# Test 527 — shared stored extension-token validator

Date: 2026-08-09
Base commit: b169e4fa00bf73b494af9d2d5241d9625b63dddb
Source commit: 2bf6be26d90669ccab56e0aa32ba748ae0b0fefc
Docker tag: anet-test527:dev
Docker image: sha256:9d944940f81d4a312bcc96efa6e298a58e8e95ffe21ac0cd3c2793e1dfd28ddd
Embedded environment: TEST527_SOURCE_COMMIT=2bf6be26d90669ccab56e0aa32ba748ae0b0fefc
Runner artifact SHA256: f57d6608d6440935aec16ac48ba79fbe9e4246f04c5a4a4113155da2cdaf8802

Command:

    sg docker -c 'docker build -t anet-test527:dev --build-arg SOURCE_COMMIT=2bf6be26d90669ccab56e0aa32ba748ae0b0fefc -f tests/test527-ext-validator-dedup/Dockerfile . && docker run --rm -v /tmp/test527-artifacts:/artifacts anet-test527:dev'

Result:

- Structural scope: one stored-token regex and exactly three consumers; `sanitizeExt` remains an independent filename parser.
- Shared-boundary plus existing upload tests: 73 passed, 0 failed, 276 assertions.
- Production CommHub bundle: PASS (257 modules, 1.52 MB output).
- Mutation widens the one shared grammar to `/./`:
  - new-upload path: witnessed red, rc=1;
  - existing-blob path: witnessed red, rc=1;
  - stored-index gate: witnessed red, rc=1.
- Restored source: 73 passed, 0 failed, 276 assertions.

Conclusion:

`buildStoragePath`, `pathForExistingBlob`, and `validateIndexEntry` enforce the same stored extension-token invariant and now share one private validator. `sanitizeExt` is intentionally not deduplicated because it parses a client filename and has different anchoring/capture semantics.
