---
id: ADR-CRM-ACT-016
title: Activity files go through the shared record-asset pipeline
product_area: crm
module: activities-tasks
revision: 1
status: proposed
design_intent: proposed
source_sha:
  services-crm: a8d1364f1dd44b723bb5f9acba12f983e9ec8d69
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Permit activity files already held by the record or newly prepared by shared asset
  handling, attach their references transactionally and delegate released-file removal to
  shared cleanup.
constrains:
  - DOM-CRM-ACT-001
  - SVC-CRM-ACT-activities
  - WF-CRM-ACT-001
  - WF-CRM-ACT-002
  - SCR-CRM-ACT-004
origin: >-
  CRM's rule that files go through the shared record-asset module (services-crm AGENTS.md,
  as cited in modules/activities/services/persistence/activities.ts); regression
  DEF-CRM-0724 fixed the function's asset environment.
alternatives:
  - option: Trust arbitrary file references submitted by clients.
    why_not: This would bypass preparation and record ownership checks for new attachments.
  - option: Physically remove files inside the database save transaction.
    why_not: External storage removal could not be rolled back with a refused database change.
consequences:
  - A new file reference that bypasses required preparation is refused.
  - Prepared copies can outlast a failed record save as unreferenced external assets.
  - >-
    Removal of file entries delegates released references to cleanup; its retry policy and
    completion deadline remain external proof.
  - The inspected console can remove saved attachments but has no working upload control.
supersedes: []
evidence:
  - >-
    services-crm at a8d1364f: modules/activities/services/persistence/activities.ts
    (saveNewActivity, updateActivity, deleteActivity, assetChanges,
    requireActivityAttachmentAssets); aws/activities.module.ts (applyAssetEnvironment);
    aws/crm.asset-cleanup.names.ts.
---

# Activity files go through the shared record-asset pipeline

## Context

Supporting files have both activity associations and an external storage lifecycle. Those two lifecycles cannot share database rollback semantics.

## Decision

The save path computes asset changes, prepares new permanent references and attaches the retained or prepared file list during persistence. Shared cleanup owns physical removal after release.

## Alternatives Considered

The structured alternatives describe concrete competing designs and their tradeoffs. Where the origin records an existing ruling, it remains the authority; an observed implementation does not establish Product’s rejection of every alternative.

## Consequences

Record ownership checks constrain attachment references. Storage can retain unused copies beyond a transaction, with no locally established maximum cleanup delay.