@@ -0,0 +1,16 @@
+---
+'@objectstack/core': patch
+'@objectstack/objectql': patch
+'@objectstack/service-storage': patch
+---
+
+fix(service-storage): a member attaches a file through the attach verb again; the verb vouches for the one file it created
+
+Clause-②: no
+Metadata-protocol: none
+
+A signed-in member who may attach files can attach one again through the server-side attach verb (`attachFileAs` on the `file-attachments` service), and so can a print to a record's attachments (`printRecordToFile`). Since the write-time reference check began judging a `lookup` value through the caller's own read door, the verb's `sys_attachment` insert — written as the caller — was refused over its `file_id`: a member who may attach need not read `sys_file`, so the file the verb had just created answered `reference_not_found` and the call failed.
+
+The rule now: a service verb that has created a record in the same call may vouch, on its own write, for the one reference to that record (`vouchForReference`, `@objectstack/core`). The write-time reference check does not ask the caller's read door for exactly that object, field and id, and still probes that the record exists. The attach verb vouches for its own `sys_attachment.file_id` and for nothing else; every other gate on the insert still judges the caller (the permission to create an attachment, the parent-edit attach rule, `enable.files`, the file-reference gate, row- and field-level security, and the `uploaded_by` stamp).
+
+Unchanged: no caller gains a read of `sys_file` or of anything else. A `sys_file` id sent through any data door — REST, MCP, a flow, an import — is judged through the caller's read door exactly as before, the file the verb attached included. The mark is a symbol-keyed context property that no request body, query, stored row or flow definition can spell.
@@ -537,6 +537,16 @@ export {
   keepsFlowWriteReferenceCheck,
 } from './flow-write-reference-check.js';
 
+// The mark a service verb's own write carries for one reference to a record
+// the same call authorized and created. Set by service-storage's
+// file-attachments writer, read by objectql's write-time reference check.
+export {
+  VOUCHED_REFERENCES,
+  vouchForReference,
+  isVouchedReference,
+  type VouchedReference,
+} from './vouched-reference.js';
+
 // #30205 — a banned user's open work: the per-object counts, the optional bulk
 // hand-over (both read and written as the caller), and the ban-in-force
 // predicate objectql's write-time reference check refuses a new assignment by.
 
@@ -0,0 +1,100 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * The mark a service's own write carries for ONE reference value it vouches
+ * for: a record the same call has itself authorized and created.
+ *
+ * ## The rule it answers to
+ *
+ * A write that is not a system write may name, in a `lookup`, `user` or
+ * `master_detail` field, only a record its caller's own read door returns; a
+ * record the caller cannot read answers `reference_not_found`
+ * (`assertReferencesResolve`, objectql). That rule judges a reference the
+ * CALLER chose. Some service verbs write, as the caller, a row that links to a
+ * record the verb created a moment earlier in the same call, after asking its
+ * own authorization question first. The file-attachments verb is the case: it
+ * asks the attach rule (`assertMayAttach`), stores a new `sys_file` for the
+ * caller, then inserts the `sys_attachment` naming it AS the caller, so every
+ * gate on that insert judges the caller. The caller did not choose that file
+ * id, and a caller who may attach files need not read `sys_file` at all, so
+ * the read-door question has nothing to judge there; asking it refuses the
+ * verb outright.
+ *
+ * ## What it admits, and what it does not
+ *
+ * The mark names one `(object, field, id)`. The reference check reads it for
+ * exactly that value on a write to that object: the caller's read door is not
+ * asked for it, and the elevated, tenant-kept existence probe still is, so an
+ * id that names no row of the caller's organization is refused as before.
+ * Everything else about the write stays the caller's: every other field and
+ * every other value in the same field is judged through the caller's read door,
+ * and nothing about RLS, FLS, the owner and audit stamps, the object's hooks
+ * or the caller's read of anything changes. It grants no read.
+ *
+ * ## Where it is set — and where it is never set
+ *
+ * Only by a service verb, on the one write it makes for the record it just
+ * created, after that verb's own authorization: today the file-attachments
+ * writer's `sys_attachment` insert (`FileAttachmentService.attachFileAs`,
+ * service-storage). ⛔ Never on a context a request, an import, a flow, an
+ * agent tool or any other generic data door hands the engine: a reference such
+ * a door carries is the caller's choice, and the read-door rule judges it.
+ *
+ * ## Why a symbol, and why it is not an `ExecutionContext` field
+ *
+ * The same reasons as `FLOW_WRITE_REFERENCE_CHECK`: no request body, query
+ * string, stored row or flow definition can spell a symbol, so no author can
+ * set it; it is in no schema; `Symbol.for` keeps it one key across the ESM and
+ * CJS builds; and, being undeclared, it does not survive
+ * `ExecutionContextSchema.parse`. It rides a spread of the context as any own
+ * property does, so a write a hook sets off under the vouched write carries it
+ * too, and is admitted only for the same object, field and id.
+ */
+
+/** The context key of the mark. See the module header. */
+export const VOUCHED_REFERENCES: unique symbol = Symbol.for('objectstack.core.vouchedReferences');
+
+/** One reference value a service vouches for: `field` of a write to `object`, naming `id`. */
+export interface VouchedReference {
+  readonly object: string;
+  readonly field: string;
+  readonly id: string;
+}
+
+/**
+ * `context` with `reference` added to the references it vouches for — a fresh
+ * object; `context` is not changed. Called only by a service verb, for a
+ * record the same call created (see the module header).
+ */
+export function vouchForReference<T extends object>(
+  context: T,
+  reference: VouchedReference,
+): T & { [VOUCHED_REFERENCES]: ReadonlyArray<VouchedReference> } {
+  const held = (context as { [VOUCHED_REFERENCES]?: unknown })[VOUCHED_REFERENCES];
+  const prior = Array.isArray(held) ? (held as ReadonlyArray<VouchedReference>) : [];
+  const entry: VouchedReference = Object.freeze({
+    object: String(reference.object),
+    field: String(reference.field),
+    id: String(reference.id),
+  });
+  return { ...context, [VOUCHED_REFERENCES]: Object.freeze([...prior, entry]) };
+}
+
+/**
+ * Does `context` vouch for `id` in `field` of a write to `object`? `false` for
+ * every other value, field, object and context.
+ */
+export function isVouchedReference(context: unknown, object: unknown, field: unknown, id: unknown): boolean {
+  if (context === null || typeof context !== 'object') return false;
+  if (typeof object !== 'string' || typeof field !== 'string') return false;
+  if (typeof id !== 'string' && typeof id !== 'number') return false;
+  const held = (context as { [VOUCHED_REFERENCES]?: unknown })[VOUCHED_REFERENCES];
+  if (!Array.isArray(held)) return false;
+  const value = String(id);
+  return held.some(
+    (r) => r !== null && typeof r === 'object'
+      && (r as VouchedReference).object === object
+      && (r as VouchedReference).field === field
+      && (r as VouchedReference).id === value,
+  );
+}
@@ -52,7 +52,7 @@
 
 import { referenceTargetOf, type EngineQueryOptions } from '@objectstack/spec/data';
 import type { ExecutionContext } from '@objectstack/spec/kernel';
-import { isUserBanInForce, keepsFlowWriteReferenceCheck, USER_BAN_FIELDS } from '@objectstack/core';
+import { isUserBanInForce, isVouchedReference, keepsFlowWriteReferenceCheck, USER_BAN_FIELDS } from '@objectstack/core';
 import { ValidationError, buildFieldError } from './validation/record-validator.js';
 import { servedAsStored } from './engine-top-level.js';
 import type { ObjectQL } from './engine.js';
@@ -219,6 +219,16 @@ export function referencesCheckedBeforeRules(context: unknown): boolean {
  * and a value the row already stores is not judged again (#29062). `tree`
  * keeps the elevated probe alone.
  *
+ * One value is not the caller's choice: a reference a service verb vouches for
+ * on its own write (`vouchForReference`, `@objectstack/core`), naming a record
+ * the same call authorized and created — the file-attachments writer's
+ * `sys_attachment.file_id`, inserted as the caller after its own attach check.
+ * For exactly that object, field and id the caller's read door is not asked;
+ * the elevated, tenant-kept existence probe still is. Every other value, field
+ * and object on the write is judged as above, and the mark comes from no
+ * request: it is a symbol-keyed context property no body, query or stored row
+ * can spell.
+ *
  * Fails OPEN when the target cannot be checked (unregistered object, no
  * driver, a probe that throws): an integrity check that cannot run must not
  * invent a rejection, and the alternative — refusing every write to an object
@@ -301,8 +311,12 @@ export async function assertReferencesResolve(
       if (v === null || v === undefined || v === '') continue;
       if (typeof v === 'object') continue;
       // [#22519, #29029] A master-detail header, a lookup target and a user
-      // must also be one the caller can read.
-      const callerReads = CALLER_READ_REFERENCE_TYPES.has(def?.type);
+      // must also be one the caller can read — except the one value a service
+      // verb vouches for on its own write: a record the same call authorized
+      // and created (`vouchForReference`, @objectstack/core). Its existence is
+      // still probed; nothing else on the write is admitted by it.
+      const callerReads = CALLER_READ_REFERENCE_TYPES.has(def?.type)
+        && !isVouchedReference(context, schema?.name, name, v);
       if (def?.type !== 'master_detail' && target === BAN_CHECKED_USER_OBJECT) {
         // [#30205] One probe answers both: the row's existence and its ban.
         // [#29029] The caller's read door comes first: a user it does not
 
@@ -31,7 +31,7 @@
 
 import { describe, it, expect, beforeEach } from 'vitest';
 import { resolveThrownHttpError } from '@objectstack/types';
-import { markFlowWriteReferenceCheck } from '@objectstack/core';
+import { markFlowWriteReferenceCheck, vouchForReference, VOUCHED_REFERENCES } from '@objectstack/core';
 import { ObjectQL } from './engine.js';
 import { ValidationError } from './validation/record-validator.js';
 
@@ -498,3 +498,74 @@ describe('[#29029] the update\'s reference forgiveness compares only stored valu
     });
   });
 });
+
+describe('a reference a service verb vouches for on its own write: that one value skips the caller\'s read door, nothing else does', () => {
+  let engine: ObjectQL;
+  let targetReads: TargetRead[];
+  let storeFor: (o: string) => Map<string, Record<string, any>>;
+
+  beforeEach(() => {
+    ({ engine, targetReads, storeFor } = makeEngine());
+  });
+
+  /** Alice's context, vouching for `id` in `field` of a write to `object`. */
+  const vouched = (id: string, field = 'duty', object = ITEM, base: Record<string, unknown> = ALICE) =>
+    vouchForReference({ ...base }, { object, field, id });
+  const insert = (object: string, payload: Record<string, unknown>, context: Record<string, unknown>) =>
+    engine.insert(object, { title: 'new', ...payload }, { context });
+  const items = (object = ITEM) => [...storeFor(object).values()];
+
+  it('the vouched value lands although the caller cannot read it; its existence is still probed, elevated', async () => {
+    await insert(ITEM, { duty: UNREADABLE }, vouched(UNREADABLE));
+    expect(items().some((r) => r.duty === UNREADABLE)).toBe(true);
+    // No read door asked for it; the existence probe ran.
+    expect(targetReads.map(({ operation, elevated }) => ({ operation, elevated }))).toEqual([
+      { operation: 'findOne', elevated: true },
+    ]);
+  });
+
+  it('a vouched id that names no row is still refused reference_not_found', async () => {
+    expect(envelopeOf(await refusalOf(() => insert(ITEM, { duty: NOWHERE }, vouched(NOWHERE))))).toEqual(notFound('duty'));
+    expect(items()).toEqual([]);
+  });
+
+  it('control: another unreadable id in the vouched field is refused as before', async () => {
+    const err = await refusalOf(() => insert(ITEM, { duty: 't_flagged_other' }, vouched(UNREADABLE)));
+    expect(envelopeOf(err)).toEqual(notFound('duty'));
+    expect(items()).toEqual([]);
+  });
+
+  it('control: the vouched id in another field of the same write is refused as before', async () => {
+    const err = await refusalOf(() => insert(ITEM, { duty: UNREADABLE, assignee: UNREADABLE }, vouched(UNREADABLE)));
+    expect(envelopeOf(err)).toEqual(notFound('assignee'));
+    expect(items()).toEqual([]);
+  });
+
+  it('control: the vouched id on a write to another object is refused as before', async () => {
+    const err = await refusalOf(() => insert(RULED, { duty: UNREADABLE }, vouched(UNREADABLE)));
+    expect(envelopeOf(err)).toEqual(notFound('duty'));
+    expect(items(RULED)).toEqual([]);
+  });
+
+  it('control: a multi-valued field admits the vouched member only, and refuses another unreadable one beside it', async () => {
+    const err = await refusalOf(() => insert(ITEM, { duties: [UNREADABLE, 't_flagged_other'] }, vouched(UNREADABLE, 'duties')));
+    expect(envelopeOf(err)).toEqual(notFound('duties'));
+    await insert(ITEM, { duties: [UNREADABLE, 't_mine'] }, vouched(UNREADABLE, 'duties'));
+    expect(items().some((r) => Array.isArray(r.duties) && r.duties.includes(UNREADABLE))).toBe(true);
+  });
+
+  it('control: the same value without the mark is refused, and a string key of the same name is no mark', async () => {
+    expect(envelopeOf(await refusalOf(() => insert(ITEM, { duty: UNREADABLE }, { ...ALICE })))).toEqual(notFound('duty'));
+    // What a JSON body or a stored row could spell: the symbol's description as a plain key.
+    const spelled = { ...ALICE, [String(VOUCHED_REFERENCES.description)]: [{ object: ITEM, field: 'duty', id: UNREADABLE }] };
+    expect(envelopeOf(await refusalOf(() => insert(ITEM, { duty: UNREADABLE }, spelled)))).toEqual(notFound('duty'));
+    expect(items()).toEqual([]);
+  });
+
+  it('control: a caller whose read of the target object is refused outright is admitted for the vouched value only', async () => {
+    await insert(ITEM, { duty: 't_mine' }, vouched('t_mine', 'duty', ITEM, CAROL));
+    expect(items().some((r) => r.duty === 't_mine')).toBe(true);
+    const err = await refusalOf(() => insert(ITEM, { duty: 't_mine_2' }, vouched('t_mine', 'duty', ITEM, CAROL)));
+    expect(envelopeOf(err)).toEqual(notFound('duty'));
+  });
+});