[antosubash]

Summary

• file_storage: DELETE drops the stored bytes before the transaction commits #582 File storage: single and bulk DELETE drop the stored bytes only after the request transaction commits (register_on_commit), so a failed commit no longer leaves a live row with no bytes. New hourly file_storage.reap_objects beat task (needs background_tasks) retries objects of soft-deleted rows and removes objects left by uploads whose row never committed, after twice the upload-session TTL. It only touches keys shaped like this module's own (constants.OWN_KEY), skips the multipart staging dir and walks the filesystem off the event loop.
• file_storage: cancelling a queued upload still uploads it #588 File storage: a file cancelled while queued behind the concurrency limit is no longer uploaded later.
• tenants: organisation settings view hard-imports the optional settings module #585 Tenants: the organisation settings route and menu item are registered only when the settings module is enabled (it used to 500 with ImportError). file_storage now lists BackgroundTasks in optional_depends_on.
• docs: docker-compose promises a generated admin password; release rehearsal runs git reset --hard HEAD~1 #587 Docker (behaviour change): with SM_USERS_BOOTSTRAP_PASSWORD unset the entrypoint generates a random password; the users module logs it once, only when it actually seeds the first admin. An explicit changeme is refused in production. docs/release.md's rehearsal runs in a disposable worktree instead of git reset --hard HEAD~1.
• release: CHANGELOG is never cut — [Unreleased] has accumulated since 0.0.27 #584 Release: the changelog cut was already wired into finalize by Release gate, lockstep JS versions, dated CHANGELOG cut; enforced removal versions for compat shims (#510 #515) #572 (after v0.0.37 shipped), so the issue's premise was out of date. Added tests that pin the cut step order and both heading separators, fixed the heading format in the docs, and noted in CHANGELOG.md that 0.0.28–0.0.37 entries are still under [Unreleased].

Verification

• Browser-verified at /file-storage/ and /tenants/settings on port 8211; no console errors
• Local CI: make lint, make test-py (5633 passed), make test-js (748 passed), full e2e suite (49 passed)
• Verification report: https://claude.ai/artifact/Y1Ptog2u3RiJDL5nXASjwF

QA Report

• Full QA cycle completed (1 iteration)
• 0 bugs found, 0 fixed (2 P3 observations: no distinct "Queued" label; cancel clicked after a 100% upload is a no-op, both pre-existing)
• Categories tested: Happy Path, Error States, Edge Cases (form validation folded in: only upload/delete inputs)
• Full QA report: https://claude.ai/artifact/1Kqh4FdYx4KVrAm7ZzuNVe

Report links are Claude Artifacts and start private; the author can share them from claude.ai/code/artifacts if reviewers need access.

Test plan

• Delete a file on /file-storage/: the row goes and its download URL 404s
• With SM_MODULES_ENABLED excluding Settings, /tenants/settings 404s and the menu item is gone
• CI is green

Closes #582
Closes #584
Closes #585
Closes #587
Closes #588

https://claude.ai/code/session_01M9neheZZEe3sVpDi2S3zT4

[cloudflare-workers-and-pages]

Deploying simple-module-python with    Cloudflare Pages

Latest commit:	b0a8bb7
Status:	✅  Deploy successful!
Preview URL:	https://692b9fab.simple-module-python.pages.dev
Branch Preview URL:	https://fix-debt-batch-1.simple-module-python.pages.dev

View logs

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-22T18:03:06.945257Z	b0a8bb7	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.