-side stamp of owner_id); packages/spec/src/api/errors.zod.ts and error-code-ledger.zod.ts (every code the diff throws); packages/spec/src/data/field-value.zod.ts 325 (isFileIdToken); packages/qa/dogfood/test/anonymous-door-sweep.classification.ts 148–182 (a token-addressed route not in a door class is everything-else and must answer 401); docs/adr/0138-…md D2; packages/spec/src/kernel/plugin-security-advanced.zod.ts 488 (allowCredentials default false); AGENTS.md Post-Task Checklist step 3 and .claude/skills/pm-dispatch/SKILL.md 313 (the declaration lines and when Skills-docs: is owed).

Inputs read: card #30892 body and all seven comments (triage 6685125943, seat 4's two claims 6685222837 / 6685332126, the progress ping 6689332927, seat 4's brief 6690566522, the ruling 6691366983, the dev's current os-dev report 6691432611 on head 67847d9c, which supersedes 6690647935); PR #31009's body, its 30-file list (3947+ / 86−), its eight commits over merge-base 8ae0ab9b (75bc8cfa the feature, ebd0dbc4, e3f0aa4e, bc5ad15b, 04ff76bc option B, c5fe7df9 the main merge, f30868c7 and 67847d9c test-only CI fixes); the one PR comment, the docs-drift bot 6690667667; the net diff origin/main...67847d9c; the check-runs on 67847d9c, read at 2026-11-06T17:58Z: 66 total, 59 completed/success, 7 completed/skipped (opt-in and matrix placeholders: UI Published Artifacts, Temporal Conformance, Schedule gate, Packed-tarball smoke, Dogfood Verify CLI, the matrix-shard placeholder, 18.x upgrade harness), 0 failed, 0 in progress (Check Changeset, Governed Surface Queue Guard, Dogfood Regression Gate, PR-body guards, Spec property liveness, Build Core, Lint & Repo Gates with every Lint · leg, Type Check · workspace / consumer gates / source gates / debt ledger, TypeScript Type Check, Test Core 1–8 and aggregate, Test UI 1–16 and aggregate, Live E2E UI, Validate Package Dependencies, Check Documentation Links, Check PR Size). Both carriers read by eye: PR body and changeset each carry Clause-②: yes (widening) and Metadata-protocol: none as line-initial keys, one each. The PR is a draft, mergeable: true, author objectstack-fleet[bot], branch claude/project-thread-s2vcdk, Fixes #30892.

① Derived judgments

• Token entropy. The link is UUID.SECRET: the UUID is the row id (randomUUID), the secret is randomBytes(32) in base64url — 256 bits, 43 characters without padding. parseToken shape-checks both halves (LINK_ID, LINK_SECRET) before any read, so a malformed token never reaches the store. Pinned (grant.token matches the two-part shape). TRUE.
• Hashed at rest. The row's metadata holds secret_sha256 only (sha256Hex(secret)); the secret is in the mint answer and nowhere else — not in the row, not in a log line, not in the page. The compare is sameDigest: equal-length hex buffers under timingSafeEqual. Pinned (the row's metadata does not contain the secret). TRUE.
• Single use. The spend is one compare-and-set: updateFileIfUnchanged(store, id, { status: 'pending', name: 'upload-link' }, { name: 'upload-link (used)' }) — engine.update on sys_file with where: { id, status, name } and multi: true, answering the matched-row count, with a thrown fault when the count is not a number so an unknown outcome is never read as either; the spend counts only when the matched count is above zero. The engine-absent stand-in is one synchronous Map compare-and-set. The guard columns are status and name because a JSON metadata string cannot be a where value (the engine reads a {…}-shaped string as a filter placeholder) — the reason is written at the guard type. After the write chain, finally deletes the row; a failed delete leaves a row named used, which openLinkStateOf refuses on name. Pinned: second use 404, the used link's page 404, the race (two concurrent uses: [200, 404]) in both the package suite and the dogfood; the dev's ablation (if (!spent) flipped) turned the race pin red. TRUE.
• Expiry. expires_at = mint + 600 s, checked in openLink on both the page and the upload (a deadline at or before now is refused, as is a non-finite one). UPLOAD_LINK_TTL_SECONDS is exported and the pins read it. Pinned in both suites by moving Date.now past the TTL (page and PUT 404, nothing lands); the dev's ablation (the deadline check removed) turned the expiry pin red. An expired, never-used row stays pending for the pending-upload retention (attachment-lifecycle.ts, 7 days), stated in the body. TRUE.
• One same-shaped answer, so the answer is not an oracle. Every refusal inside openLink — a token that is not one, no row, a row that is not an open link (used, not pending, not a link, unparsable metadata, a missing binding field), a digest mismatch, expiry, a session naming another user — is refuseUnusableLink(): 404 RESOURCE_NOT_FOUND with the one sentence in upload-link-wire.ts. The routes map it to the one page (sendUnusableUploadLinkPage) on GET and the one JSON envelope on PUT; a kernel without the door answers the same two. The signed-out caller is a different shape, 401 AUTH_REQUIRED, and that is correct rather than an oracle: uploadLinkCaller runs before the token is read at all, so a signed-out request gets 401 for any token — valid, used, expired, unknown or malformed alike — and learns nothing about it; it is the answer ADR-0138 D2's everything-else class requires. Pinned: the package suite's one loop over the used, forged, unknown and malformed tokens (PUT and page), the other-user case for two users, the expired case; the dogfood's used, unknown and admin-as-stranger cases. TRUE.
• Never acts without sign-in (ruling B). Both routes are mounted through mountFamilyRoute (the ADR-0069 held-session gate first) and call uploadLinkCaller before anything else: it reads opts.resolveSession — the one buildAuthSessionResolver wired in composeStorageRoutes — and sends 401 when there is no session, no resolver (fails closed, unlike the bare-kernel upload doors) or a resolver that throws. The user it answers is the request's own session user, handed to inspectUploadLink / consumeUploadLink as callerUserId, and openLink refuses when state.user_id differs. No branch mints, opens or spends on the token alone. The page's script PUTs to location.pathname with credentials: 'same-origin', so the browser's session rides along. Pinned: no session 401 on page and PUT with the link still open afterwards (package suite and dogfood, the latter over the real /api/v1/storage/upload-links/:token with Bearer sessions); another signed-in user 404, not spent. Nothing in the diff contradicts ruling B: the tool description, the skill lines, the ledger notes, connect-mcp.mdx and the changeset all say the link works only for its user, signed in. The one place A survives is prose (should-fix 2). TRUE.
• Organization boundary. At mint the row is stamped with the caller's tenantId (createFile(..., { organizationId })) and the binding carries organization_id. At use the row is read by id under the store's system by-id read (unscoped, as every getFile is), then the user must match; the spend and the delete run under writeContext = { organizationId } from the binding (systemByIdWriteOptionsFor scopes the statement by it), and the user is re-resolved in that organization: resolveUserAuthzGrants with bypassGrantsCache and vetOrganizationClaim under the admission posture — an unbacked claim answers null and the upload is refused 403 PERMISSION_DENIED before the spend. The field write is engine.update as that user (RLS, field security, hooks), the attachment write is attachFileAs as that user with the binding's organizationId. A user signed in to another organization than the link's still acts, for this upload, in the organization the link was minted in, as its grants there allow — the right reading, since the record lives there. Pinned: revoked reach 403 with nothing landed and no stray sys_file; the dogfood runs under the showcase's owner RLS and controlled_by_parent. TRUE.
• Binding. record_id, field / attachments and user_id come from the row alone; the PUT reads no query parameter and only two headers (x-file-name, content-type), both sanitised (uploadLinkFilename: last path segment, control characters dropped, 255 chars, ./.. refused; uploadLinkMimeType: a media type or application/octet-stream). Pinned in both suites with a request naming another record, field and user in headers and query string. TRUE.
• Access follows the record. readRecordAs reads as the caller with raw file values and maps a refused or missing row to 404 RECORD_NOT_FOUND with get_record's sentence; the bridge reads through callData('get') first, so an unreadable record is refused before storage is asked (bridge pin and dogfood pin: read.code === door.code). A field file is the id the caller's own read returns (field-level security decides), an attachment is a caller-scoped sys_attachment read bound to that record (an attachment of another record 404). The file itself takes the download door's own verdict (judgeFileRead, bound by the plugin, public_read short-circuit as the door has) and answers that door's 403 codes. Mint asks assertMayAttach (attachments) or mayEditAttachmentParent + getWritableFields (field). TRUE.
• Refusal codes and messages. RECORD_NOT_FOUND 404, RESOURCE_NOT_FOUND 404, FILE_NOT_FOUND 404, VALIDATION_ERROR 400, INVALID_REQUEST 400, PERMISSION_DENIED 403, FIELD_NOT_ACCESSIBLE 403, ATTACHMENT_DOWNLOAD_DENIED 403, FILE_DOWNLOAD_DENIED 403, AUTH_REQUIRED 401, PAYLOAD_TOO_LARGE 413, SERVICE_UNAVAILABLE 503 — every one is in errors.zod.ts or the error-code ledger; ATTACHMENT_PARENT_ACCESS (pinned at mint) is the attach door's own. relayUploadLinkRefusal relays a 4xx with its code and message and the two declared 5xx outages only, so a fault's text never reaches the link holder. No runtime string carries a tracker number (check:doc-authoring green). The MCP side renders refusals through errorResultWithCode (ADR-0112 envelope; pinned on read_file and create_upload_link). TRUE.
• The page. CSP default-src 'none' with per-response nonces for the inline script and style, connect-src 'self', form-action 'none', frame-ancestors 'none', base-uri 'none'; no-store, no-referrer, noindex, nosniff, DENY. It names the target kind and the expiry only. Pinned (headers; the HTML contains neither the record id, the object name nor the user). A cross-site PUT with the session cookie needs a CORS preflight that allows credentials, and allowCredentials defaults false. TRUE.
• Tests pin each refusal; ablations where the body claims them. The package suite's 21 cover the read cap, record access on read and mint (404 / 403 PERMISSION_DENIED / 403 ATTACHMENT_PARENT_ACCESS), the system context (403), the non-file field, multi-file naming, the page headers, the binding, single use with one same-shaped 404 for four token states, no session 401 not spent, another user 404 not spent, the race, expiry, 413 before the spend (bytes and declared length), revoked reach 403 with nothing landed, maxSize refused with the bytes removed. The MCP suite's 21 cover registration by scope, argument refusals, the sys_* refusal, relayed codes, the cap, image, PDF, damaged PDF, docx, docx bomb, unknown type, skill lines by scope. The bridge's 5 cover the get_record door first, the principal, absolute links, no members without the seam. The dogfood runs the composed chain. The body claims two ablations (spend guard, expiry) and reports both red; they are the dev's readings (Local-runs: none), consistent with what the pins assert. TRUE.
• PR body vs diff. Every claim in "What changes" and "The upload-link security surface" is in the diff; the figures (10 MiB / 100 000 chars / 200 pages / 32 MiB / 5 MiB, 600 s, 300 s, 32 bytes) match the constants; unpdf pinned exactly, loaded by dynamic import with isEvalSupported: false, disableFontFace, useSystemFonts: false; docx by inflateRawSync with maxOutputLength. The two routes are ledgered server-only, the mount count moves 10 to 12 and the pins say so. TRUE.

② Semver level

Both carriers read Clause-②: yes (widening) and Metadata-protocol: none, line-initial, one each. widening is right: two tools join the MCP surface where the storage service is installed, two signed-in routes join the storage family, and nothing that answered before answers differently (the two download doors now mint through mintDownloadUrl, same URL). none is right: no spec file, no key, no object (the link is a pending sys_file row, D2). No Skills-docs: line is owed (none with a (widening) arm). The level follows the rule: a non-protocol widening ships patch — patch on @objectstack/mcp, @objectstack/runtime, @objectstack/service-storage, the three published packages the diff moves. No BREAKING banner, no ADR-0087 marker owed. Check Changeset green on this head.

Check-runs on 67847d9c: 59 success / 7 skipped / 0 failed / 0 in progress (list above). Draft; no governed surface in the file list (no docs/adr/**, no packages/spec/**), the brief expects not-governed and asks the seat to re-run check-governed-merges on the final list.

③ Boundary flags

• open_questions in 6691432611: one, the A/B sign-in choice. Answered by ruling 6691366983: B, as built. Nothing else is open.
• Out-of-scope notes of the dev, read: dispatch-gates --commands does not derive the dogfood's typecheck (CI's Type Check · workspace caught it, fixed f30868c7) — a tooling card, not this PR's; the ADR-0069 hold on the minting user is not re-checked at use (the uploading request's own session is gated by mountFamilyRoute, and the minting user is the uploading user under B, so the hold is checked on the request that matters); the link path follows the plugin basePath; no byte quota in the open tree (cloud's half). All stand as filed.
• File surface: inside seat 4's claim except the seven the body lists (packages/mcp/package.json + lockfile for D1, plugin-endpoints.mdx, the two census pages and the counts ledger, gate-forced, the parity dogfood's comment); packages/runtime/src/mcp-record-file-bridge.test.ts is the runtime half's test, which the claim allows. No packages/spec/**, ui/**, skills/**.
• Inside service-storage, beyond calling existing doors, the diff adds the two routes, the page, the wire module and the conditional update — the "one single-use upload-link record" the claim allows, plus the doors that serve it; the record is a sys_file row, so no new object.
• The docs-drift bot (6690667667) lists 81 hand-written docs naming a touched symbol; the three pages the diff edits are the ones the surface change makes stale, and plugin-endpoints.mdx carries the two routes. The lane seat's ACCEPT reads the rest.
• security#1: the security face is covered here at rule level; should-fix 1 is a hardening with a one-line fix. Recommend a notice to security#1 on landing (a new token-bearing route pair), not a hold.
• Author objectstack-fleet[bot]; Fixes #30892; the merge of main at c5fe7df9 (not rebased, stated) brings feat(mcp)!: delete_record refuses a call without confirm: true #30861's mcp-http-tools.ts beside this diff with no conflict.
• Independence: rendered by an isolated contract-review subagent fed the card and its comments, the ruling, the brief, the PR body, the os-dev report, the net diff, the cited code on origin/main, the error-code ledger, the sweep classification and the check-runs — not the seat's or the dev's conclusions; adopted by the seat named in Reviewed-by:.

④ Design judgment

• The widening against the MCP contract. Two tools, each registered only where the bridge carries its member and under its scope family, both refusing sys_* as the object tools do, both judged by existing doors (get_record's read, the download door's verdict, the attach rule, the record's own update) — the diff adds no second access judgment, which the module doc states and the code holds. The four-axis reading: declared ⇒ enforced holds (each refusal the body lists is a pinned code); tightening over leniency holds (the link doors fail closed with no resolver, the spend is all-or-nothing, a refused write after the spend discards bytes and row). Holds.
• Option B's shape. Binding the token to a session makes the token a second factor rather than a capability: a leaked or forwarded link opens nothing for anyone else, and the anonymous-door sweep's everything-else class holds with no ADR-0138 amendment. The cost the body states (sign in on the phone first) is the ruling's. The upload acting as the minting user with grants re-resolved (D3) is the right side of the signed-URL precedent: no write runs as the system on a user's behalf. Holds.
• record-file-access.ts. The order of consumeUploadLink — open, validate, size gate, re-resolve, spend, write, delete — puts every refusal that should not cost the link ahead of the spend and every refusal that must cost it after; the body's "strict single use" paragraph matches it. openLink is one function for both routes so the page and the upload can never disagree on what a usable link is. The state-in-name choice is forced by the engine's placeholder reading of a {…} string and is written at the guard; it has one consequence the diff does not close (should-fix 1). Holds.
• storage-routes.ts and the plugin. The doors read nothing but the token, the session, the body and two sanitised headers; the service verbs are reached through the kernel's file-attachments service per request so a host mount and the plugin's serve the same links; bindRecordFileAccess binds the download verdict, servability, the user re-resolution and the TTL from the kernel, in the one place the other gates are bound. Holds.
• The pins. The matrix per refusal × door, the race, the two ablations, the composed dogfood over real sessions and RLS. Holds.

Findings (none must-fix):

1. should-fix (hardening) — packages/services/service-storage/src/record-file-access.ts, openLink: the link's state (name) and binding (metadata) live in two sys_file columns that are not readonly (objects/system-file.object.ts), and sys_file carries no owner rule, so a caller holding a sys_file edit grant can rewrite a pending link row's binding or user through the data door; the readonly, system-stamped owner_id on the same row already names the minting user. Rule: a link is usable only when the binding's user is the row's stamped uploader — add row.owner_id === state.user_id to openLink's checks (one line, the same refuseUnusableLink answer) and pin it; state in the module doc that the binding's other columns rest on sys_file edit being an administrative grant. Not must-fix: the upload still runs as the bound user under every gate, the grant is administrative, and the row is deleted after use.
2. should-fix (prose, the carrier) — PR feat(mcp): read_file and create_upload_link read and attach a record's files #31009 body: 「需要你做的：二选一…」, Acceptance notes "Open: whether the link needs a sign-in is still the maintainer's choice … The choice has not been made. If A is chosen, revert 04ff76bc", and the os-dev report's open_questions still present the A/B choice as open. Ruled B (ruling record 6691366983). Fix: replace the open-question text with the ruling and drop the revert instruction before landing; the body is what ships with the merge. No code change.
3. should-fix (follow-up card, storage lane) — storage-routes.ts, uploadLinkCaller on the GET: a person who opens the link in a browser where they are not signed in gets a JSON 401 envelope, not a page. Under ruling B that is the first thing the card's phone scenario meets. Rule unchanged (401 AUTH_REQUIRED, nothing served); the form can be an HTML 401 page carrying the same code with a sign-in pointer. Not a reason to hold this head.

Nits:

• nit — recordFileMembers / publicOrigin: with no auth resource URL the link's origin is the request's host and x-forwarded-proto; the answer goes only to the caller whose request carried them, so nothing is misdirected, but a note that the auth service's URL is the authority would help the next reader.
• nit — consumeUploadLink, the finally delete also runs when the write chain refused; the body says so ("Any refusal after the spend discards the bytes and the row"). Worth one sentence in the ledger note for the PUT, which today describes the success path.
• nit — connect-mcp.mdx "Twelve tools … and two more": the sentence under the table still says "a fixed ~10-tool spine"; harmless, pre-existing drift.
• nit — read_file's facts carry the download URL, whose TTL is the doors' 300 s; the tool's maxBytes is in the description and the facts, so the cap is named twice. Fine.

Implemented-by: claude/project-thread-s2vcdk
Reviewed-by: session_01L9qibyvxbrLP4jm4PargoH

VERDICT: PASS

Record written 2026-11-06T17:58Z.

domain:server#2 · os-tesla · session_01L9qibyvxbrLP4jm4PargoH

维护者速读

• 改了什么：MCP 新增两个工具。read_file 读一条记录上的文件（文件字段或附件），返回文本（PDF、Word 服务端抽取，图片作图片块）、短时下载链接和大小；create_upload_link 给一条可编辑记录的某个文件字段发一个上传链接：10 分钟内有效、只能用一次、只限发链接的本人登录后使用。
• 为什么改：卡片 MCP cannot read or attach files: no tool downloads an attachment (e.g. a policy PDF to analyse) and none attaches one (e.g. a photographed invoice) to a record #30892，agent 以前读不到记录上的文件，也不能把文件挂到记录上。权限完全跟随记录：读不到记录就答与 get_record 相同的 404。
• 风险与回滚：新增两条需要登录的路由（GET/PUT /api/v1/storage/upload-links/:token），未登录答 401，不是匿名入口（按你的裁决 B，6691366983）。令牌 256 位随机，库里只存 SHA-256；已用、过期、不存在、别人的链接答同一个 404；链接行记的使用人必须等于该行只读的上传人 owner_id。回滚＝撤销本 PR。
• 先看：packages/services/service-storage/src/record-file-access.ts（openLink 的检查与 consumeUploadLink 的顺序），storage-routes.ts 的两条 upload-links 路由。
• 两分钟验证：pnpm --filter @objectstack/service-storage exec vitest run src/record-file-access.integration.test.ts，预期 22 条全绿。
• 需要你做的：本 PR 共 4,063 行改动，超过 3,000 行的人工合并门槛，需要你以 os-zhuang 批准一次；批准后席位 2 落地。

席位意见：可以落地（待 os-zhuang 批准）。

席位核对

ACCEPT · seat domain:server#2 · head 57724d86 · 2026-11-06T19:35Z

1. Shape: Fixes #30892, draft, base main, 30 files, +3979/−84 (4,063 changed lines; check-governed-merges --pr 31009: 0 of 30 paths governed, but over the 3,000-line human-merge line ⇒ Tier H, HUMAN MERGE OR AUTHORIZED APPROVAL). Clause-②: yes (widening), Metadata-protocol: none. Take-over claim 6691779259 (hand-off 6690566522).
2. Premise: an MCP client could read a record's fields but not its files, and could not attach one. Ruling B (6691366983): the upload link needs the issuer's own sign-in.
3. Review: CONTRACT_REVIEW_TIER review 6691738005 (PASS, 0 must-fix). Should-fix 1 is in 8d23d823, read by the seat: openLink also refuses unless row.owner_id === state.user_id (the readonly uploader column), with the same 404; a new pin rewrites a link row's binding to another user and both users get the 404 with nothing spent; dev ablation of that line → expected 200 to be 404, restored to HEAD. Should-fix 2 (body states ruling B, the revert line dropped) is in the body. Should-fix 3 (a signed-out browser gets a JSON 401, not a page) is out of scope; the seat files it as a storage follow-up card.
4. Gates / check-runs: the merge of main at 57724d86 resolved one conflict, the tenant-audit census (regenerated, 265 sites, the page's 15 stated figures moved). Check-runs on 57724d86: 61 success, 9 skipped, 0 failed. Dev report 6693590942: storage 1,389, mcp 714, typechecks 0, 5 dogfood files 114 tests, derived gates 84/84. The console SKILL.md drift pin (fix(console): the skill download teaches delete_record confirm: true and mirrors the served SKILL.md #31015) stays green: the two file tools render only when the host says its bridge carries them, which the console copy does not.
5. Accepted deviations / serial notes: feat(mcp): delete_records deletes many records of one object in one confirmed call #31024 (MCP: delete records by filter in one confirmed call, with refusals grouped by reason, instead of one delete_record per row #30891, MCP bulk delete) touches the same tool count and prose in 3 hunks; whichever lands second resolves them (merged count 15) and re-runs the census if it moved. On landing the seat notifies security#1 (a new token-bearing route pair).
6. Landing: Tier H by size: the PR stays draft, pm:awaiting-merge, reviewers os-zhuang and hotlong requested. After os-zhuang's approval the seat readies it and arms auto-merge on the maintainer's word 「你应该使用 pm-dispatch 技能审核和落地pr」(2026-11-06T16:49Z).