Storage Media Browser Proof

Status: accepted-bounded-next-slice-not-complete.

This proof closes the SVC-011-storage-media-browser-proof contract slice for the file-service domain alias implemented by document-service, while keeping public storage/document promotion gated.

Evidence

Requirement	Evidence	Result
Storage/media parity proof	STORAGE_PARITY_SELF_TEST=1 make test-storage-media-parity plus document-service upload, metadata, content, variant, object-delete, and archive tests.	Passed bounded/self-test evidence
Upload/read browser evidence	A disposable PNG rendered directly through the non-default storage Gateway route with browser-observed native headers. A real frontend import/question/document workflow remains required.	Partial: direct media render only
Teacher Import Review media workflow	The real Teacher Import Review page loaded a fresh Physics DOCX job, selected its first media question, fetched the materialized PNG through the scoped DOCX Fast adapter, and rendered a Blob URL before saving/reloading the review.	Passed local non-default workflow evidence
Rollback notes	Default deploy/gateway/routes.json remains active; native storage route tables are rehearsal-only and can be removed by switching back to the default table.	Passed

Ownership Boundary

• document-service owns file/media metadata, object-key scope, signed upload URLs, content/variant reads, teaching-document review/archive state, and copied search projections.
• docx-import-service consumes the document-service storage boundary and does not read object-store internals directly.
• Billing, wallet, usage/quota, purchase, entitlement, parser, and public marketplace decisions remain outside the file-service domain.
• Destructive object deletes require organization scope and never accept the internal object-read token as a bypass.

Verification

GOTOOLCHAIN=go1.25.11 go test ./services/document-service/... -count=1
STORAGE_PARITY_SELF_TEST=1 make test-storage-media-parity
cmp -s services/document-service/api/openapi.yaml contracts/openapi/services/document-service.yaml
ruby -e 'require "yaml"; ARGV.each { |f| YAML.load_file(f) }' services/document-service/api/openapi.yaml contracts/openapi/services/document-service.yaml

All bounded commands passed. The parity self-test is not real media or browser promotion evidence.

Disposable Runtime Recheck (2026-07-13)

An in-memory document-service stored a token-gated internal PNG fixture. Its direct native content and GET /api/storage/media-assets/{id}/content through the non-default storage route had identical SHA-256 bytes. Playwright rendered the 480x180 PNG, and the browser-observed response included X-Hoctapaz-Gateway-Route: storage and native_write. Restarting Gateway with the active default table returned storage/legacy_proxy with the expected 502 against a deliberately unavailable legacy target.

Captures and assertions are in output/qa/storage-media-browser-proof-20260713/ and output/playwright/storage-media-browser-proof-20260713/. This fixture does not use a legacy media asset, shared object store, or a frontend workflow page, so it does not close the public promotion gate.

Teacher Import Review Recheck (2026-07-14)

The disposable local PostgreSQL DOCX Physics runtime now includes the real Teacher Vite app and its authenticated Import Review page. It creates an unapproved 28-question job using an owner-scoped sourceAssetId; question 7 has materialized PNG media. The browser selected that question, received a 200 image/png response from GET /api/exam-import/docx-fast-jobs/{job}/temp-draft/assets/{asset}/content with exam-import-docx-fast-asset-content, and rendered the response through a Blob URL before saving and reloading question 1 review state.

The same browser proof selects formula-bearing question 4 and displays R=8,31J/mol.K, source kind mtef-ole, deterministic confidence, and the DOCX OLE source part as safe text. The review reload retains the selected formula id, LaTeX, and source kind. This is provenance visibility, not a claim of Word/MathType visual equivalence.

The evidence bundle is output/qa/docx-physics-gateway-attempt-local-postgres-20260714181852/. The scoped import adapter is backed by document-service media content, but this does not replace generic storage-route browser parity against a shared legacy object store and does not justify default storage or import promotion.

Route State

• Default storage/media/document routes remain legacy-proxied in deploy/gateway/routes.json.
• Native document-service routes and storage route tables are non-default rehearsals only.
• Storage/media promotion requires parity proof plus browser evidence for the touched upload/read flows.
• Rollback is switching GATEWAY_ROUTE_TABLE back to deploy/gateway/routes.json, removing the rehearsal route, and rerunning the route coverage and storage smoke checks.

Remaining Work

• Run against a real legacy media asset, shared object store, gateway, and frontend with a seeded token/organization for generic storage parity.
• Capture rollback-after-candidate evidence before any default route change.