When a public image's thumb_url or url fails to load, the fileupload
field fetches its preview once through the authenticated thumb route
(session key in the header) and shows it from an object URL, revoked
when the item is forgotten and on unmount. The preview is reported as
unavailable only when that fetch or the object-URL image fails too.
Protected fields behave as before.
Keep form save behind in-flight uploads, make retries idempotent via X-Upload-Id, cap remaining JSON bodies, and surface pending pivot type errors instead of zeroing them.
Co-authored-by: Cursor <cursoragent@cursor.com>
- sessionKey, dateFormat, FileuploadField (protected thumbnails and
keyboard reorder backstops), RelationChildModal, RelationPivotModal,
RelationManager row actions and create-screen deferral, date and time
list cells; typed deferred relation-schema and file-list fixtures
- scripts/check-phase12.2.sh: go, security (named tests, refuses missing
or skipped), spa, openapi, dist, docs, hygiene and app stages, a
detector self-test, one PASS or FAIL line per stage under --all
