dispatch-2 storage-cors-2: apply latest storage-safety steering; retain deferred feed audit

docs/agents/backlog/storage-cors-2.json

@@ -2,7 +2,7 @@
   "id": "storage-cors-2",
   "area": "storage-cors",
   "status": "open",
-  "title": "Audit feed/view tombstone stale-refresh regression gap with offline integration",
+  "title": "Audit best-effort storage/delete safety and remaining R2 followups offline",
   "blockedOn": null,
   "addedOn": "2026-10-20",
   "filedAt": "7f99c0456931c917082d6a6680c79655221dcc82"

docs/agents/backlog/storage-cors-3.json

@@ -0,0 +1,9 @@
+{
+  "id": "storage-cors-3",
+  "area": "storage-cors",
+  "status": "deferred",
+  "title": "Audit feed/view tombstone stale-refresh regression gap with offline integration",
+  "blockedOn": "Deferred behind latest storage-safety steering from interpreter2026-10-20T14:57:03;not cancelled",
+  "addedOn": "2026-10-20",
+  "filedAt": "7f99c0456931c917082d6a6680c79655221dcc82"
+}

docs/agents/prompts/storage-cors.md

@@ -1,12 +1,12 @@
 # Area: Storage CORS reliability (storage-cors)
 
-## Current assignment: storage-cors-2 — temporary feed/view deletion audit
+## Current assignment: storage-cors-2 — remaining storage/delete safety audit
 
-Storage item1 doneproductd3f4c215/closure7f99c045. Owner continuing direction calls for useful disjoint work now; this worker is temporarily lent to an independent read-only feed/view reliability slice. No other agent owns this slice. Claim storage-cors-2,merge verified unstable,read GOAL/PROGRAM/QUALITY/RULE-CHANGES/KNOWN_ISSUES plus NIP09/addressable deletion docs and centralized schema before Nostr-related investigation.
+Storage item1 doneproductd3f4c215/closure7f99c045. Latest interpreter checkpoint14:57:03 steers this existing worker toward remaining todo/TODO_2026-06-16_r2-followups.md and current upload/delete safety. Earlier feed/view audit is deferred as storage-cors-3,not cancelled;preserve any scratch notes. Claim item2,merge verified unstable,read GOAL/PROGRAM/QUALITY/RULE-CHANGES/KNOWN_ISSUES and docs/lessons/cloudflare-s3-upload-gotchas.md.
 
-High-priority pre-launch TODO1 asks seed→delete→assert-not-rendered feed/view regression; underlying tombstone guard and buffer tests exist. Dispatch inspected CRUD flow spec: settings/delete modal/cancel coverage is not proof of full stale-relay/reload suppression. Inspect all existing scenarios first;do not duplicate or misclassify known Firefox fixture flake as product bug. Trace actual client/buffer→feed/view boundary read-only. Build deterministic offline scratch at actual integration seam:seed visible owned synthetic video,apply local tombstone/delete event,deliver stale older version and refresh/cache hydration;assert card remains absent; include unaffected/live-video control. No public relay/signer/session actor publishing,real deletion/private data or app.js edits.
+Bounded investigation only:validate current deleteVideoStorage best-effort/no-throw/owner-bucket invariant and remaining cleanup followups at actual service/caller boundary. Dispatch inspected settings/npub .trim calls before catch in r2Service:potential malformed cached connection/metadata boundary is evidence to check,not a presumed active bug. Inspect existing delete/storage-key tests and call normalization first;construct real service offline scenario with fake SDK/delete transport,valid owned/external URL controls and meaningful malformed/locked/partial-failure cases. Characterize existing all-versions/thumbnail followups without inventing retention/deletion policy. If no current defect,give evidence and choose one current managed-domain/idempotency followup from same backlog via actual callgraph;stop after one bounded actionable result or documented already-covered outcome.
 
-Investigation/evidence only,no product/committed regression edits until dispatch scopes a demonstrated defect or mutant-proven coverage gap. Report exact HEAD/commands/counts,which actual renderer/cache/client boundaries are exercised,smallest proposed test/fix files and fixture limits. Do not call a mocked-only callback a full feed proof. Existing js/app.js,js/app/**,Nostr core,VideoListView,existing CRUD specs all read-only. Unique docs/testing/storage-cors-feed-* and own evidence/backlog allowed. QA owns current expensive gate:cheap focused offline checks only,no browser/build/full run. No subagents/kit/scheduler/cloud/real signer/wallet/production actions. Send immediate read+next-action and eventual evidence/blocker;keep .task current.
+R2Service.deleteVideoStorage must stay best-effort,never throw,and never delete outside owner bucket. r2Service/s3UploadService are mirrored copies;any later fix would require explicit symmetric scope. For NOW all product/existing tests/read-only including js/services/r2Service.js,s3UploadService.js,storagePointer and storage/r2-mgmt.js. No real delete,cloud/provider credentials,public requests,signer/wallet/private data or app edits. Scratch/evidence/own backlog and docs/testing/storage-cors-* only;report exact HEAD/command/counts,fidelity and smallest proposed test/fix scope before product/committed regression changes. QA owns full/normal slot;cheap focused local checks only,no browser/full/build. Send immediate corrected read+next-action,then evidence/blocker;keep .task current. No new agents/features/kit/scheduler changes.
 
 ## Archived completed assignment: storage-cors-1 — preservation fix routed
 

fleet/LOG.md

@@ -98,3 +98,5 @@
 
 - Owner exact direction relayed "ok try to keep them working until the project is in a good place." Recorded GOAL/PROGRAM;QUALITY matrix distinguishes current local proof from Amber/cloud/peer/manual gates across feed/playback/profile/storage/mobile/validation/preview. No readiness claim from unit counts.
 - Existing client worker item6 assigned profile-history actual-removal wiring gap from TODO2;existing storage worker item2 temporarily lent to independent feed/view tombstone gap TODO1. Investigation/evidence only before routing,cheap focused checks while QA full/normal slot active. No extra agents,new product definitions or competing app/Nostr/URL writes.
+
+- Latest interpreter checkpoint14:57:03 consumed14:57:16 asks storage-followup/default rather than prior feed candidate. Client6 and initial storage read-next-action verified14:57:29/14:57:22. Adapt storage2 to actual current best-effort delete safety/backlog followups read-only;retain agreed feed gap deferredstorage3. Inspection sees .trim on caller/settings before catches,requires call-normalization/current-test investigation,not assumed defect. QA full429/429 diagnostic pass,normal submission64143f42 gating since14:56:10;slot unchanged.

fleet/QUALITY.md

@@ -4,10 +4,10 @@ Updated2026-10-20. Goal: improve robustness/usability against pre-launch TODO an
 
 | Area | Current local evidence | Next bounded work | Still unverified / release gate |
 |---|---|---|---|
-| Feed/load/navigation | Existing client tombstone/buffer guards and broad428-file normal gate; current CRUD spec includes delete-modal/cancel coverage | storage-cors-2 temporary read-only feed/view tombstone coverage audit, TODO1 seed→delete→stale refresh scenario | Full app/feed behavior and documented parallel Firefox hydration flakes; live zombie reports |
+| Feed/load/navigation | Existing client tombstone/buffer guards and broad428-file normal gate; current CRUD spec includes delete-modal/cancel coverage | Feed/view tombstone gap deferred as storage-cors-3 behind latest storage safety priority, TODO1 seed→delete→stale refresh scenario | Full app/feed behavior and documented parallel Firefox hydration flakes; live zombie reports |
 | Playback/fallback/magnets | Queued torrent/URL lifecycle fixes7d20a509/89ccb907; mirror guard0bd0b1c3; independent URL18 scenarios. QA actual coordinator/service scratch4 and local Chromium/Firefox3 each, literal hash/webseed checks | playback-qa-1 retained regression full/normal landing currently active | Actual WebTorrent/live peers; full-app fallback; local decoded mirror/substituted torrent does not prove real torrent |
 | Profile/session/history | Profile fixture hang fixedde6918ce;27 focused historical scenarios and current broad suite. History lazy-init test injects fake renderer | client-reliability-6 read-only actual history removal wiring audit, TODO2 regression gap | Amber NIP46 identity/switch/logout across refresh, real signers; KNOWN_ISSUES isolated logout UI failure |
-| Storage/upload safety | CORS productd3f4c215,closure7f99c045; independent9 CORS scenarios,worker focused13/10mutants/full428/lint/build; content-addressed/cleanup safeguards documented | Complete CORS evidence/current integration; follow bounded caller/provider issues only if reproduced | Live bucket/IAM/provider serialization; concurrent read-modify-write has no CAS; no credentials/cloud writes tested |
+| Storage/upload safety | CORS productd3f4c215,closure7f99c045; independent9 CORS scenarios,worker focused13/10mutants/full428/lint/build; content-addressed/cleanup safeguards documented | storage-cors-2 read-only best-effort delete safety/current remaining followups audit | Live bucket/IAM/provider serialization; concurrent read-modify-write has no CAS; no credentials/cloud writes tested |
 | Mobile usability | No fresh local mobile flow/visual qualification from trial | After current investigations, select bounded viewport navigation/modal/card smoke from TODO7; inspect before redesign | Real-device/manual accessibility and UX; visual baselines remain CI-canonical |
 | Trustworthy validation | Unchanged normal gates and restored failing mutants; latest product gate428 files. QA new regression full run in progress | Finish QA gate; retain exact counts, ancestry, fixture boundaries, failed mutants and Known Issues classification | Full broad E2E/release/manual cross-browser checks; never weaken assertions or treat mocked boundaries as live proof |
 | Preview | Preserved localhost3000,storage integrated7f99c045; build/artifact pass,HTTP200/index matches dist | Refresh after each verified product landing; QA is test-only so inspect product delta before rebuilding | Production/live-site state not touched or qualified |
@@ -15,7 +15,7 @@ Updated2026-10-20. Goal: improve robustness/usability against pre-launch TODO an
 ## Milestones
 
 1. Finish prepared trial outputs: two product fixes are durable; retained QA regression still needs full/normal landing. Report actual timings: implementation parallelism exists, but serialized duplicate full gates and39m57 dispatch wake/checkpoint lag prevent an overall speedup claim.
-2. Revalidate high-priority history and feed deletion gaps at current HEAD using real wiring plus controlled IO; route only reproduced defects or valuable mutant-proven regressions. No product changes authorized by investigation assignments.
+2. Revalidate high-priority history wiring and storage/delete safety at current HEAD;feed-view deletion gap remains deferred,not cancelled using real wiring plus controlled IO; route only reproduced defects or valuable mutant-proven regressions. No product changes authorized by investigation assignments.
 3. Establish fresh local core-flow/mobile baseline after those checks; keep live Amber/cloud/peer/manual release gates separate. Continue useful bounded work under existing authority; surface substantive blockers/owner product choices instead of inventing features or keeping agents busy.
 
 ## Resource and operating limits

fleet/RULE-CHANGES.md

@@ -9,6 +9,9 @@ a landing rule changes.
 
 ## 2026-10-20
 
+- Latest14:57:03 interpreter checkpoint prioritizes remaining storage/upload/delete safety for storage worker. storage-cors-2 now read-only best-effort delete safety/current followups audit;prior feed/view audit retained deferred as storage-cors-3. Client6 history audit unchanged. No product/test writes before evidence/routing;QA expensive slot stays exclusive.
+
+
 - Owner continuation now extends beyond trial until project quality is evidenced,tracked in QUALITY.md with local/live gates distinct. Existing client worker item6 investigates real profile-history removal wiring;storage worker item2 temporarily investigates feed/view tombstone coverage. Both read-only scratch/evidence,no product or committed tests before routing. QA retains expensive full/normal slot. Same3 workers,disjoint scope,no app.js writers/new features/kit/scheduler/external authority.