# ADR 0043: One file store in halkyon_base; Todo's attachments

- **Status:** decided 10 Nov 2026 by the developer: D1 and D2 are their own requests,
  D3 their choice over the agent's recommendation (20 MB), D4 and D5 the agent's
  recommendations, which they chose. Not built yet.
- **Builds on:** ADR 0004 (Learn's assets, rule 5), ADR 0014 (the module), ADR 0017
  (the account's keys), ADR 0019 (sealed files), ADR 0033 (Todo), ADR 0042 (mobile data).

## Context

Learn keeps people's files (images, sounds, PDFs) in the server's private storage by
space and SHA-256 (`AssetEndpoint`, `file_limits.dart`, `file_pruning.dart`), counts
each person's room against `FILE_LIMIT_IDENTIFIED_MB` and the operator's allowances,
and seals a private studyset's files on the device (`HLKF`, ADR 0019). Todo has
descriptions and comments as rich text (ADR 0033, D36, D38) and no files. The developer
asked for attachments in both, now (10 Nov 2026).

## Decisions

- **D1.** Todo gets attachments in a task's description and in comments: an image shows
  inline, any other file as a chip with its name and size that opens in the system's
  app (or saves, on a desktop).
- **D2.** The file store moves into **halkyon_base**: the endpoint (upload by hash into
  the caller's own space, finish, usage, download by a row a member may read), the
  limits, the room counted and the pruning. Learn's server uses the module's and drops
  its own; the tables keep their names and data (a move with the version rows alone,
  as ADR 0014's moves). The module asks each app, through a hook as `deletePersonData`,
  which synced rows name a file, for download rights and the pruning: Learn's `asset`
  rows, Todo's attachment rows.
- **D3.** Todo takes **any file up to 100 MB**, as Learn's PDFs. Every Todo file is
  sealed (everything of Todo's is, ADR 0033, D5), so the server can't look into it and
  checks only its size and the sealed header; Learn's rule for readable files (over 20
  MB only a PDF) stays Learn's.
- **D4.** **Room per service**, Learn's rule: each server counts its own people's files
  against its own `FILE_LIMIT_IDENTIFIED_MB` (500 MB by default), `FILE_LIMIT_INSTANCE_MB`
  and allowances. The operator's grants screen (ADR 0021) grants a service's room on
  that service.
- **D5.** A device fetches a file **when it is shown**, then keeps it in the person's
  folder; offline, it has what was seen. On mobile data, *Without files* (ADR 0042)
  holds back uploads and downloads alike; a file not fetched shows as its chip with
  *Download*.

## Todo's rows

An `attachment` table, synced and sealed as every Todo table: the file's hash, sealed
size and kind (image or file), its name and the task or comment it belongs to, all in
the sealed payload but the hash, which the server needs to count and serve. The rich
text names the attachment by its row ID, as Learn's editor names an asset. Deleting a
task or a comment blanks its attachment rows (the payload first, ADR 0002, rule 2); the
module's pruning removes a file no row names any more.

## To work out when building

- The move of Learn's tables into the module: their migration SQL (version rows only,
  or a rename where the module's naming differs), explained before it is applied.
- Whether the sealed header (`HLKF`) and Learn's `SealedFile` move to `halkyon_keys`
  for Todo to share, which the recommendation is.
- The quota's text in Todo's Settings: Learn shows the room used in its Sync card.