@elytracms/studio 0.0.102 → 0.0.104

package/convex/ingest.test.ts

@@ -10,13 +10,14 @@ import {
   signedIngestRequest,
 } from '@elytracms/core/ingest'
 import type { IngestHandlerResult, IngestPayload } from '@elytracms/core/ingest'
-import { defineRecordKind } from '@elytracms/core/persistence'
+import { defineRecordKind, resolveRecordQuery } from '@elytracms/core/persistence'
 import schema from './schema'
 import { internalMutation } from './functions'
 import { defineStudioHttp } from './http'
 import { CONVEX_MAX_NESTING_DEPTH, measureMaxDepth } from '@elytracms/core/cms-core'
 import {
   claimIngestUploads,
+  ingestBindingRecordKind,
   ingestHandlerArgs,
   parseIngestPayload,
   recordIngestUpload,
@@ -24,7 +25,7 @@ import {
   unclaimedIngestUploads,
 } from './ingest'
 import type { IngestHandlerRef } from './ingest'
-import { saveRecord } from './record-functions'
+import { findRecordDoc, saveRecord } from './record-functions'
 import { createIngestRoute } from '../../next/src/ingest'
 
 beforeEach(() => {
@@ -77,11 +78,12 @@ const testIngestModule = {
       }
       if (payload.kind !== 'submission') return { ok: false, status: 422, message: 'Not a submission.' }
       if (payload.target !== 'contact') return { ok: false, status: 404, message: `No form “${payload.target}”.` }
+      // EC-750: the row's id first — the claim binds every file to it (the owner release is asked for).
+      const id = `sub_${(await ctx.db.query('records').collect()).length + 1}`
       // EC-695: one call for every upload, after every check that can refuse — all bound or none.
-      const claim = await claimIngestUploads(ctx, payload.uploads ?? [], payload.target, args.receivedAt)
+      const claim = await claimIngestUploads(ctx, payload.uploads ?? [], payload.target, args.receivedAt, testSubmissionKind, id)
       if (!claim.ok) return claim
       const files = claim.files.map((file) => file.storageId)
-      const id = `sub_${(await ctx.db.query('records').collect()).length + 1}`
       await saveRecord(
         ctx,
         testSubmissionKind,
@@ -97,11 +99,56 @@ const testIngestModule = {
 const handle = makeFunctionReference<'mutation'>('testIngest:handle') as unknown as IngestHandlerRef
 const silentAuth = { addHttpRoutes: () => {} }
 
+/**
+ * EC-762 (Codex r10 F51) — a third-party addon whose ONE submission handler writes two record
+ * kinds, each row under an EXPLICIT id the payload names (the records API accepts any nonempty
+ * id; ids are unique only within a kind). The target names the kind.
+ */
+const attachmentRequestKind = defineRecordKind({
+  kind: 'attachmentRequest',
+  module: 'testCases',
+  fields: { note: z.string().min(1), files: z.array(z.string()).optional() },
+})
+const supportCaseKind = defineRecordKind({
+  kind: 'supportCase',
+  module: 'testCases',
+  fields: { note: z.string().min(1), files: z.array(z.string()).optional() },
+})
+const caseKindOf = (target: string) =>
+  target === 'attachmentRequest' ? attachmentRequestKind : target === 'supportCase' ? supportCaseKind : undefined
+
+const testCasesModule = {
+  handle: internalMutation({
+    args: ingestHandlerArgs,
+    handler: async (ctx, args): Promise<IngestHandlerResult> => {
+      const payload: IngestPayload = parseIngestPayload(args.payload)
+      if (payload.kind === 'upload') {
+        return recordIngestUpload(ctx, payload, args.receivedAt, { maxBytes: 1000, contentTypes: ['image/*'] })
+      }
+      if (payload.kind !== 'submission') return { ok: false, status: 422, message: 'Not a submission.' }
+      const kind = caseKindOf(payload.target)
+      if (!kind) return { ok: false, status: 404, message: `No case kind “${payload.target}”.` }
+      const id = payload.data['id']
+      if (typeof id !== 'string' || id.length === 0) return { ok: false, status: 422, message: 'An id is required.' }
+      const claim = await claimIngestUploads(ctx, payload.uploads ?? [], payload.target, args.receivedAt, kind, id)
+      if (!claim.ok) return claim
+      const files = claim.files.map((file) => file.storageId)
+      await saveRecord(ctx, kind, id, { note: payload.target, ...(files.length ? { files } : {}) }, {
+        createdAt: args.receivedAt,
+        updatedAt: args.receivedAt,
+      })
+      return { ok: true, id }
+    },
+  }),
+}
+const casesHandle = makeFunctionReference<'mutation'>('testCases:handle') as unknown as IngestHandlerRef
+
 function backend(handlers: Parameters<typeof defineStudioHttp>[0]['ingest'] = { submission: handle }) {
   return convexTest(schema, {
     ...import.meta.glob(['./**/*.ts', '!./**/*.test.ts', '!./_generated/**']),
     './_generated/api.ts': async () => ({}),
     './testIngest.ts': async () => testIngestModule,
+    './testCases.ts': async () => testCasesModule,
     './http.ts': async () => ({ default: defineStudioHttp({ auth: silentAuth, ingest: handlers }) }),
   })
 }
@@ -340,9 +387,10 @@ describe('the ingest receiver — dispatch (EC-617)', () => {
 /**
  * EC-671 — a claim binds only bytes the deployment's own facts say are this intent's, each
  * check isolated (the others pass by construction) beside a control the same harness claims;
- * and `releaseIngestUploads` deletes only what a claim bound. The forms addon's end-to-end
- * probe (its rollback and removal, the attacker's harvest) is
- * `packages/forms/src/convex/claim-ownership.convex.test.ts`.
+ * and `releaseIngestUploads` deletes only what a claim bound to the OWNER it is asked for
+ * (EC-750). The forms addon's end-to-end probes (its rollback and removal, the attacker's
+ * harvest; a sibling's removal) are `packages/forms/src/convex/claim-ownership.convex.test.ts`
+ * and `sibling-release.convex.test.ts`.
  */
 describe('the claim binds only this intent’s bytes; release deletes only bound bytes (EC-671)', () => {
   const PNG = { kind: 'upload', target: 'contact', field: 'cv', contentType: 'image/png', size: 500 } as const
@@ -352,6 +400,11 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
   }
   const claimWith = (t: ReturnType<typeof backend>, uploadId: string, storageId: string) =>
     signedPost(t, { ...SUBMISSION, uploads: [{ uploadId, storageId }] })
+  /** The id of the row an accepted submission wrote — the owner its claim bound the files to (EC-750). */
+  const ownerOf = async (answer: Response) => {
+    expect(answer.status).toBe(200)
+    return ((await answer.json()) as { id: string }).id
+  }
   async function insertAsset(t: ReturnType<typeof backend>, files: { storageKey: string; thumb?: string }) {
     await t.run(async (ctx) => {
       await ctx.db.insert('assets', {
@@ -372,6 +425,15 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
         .filter((row) => row.kind === 'ingestBinding')
         .map((row) => ({ storageId: row.recordId, uploadId: (row.data as { uploadId: string }).uploadId })),
     )
+  /** EC-750: every binding's owner, by its storage id. */
+  const owners = (t: ReturnType<typeof backend>) =>
+    t.run(async (ctx) =>
+      Object.fromEntries(
+        (await ctx.db.query('records').collect())
+          .filter((row) => row.kind === 'ingestBinding')
+          .map((row) => [row.recordId, (row.data as { owner: string }).owner]),
+      ),
+    )
 
   it('(1) a file stored BEFORE the intent — in the same millisecond — is refused, rejected and kept; one stored after is claimed', async () => {
     env()['ELYTRA_INGEST_SECRET'] = SECRET
@@ -429,18 +491,24 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
     expect([await stored(t, original), await stored(t, preview)]).toEqual([true, true])
   })
 
-  it('releaseIngestUploads deletes a bound file and its binding, keeps an unbound one (an asset’s), and dedupes', async () => {
+  it('EC-750: releaseIngestUploads deletes the files its OWNER claimed, with their bindings — never another owner’s, never an asset’s', async () => {
     env()['ELYTRA_INGEST_SECRET'] = SECRET
     const t = backend()
-    const uploadId = await declare(t)
+    const [mine, theirs] = [await declare(t), await declare(t)]
     const own = await storeFile(t, 400, 'image/png')
-    expect((await claimWith(t, uploadId, own)).status).toBe(200)
+    const other = await storeFile(t, 400, 'image/png')
+    const owner = await ownerOf(await claimWith(t, mine, own))
+    const otherOwner = await ownerOf(await claimWith(t, theirs, other))
     const assetFile = await storeFile(t, 400, 'image/png')
     await insertAsset(t, { storageKey: assetFile })
-    const released = await t.run((ctx) => releaseIngestUploads(ctx, [own, assetFile, own]))
-    expect(released).toEqual({ deleted: [own], kept: [assetFile] })
-    expect([await stored(t, own), await stored(t, assetFile)]).toEqual([false, true])
-    expect(await bindings(t)).toEqual([])
+    expect(await owners(t)).toEqual({ [own]: owner, [other]: otherOwner })
+    const released = await t.run((ctx) => releaseIngestUploads(ctx, testSubmissionKind, owner))
+    expect(released).toEqual({ deleted: [own], kept: [] })
+    expect([await stored(t, own), await stored(t, other), await stored(t, assetFile)]).toEqual([false, true, true])
+    expect(await bindings(t)).toEqual([{ storageId: other, uploadId: theirs }])
+    // An owner with nothing bound any more (released already, or a row that never claimed) deletes nothing.
+    expect(await t.run((ctx) => releaseIngestUploads(ctx, testSubmissionKind, owner))).toEqual({ deleted: [], kept: [] })
+    expect(await t.run((ctx) => releaseIngestUploads(ctx, testSubmissionKind, 'sub_never'))).toEqual({ deleted: [], kept: [] })
   })
 
   // EC-685 (Codex r4 F20, ordering 2): a fact checked at claim time is not permanent — an
@@ -460,12 +528,20 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
     const promoted = await storeFile(t, 400, 'image/png')
     const preview = await storeFile(t, 40, 'image/png')
     const unreferenced = await storeFile(t, 400, 'image/png')
-    for (const [uploadId, file] of [[asFile, promoted], [asThumb, preview], [plain, unreferenced]] as const) {
-      expect((await claimWith(t, uploadId, file)).status).toBe(200)
-    }
+    // One submission claims all three (EC-750: one owner).
+    const owner = await ownerOf(
+      await signedPost(t, {
+        ...SUBMISSION,
+        uploads: [
+          { uploadId: asFile, storageId: promoted },
+          { uploadId: asThumb, storageId: preview },
+          { uploadId: plain, storageId: unreferenced },
+        ],
+      }),
+    )
     // An editor promotes two of the uploads to an asset (its file and its preview) — after the claims.
     await insertAsset(t, { storageKey: promoted, thumb: preview })
-    const released = await t.run((ctx) => releaseIngestUploads(ctx, [promoted, preview, unreferenced]))
+    const released = await t.run((ctx) => releaseIngestUploads(ctx, testSubmissionKind, owner))
     expect(released).toEqual({ deleted: [unreferenced], kept: [promoted, preview] })
     expect([await stored(t, promoted), await stored(t, preview), await stored(t, unreferenced)]).toEqual([true, true, false])
     expect(await bindings(t)).toEqual([]) // ownership passed: no binding is left to hold the asset's bytes
@@ -480,7 +556,7 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
     const t = backend()
     const uploadId = await declare(t)
     const own = await storeFile(t, 400, 'image/png')
-    expect((await claimWith(t, uploadId, own)).status).toBe(200)
+    const owner = await ownerOf(await claimWith(t, uploadId, own))
     await insertAsset(t, { storageKey: own }) // promoted to an asset while the submission still holds it
     const editor = await asEditor(t)
     expect(await editor.mutation(deleteBlob, { storageKey: own })).toEqual({ deleted: false, heldBy: 'ingest' })
@@ -490,7 +566,7 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
     await t.run(async (ctx) => {
       for (const row of await ctx.db.query('assets').collect()) await ctx.db.delete(row._id)
     })
-    expect(await t.run((ctx) => releaseIngestUploads(ctx, [own]))).toEqual({ deleted: [own], kept: [] })
+    expect(await t.run((ctx) => releaseIngestUploads(ctx, testSubmissionKind, owner))).toEqual({ deleted: [own], kept: [] })
     expect(await stored(t, own)).toBe(false)
   })
 
@@ -593,9 +669,19 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
     const t = backend()
     const uploadId = await declare(t)
     const own = await storeFile(t, 400, 'image/png')
-    expect((await claimWith(t, uploadId, own)).status).toBe(200)
+    const owner = await ownerOf(await claimWith(t, uploadId, own))
     const row = await t.run(async (ctx) => (await ctx.db.query('records').collect()).find((r) => r.kind === 'ingestBinding')!)
-    expect(row.data).toEqual({ uploadId, target: 'contact', boundAt: '2026-10-26T12:00:00.000Z' })
+    expect(row.data).toEqual({ uploadId, target: 'contact', ownerKind: 'testSubmission', owner, boundAt: '2026-10-26T12:00:00.000Z' })
+    // EC-762: the owner's kind fills the static `key1` slot and its id `key2`, read together
+    // through the existing `by_kind_keys` index — no schema or index change.
+    expect(row.key1).toBe('testSubmission')
+    expect(row.key2).toBe(owner)
+    expect(resolveRecordQuery(ingestBindingRecordKind, { where: { ownerKind: 'testSubmission', owner } })).toEqual({
+      index: 'by_kind_keys',
+      key1: 'testSubmission',
+      key2: owner,
+      order: 'asc',
+    })
     expect(measureMaxDepth(row).depth).toBe(2) // the row object → `data` → its string columns
     expect(measureMaxDepth(row).depth).toBeLessThanOrEqual(CONVEX_MAX_NESTING_DEPTH)
   })
@@ -610,7 +696,7 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
       ),
     )
   const claimDirect = (t: ReturnType<typeof backend>, claims: { uploadId: string; storageId: string }[]) =>
-    t.run((ctx) => claimIngestUploads(ctx, claims, 'contact', '2026-10-26T12:00:00.000Z'))
+    t.run((ctx) => claimIngestUploads(ctx, claims, 'contact', '2026-10-26T12:00:00.000Z', testSubmissionKind, 'sub_direct'))
 
   it('EC-695: a submission with one refused claim binds NOTHING — the claims before it stay issued; nothing is deleted', async () => {
     env()['ELYTRA_INGEST_SECRET'] = SECRET
@@ -680,6 +766,148 @@ describe('the claim binds only this intent’s bytes; release deletes only bound
   })
 })
 
+/**
+ * EC-762 (Codex r10 F51) — the first EXECUTABLE probe of F51's static trace. A record is
+ * identified by its kind AND its id (`record-functions.ts`, `findRecordDoc`), and an explicit id
+ * is unique only within its kind. One third-party handler writes `attachmentRequest/same` and
+ * `supportCase/same`, each claiming its OWN upload; removing one must not delete the other's.
+ */
+describe('EC-762 probe — an upload’s owner is the record’s kind AND id (Codex r10 F51)', () => {
+  const REMOVED_AT = '2026-10-26T12:00:00.000Z'
+  async function declareFor(t: ReturnType<typeof backend>, target: string): Promise<string> {
+    const intent = { kind: 'upload', target, field: 'cv', contentType: 'image/png', size: 500, sha256: await sha256Of(400) } as const
+    const answer = await signedPost(t, intent)
+    expect(answer.status).toBe(200)
+    return ((await answer.json()) as { uploadId: string }).uploadId
+  }
+  /** A genuine case of `target`'s kind under the explicit id `id`, claiming one upload of its own. Returns its file. */
+  async function genuineCase(t: ReturnType<typeof backend>, target: string, id: string): Promise<string> {
+    const uploadId = await declareFor(t, target)
+    const file = await storeFile(t, 400, 'image/png')
+    const answer = await signedPost(t, { kind: 'submission', target, data: { id }, uploads: [{ uploadId, storageId: file }] })
+    expect(answer.status).toBe(200)
+    expect(await answer.json()).toEqual({ ok: true, id })
+    return file
+  }
+  /** The addon's removal of one row: release what it claimed, then delete it. */
+  const removeCase = (t: ReturnType<typeof backend>, kind: typeof attachmentRequestKind, id: string) =>
+    t.run(async (ctx) => {
+      const released = await releaseIngestUploads(ctx, kind, id)
+      const doc = await findRecordDoc(ctx, kind, id)
+      if (doc) await ctx.db.delete(doc._id)
+      return released
+    })
+  const caseBindings = (t: ReturnType<typeof backend>) =>
+    t.run(async (ctx) =>
+      (await ctx.db.query('records').collect())
+        .filter((row) => row.kind === 'ingestBinding')
+        .map((row) => {
+          const data = row.data as { ownerKind?: string; owner?: string }
+          return { storageId: row.recordId, ownerKind: data.ownerKind, owner: data.owner }
+        }),
+    )
+  async function twoKindsOneId() {
+    env()['ELYTRA_INGEST_SECRET'] = SECRET
+    const t = backend({ submission: casesHandle })
+    const a = await genuineCase(t, 'attachmentRequest', 'same')
+    const b = await genuineCase(t, 'supportCase', 'same')
+    return { t, a, b }
+  }
+
+  /** A binding row as an earlier release wrote it, straight into the table. */
+  const plantBinding = (t: ReturnType<typeof backend>, storageId: string, data: Record<string, string>, key1?: string) =>
+    t.run(async (ctx) => {
+      await ctx.db.insert('records', {
+        kind: 'ingestBinding',
+        recordId: storageId,
+        data: { uploadId: `upload_${storageId}`, target: 'attachmentRequest', boundAt: REMOVED_AT, ...data },
+        ...(key1 !== undefined ? { key1 } : {}),
+        at: REMOVED_AT,
+        createdAt: REMOVED_AT,
+        updatedAt: REMOVED_AT,
+      })
+    })
+  async function asEditor(t: ReturnType<typeof backend>) {
+    await t.run(async (ctx) => {
+      await ctx.db.insert('members', { userId: 'user_editor', role: 'admin', createdAt: REMOVED_AT, updatedAt: REMOVED_AT })
+    })
+    return t.withIdentity({ subject: 'user_editor', issuer: 'https://convex.test' })
+  }
+  const deleteBlob = makeFunctionReference<'mutation', { storageKey: string }, unknown>('assets:deleteBlob')
+
+  it('a claim binds each file to its owner’s kind AND id', async () => {
+    const { t, a, b } = await twoKindsOneId()
+    expect(await caseBindings(t)).toEqual([
+      { storageId: a, ownerKind: 'attachmentRequest', owner: 'same' }, // base: ownerKind undefined
+      { storageId: b, ownerKind: 'supportCase', owner: 'same' },
+    ])
+  })
+
+  it('Codex’s trace: removing attachmentRequest/same keeps supportCase/same’s bytes and binding', async () => {
+    const { t, a, b } = await twoKindsOneId()
+    // Measured on the base (7c2e9261), counterexample form: `{ deleted: [a, b], kept: [] }`, both files gone, no binding left.
+    expect(await removeCase(t, attachmentRequestKind, 'same')).toEqual({ deleted: [a], kept: [] })
+    expect([await stored(t, a), await stored(t, b)]).toEqual([false, true])
+    expect(await caseBindings(t)).toEqual([{ storageId: b, ownerKind: 'supportCase', owner: 'same' }])
+    // supportCase/same still holds its file; its own removal deletes it (below).
+  })
+
+  it('control: removing the owner itself (same kind, same id) deletes its file and binding — the instrument sees a deletion', async () => {
+    const { t, a, b } = await twoKindsOneId()
+    const released = await removeCase(t, supportCaseKind, 'same')
+    expect(released.deleted).toContain(b)
+    expect(await stored(t, b)).toBe(false)
+    expect((await caseBindings(t)).map((binding) => binding.storageId)).not.toContain(b)
+    // …and after both rows are removed nothing is left: no residue.
+    await removeCase(t, attachmentRequestKind, 'same')
+    expect([await stored(t, a), await stored(t, b)]).toEqual([false, false])
+    expect(await caseBindings(t)).toEqual([])
+  })
+
+  it('a KIND-LESS binding (written before bindings recorded the owner’s kind) is never deleted — residue, never loss; it still holds its bytes', async () => {
+    const { t, a } = await twoKindsOneId()
+    const kindless = await storeFile(t, 300, 'image/png')
+    await plantBinding(t, kindless, { owner: 'same' }, 'same') // the shape EC-750 wrote: `owner` in `key1`, no kind
+    expect(await removeCase(t, attachmentRequestKind, 'same')).toEqual({ deleted: [a], kept: [] }) // base: deleted the kind-less file too
+    expect(await stored(t, kindless)).toBe(true)
+    expect((await caseBindings(t)).filter((binding) => binding.storageId === kindless)).toEqual([
+      { storageId: kindless, ownerKind: undefined, owner: 'same' },
+    ])
+    const editor = await asEditor(t)
+    expect(await editor.mutation(deleteBlob, { storageKey: kindless })).toEqual({ deleted: false, heldBy: 'ingest' })
+    expect(await stored(t, kindless)).toBe(true)
+  })
+
+  it('control: an OWNER-LESS binding (written before EC-750) is never deleted', async () => {
+    const { t, a } = await twoKindsOneId()
+    const ownerless = await storeFile(t, 300, 'image/png')
+    await plantBinding(t, ownerless, {})
+    await removeCase(t, attachmentRequestKind, 'same')
+    await removeCase(t, supportCaseKind, 'same')
+    expect([await stored(t, a), await stored(t, ownerless)]).toEqual([false, true])
+    expect(await caseBindings(t)).toEqual([{ storageId: ownerless, ownerKind: undefined, owner: undefined }])
+  })
+
+  it('assets:deleteBlob still keeps bytes a binding holds — after attachmentRequest/same’s removal, supportCase/same’s binding protects its file', async () => {
+    const { t, b } = await twoKindsOneId()
+    await removeCase(t, attachmentRequestKind, 'same')
+    await t.run(async (ctx) => {
+      await ctx.db.insert('assets', {
+        assetId: 'asset_case',
+        filename: 'case.png',
+        contentType: 'image/png',
+        byteSize: 400,
+        storageKey: b,
+        createdAt: REMOVED_AT,
+        updatedAt: REMOVED_AT,
+      })
+    })
+    const editor = await asEditor(t)
+    expect(await editor.mutation(deleteBlob, { storageKey: b })).toEqual({ deleted: false, heldBy: 'ingest' }) // base: the bytes were already gone
+    expect(await stored(t, b)).toBe(true)
+  })
+})
+
 describe('the site’s route → the receiver, end to end (EC-617)', () => {
   it('a visitor’s submission through createIngestRoute lands a record; a mismatched site secret is a 502', async () => {
     env()['ELYTRA_INGEST_SECRET'] = SECRET

package/convex/ingest.ts

@@ -16,9 +16,10 @@ import {
 } from '@elytracms/core/ingest'
 import type { IngestHandlerResult, IngestPayload, IngestUploadClaim } from '@elytracms/core/ingest'
 import { defineRecordKind, resolveRecordQuery } from '@elytracms/core/persistence'
+import type { AnyRecordKind } from '@elytracms/core/persistence'
 import { createUuidIdFactory } from '@elytracms/core/determinism'
 import type { MutationCtx, QueryCtx } from './functions'
-import { findRecordDoc, listRecordWire, saveRecord } from './record-functions'
+import { findRecordDoc, listRecordWire, queryRecordDocs, saveRecord } from './record-functions'
 
 /**
  * EC-617 — the ONE inbound receiver of the public ingest seam (ruling EC-565 § 6c), and the
@@ -44,7 +45,8 @@ import { findRecordDoc, listRecordWire, saveRecord } from './record-functions'
  *    claims its stored files with {@link claimIngestUploads}, which checks that the deployment
  *    stored each for ITS intent (EC-671) — its bytes the ones the upload request declared by
  *    SHA-256 (EC-685) — and that it matches the declared size and type, and binds them all or
- *    none (EC-695); {@link releaseIngestUploads} is the only way such bytes are deleted.
+ *    none (EC-695) to the record that claims them, by its kind and id (EC-750, EC-762);
+ *    {@link releaseIngestUploads}, asked for that record, is the only way such bytes are deleted.
  *
  * The engine never imports an addon: the handler is an internal-mutation REFERENCE the
  * consumer passes in its one `http.ts` line (`defineStudioHttp({ auth, ingest: {
@@ -195,6 +197,13 @@ export function ingestReceiver(handlers: IngestHandlers = {}): PublicHttpAction
 // it never deletes, and ingest bytes are deleted only through {@link releaseIngestUploads},
 // which deletes only what a claim bound.
 //
+// EC-750 (Codex r9 F46) — bound to WHOM. A binding records the record that claimed the file
+// — EC-762 (Codex r10 F51): its kind AND its id (`ownerKind` + `owner`), the identity the records
+// table declares — and release is asked for that owner, never for storage ids: removing a row
+// deletes only the files that row claimed. Before EC-750, release took the removed row's `files`
+// ids — a column a whole-record write can fill with another row's file — and deleted any bound
+// one; before EC-762, it took the id alone, so a row of another kind sharing the id lost its files.
+//
 // EC-685 — causation. Eligibility (stored after the intent, unbound, no asset's) is not
 // ownership: with intents A and B open, bytes stored through B's URL were eligible for A. So
 // the intent DECLARES the bytes' SHA-256 before they exist, and the claim requires the digest
@@ -236,14 +245,36 @@ export const ingestUploadRecordKind = defineRecordKind({
  * and "is it bound?" is one indexed read. Written only by {@link claimIngestUploads}, in the
  * claim's transaction; read by the claim (a file another claim bound is refused) and by
  * {@link releaseIngestUploads}. Engine-internal (no public functions), like the intent.
+ *
+ * EC-750 (Codex r9 F46) — and WHOSE: the record that claimed the file (a forms submission), so
+ * release asks "this record's files", never "is this id bound?". `target` is the intent's (the
+ * form every submission to it shares), so it cannot say whose a file is.
+ *
+ * EC-762 (Codex r10 F51) — a record is its kind AND its id (the records table's `kind` +
+ * `recordId`; an explicit id is unique only within its kind), so the owner is both:
+ * `ownerKind` (the owning kind's name) in the `key1` slot and `owner` (its id) in `key2`, read
+ * TOGETHER through the existing `by_kind_keys` index. Two rows of different kinds sharing an id
+ * never share a binding. Two string columns, never one object column (a key slot holds a
+ * string: an object would stringify to the same `[object Object]` for every owner) and never a
+ * composite string (a second encoding of an identity the table already stores as two columns).
+ *
+ * Bindings of earlier releases are never read by a release, so never deleted: one written before
+ * EC-750 has no owner and no slot, one written before EC-762 has its owner's id in `key1` and no
+ * `key2`. Each keeps protecting its bytes from `assets:deleteBlob` (residue, never loss —
+ * EC-671's no-migration precedent; no owner-only fallback, which would re-open F51).
  */
 export const ingestBindingRecordKind = defineRecordKind({
   kind: 'ingestBinding',
   module: 'ingest',
+  keys: ['ownerKind', 'owner'],
   time: 'boundAt',
   fields: {
     uploadId: z.string().min(1),
     target: z.string().min(1),
+    /** EC-762: the KIND of the record that claimed the file (its declaration's `kind`). */
+    ownerKind: z.string().min(1),
+    /** EC-750: the id of the record that claimed the file — with `ownerKind`, what {@link releaseIngestUploads} is asked for. */
+    owner: z.string().min(1),
     boundAt: z.string().min(1),
   },
 })
@@ -403,12 +434,21 @@ async function assetReferencesStorage(ctx: MutationCtx, storageId: string): Prom
  * A handler calls this ONCE per submission, after every check of its own that can refuse: a
  * mutation that RETURNS commits its writes (a claim made before a later refusal stays bound with
  * no row to hold it); one that THROWS commits nothing.
+ *
+ * EC-750 / EC-762: the owner is the record the handler is about to write — its kind's
+ * declaration (`ownerKind`) and its id (`ownerId`, minted BEFORE the claim). Every binding records
+ * both, and {@link releaseIngestUploads} deletes a file only for the owner that claimed it: a row
+ * naming another row's file (an editor's whole-record write can put any id in its `files`) never
+ * deletes it, nor does a row of another kind that happens to share the id. The declaration, not a
+ * string: a misspelt kind cannot compile into bindings no release ever finds.
  */
 export async function claimIngestUploads(
   ctx: MutationCtx,
   claims: readonly IngestUploadClaim[],
   target: string,
   receivedAt: string,
+  ownerKind: AnyRecordKind,
+  ownerId: string,
 ): Promise<IngestUploadsClaimResult> {
   const accepted: AcceptedClaim[] = []
   for (const [index, claim] of claims.entries()) {
@@ -418,7 +458,13 @@ export async function claimIngestUploads(
   }
   const stamps = { createdAt: receivedAt, updatedAt: receivedAt }
   for (const claim of accepted) {
-    await saveRecord(ctx, ingestBindingRecordKind, claim.storageId, { uploadId: claim.uploadId, target, boundAt: receivedAt }, stamps)
+    await saveRecord(
+      ctx,
+      ingestBindingRecordKind,
+      claim.storageId,
+      { uploadId: claim.uploadId, target, ownerKind: ownerKind.kind, owner: ownerId, boundAt: receivedAt },
+      stamps,
+    )
     await saveRecord(ctx, ingestUploadRecordKind, claim.uploadId, { state: 'claimed', storageId: claim.storageId }, stamps)
   }
   return { ok: true, files: accepted.map(({ storageId, field, contentType, size }) => ({ storageId, field, contentType, size })) }
@@ -508,35 +554,47 @@ async function judgeIngestUploadClaim(
 }
 
 /**
- * Delete ingest bytes an addon holds (EC-671) — the ONE way they are deleted, and it deletes
- * only files a claim BOUND that no asset references NOW: the bytes and their binding go
- * together. Any other id is KEPT and returned in `kept`:
+ * Delete the ingest bytes ONE record claimed (EC-671, EC-750, EC-762) — the ONE way ingest bytes
+ * are deleted. It is asked for an OWNER — the kind's declaration and the id
+ * {@link claimIngestUploads} bound the files to — never for storage ids: it reads that owner's
+ * bindings by BOTH keys (`by_kind_keys`) and deletes each file with its binding — so it never
+ * sees, and never writes, another owner's binding, a row of another kind sharing the id
+ * included. A row's `files` column is the visitor's and the editor's word (a whole-record write
+ * can name any id, or clear the list), so release never reads it: a row naming another row's
+ * file deletes nothing, and a row whose list was cleared still deletes what it claimed.
+ *
+ * Of the owner's files it KEEPS, returned in `kept`:
  *
- * - an id with no binding — an asset's, an id a write put into a row by hand, a file claimed
- *   before bindings existed — because ingest cannot show it owns them;
  * - EC-685: a bound file an asset row references now (`storageKey` or `thumb.storageKey` — an
  *   editor promoted the upload to an asset with `assets:upsert`, a legitimate edit). Ownership
  *   has passed to the asset: the binding is spent (deleted) and the bytes stay, so the
  *   asset's own delete removes them later. Read in this transaction, so no asset can acquire
  *   the file between the check and the delete.
  *
- * Call it when removing a row that holds claimed files — never for a refused submission, which
- * bound nothing ({@link claimIngestUploads}, EC-695). The mirror is `assets:deleteBlob`, which keeps bytes a binding holds
- * ({@link ingestBindingHolds}): each delete path re-checks the OTHER owner in its own
- * transaction.
+ * Never touched: a binding of another owner; a binding written before EC-750 (no owner, no key
+ * slot); one written before EC-762 (its owner's id alone, in `key1`, no `key2` — read by id
+ * alone it would be F51 again, so there is no such fallback). Residue, never loss: each keeps
+ * protecting its bytes from `assets:deleteBlob`.
+ *
+ * Call it when removing a row that holds claimed files, with that row's kind and id — never for
+ * a refused submission, which bound nothing ({@link claimIngestUploads}, EC-695). The mirror is
+ * `assets:deleteBlob`, which keeps bytes a binding holds ({@link ingestBindingHolds}): each
+ * delete path re-checks the OTHER owner in its own transaction.
  */
 export async function releaseIngestUploads(
   ctx: MutationCtx,
-  storageIds: readonly string[],
+  ownerKind: AnyRecordKind,
+  ownerId: string,
 ): Promise<{ deleted: string[]; kept: string[] }> {
   const deleted: string[] = []
   const kept: string[] = []
-  for (const storageId of new Set(storageIds)) {
-    const binding = await findRecordDoc(ctx, ingestBindingRecordKind, storageId)
-    if (!binding) {
-      kept.push(storageId)
-      continue
-    }
+  const owned = await queryRecordDocs(
+    ctx,
+    ingestBindingRecordKind,
+    resolveRecordQuery(ingestBindingRecordKind, { where: { ownerKind: ownerKind.kind, owner: ownerId } }),
+  )
+  for (const binding of owned) {
+    const storageId = binding.recordId
     await ctx.db.delete(binding._id)
     if (await assetReferencesStorage(ctx, storageId)) {
       kept.push(storageId) // the asset owns the bytes now (EC-685)

package/dist/components/ai/translate-document-dialog.d.ts

@@ -1,5 +1,48 @@
+import type { CollectionDef, Locale } from '@elytracms/core/cms-core';
+import type { TranslateMode, TranslatePlan, TranslateSkip, TranslateWrite } from '../../lib/ai/index.js';
 import type { TranslateDocumentActionProps } from './translate-document-action.js';
+/** What the done phase reports — what the run actually wrote, against what it planned. */
+export interface TranslateRunSummary {
+    mode: TranslateMode;
+    plan: TranslatePlan;
+    /** Units translated (the fill message's count). */
+    translated: number;
+    locales: number;
+    cancelled: boolean;
+    /** EC-752: the writes that landed (a write refused at its revision is in {@link refused}). */
+    writes: readonly TranslateWrite[];
+    refused: readonly TranslateWrite[];
+    /** EC-752: the version saved before a re-translation wrote. */
+    restorePoint?: number;
+    /** EC-593: every text position the run could not translate — listed, never silent. */
+    skipped: readonly TranslateSkip[];
+}
 export declare function TranslateDocumentDialog({ projectId, collection, docRef, document, revision, localeConfig, flushDraft, open, onOpenChange, }: TranslateDocumentActionProps & {
     open: boolean;
     onOpenChange: (open: boolean) => void;
 }): import("react").JSX.Element;
+/**
+ * EC-752 — the confirm phase: the target languages, the scope choice and, for a
+ * re-translation, its plan (what it replaces, fills and leaves as it is — "up to").
+ */
+export declare function TranslateConfirm({ mode, onModeChange, base, targets, plan, collection, }: {
+    mode: TranslateMode;
+    onModeChange: (mode: TranslateMode) => void;
+    base: Locale;
+    targets: readonly Locale[];
+    /** The run's plan — present in `retranslate-all`. */
+    plan: TranslatePlan | null;
+    collection: CollectionDef;
+}): import("react").JSX.Element;
+/** The headline of the done phase (EC-752: mode-aware; slugs and replacements are listed below it). */
+export declare function translateDoneMessage(summary: TranslateRunSummary, base: Locale): string;
+/**
+ * EC-752 — the done phase: what was actually written (a re-translation lists what it
+ * replaced and filled), the slugs it set, what was refused at its revision, what a
+ * re-translation planned but left as it was, its restore point, and what was not translated.
+ */
+export declare function TranslateDoneSummary({ summary, base, collection, }: {
+    summary: TranslateRunSummary;
+    base: Locale;
+    collection: CollectionDef;
+}): import("react").JSX.Element;