test(05): persist human verification items as UAT

.planning/phases/05-files/05-HUMAN-UAT.md

@@ -0,0 +1,48 @@
+---
+status: partial
+phase: 05-files
+source: [05-VERIFICATION.md]
+started: 2026-05-15T00:00:00Z
+updated: 2026-05-15T00:00:00Z
+---
+
+## Current Test
+
+[awaiting human testing]
+
+## Tests
+
+### 1. Tab navigation URL sync
+expected: Clicking Overview / Tasks / Files tabs updates the browser URL bar via hx-push-url; browser Back button returns to previous tab
+result: [pending]
+
+### 2. File upload end-to-end
+expected: Selecting a file and submitting the upload form stores bytes in MinIO S3 bucket and creates a tablo_files DB row; file appears in the list immediately
+result: [pending]
+
+### 3. Download via presigned URL
+expected: Clicking the download link generates a presigned S3 URL and redirects (302) the browser to it; file downloads within 5-minute TTL
+result: [pending]
+
+### 4. Delete row removal + persistence
+expected: Clicking the inline delete confirmation removes the file from both S3 and DB; the file row disappears from the list on next page load
+result: [pending]
+
+### 5. Oversize upload friendly error
+expected: Uploading a file larger than MAX_UPLOAD_SIZE_MB (default 25MB) shows a friendly error message above the upload form rather than a 500 or generic error
+result: [pending]
+
+### 6. Authorization with two accounts
+expected: A user who does not own the tablo cannot upload, list, download, or delete files for that tablo (receives 404); only the tablo owner can access file routes
+result: [pending]
+
+## Summary
+
+total: 6
+passed: 0
+issues: 0
+pending: 6
+skipped: 0
+blocked: 0
+
+## Gaps