fix(score): publish attachments through private bounded storage

.github/workflows/score-storage-native.yml

@@ -0,0 +1,211 @@
+name: score-storage-native
+
+on:
+  pull_request:
+    branches:
+      - develop
+      - main
+    paths:
+      - "apps/desktop/core/Cargo.toml"
+      - "apps/desktop/core/src/root.rs"
+      - "apps/desktop/core/src/lib.rs"
+      - "apps/desktop/core/src/content_sha256.rs"
+      - "apps/desktop/core/src/score_pdf.rs"
+      - "apps/desktop/core/src/score_publication.rs"
+      - "apps/desktop/core/src/score_recovery.rs"
+      - "apps/desktop/core/src/score_retention.rs"
+      - "apps/desktop/core/src/score_storage.rs"
+      - "apps/desktop/core/tests/content_sha256_shared_kernel.rs"
+      - "apps/desktop/core/tests/score_pdf_*.rs"
+      - "apps/desktop/src-tauri/Cargo.toml"
+      - "apps/desktop/src-tauri/build.rs"
+      - "apps/desktop/src-tauri/capabilities/main.json"
+      - "apps/desktop/src-tauri/permissions/autogenerated/*.toml"
+      - "apps/desktop/src-tauri/gen/schemas/*.json"
+      - "apps/desktop/src-tauri/src/main.rs"
+      - "apps/desktop/src-tauri/src/bin/score-storage-fault-harness.rs"
+      - "apps/desktop/src/features/score/ScoreView.tsx"
+      - "apps/desktop/src/features/score/ScoreView.test.tsx"
+      - "apps/desktop/src/features/score/ScoreView.projectContext.test.tsx"
+      - "apps/desktop/src/features/score/ScoreView.persistenceOutcome.test.tsx"
+      - "apps/desktop/src/features/score/scoreStorage.ts"
+      - "apps/desktop/src/features/score/scoreStorage.test.ts"
+      - "docs/traceability/score-attachment-publication.md"
+      - "docs/traceability/score-attachment-recovery-inventory.md"
+      - "docs/traceability/score-attachment-recovery-object-receipt.md"
+      - "docs/traceability/score-attachment-post-link-recovery.md"
+      - "docs/traceability/score-attachment-success-durability.md"
+      - "docs/traceability/score-attachment-unix-stage-cleanup.md"
+      - "docs/traceability/score-attachment-fault-recovery.md"
+      - "docs/traceability/score-attachment-windows-acl-recovery.md"
+      - "docs/traceability/score-attachment-project-context.md"
+      - ".github/workflows/score-storage-native.yml"
+  push:
+    branches:
+      - develop
+      - main
+    paths:
+      - "apps/desktop/core/Cargo.toml"
+      - "apps/desktop/core/src/root.rs"
+      - "apps/desktop/core/src/lib.rs"
+      - "apps/desktop/core/src/content_sha256.rs"
+      - "apps/desktop/core/src/score_pdf.rs"
+      - "apps/desktop/core/src/score_publication.rs"
+      - "apps/desktop/core/src/score_recovery.rs"
+      - "apps/desktop/core/src/score_retention.rs"
+      - "apps/desktop/core/src/score_storage.rs"
+      - "apps/desktop/core/tests/content_sha256_shared_kernel.rs"
+      - "apps/desktop/core/tests/score_pdf_*.rs"
+      - "apps/desktop/src-tauri/Cargo.toml"
+      - "apps/desktop/src-tauri/build.rs"
+      - "apps/desktop/src-tauri/capabilities/main.json"
+      - "apps/desktop/src-tauri/permissions/autogenerated/*.toml"
+      - "apps/desktop/src-tauri/gen/schemas/*.json"
+      - "apps/desktop/src-tauri/src/main.rs"
+      - "apps/desktop/src-tauri/src/bin/score-storage-fault-harness.rs"
+      - "apps/desktop/src/features/score/ScoreView.tsx"
+      - "apps/desktop/src/features/score/ScoreView.test.tsx"
+      - "apps/desktop/src/features/score/ScoreView.projectContext.test.tsx"
+      - "apps/desktop/src/features/score/ScoreView.persistenceOutcome.test.tsx"
+      - "apps/desktop/src/features/score/scoreStorage.ts"
+      - "apps/desktop/src/features/score/scoreStorage.test.ts"
+      - "docs/traceability/score-attachment-publication.md"
+      - "docs/traceability/score-attachment-recovery-inventory.md"
+      - "docs/traceability/score-attachment-recovery-object-receipt.md"
+      - "docs/traceability/score-attachment-post-link-recovery.md"
+      - "docs/traceability/score-attachment-success-durability.md"
+      - "docs/traceability/score-attachment-unix-stage-cleanup.md"
+      - "docs/traceability/score-attachment-fault-recovery.md"
+      - "docs/traceability/score-attachment-windows-acl-recovery.md"
+      - "docs/traceability/score-attachment-project-context.md"
+      - ".github/workflows/score-storage-native.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  native-score-storage:
+    name: test / score-storage / ${{ matrix.platform }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - platform: macos
+            runner: macos-15
+          - platform: windows
+            runner: windows-2025
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - name: Install Rust 1.97.1
+        run: rustup toolchain install 1.97.1 --profile minimal
+      - name: Run owned Score Storage unit tests
+        shell: bash
+        run: |
+          cargo +1.97.1 test \
+            --manifest-path apps/desktop/core/Cargo.toml \
+            --lib score_storage::tests::
+          cargo +1.97.1 test \
+            --manifest-path apps/desktop/core/Cargo.toml \
+            --lib score_recovery::tests::
+          cargo +1.97.1 test \
+            --manifest-path apps/desktop/core/Cargo.toml \
+            --lib score_publication::tests::
+          cargo +1.97.1 test \
+            --manifest-path apps/desktop/core/Cargo.toml \
+            --test content_sha256_shared_kernel
+      - name: Verify shipped desktop excludes Score Storage fault injection
+        shell: bash
+        run: |
+          feature_tree="$(cargo +1.97.1 tree \
+            --manifest-path apps/desktop/src-tauri/Cargo.toml \
+            -e features \
+            -i bandscope-desktop-core)"
+          if printf '%s\n' "$feature_tree" | grep -F 'score-storage-fault-injection'; then
+            echo "::error::The shipped desktop dependency graph enables score-storage-fault-injection."
+            exit 1
+          fi
+          if cargo +1.97.1 check \
+            --release \
+            --manifest-path apps/desktop/core/Cargo.toml \
+            --features score-storage-fault-injection; then
+            echo "::error::A release build accepted the owner-only fault-injection feature."
+            exit 1
+          fi
+          if cargo +1.97.1 check \
+            --release \
+            --manifest-path apps/desktop/src-tauri/Cargo.toml \
+            --features score-storage-fault-injection \
+            --bin score-storage-fault-harness; then
+            echo "::error::A release desktop package accepted the owner-only fault harness."
+            exit 1
+          fi
+      - name: Run Score Storage publication, retention, interruption, restart, inventory, receipt, durability, fault-recovery, write-failure, capacity-exhaustion, Windows ACL, Unix cleanup, and wiring regressions
+        run: >-
+          cargo +1.97.1 test
+          --manifest-path apps/desktop/core/Cargo.toml
+          --test score_pdf_attachment_publication
+          --test score_pdf_retention_resolution
+          --test score_pdf_interruption_recovery
+          --test score_pdf_restart_readback
+          --test score_pdf_recovery_inventory
+          --test score_pdf_recovery_object_receipt
+          --test score_pdf_success_durability
+          --test score_pdf_fault_recovery
+          --test score_pdf_write_failure_recovery
+          --test score_pdf_capacity_exhaustion_recovery
+          --test score_pdf_windows_acl_recovery
+          --test score_pdf_unix_stage_cleanup_contract
+          --test score_pdf_attachment_wiring
+      - name: Run production-publisher process-termination recovery regression
+        run: >-
+          cargo +1.97.1 test
+          --manifest-path apps/desktop/core/Cargo.toml
+          --features score-storage-fault-injection
+          --test score_pdf_process_termination_recovery
+      - name: Run desktop-package executable process-termination recovery regression
+        shell: bash
+        run: |
+          export CARGO_TARGET_DIR="$RUNNER_TEMP/bandscope-score-fault-harness"
+          cargo +1.97.1 build \
+            --manifest-path apps/desktop/src-tauri/Cargo.toml \
+            --features score-storage-fault-injection \
+            --bin score-storage-fault-harness
+          executable_suffix=""
+          if [[ "$RUNNER_OS" == "Windows" ]]; then
+            executable_suffix=".exe"
+          fi
+          export BANDSCOPE_SCORE_STORAGE_FAULT_HARNESS_BIN="$CARGO_TARGET_DIR/debug/score-storage-fault-harness${executable_suffix}"
+          cargo +1.97.1 test \
+            --manifest-path apps/desktop/core/Cargo.toml \
+            --features score-storage-fault-injection \
+            --test score_pdf_desktop_package_termination_recovery
+
+  score-storage-ui:
+    name: test / score-storage / ui
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          persist-credentials: false
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+      - uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e # v6.4.0
+        with:
+          node-version: 22.22.3
+          package-manager-cache: false
+      - name: Install locked JavaScript dependencies
+        run: npm ci
+      - name: Run receipt-bound score detach and project-context regressions
+        run: >-
+          npm exec --workspace=@bandscope/desktop -- vitest run
+          src/features/score/ScoreView.test.tsx
+          src/features/score/ScoreView.projectContext.test.tsx
+          src/features/score/scoreStorage.test.ts
+          src/features/score/ScoreView.persistenceOutcome.test.tsx

CHANGELOG.md

@@ -16,6 +16,9 @@
 ### Fixed
 
 - Upgraded the local score PDF parser to `pdfjs-dist` 6.2.108, pinned Undici 7.29.0 across the workspace, and constrained PDF loading to copied in-memory bytes with a same-origin bundled worker and npm-generated lock provenance.
+- Bound native stored-score PDF reads to the 25 MiB product limit before heap allocation and revalidate PDF magic on the same opened descriptor, preventing an attached score that later grows from bypassing the local resource boundary.
+- Recover process-abandoned score-PDF staging before the next attachment publication under an OS-released cross-process workspace lease; ambiguous stage-plus-destination state is preserved and fails closed instead of being deleted by a blind sweep.
+- Bind buyer-facing score detachment to the path-free SHA-256 receipt captured before project metadata changes, and revalidate that receipt through Score Storage before destructive deletion so same-id replacement bytes are preserved instead of being recaptured by stale intent.
 
 ## [0.1.3] - 2026-04-29
 

apps/desktop/core/Cargo.toml

@@ -7,7 +7,10 @@ publish = false
 
 [lib]
 name = "bandscope_desktop_core"
-path = "src/lib.rs"
+path = "src/root.rs"
+
+[features]
+score-storage-fault-injection = []
 
 [lints.rust]
 unexpected_cfgs = { level = "warn", check-cfg = ['cfg(coverage)'] }