A document is worked in stages, and the compartment owns the work

An upload is not a moment, it is a piece of work: the vault scans the

file, identifies what it is, converts it to Markdown, reads a summary out

of it, indexes it, and only then admits it to the searchable vault. The

person uploading chooses whether the vault does all of that on its own or

stops for approval at each stage. Until a document is admitted, nobody

can find it — and while it waits, anyone who can write to its compartment

can pick the work up, not just whoever uploaded it.

When the vault converts a file it also says what it noticed — a

spreadsheet whose rows are not the width of its heading row, a deck whose

speaker notes are now searchable. Those remarks are not decoration: each

one names a decision the vault made about how to READ the file, and each

one can be answered. A person who knows better can have the same stored

bytes read a different way, without uploading anything again, because the

vault is still holding the file exactly as it arrived. It records which

reading it used.

The vault does the whole job when asked for its best guessstack

Given a member with a compartment of their own
When they upload a note asking the vault to use its best guess
Then the document is admitted and can be found

A document waits when the uploader wants to approve each stage

Given a member with a compartment of their own
When they upload a note asking to approve each stage
Then the document is stored and converted but nobody can find it

One approval buys exactly one stage

Given a document waiting for approval
When one stage is approved and the vault does the work
Then the document has moved exactly one stage and waits again

Approving every stage puts the document in the vault

Given a document waiting for approval
When every remaining stage is approved in turn
Then the document is admitted and can be found

A colleague in the same compartment can do the work

Given a document waiting for approval
And a colleague who can write to the same compartment
Then the colleague sees the document in the queue and can approve it

Somebody outside the compartment sees nothing at all

Given a document waiting for approval
And a stranger with a compartment of their own
Then the stranger's queue is empty and approving is refused

The scan gates run whichever way the document is processed

Given a member with a compartment of their own
When they upload a file the malware gate catches, asking to approve each stage
Then the file is held for review and never reaches the queue

A document that stops says why

Given a document waiting for approval whose stored text has been lost
When one stage is approved and the vault does the work
Then the document is stopped with a reason a person can read

A spreadsheet read with the wrong separator can be read again with the right one

Given a member with a compartment of their own
When they upload a spreadsheet whose columns are separated by semicolons
Then the vault says the rows are not the width of the heading row
When they have it read again with a semicolon as the separator
Then the remark is withdrawn and every column has a heading

The vault refuses a setting the format does not offer

Given a spreadsheet waiting to be approved
When they have it read again naming a setting that format has never offered
Then the re-reading is refused and the refusal names what the format does offer

The vault refuses a choice it never offered

Given a spreadsheet waiting to be approved
When they have it read again asking for a separator the vault does not offer
Then the re-reading is refused and the refusal names the separators it does offer

The record says how the document was actually read

Given a spreadsheet that was once read as something else entirely
When they have it read again and let the vault decide the type itself
Then the record describes the reading that just happened and not the one before it