@elytracms/studio 0.0.101 → 0.0.103

package/convex/asset-meta-patch.test.ts

@@ -4,7 +4,7 @@ import { convexTest } from 'convex-test'
 import type { ConvexHttpClient } from 'convex/browser'
 import type { FunctionReference } from 'convex/server'
 import { defaultAssetCollection, measureMaxDepth } from '@elytracms/core/cms-core'
-import { InMemoryBlobStorage, InMemoryPersistenceAdapter, PersistenceValidationError, assetAlt } from '@elytracms/core/persistence'
+import { InMemoryBlobStorage, InMemoryPersistenceAdapter, PersistenceValidationError } from '@elytracms/core/persistence'
 import type { AssetRepository } from '@elytracms/core/persistence'
 import { ConvexPersistenceAdapter } from '../src/lib/persistence/convex-adapter'
 import { runUpload } from '../src/lib/assets/upload'
@@ -29,8 +29,7 @@ afterEach(() => {
  * EC-634 — an asset's `meta` is written per key, inside the mutation, on BOTH adapters:
  * two sessions (two adapters over ONE backend — two studio tabs on one deployment) whose
  * dialog saves interleave keep both keys; a dialog save landing while a file replace is in
- * flight survives the replace; a not-yet-migrated legacy `alt` column is lifted into the
- * stored bag by the same transaction. convex-test serialises mutations, so this proves the
+ * flight survives the replace. convex-test serialises mutations, so this proves the
  * per-key MERGE in `assets:upsert`, not Convex's OCC retry (which re-runs the same handler
  * against the newer row — the merge is what makes that retry correct).
  */
@@ -42,7 +41,6 @@ const modules = {
 
 const PROJECT_ID = 'asset-meta-patch'
 const SESSION_USER_ID = 'user_admin'
-const STAMP = '2026-10-27T00:00:00.000Z'
 
 async function convexBackend() {
   const t = convexTest(schema, modules)
@@ -161,31 +159,13 @@ describe('EC-634 — asset meta is patched per key in the write, on both adapter
     expect(convex).toMatchObject({ alt: 'A harbour at dusk & boats', note: 'B note' })
   })
 
-  it('a patch lifts a not-yet-migrated legacy alt column into the stored bag, in the same mutation', async () => {
+  it('EC-708: a write naming alt is refused before the wire — the mutation declares no alt argument', async () => {
     const { t, a } = await convexBackend()
-    await t.run(async (ctx) => {
-      await ctx.db.insert('assets', {
-        assetId: 'legacy',
-        filename: 'l.jpg',
-        contentType: 'image/jpeg',
-        byteSize: 1,
-        storageKey: 'k_legacy',
-        alt: 'Column alt',
-        createdAt: STAMP,
-        updatedAt: STAMP,
-      })
-    })
-    // An edit of ANOTHER key: the alt it did not name moves home and is kept.
-    const kept = await a.upsertAsset(PROJECT_ID, { id: 'legacy', metaPatch: { credit: 'Ada' } })
-    expect(kept.meta).toEqual({ alt: 'Column alt', credit: 'Ada' })
-    expect(kept.alt).toBeUndefined()
-    expect(assetAlt(kept, null)).toBe('Column alt')
-    // A clear of the alt stays cleared — no column left to re-surface it (ASSETS D21).
-    const cleared = await a.upsertAsset(PROJECT_ID, { id: 'legacy', metaPatch: { alt: null } })
-    expect(assetAlt(cleared, null)).toBeNull()
-    const row = await t.run((ctx) => ctx.db.query('assets').filter((q) => q.eq(q.field('assetId'), 'legacy')).first())
-    expect(row?.alt).toBeUndefined()
+    await seed(a, { credit: 'Ada' })
+    await expect(a.upsertAsset(PROJECT_ID, { id: 'hero', alt: 'Column alt' } as never)).rejects.toThrow(/meta\.alt/)
+    const row = await t.run((ctx) => ctx.db.query('assets').filter((q) => q.eq(q.field('assetId'), 'hero')).first())
     expect(row?.meta).toEqual({ credit: 'Ada' })
+    expect(row && 'alt' in row).toBe(false)
   })
 
   it('EC-632 — per-locale buckets are stored by the real mutation, and the stored row measures its depth', async () => {

package/convex/assets.ts

@@ -1,9 +1,9 @@
 import { ConvexError, v } from 'convex/values'
 import type { GenericId, Validator } from 'convex/values'
 import type { DocumentByName, WithoutSystemFields } from 'convex/server'
-import { liftLegacyAlt as legacyAltLift, rejectedWriteMessage, resolveAssetWrite } from '@elytracms/core/persistence'
+import { rejectedWriteMessage, resolveAssetWrite } from '@elytracms/core/persistence'
 import type { DataModel } from './functions'
-import { internalMutation, mutation, query } from './functions'
+import { mutation, query } from './functions'
 import { requireCapability } from './guard'
 import { ingestBindingHolds } from './ingest'
 
@@ -26,9 +26,10 @@ const clearable = <T, F extends string>(validator: Validator<T, 'required', F>)
 /**
  * Write one asset (EC-577). The ONE write rule (`resolveAssetWrite`, shared with
  * the in-memory adapter) runs here, inside the transaction: a column absent from
- * the args keeps its stored value, `null` clears it, a value sets it — the legacy
- * `alt` column can only be cleared (EC-587: an asset's alt is `meta.alt`), and a
- * `metaPatch` changes `meta` per key against the row read here (EC-634). An edit is
+ * the args keeps its stored value, `null` clears it, a value sets it — there is no `alt`
+ * argument (EC-708: an asset's alt is `meta.alt`; the adapter refuses an `alt` write
+ * before the wire), and a `metaPatch` changes `meta` per key against the row read here
+ * (EC-634). An edit is
  * ONE `db.patch` — the rule's store patch, where a cleared column is `undefined`,
  * which `db.patch` removes — so the write-chokepoint triggers fire once. No stored
  * asset → ONE `db.insert` of the complete row (the `defaults` fill what the write
@@ -44,13 +45,6 @@ export const upsert = mutation({
     storageKey: v.optional(v.string()),
     width: clearable(v.number()),
     height: clearable(v.number()),
-    /**
-     * LEGACY column (EC-587): accepted on the wire only so a write that still sets it
-     * is refused BY THE RULE with a message naming `meta.alt` (not a bare validator
-     * error); `null` clears it. Dropped with the column once `liftLegacyAlt` ran on
-     * every deployment.
-     */
-    alt: clearable(v.string()),
     title: clearable(v.string()),
     url: clearable(v.string()),
     focalPoint: clearable(v.object({ x: v.number(), y: v.number() })),
@@ -124,35 +118,6 @@ export const upsert = mutation({
   },
 })
 
-/**
- * EC-587 — the one-shot migration of the legacy `alt` column: every asset row holding
- * it gets the value lifted into `meta.alt` (unless `meta` already carries an `alt`
- * key, which wins — it is what every reader already reads) and the column unset, by
- * the ONE pure rule (core `liftLegacyAlt`, shared with the in-memory runner
- * `liftLegacyAssetAlts`). Idempotent: a second run lifts nothing.
- *
- * Internal: run by an admin from the CLI, never by a client —
- * `npx convex run assets:liftLegacyAlt` (no args). Each lifted row is one `db.patch`
- * through the write-chokepoint triggers, so it schedules the asset's revalidation like
- * any asset edit (the delivered alt is unchanged by the lift; the sweep is harmless).
- * One transaction: Convex bounds it at 8192 written rows, far above any v1 library —
- * documented, not paginated (as `cms:clearDocuments`).
- */
-export const liftLegacyAlt = internalMutation({
-  args: {},
-  handler: async (ctx) => {
-    const rows = await ctx.db.query('assets').collect()
-    const lifted: string[] = []
-    for (const row of rows) {
-      const patch = legacyAltLift(row)
-      if (!patch) continue
-      await ctx.db.patch(row._id, patch as Partial<AssetDoc>)
-      lifted.push(row.assetId)
-    }
-    return { scanned: rows.length, lifted }
-  },
-})
-
 export const get = query({
   args: { assetId: v.string() },
   handler: async (ctx, args) => {

package/convex/cms.ts

@@ -12,9 +12,9 @@ import {
   unfoldValue,
 } from '@elytracms/core/cms-core'
 import type { CmsDocument, DocumentPatch, PatchLogKind, ReplacePrecondition } from '@elytracms/core/cms-core'
-import { isPinnableVersion, planVersionKindStamps } from '@elytracms/core/persistence'
+import { isPinnableVersion } from '@elytracms/core/persistence'
 import type { DocumentVersionKind } from '@elytracms/core/persistence'
-import { internalMutation, mutation, query } from './functions'
+import { mutation, query } from './functions'
 import type { MutationCtx, QueryCtx } from './functions'
 import { requireCapability } from './guard'
 import { assertWithinWriteLimits } from './write-limits'
@@ -866,33 +866,6 @@ export const listAllDocumentVersions = query({
   },
 })
 
-/**
- * EC-707 — the EC-585 kind stamping: every version row recorded before EC-585 (no `kind`)
- * gets the kind `isPinnableVersion` already reads it as — `label: 'published'` → `'publish'`,
- * anything else → `'snapshot'` (core `planVersionKindStamps`, the same inference) — so
- * pinnability is unchanged for every row, and once every deployment reads 0 kind-less rows
- * the tolerant branch and the optional `kind` can go (EC-707's deletions). Idempotent: a
- * second run stamps 0; a row that names a kind is never touched; nothing but `kind` is written.
- *
- * Internal: an admin runs it from the CLI, once per deployment — `npx convex run
- * cms:stampVersionKinds` (no args) → `{ scanned, stamped }`; `pnpm demo:reseed` runs it twice.
- * ONE transaction at a documented bound (`VERSION_KIND_STAMP_BOUND`: 4096 rows / 4 MiB of
- * rewritten rows, half of Convex's per-transaction write limits): it reads every version row,
- * as `listAllDocumentVersions` already does for delivery, and above the bound it throws
- * before writing anything — a refusal is whole, never a partial stamping. `documentVersions`
- * has no write-chokepoint trigger, so the stamp schedules no revalidation (delivery reads the
- * same pins before and after).
- */
-export const stampVersionKinds = internalMutation({
-  args: {},
-  handler: async (ctx) => {
-    const rows = await ctx.db.query('documentVersions').collect()
-    const stamps = planVersionKindStamps(rows)
-    for (const { row, kind } of stamps) await ctx.db.patch(row._id, { kind })
-    return { scanned: rows.length, stamped: stamps.length }
-  },
-})
-
 /**
  * Pin an EXISTING version live (EC-224 `pinVersion`, changeset revert). Pin integrity is
  * enforced here, in the transaction: the version must exist for THIS document

package/convex/delivery.ts

@@ -181,8 +181,8 @@ export async function loadSnapshot(
 
   // Editorial redirects (EC-303): only ENABLED entries serve — a disabled redirect is
   // stored but never live, in either perspective. EC-616: read through the redirect
-  // kind's one server-side reader (records + the marked legacy tolerant read) and
-  // decided by the ONE live-redirect rule, `readLiveRedirects` (EC-590 / EC-627 — this
+  // kind's one server-side reader (the `records` store) and decided by the ONE
+  // live-redirect rule, `readLiveRedirects` (EC-590 / EC-627 — this
   // was the last hand-built copy on Convex). EC-628: a stored redirect the rule cannot
   // read (a non-boolean switch, a non-string `to`) is withheld AND reported — the host
   // carries `redirectIssues` into its source issues — instead of being served or dropped

package/convex/ingest.test.ts

@@ -77,11 +77,12 @@ const testIngestModule = {
       }
       if (payload.kind !== 'submission') return { ok: false, status: 422, message: 'Not a submission.' }
       if (payload.target !== 'contact') return { ok: false, status: 404, message: `No form “${payload.target}”.` }
+      // EC-750: the row's id first — the claim binds every file to it (the owner release is asked for).
+      const id = `sub_${(await ctx.db.query('records').collect()).length + 1}`
       // EC-695: one call for every upload, after every check that can refuse — all bound or none.
-      const claim = await claimIngestUploads(ctx, payload.uploads ?? [], payload.target, args.receivedAt)
+      const claim = await claimIngestUploads(ctx, payload.uploads ?? [], payload.target, args.receivedAt, id)
       if (!claim.ok) return claim
       const files = claim.files.map((file) => file.storageId)
-      const id = `sub_${(await ctx.db.query('records').collect()).length + 1}`
       await saveRecord(
         ctx,
         testSubmissionKind,
@@ -340,9 +341,10 @@ describe('the ingest receiver — dispatch (EC-617)', () => {
 /**
  * EC-671 — a claim binds only bytes the deployment's own facts say are this intent's, each
  * check isolated (the others pass by construction) beside a control the same harness claims;
- * and `releaseIngestUploads` deletes only what a claim bound. The forms addon's end-to-end
- * probe (its rollback and removal, the attacker's harvest) is
- * `packages/forms/src/convex/claim-ownership.convex.test.ts`.
+ * and `releaseIngestUploads` deletes only what a claim bound to the OWNER it is asked for
+ * (EC-750). The forms addon's end-to-end probes (its rollback and removal, the attacker's
+ * harvest; a sibling's removal) are `packages/forms/src/convex/claim-ownership.convex.test.ts`
+ * and `sibling-release.convex.test.ts`.
  */
 describe('the claim binds only this intent’s bytes; release deletes only bound bytes (EC-671)', () => {
   const PNG = { kind: 'upload', target: 'contact', field: 'cv', contentType: 'image/png', size: 500 } as const
@@ -352,6 +354,11 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
   }
   const claimWith = (t: ReturnType<typeof backend>, uploadId: string, storageId: string) =>
     signedPost(t, { ...SUBMISSION, uploads: [{ uploadId, storageId }] })
+  /** The id of the row an accepted submission wrote — the owner its claim bound the files to (EC-750). */
+  const ownerOf = async (answer: Response) => {
+    expect(answer.status).toBe(200)
+    return ((await answer.json()) as { id: string }).id
+  }
   async function insertAsset(t: ReturnType<typeof backend>, files: { storageKey: string; thumb?: string }) {
     await t.run(async (ctx) => {
       await ctx.db.insert('assets', {
@@ -372,6 +379,15 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
         .filter((row) => row.kind === 'ingestBinding')
         .map((row) => ({ storageId: row.recordId, uploadId: (row.data as { uploadId: string }).uploadId })),
     )
+  /** EC-750: every binding's owner, by its storage id. */
+  const owners = (t: ReturnType<typeof backend>) =>
+    t.run(async (ctx) =>
+      Object.fromEntries(
+        (await ctx.db.query('records').collect())
+          .filter((row) => row.kind === 'ingestBinding')
+          .map((row) => [row.recordId, (row.data as { owner: string }).owner]),
+      ),
+    )
 
   it('(1) a file stored BEFORE the intent — in the same millisecond — is refused, rejected and kept; one stored after is claimed', async () => {
     env()['ELYTRA_INGEST_SECRET'] = SECRET
@@ -429,18 +445,24 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
     expect([await stored(t, original), await stored(t, preview)]).toEqual([true, true])
   })
 
-  it('releaseIngestUploads deletes a bound file and its binding, keeps an unbound one (an asset’s), and dedupes', async () => {
+  it('EC-750: releaseIngestUploads deletes the files its OWNER claimed, with their bindings — never another owner’s, never an asset’s', async () => {
     env()['ELYTRA_INGEST_SECRET'] = SECRET
     const t = backend()
-    const uploadId = await declare(t)
+    const [mine, theirs] = [await declare(t), await declare(t)]
     const own = await storeFile(t, 400, 'image/png')
-    expect((await claimWith(t, uploadId, own)).status).toBe(200)
+    const other = await storeFile(t, 400, 'image/png')
+    const owner = await ownerOf(await claimWith(t, mine, own))
+    const otherOwner = await ownerOf(await claimWith(t, theirs, other))
     const assetFile = await storeFile(t, 400, 'image/png')
     await insertAsset(t, { storageKey: assetFile })
-    const released = await t.run((ctx) => releaseIngestUploads(ctx, [own, assetFile, own]))
-    expect(released).toEqual({ deleted: [own], kept: [assetFile] })
-    expect([await stored(t, own), await stored(t, assetFile)]).toEqual([false, true])
-    expect(await bindings(t)).toEqual([])
+    expect(await owners(t)).toEqual({ [own]: owner, [other]: otherOwner })
+    const released = await t.run((ctx) => releaseIngestUploads(ctx, owner))
+    expect(released).toEqual({ deleted: [own], kept: [] })
+    expect([await stored(t, own), await stored(t, other), await stored(t, assetFile)]).toEqual([false, true, true])
+    expect(await bindings(t)).toEqual([{ storageId: other, uploadId: theirs }])
+    // An owner with nothing bound any more (released already, or a row that never claimed) deletes nothing.
+    expect(await t.run((ctx) => releaseIngestUploads(ctx, owner))).toEqual({ deleted: [], kept: [] })
+    expect(await t.run((ctx) => releaseIngestUploads(ctx, 'sub_never'))).toEqual({ deleted: [], kept: [] })
   })
 
   // EC-685 (Codex r4 F20, ordering 2): a fact checked at claim time is not permanent — an
@@ -460,12 +482,20 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
     const promoted = await storeFile(t, 400, 'image/png')
     const preview = await storeFile(t, 40, 'image/png')
     const unreferenced = await storeFile(t, 400, 'image/png')
-    for (const [uploadId, file] of [[asFile, promoted], [asThumb, preview], [plain, unreferenced]] as const) {
-      expect((await claimWith(t, uploadId, file)).status).toBe(200)
-    }
+    // One submission claims all three (EC-750: one owner).
+    const owner = await ownerOf(
+      await signedPost(t, {
+        ...SUBMISSION,
+        uploads: [
+          { uploadId: asFile, storageId: promoted },
+          { uploadId: asThumb, storageId: preview },
+          { uploadId: plain, storageId: unreferenced },
+        ],
+      }),
+    )
     // An editor promotes two of the uploads to an asset (its file and its preview) — after the claims.
     await insertAsset(t, { storageKey: promoted, thumb: preview })
-    const released = await t.run((ctx) => releaseIngestUploads(ctx, [promoted, preview, unreferenced]))
+    const released = await t.run((ctx) => releaseIngestUploads(ctx, owner))
     expect(released).toEqual({ deleted: [unreferenced], kept: [promoted, preview] })
     expect([await stored(t, promoted), await stored(t, preview), await stored(t, unreferenced)]).toEqual([true, true, false])
     expect(await bindings(t)).toEqual([]) // ownership passed: no binding is left to hold the asset's bytes
@@ -480,7 +510,7 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
     const t = backend()
     const uploadId = await declare(t)
     const own = await storeFile(t, 400, 'image/png')
-    expect((await claimWith(t, uploadId, own)).status).toBe(200)
+    const owner = await ownerOf(await claimWith(t, uploadId, own))
     await insertAsset(t, { storageKey: own }) // promoted to an asset while the submission still holds it
     const editor = await asEditor(t)
     expect(await editor.mutation(deleteBlob, { storageKey: own })).toEqual({ deleted: false, heldBy: 'ingest' })
@@ -490,7 +520,7 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
     await t.run(async (ctx) => {
       for (const row of await ctx.db.query('assets').collect()) await ctx.db.delete(row._id)
     })
-    expect(await t.run((ctx) => releaseIngestUploads(ctx, [own]))).toEqual({ deleted: [own], kept: [] })
+    expect(await t.run((ctx) => releaseIngestUploads(ctx, owner))).toEqual({ deleted: [own], kept: [] })
     expect(await stored(t, own)).toBe(false)
   })
 
@@ -593,9 +623,12 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
     const t = backend()
     const uploadId = await declare(t)
     const own = await storeFile(t, 400, 'image/png')
-    expect((await claimWith(t, uploadId, own)).status).toBe(200)
+    const owner = await ownerOf(await claimWith(t, uploadId, own))
     const row = await t.run(async (ctx) => (await ctx.db.query('records').collect()).find((r) => r.kind === 'ingestBinding')!)
-    expect(row.data).toEqual({ uploadId, target: 'contact', boundAt: '2026-10-26T12:00:00.000Z' })
+    expect(row.data).toEqual({ uploadId, target: 'contact', owner, boundAt: '2026-10-26T12:00:00.000Z' })
+    // EC-750: the owner fills the static `key1` slot (`by_kind_key1`) — no schema or index change.
+    expect(row.key1).toBe(owner)
+    expect(row.key2).toBeUndefined()
     expect(measureMaxDepth(row).depth).toBe(2) // the row object → `data` → its string columns
     expect(measureMaxDepth(row).depth).toBeLessThanOrEqual(CONVEX_MAX_NESTING_DEPTH)
   })
@@ -610,7 +643,7 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
       ),
     )
   const claimDirect = (t: ReturnType<typeof backend>, claims: { uploadId: string; storageId: string }[]) =>
-    t.run((ctx) => claimIngestUploads(ctx, claims, 'contact', '2026-10-26T12:00:00.000Z'))
+    t.run((ctx) => claimIngestUploads(ctx, claims, 'contact', '2026-10-26T12:00:00.000Z', 'sub_direct'))
 
   it('EC-695: a submission with one refused claim binds NOTHING — the claims before it stay issued; nothing is deleted', async () => {
     env()['ELYTRA_INGEST_SECRET'] = SECRET

package/convex/ingest.ts

@@ -18,7 +18,7 @@ import type { IngestHandlerResult, IngestPayload, IngestUploadClaim } from '@ely
 import { defineRecordKind, resolveRecordQuery } from '@elytracms/core/persistence'
 import { createUuidIdFactory } from '@elytracms/core/determinism'
 import type { MutationCtx, QueryCtx } from './functions'
-import { findRecordDoc, listRecordWire, saveRecord } from './record-functions'
+import { findRecordDoc, listRecordWire, queryRecordDocs, saveRecord } from './record-functions'
 
 /**
  * EC-617 — the ONE inbound receiver of the public ingest seam (ruling EC-565 § 6c), and the
@@ -44,7 +44,8 @@ import { findRecordDoc, listRecordWire, saveRecord } from './record-functions'
  *    claims its stored files with {@link claimIngestUploads}, which checks that the deployment
  *    stored each for ITS intent (EC-671) — its bytes the ones the upload request declared by
  *    SHA-256 (EC-685) — and that it matches the declared size and type, and binds them all or
- *    none (EC-695); {@link releaseIngestUploads} is the only way such bytes are deleted.
+ *    none (EC-695) to the record that claims them (EC-750); {@link releaseIngestUploads}, asked
+ *    for that record, is the only way such bytes are deleted.
  *
  * The engine never imports an addon: the handler is an internal-mutation REFERENCE the
  * consumer passes in its one `http.ts` line (`defineStudioHttp({ auth, ingest: {
@@ -195,6 +196,11 @@ export function ingestReceiver(handlers: IngestHandlers = {}): PublicHttpAction
 // it never deletes, and ingest bytes are deleted only through {@link releaseIngestUploads},
 // which deletes only what a claim bound.
 //
+// EC-750 (Codex r9 F46) — bound to WHOM. A binding records the record that claimed the file
+// (`owner`), and release is asked for an owner, never for storage ids: removing a row deletes
+// only the files that row claimed. Before, release took the removed row's `files` ids — a column
+// a whole-record write can fill with another row's file — and deleted any bound one.
+//
 // EC-685 — causation. Eligibility (stored after the intent, unbound, no asset's) is not
 // ownership: with intents A and B open, bytes stored through B's URL were eligible for A. So
 // the intent DECLARES the bytes' SHA-256 before they exist, and the claim requires the digest
@@ -236,14 +242,25 @@ export const ingestUploadRecordKind = defineRecordKind({
  * and "is it bound?" is one indexed read. Written only by {@link claimIngestUploads}, in the
  * claim's transaction; read by the claim (a file another claim bound is refused) and by
  * {@link releaseIngestUploads}. Engine-internal (no public functions), like the intent.
+ *
+ * EC-750 (Codex r9 F46) — and WHOSE: `owner` is the id of the record that claimed the file (a
+ * forms submission), its `key1` slot, so "this record's files" is one indexed read
+ * (`by_kind_key1`) and release asks that question, never "is this id bound?". `target` is the
+ * intent's (the form every submission to it shares), so it cannot say whose a file is. A
+ * binding written before EC-750 has no owner and no slot: no release reads it, so it is never
+ * deleted and keeps protecting its bytes from `assets:deleteBlob` (residue, never loss — EC-671's
+ * no-migration precedent).
  */
 export const ingestBindingRecordKind = defineRecordKind({
   kind: 'ingestBinding',
   module: 'ingest',
+  keys: ['owner'],
   time: 'boundAt',
   fields: {
     uploadId: z.string().min(1),
     target: z.string().min(1),
+    /** EC-750: the id of the record that claimed the file — what {@link releaseIngestUploads} is asked for. */
+    owner: z.string().min(1),
     boundAt: z.string().min(1),
   },
 })
@@ -403,12 +420,18 @@ async function assetReferencesStorage(ctx: MutationCtx, storageId: string): Prom
  * A handler calls this ONCE per submission, after every check of its own that can refuse: a
  * mutation that RETURNS commits its writes (a claim made before a later refusal stays bound with
  * no row to hold it); one that THROWS commits nothing.
+ *
+ * EC-750: `owner` is the id of the record the handler is about to write — mint it BEFORE the
+ * claim. Every binding records it, and {@link releaseIngestUploads} deletes a file only for the
+ * owner that claimed it: a row naming another row's file (an editor's whole-record write can
+ * put any id in its `files`) never deletes it.
  */
 export async function claimIngestUploads(
   ctx: MutationCtx,
   claims: readonly IngestUploadClaim[],
   target: string,
   receivedAt: string,
+  owner: string,
 ): Promise<IngestUploadsClaimResult> {
   const accepted: AcceptedClaim[] = []
   for (const [index, claim] of claims.entries()) {
@@ -418,7 +441,13 @@ export async function claimIngestUploads(
   }
   const stamps = { createdAt: receivedAt, updatedAt: receivedAt }
   for (const claim of accepted) {
-    await saveRecord(ctx, ingestBindingRecordKind, claim.storageId, { uploadId: claim.uploadId, target, boundAt: receivedAt }, stamps)
+    await saveRecord(
+      ctx,
+      ingestBindingRecordKind,
+      claim.storageId,
+      { uploadId: claim.uploadId, target, owner, boundAt: receivedAt },
+      stamps,
+    )
     await saveRecord(ctx, ingestUploadRecordKind, claim.uploadId, { state: 'claimed', storageId: claim.storageId }, stamps)
   }
   return { ok: true, files: accepted.map(({ storageId, field, contentType, size }) => ({ storageId, field, contentType, size })) }
@@ -508,18 +537,25 @@ async function judgeIngestUploadClaim(
 }
 
 /**
- * Delete ingest bytes an addon holds (EC-671) — the ONE way they are deleted, and it deletes
- * only files a claim BOUND that no asset references NOW: the bytes and their binding go
- * together. Any other id is KEPT and returned in `kept`:
+ * Delete the ingest bytes ONE record claimed (EC-671, EC-750) — the ONE way ingest bytes are
+ * deleted. It is asked for an OWNER (the id {@link claimIngestUploads} bound the files to), never
+ * for storage ids: it reads that owner's bindings by their key (`by_kind_key1`) and deletes each
+ * file with its binding — so it never sees, and never writes, another owner's binding. A row's
+ * `files` column is the visitor's and the editor's word (a whole-record write can name any id,
+ * or clear the list), so release never reads it: a row naming another row's file deletes
+ * nothing, and a row whose list was cleared still deletes what it claimed.
+ *
+ * Of the owner's files it KEEPS, returned in `kept`:
  *
- * - an id with no binding — an asset's, an id a write put into a row by hand, a file claimed
- *   before bindings existed — because ingest cannot show it owns them;
  * - EC-685: a bound file an asset row references now (`storageKey` or `thumb.storageKey` — an
  *   editor promoted the upload to an asset with `assets:upsert`, a legitimate edit). Ownership
  *   has passed to the asset: the binding is spent (deleted) and the bytes stay, so the
  *   asset's own delete removes them later. Read in this transaction, so no asset can acquire
  *   the file between the check and the delete.
  *
+ * Never touched: a binding of another owner, and a binding written before EC-750 (no owner, no
+ * key slot — residue, never loss; it keeps protecting its bytes from `assets:deleteBlob`).
+ *
  * Call it when removing a row that holds claimed files — never for a refused submission, which
  * bound nothing ({@link claimIngestUploads}, EC-695). The mirror is `assets:deleteBlob`, which keeps bytes a binding holds
  * ({@link ingestBindingHolds}): each delete path re-checks the OTHER owner in its own
@@ -527,16 +563,17 @@ async function judgeIngestUploadClaim(
  */
 export async function releaseIngestUploads(
   ctx: MutationCtx,
-  storageIds: readonly string[],
+  owner: string,
 ): Promise<{ deleted: string[]; kept: string[] }> {
   const deleted: string[] = []
   const kept: string[] = []
-  for (const storageId of new Set(storageIds)) {
-    const binding = await findRecordDoc(ctx, ingestBindingRecordKind, storageId)
-    if (!binding) {
-      kept.push(storageId)
-      continue
-    }
+  const owned = await queryRecordDocs(
+    ctx,
+    ingestBindingRecordKind,
+    resolveRecordQuery(ingestBindingRecordKind, { where: { owner } }),
+  )
+  for (const binding of owned) {
+    const storageId = binding.recordId
     await ctx.db.delete(binding._id)
     if (await assetReferencesStorage(ctx, storageId)) {
       kept.push(storageId) // the asset owns the bytes now (EC-685)