toga-ai 1.0.1201 → 1.0.1202

package/knowledge/1.0/apps/api/features/bitstorm-order-diagnostic-endpoint.md

@@ -30,7 +30,7 @@ How BitStorm posts PC scan results to an ODP quote, why one failure wipes the wh
 ## How it works
 
 - `api.php` ~229 wraps **every** route in `App_Database::beginTransaction()`. Any fatal → HTTP 500 → the Device and Diagnostics rows roll back too.
-- Results document → `Document::save()` → s3fs mount write (`api` has no AWS SDK; see the no-SDK fallback in [App_Cloud](../../library/features/app-cloud-aws-credentials.md)).
+- Results document → `Document::save()` → s3fs mount write (`api` has no AWS SDK; see the no-SDK fallback in [App_Cloud](../../library/features/app-cloud-aws-credentials.md)). Mount missing or short write → throw → 500 + full rollback, so nothing half-saved.
 
 ## Gotchas
 
@@ -46,4 +46,5 @@ How BitStorm posts PC scan results to an ODP quote, why one failure wipes the wh
 4. Compare failing vs passing posts with `JSON_EXTRACT` on `Logs.API.requestPayload`.
 
 ## Change history
+- 2026-10-29 — Document save fails closed (unmounted s3fs / short write) (TRUE-83311) (snaredla)
 - 2026-10-29 — Created: no-SDK document save fixes 500 + rollback of diag data; api debug recipe; open ACL risk (TRUE-83311) (snaredla)

package/knowledge/1.0/apps/library/features/app-cloud-aws-credentials.md

@@ -15,6 +15,7 @@ files:
   - toga/ebs/register_instance_to_shared_application_load_balancer.php
   - tools/ebs/check_s3fs.php
   - library/app/model.php
+  - library/app/model/toga/document.php
   - togadesk/ebs/check_s3fs.php
   - togadesk/ebs/register_instance_to_shared_application_load_balancer.php
   - togadesk/.ebextensions/020_setup_git_libraries.config
@@ -80,7 +81,7 @@ CodePipeline `Worker` (502, us-west-2) sources `_production` of **both** `agilan
   - **Testing gotcha:** after one passing run, `databaseReadHost.txt` is fresh for 30-60 s, so a control run right after also passes. Wait > 60 s (or delete the cache file) before the control.
   - store: fixed on branch (TRUE-82856, ae1861f4f — same pins plus aws-crt-php 1.2.7, psr/http-client 1.0.3, polyfill-mbstring 1.31.0; verified on PHP 7.2.33); needs merge + deploy. Its `.ebextensions/015_install_composer.config` already runs `composer install --no-dev`.
   - **Missed by the audit (TRUE-82935): the 1.0 `api` repo** (no composer at all) and **togadesk's email cron** (`crons/tickets.php` loads only `desk/vendor/autoload.php`; the root togadesk composer with aws is not loaded there). Both stopped `App_Cloud`: [Talos ticket API](../../api/features/talos-ticket-endpoint.md), [email intake](../../togadesk/features/email-to-ticket-intake.md). Audit per **entry point**, not per repo: a CLI cron or sub-app can load a different autoloader than the web app.
-  - **`App_Model_Toga_Document::save()` has a no-SDK fallback (TRUE-83311).** If `!class_exists('Aws\S3\S3Client')` it writes to `storage_folder` + the same `/togadocuments-<env>/<clientId>/<id>` path (`storage_folder` = s3fs mount of `asifiles`) instead of `App_Cloud::copyFileToS3`. SDK apps (toga, togadesk, worker, togaview) unchanged; api, vision, store, worker1.5, compass take the mount path. The library autoloader returns `false` on a `class_exists` miss, so the check is safe. Caller: [BitStorm diagnostic endpoint](../../api/features/bitstorm-order-diagnostic-endpoint.md).
+  - **`App_Model_Toga_Document::save()` has a no-SDK fallback (TRUE-83311).** If `!class_exists('Aws\S3\S3Client')` it writes to `storage_folder` + the same `/togadocuments-<env>/<clientId>/<id>` path (`storage_folder` = s3fs mount of `asifiles`) instead of `App_Cloud::copyFileToS3`. SDK apps (toga, togadesk, worker, togaview) unchanged; api, vision, store, worker1.5, compass take the mount path. The library autoloader returns `false` on a `class_exists` miss, so the check is safe. **Fails closed:** throws `Storage folder is not mounted` when `storage_folder` has the same `stat` device as its parent (dropped s3fs mount = plain local folder, writes never reach S3); writes with `fopen`/`fwrite`/`fclose` and throws unless every byte is written and `fclose` succeeds (s3fs uploads on close). An `fopen` failure raises a warning that `App_Error` turns into exit before the throw — still a failed request. Caller: [BitStorm diagnostic endpoint](../../api/features/bitstorm-order-diagnostic-endpoint.md).
   - The missing class throws **`Error`, not `Exception`** — `catch (Exception)` around an App_Cloud call does not catch it; use `\Throwable` where a fallback is meant.
   - Not changed on TRUE-82856: walmarttechservices — GitHub repo `agilantsolutions/walmarttechservices` no longer exists ("Repository not found", checked 2026-10-16); webhook — reported no longer active by the developer (2026-10-16). Removal / deprecation is left to the owners.
 - Verify assume-role in CloudTrail (`AssumeRole` on `WorkloadsRuntime`, by session name: `library-app-cloud`, `setup-git-libraries`, `register-instance`, `worker-deploy`).
@@ -88,6 +89,7 @@ CodePipeline `Worker` (502, us-west-2) sources `_production` of **both** `agilan
 - Every long-lived key still in code across repos (SES SMTP, s3fs, ALB scripts, other accounts): [audit 2026-10-13](../../../../2.0/apps/worker2/features/cross-account-aws-access.md#long-lived-keys-still-in-code-audit-2026-10-13).
 
 ## Change history
+- 2026-10-29 — no-SDK document save fails closed on unmounted folder / short write (TRUE-83311) (snaredla)
 - 2026-10-29 — `App_Model_Toga_Document::save()` falls back to the s3fs mount when the SDK is missing (TRUE-83311) (snaredla)
 - 2026-10-23 — walmart-activate added aws-sdk-php; moved-app check + read-host cache testing gotcha (TRUE-83161) (rgirish)
 - 2026-10-22 — Leaked key was abused (Bedrock LLM-jacking, GuardDuty, TRUE-82983) (jcardinal)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "toga-ai",
-  "version": "1.0.1201",
+  "version": "1.0.1202",
   "description": "TOGA Technology Team Claude Knowledge System — shared AI coding harness with skills, knowledge base CLI, and project installer for Claude Code.",
   "keywords": [
     "claude",