qbit-record-files/docs/TODO.md

Record Files release gates

Current authoritative local-v1 requirement/evidence assessment: V1-REMAINING.md. Historical entries below are retained. Checkpoint ownership (49 tests), native collection corrections, managed attachment HTTP (2 tests), and compiled dependency enforcement (4 tests) passed. The later MySQL aggregate/control transport failures remain unresolved; the matched Mobile/API consumer gate remains pending.

Status: development snapshot undergoing implementation and real JDBC verification, not production 1.0. Current status is in V1-REMAINING.md. Initial Claude sources were uncompiled; that historical limitation no longer describes the current tree.

Current implementation and verification work

• Verify the new transactional vocabulary service and standard QQQ form processes, including rollback, stale forms, permission revocation and visible history.
• Complete full-suite verification of independent audit transactions, atomic state/outcome commits, replay recovery, concurrent collection/intake requests, monotonic retention and exact-version content API. Fix findings; do not waive behavior tests.
• Finish parent-owned resumable ingestion transport/discovery/OpenAPI and real HTTP/channel/CSRF tests. Sessions, strict JSON, verified staging chunks, finalization, quota and cleanup services exist; their current status is recorded by the parent.
• Verify the standard desktop attachment panel, mobile scanner/gallery and print-adapter consumers against a compiled contract. Persisted originals and business release are different: a complete upload receipt may describe quarantined files in an OPEN collection.
• Add the user-facing review/category/collection surfaces and their accessibility/empty/error/recovery states. Categories are installation-global; tenant-specific vocabulary is not promised by the current metadata.

Database and durability

• MySQL8.4 pinned disposable provider acceptance passed11 native tests within a clean167-test full install. Preserve its exact connection/schema/durability/isolation/timeout checks and qualify the intended deployed provider separately. See MYSQL.md. Aurora, PostgreSQL and unrelated full Collaboration schemas remain unqualified.

• The audit adapter qualifies file-backed H2 with WRITE_DELAY=0 and the explicitly checked MySQL8.4/InnoDB contract; it rejects no-op/memory transactions. Qualify the intended deployed engine, driver, pooling/isolation behavior and durable settings before enabling it.

• Generate and execute versioned migrations for the qualified database, including owner attachment intake uniqueness, retained identities, collection ordinals and session/quota indices. The generated H2 initial schema now runs in all service fixtures (93-test full pass); versioned upgrade/rollback remains separate work. The original PostgreSQL script is an unqualified design artifact: core RC20 has no qualified PostgreSQL strategy here. Do not call that script production-tested.

• Application retention and immutable-field guards do not establish WORM storage or protect against a privileged database administrator. Qualify storage versions/Object Lock, lifecycle settings, protected backups, restoration and restart recovery.

• Retryable originals currently have the owner's 20 MiB bound. Larger files require separately qualified conditional multipart semantics. Never silently overwrite an uncertain original.

• Standard-panel retained registrations now have a durable owner journal and original-actor native recovery. Disabled/deleted original actors still require separately authorized administrative reconciliation. Coordinated archive/delete preserves access under captured supported direct-lock policy; uncoordinated deletes and unsupported policy shapes remain denied.

Security and audit

• Integrate required content sniffing/malware policy; quarantine defaults true and manual release is a permissioned action, not a scan verdict.
• Finish isolated preview-origin and active-content review. Do not infer safety from a declared MIME type.
• URL-issuance and verified server-read events exist. A completed user transfer requires a serving gateway/storage observation; a queue acknowledgement never proves physical printing. Physical confirmations require the host verifier to authenticate connector/job/file authority.
• Independent events cannot have database FKs that block on rows locked by their calling metadata transaction. Preserve immutable source IDs for historical correlation without false success claims.
• Raw counts/aggregates of parent-guarded rows remain denied until safely scoped. Post-filtered pages can be short; qualify projections, joined labels, exports and parent deletion behaviors.
• Complete canonical security scan and architecture/client/server review on the fixed release candidate, including untrusted script boundaries in the separate scripting QBit. This QBit must never expose its privileged store to scripts.

Release engineering

• Replace local snapshot Collaboration dependency with a released supported owner contract; keep the dependency direction one-way and use only owner APIs.
• Measure meaningful coverage and apply the agreed quality gate; configure CI and dependency/license checks.
• Benchmark bounded concurrency, storage and database failure behavior, quotas, pool exhaustion and worst-case batch workloads.
• Supply health/readiness, operational metrics/alerts, configuration guide, reconciliation/restore runbooks and migration/rollback procedures.
• No commit, push or deployment is authorized by these documentation items; coordinate any release action with the parent and user.

Archive acceptance in progress

• The combined142-test Record Files install passed, including eleven archive and five owner-recovery cases. Re-run the full suite after native management workflow/navigation changes; do not substitute the prior frozen artifact as evidence for new source.

• Qualify the owner transfer's cleared mirrored locks and scoped Count/Aggregate behavior; generic totals must not reveal archive tenants or cause list pages to request unavailable capabilities.

• Verify the staged owner journal/recovery process end to end and expose pending-upload recovery from the attachment panel. Never clear a pending possible original by timeout or a missing attachment row. Design a separately audited trusted reconciliation path for disabled/deleted original actors; current recovery intentionally requires the original actor.

• Add explicit, audited policy migration before claiming continued access after source lock-policy/table-definition removal. Joined/custom/personalized capture and cross-database deletion remain unsupported.

• Verify broad native-table pagination with interleaved unauthorized and authorized rows. Post-query visibility filtering can produce empty/short pages before later visible rows; source-pinned panels and exact archive reads are correct, but broad discovery needs an authorization-aware continuation contract or a secured source-pinned browsing flow. Do not infer end-of-list solely from the filtered page length.

Native management workflow acceptance

• Verify new standard actions for category/review/release/failure and collection create/add/reorder/finalize. They call existing services; tests cover confirmation, permission revocation, duplicate membership, exact order, quarantine finalization and retry audit behavior.
• Verify source-pinned retained file/collection links and owned collection-item association in the installed UI. The generic relatedViews metadata validator accepts no external URL or executable expression.
• A newly launched create-collection action intentionally creates a new collection; there is no claim of distributed exactly-once retries for manual process creation. Existing item-add/finalize retries fail safely, and identical review/category calls retain service idempotency.

Tracked delivery follow-through

• RF aggregate155-test install passed; parent freezes the new consumer artifact bundle.
• Complete bounded inert PDF.js canvas preview verification with the verified-byte helper; no active HTML/SVG inline rendering.
• Verify generation optional bridge authenticated-mode propagation against the newly installed owner/RF artifacts.
• Deployment must enable tracked download configuration, allocate aggregate host heap/concurrency, and enforce a bounded connector/proxy output-idle timeout. Legacy signed URL issuance alone is not observed delivery.

Authorized browsing

• Verify the final unknown-completeness metadata/source-marker snapshot with native and desktop gates; see AUTHORIZED-BROWSING.md. No raw totals, unbounded refill or end-of-results claim is permitted. Source-pinned Files tabs remain the preferred narrowing workflow.

• Owner Files-tab API ListAttachmentsSpec currently loads all pinned-source attachments before slicing. Replace that owner path with native bounded SQL pagination under its existing current-parent/cursor contract; broad RF native queries and Review links are already bounded. No hidden truncation or unrelated registry.

Current native navigation correction — 2026-10-31

• Move Record Files app registration into production producer; native file/collection/configuration table actions work independently of a demo or Collaboration app layout.
• Record combined producer/headless API verification after the shared source gate completes.

Native trusted print reporting

• Stage client-neutral record_files_observe_print form/process through the existing trusted observation service and production navigation.
• Parent gate 57042 passed TrustedPrintObservationProcessTest (6), TrustedPrintObservationTest (12) and ProducerAndSchemaTest (9): 27 tests and Checkstyle, covering native discovery/replay/denial/audit failure.

2026-11-01 OPEN collection corrections — staged

Caption edits, soft membership exclusion/same-ID restore, and explicit title/expected-count correction are staged with native processes, additive H2/MySQL migrations and authorization/audit/replay tests. No new source gate has run yet. Apply the matching migration before adoption; existing rows remain active and old upload receipts remain immutable. See COLLECTION-CORRECTIONS.md. Prior collection HTTPS gate passed 3 tests but does not qualify this new correction delta.

2026-11-01 collection correction follow-up

Initial focused correction gate passed 47; full RF 212 had one pre-service MySQL fixture connection reset (211 passed), retained as failed evidence. A newly staged finalizer-owned append scope now blocks ordinary additions during FINALIZING/FAILED while preserving same-transaction genuine checkpoints and capture authorization through commit. New tests and HTTP correction acceptance remain pending root gates; no live database/cohort adoption. See COLLECTION-CORRECTIONS.md.

2026-11-01 existing attachment adoption (source only)

Owner-native ID-only adoption and aligned host managed parent metadata are staged. Gates pending: owner5 + RF8 + native HTTP2. See EXISTING-ATTACHMENT-ADOPTION.md. No live original/runtime/schema/artifact changes; preserve prior collection/provider failure evidence.

• Verify staged generated-file admission policy (intake/parser tests and actual native Preview + external-upload quarantine); keep product default inherited and live adoption separate.