[JasonWildMe]

Follow-up to #1848 (bulk import boxes A), which merged before review was finished.

What

The extract-then-identify intake and the per-box extraction tasks added for bulk imports with user-supplied boxes now check what they are handed before changing anything. They only ever work on a box that the named import created.

How

• Intake — IA.intakeImportedBoxes stages an annotation only when its feature carries the stamp of the import named on the request's root task. Anything else is logged and left untouched (no task, no status change). The recovery holder applies the same rule.
• One shared rule — Annotation.isImportedBoxOf(importTaskId), used by the intake, the envelope builder (IAGateway.importedBoxAnnotationIds) and the processor.
• Processor — MlServiceProcessor.process checks every job for an imported-box child: it must name the one box in the job the server stored on that child, and the box must carry the child's import stamp. Any other job is dropped before a write. The check uses strict lookups, so a datastore failure or unreadable stored task parameters (Task.hasUnreadableParameters) return an error and the job does not run.
• Gateway — an imported-box child is never reused as a request's root task, and the imported-box marker is removed from incoming task parameters on both the enqueue path and the bulk-import hand-off.

No change for imports without boxes, for normal detection and identification, or for legitimate boxed imports: the importer already stamps every box it creates, and the server-built jobs (intake, startup replay, deferred matches, retries) all pass the check.

Testing

• New and extended cases in ImportedBoxIntakeDbTest, MlServiceProcessorImportedBoxDbTest, IAGatewayRequestRootTest and IAGatewayImportEnvelopeTest: annotations that are not this import's boxes are left untouched (identification status, tasks and the asset's detection status all unchanged); jobs of every other shape for an imported-box child are dropped; a failed lookup or unreadable parameters is an error, not a pass; server-published deferred matches still run.
• 310 tests across the 27 imported-box, processor, gateway and boxed-import test classes pass locally.

Not verified: the full suite was not run locally (CI will), and nothing was exercised on a running install.

Reviewed with Codex over five rounds until it reported no remaining findings.

🤖 Generated with Claude Code

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.43%. Comparing base (809b1ee) to head (78b5336).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1858   +/-   ##
=======================================
  Coverage   59.43%   59.43%           
=======================================
  Files         320      320           
  Lines       13104    13104           
  Branches     4274     4274           
=======================================
  Hits         7788     7788           
  Misses       5033     5033           
  Partials      283      283           

Flag	Coverage Δ
backend	59.43% <ø> (ø)
frontend	59.43% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[UrbanFercec]

Ran it with #1860 on top as well, 279 tests green including the DbTests. Three things inline, the first one also hits ordinary detection jobs.

[UrbanFercec]

This catch covers every job with a taskId, not only imported boxes. I ran a plain task with parameters {broken and a mediaAssetId job: ERROR_PERSIST, no ML call, task stays initiated, asset stays processing. On main the same job completes. Failing closed only when the raw parameters carry the marker, or calling markDetectionFailure here like the load path does, would avoid that.

[JasonWildMe]

Thanks, good catch. Fixed in f413547: an unreadable-parameters task now fails closed only when something persisted says it could be an imported-box child (the marker text, a stored job that names an annotation, or a held imported box). A plain task with {broken parameters and a mediaAssetId job passes the check and runs as on main. New test unreadableParametersWithoutTheMarkerDoNotStopAnOrdinaryJob; the existing corruption test still covers a real imported-box child (including none, Unknown and {broken).

[UrbanFercec]

This drops only the top-level key, but ImportedBoxReplay matches "importedBox":true anywhere in the stored parameters. Through gatewayTaskParams, {"x":{"importedBox":true}} is kept and the task gets replayed on every restart, and enough of them fill the 500 oldest slots. Re-checking Task.isImportedBoxTask(t) in fetchStaleResumeMessages would close it.

[JasonWildMe]

Fixed in f413547. The gateway now removes the marker at every depth of the task parameters (both gatewayTaskParams and handleBulkImport), and fetchStaleResumeMessages re-checks Task.isImportedBoxTask on each row. Candidates are read in pages, so rows that don't qualify never count toward the 500, and the rows examined per run are strictly bounded. Tests: gatewayTaskParamsDropTheMarkerAtEveryDepth, aNestedMarkerIsNotAnImportedBoxChild (including limit 1 with an older non-qualifying row), theScanBoundIsStrict.

[UrbanFercec]

When every box gets skipped here, nothing marks the root, so a client polling it sees a task that never finishes. rootWithoutAnImportStampExtractsNothing checks that nothing ran but not the root's status. Maybe mark the root as an invalid envelope when boxes were named and none were taken?

[JasonWildMe]

Fixed in f413547. When no named box is taken, the root now ends: error / INVALID_ENVELOPE if a named annotation exists but isn't a box of this import, completed if they were all deleted. A failed commit of that end goes through the existing staging recovery (root ends EXTRACTION_PERSIST). rootWithoutAnImportStampExtractsNothing now checks the root status; new tests rootWhoseBoxesAreAllGoneCompletesWithNothingToDo and aFailedCommitOfTheEmptyRootEndsItThroughRecovery. The import page's summary does not yet read this request's end for the all-deleted case; that is a follow-up on #1861, which owns the boxed-import completion rule.

[JasonWildMe]

Thanks @UrbanFercec! Lemme know of the fixes address your concerns.