DL-482

An unbound attachment is readable only by its uploader; a bound one is readable when Store.IsTopicChannelMember (the TopicChannelParticipant probe that gates MessagePosted delivery) is true for its message’s topic, so it is readable exactly where its block was delivered, with no new participating CTE copy and a pgtest pinning parity with ListMessages visibility; unknown, unbound-foreign and unreadable ids all return NotFound (the D9 merge), and the tenant-RLS row lookup runs before any object read

Status: Active (proposed, pending Matt, 2026-10-11)

Record: ../../agent/compass-comms-file-sharing/design.md#d3-read-access-is-message-read-access