Verified 20 October 2026. Implementation complete; final application build passed, 10 unit tests passed, four native Playwright upload cases passed and all fixtures cleaned.
The existing document-type Enable Private and document-subtype Enable Private controls configure whether a user can choose Private for a new upload. Explicit false at either level hides/reset the frontend choice and enforces Public before indexing. A parent false cannot be overridden by a subtype true. Missing metadata or NULL inherits the previous requested behavior, as required by the latest compatibility instruction. Existing explicit client choices, documents and access permissions are preserved.
Both native administration editors load the existing flags, explain the effective restriction and persist them through their existing DataSet update paths. An unrelated save preserves an inherited NULL instead of converting it to an explicit policy. New editor defaults retain the existing Public-only selection. The native administration Save journeys remain part of release UAT; their existing persistence wiring and NULL preservation were source reviewed and covered by focused production-source tests.
All four user-choice IndexGeneralDocument overloads enforce the policy before storage/indexing. The native shared uploader uses the same effective policy for display and save. Existing storage checks, file handling, authorization callbacks, indexing, confidential flags, workflow and viewing behavior remain in their original paths.
Trusted generated PDFs, generated bulk-template documents and fixed server-configured form privacy retain their existing business behavior. A Friend assembly-scoped route is restricted to audited callers; there is no browser bypass parameter and no generic verified=True exemption. IRP5 user-choice uploads remain guarded. Both synchronous CSS-hidden TextBox and asynchronous HiddenField echoes are browser-postable, so their document type/subtype/private/confidential/index properties now take authoritative server values assigned during Init, with MAC-protected ViewState fallback. Old restored state cannot overwrite new server configuration. Nothing index values normalize to String.Empty.
| Verification | Result |
|---|---|
| MyFocus.vbproj build using installed .NET Framework/Telerik toolchain | Passed with BuildProjectReferences=false, existing dependency binaries; no dependency source changes |
| DocumentPrivacyPolicyUnit | 10/10 passed: explicit/null matrix, missing fields, actual indexing gate, failure handling, overload routing, trusted generation, admin NULL handling, both controls tampering, real ViewState restoration/Init ordering and null index |
| Parent off / subtype on | Native choice hidden; upload/list passed; stored DOC_PRIVATE=N |
| Parent on / subtype off | Native choice hidden; upload/list passed; stored DOC_PRIVATE=N |
| Parent on / subtype on | Native Private choice selected; upload/list passed; stored DOC_PRIVATE=Y |
| Parent NULL / subtype NULL | Legacy Private choice preserved; upload/list passed; stored DOC_PRIVATE=Y |
| Fixture cleanup | Passed: four new synthetic documents and exact library files removed, isolated type/subtype/security metadata removed; zero existing-document changes |
| Release verification SQL 909 | Executed read-only: two metadata rows and two result sets, no data/schema changes |
| Final relevant diff whitespace check | Passed |
Native tests use the existing authorized task MAN mode and its normal CanAddTaskDocument check. EMP mode remains read-only and correctly exposes no Add document action. Test metadata is cloned into isolated CODEX9228 rows, files contain only a fictional sentence, and credentials stay in the test process. No original document content is published. Earlier failed harness attempts were cleaned separately; the final four-case receipt is Passed=true.
Deploy the application source/binary changes, including Classes/DocumentPrivacyPolicy.vb and its project inclusion. No new HRF_MYFOCUS_SETTING key, schema migration, permission grant, blanket flag backfill or document rewrite is required. Upcoming release script 909 is verification only. Existing table/default/backfill scripts 002/003/901/902 remain unchanged.
The native automation exercised the actual shared uploader hosted on a task with independent index verification, not every host page. Employee-profile Add New, native administration Save on both lookup editors, dynamically configured form uploads and generated bulk letters require their normal release UAT journeys. Source/production-property regression coverage preserves their contracts without generating business documents or changing live privacy. The separate 9289 task document read/deadlock evidence remains in its own verification report.