T7.7 - CR-007/D8: the sheet travels with the package, and opens offline

The field wants the specific PDF attached, not a link to a Bluebeam session.

Storage: a new wp_files table (Alembic f3a9d2c1e8b7, additive only) holding
the BYTES in the same database as everything else - the Aug 18 decision: a
backup that excludes the drawings is a backup you cannot restore from. The
D8 numbers bound the cost and are enforced ON THE SERVER as well as in the
browser: 5MB a file (413, naming the limit), PDF and image mimes only (400,
naming what is accepted), 2GB a project (413 naming the ceiling; response
flags the 80% warning). The ceiling is env-overridable for tests; the shipped
default is the decision, asserted from source.

The package record carries a server-owned meta mirror (data.files): the
upload/patch/delete routes rewrite it, and the upsert re-asserts the stored
copy over whatever a client sends - a save from a browser that had not seen
an upload land cannot erase the list.

Creator: uploads live beside the links (links still work), the limits and the
running project total sit ABOVE the picker (amber from 80%, red at full), a
refused file costs nothing but a toast and never leaves the browser (the
probe counts fetch calls), and each drawing has a description ("Tray section,
Level 3 east only") editable inline and persisted server-side. Uploads attach
to the saved record, so T4.3's autosave keeps the surrounding form safe (X8).

Export: uploads print with the package - name, size tag, description on the
attachments table, images inline as the sheet itself, PDFs as links.

Offline (D8): the service worker gains a drawings cache (cache-first on
/api/files/), and field.js prefetches ONLY the requesting user's assigned
packages - assignment-scoped by decision, not project-wide. The probe's first
offline check used CDP network emulation and PASSED FOR THE WRONG REASON: the
emulation binds to the page's session and the service worker fetches on its
own target, straight past it. The shipped check kills the server instead -
my drawing opens, the other package's does not, against a genuinely dead
network.

Field View: a Drawings section on the package detail, 44px rows, description
inline, inside the 390px screen.

Verification (each probe run alone): NEW tests/files_check.py 36/36; the
Alembic chain applied end-to-end to a scratch DB and the table verified.
Regressions: form_structure_check 50/51 (the standing F6 height gap),
frame_check 39/39.

Items: CR-007, D8 (X8 honored)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

html/sw.js

@@ -15,6 +15,11 @@
 // Bumped when the shell file list changes, so clients fetch the new assets
 // instead of serving a half-old shell from the previous cache.
 const CACHE = 'wp-suite-shell-v6';
+// CR-007/D8: uploaded drawings, cached at first fetch so an assigned package's
+// sheets open with no network. The CLIENT decides what gets fetched (field.js
+// prefetches only the requesting user's assigned packages); this worker just
+// keeps whatever came through. Never precached - a fresh sign-in starts empty.
+const DRAWINGS = 'wp-suite-drawings-v1';
 const SHELL = [
   '/', '/index.html', '/work-package-suite.html', '/wp-creation-index.html',
   '/field.html', '/login.html', '/admin.html', '/users.html',
@@ -43,7 +48,7 @@ self.addEventListener('install', (e) => {
 self.addEventListener('activate', (e) => {
   e.waitUntil(
     caches.keys()
-      .then((keys) => Promise.all(keys.filter((k) => k !== CACHE).map((k) => caches.delete(k))))
+      .then((keys) => Promise.all(keys.filter((k) => k !== CACHE && k !== DRAWINGS).map((k) => caches.delete(k))))
       .then(() => self.clients.claim())
   );
 });
@@ -65,6 +70,18 @@ self.addEventListener('fetch', (e) => {
   if (req.method !== 'GET') return;                         // outbox owns writes
   const url = new URL(req.url);
   if (url.origin !== self.location.origin) return;          // third-party: default
+  // Drawing bytes are immutable once uploaded (edits replace the row id), so
+  // cache-first is safe and is what makes them open offline (CR-007/D8).
+  if (url.pathname.startsWith('/api/files/')) {
+    e.respondWith(
+      caches.open(DRAWINGS).then((c) => c.match(req).then((hit) => hit ||
+        fetch(req).then((res) => {
+          if (res && res.ok) c.put(req, res.clone());
+          return res;
+        })))
+    );
+    return;
+  }
   if (url.pathname.startsWith('/api/')) return;             // never cache the API
 
   const isCode = CODE_RE.test(url.pathname);