chore: bump Guild/Frontend/Plugin (files + canvas); docs

File upload (100MB default, 1-week retention), per-channel pinned
canvas (single active, sharer-only update), and plugin file delivery
to agents. TEST_POINTS §8 + P14 added.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

docs/TEST_POINTS.md

@@ -129,6 +129,9 @@ Guild1 :7002 = `test-guild1`, Guild2 :7003 = `test-guild2`, Frontend :8088).
 | F15 | Discord-style dark theme | server rail / channel sidebar / messages / members layout |
 | F16 | create-modal bypass select | discuss/work only: optional multi-select of guild members; sent as `bypassUserIds`; reset on open/close |
 | F17 | members panel bypass UI | discuss/work + in-channel list only: bypass members tagged `bypass`; others show "→ bypass" action calling `POST :id/bypass` |
+| F18 | composer file attach | 📎 button + multi file input; selected files shown as removable chips; sent after upload; image preview / download chip rendered (via `?access_token`) |
+| F19 | pinned canvas panel | fixed below topbar, independent of message scroll; md→renderMarkdown, text→`<pre>`, html→sandboxed `<iframe sandbox srcdoc>`; collapse/expand |
+| F20 | canvas share/edit | Share (no canvas) / Edit (sharer) modal: title, format, source; sharer-only Edit/Remove; live update via `canvas.updated`/`canvas.removed` sockets; channel & messages context menus |
 
 ## 7. Fabric.OpenclawPlugin (channel plugin)
 
@@ -147,8 +150,25 @@ Guild1 :7002 = `test-guild1`, Guild2 :7003 = `test-guild2`, Frontend :8088).
 | P11 | tools | `fabric-register`; `create-{chat,work,report,discussion}-channel` (→ x_type); `discussion-complete` (summary + close) |
 | P12 | gateway lifecycle | starts inbound on `gateway_start`, stops on `gateway_stop`; no separate sidecar |
 | P13 | full round-trip | human posts in Fabric → wakeup → agent runs → reply lands in channel as agent |
+| P14 | file delivery to agent | message attachments downloaded with the agent's guild token to a temp dir; `MediaPaths`/`MediaTypes`/`MediaUrls` (+ singular) set on the finalized inbound context so the model receives the files |
 
-## 8. Cross-cutting / infra
+## 8. Fabric.Backend.Guild — files & canvas
+
+| # | Test point | Expected |
+|---|---|---|
+| FC1 | `POST /files` (multipart) | returns `{fileId,url:/api/files/:id,name,mimeType,size,expiresAt}`; `expiresAt ≈ now + TTL` (default 7d) |
+| FC2 | size limit | `> FABRIC_BACKEND_GUILD_FILE_MAX_BYTES` (default 100MB, operator-configurable) → 400 |
+| FC3 | `GET /files/:id` auth | reachable with Bearer **or** `?access_token=` (browser `<img>/<a>`); no token → 401; image/pdf/av inline, else attachment |
+| FC4 | bytes round-trip | downloaded content byte-identical to upload |
+| FC5 | retention sweep | rows past `expiresAt` purged with their blob on boot + hourly (`FilesService.cleanup`) |
+| FC6 | message attachments | `attachments[]` persisted on the message and returned by `GET …/messages` |
+| FC7 | canvas single-active | one row per channel (unique `channel_id`); `GET` null when none |
+| FC8 | canvas share (PUT/POST) | caller becomes `sharerUserId`, `version=1`; re-share replaces (resets version, new sharer); emits `canvas.updated` |
+| FC9 | canvas update (PATCH) | original sharer only (else 403); `version` increments; emits `canvas.updated` |
+| FC10 | canvas delete | sharer only (else 403); emits `canvas.removed` |
+| FC11 | canvas access scope | non-member of a non-public channel → 403 on get/share |
+
+## 9. Cross-cutting / infra
 
 | # | Test point | Expected |
 |---|---|---|
@@ -170,6 +190,13 @@ Guild1 :7002 = `test-guild1`, Guild2 :7003 = `test-guild2`, Frontend :8088).
   long-lived sockets (currently re-auth only on gateway restart); messages
   posted before an agent socket finishes joining are missed (no backfill);
   guild-token reconnect handling is minimal. Phase 2 (B2 firehose) not built.
+- **Files & canvas (§8)** backend is automated-e2e verified (upload,
+  `?access_token` download, 401, attachment persistence, canvas
+  share/update/replace/delete + sharer-only/access enforcement; retention
+  deadline asserted, sweep logic unit-level only — not waited out).
+- **Plugin file delivery (P14)** is build- + install-verified and follows
+  the documented openclaw inbound media contract; a live agent media
+  round-trip was not re-exercised (reuses the validated P13 path).
 - `discuss`/`work` differ only in x_type label; turn semantics identical —
   test one, both covered.
 - Desktop / Android submodules are out of scope (untouched).