docs: mark archive upload/copy-path tasks DONE with verification evidence

docs/design.md

@@ -41,8 +41,9 @@ data/                                   # Docker volume
 ```
 
 Master dataset filenames: `<batch-id>__<frame number>.jpg` — unique across batches and
-self-documenting about where each image came from. The user's video archive is read-only
-(REQ-074).
+self-documenting about where each image came from. The user's video archive is written only
+by the user-initiated upload and date-folder endpoints (REQ-178); no other code path writes
+into it (REQ-074).
 
 ## SQLite schema
 
@@ -166,8 +167,8 @@ GET    /api/projects/{id}/dataset/download      # zip (REQ-054)
 
 GET    /api/projects/{id}/library               # list of dates (REQ-011)
 GET    /api/projects/{id}/library/{date}        # videos + duration/resolution (REQ-012)
-POST   /api/projects/{id}/library/dates?date=   # create YYYY-MM-DD folder, 409 if it exists (REQ-178)
-POST   /api/projects/{id}/library/upload?date=  # multipart `file`, streamed to disk (REQ-178)
+POST   /api/projects/{id}/library/dates?date=   # create YYYY-MM-DD folder → {date}; 409 if it exists, 400 bad format (REQ-178)
+POST   /api/projects/{id}/library/upload?date=  # multipart `file`, streamed to disk → {rel}; 409 dup, 400 bad ext/missing date (REQ-178)
 GET    /api/projects/{id}/video?rel=…           # Range streaming (REQ-013)
 
 POST   /api/projects/{id}/batches               # {rel, start_sec, end_sec, fps} → extract job
@@ -402,8 +403,8 @@ would wipe the class and leave only the drawings.
   known traps still apply: `setuptools<81` (because `sam3` imports `pkg_resources`) and the
   undeclared `einops` + `pycocotools` dependencies of the vendored SAM3.
 - `docker-compose.yml` — a `backend` service (GPU passthrough, `./data` volume, video archive
-  mounted read-only, `.env` for `HF_TOKEN`) and a `frontend` service (nginx: static files +
-  `/api` proxy).
+  mounted read-write (REQ-178), `.env` for `HF_TOKEN`) and a `frontend` service (nginx: static
+  files + `/api` proxy, `client_max_body_size 20g`).
 - GPU access uses **CDI** (`devices: nvidia.com/gpu=all`), not the legacy `runtime: nvidia`.
   Docker Engine 27+ discovers `nvidia.com/gpu` through the container toolkit; the runtime
   entry in `/etc/docker/daemon.json` is not registered with the daemon here.

docs/tasks.md

@@ -1207,21 +1207,27 @@ rather than direct (`zerotier-cli peers` — a `RELAY` row explains both the los
 end to end, but the decode cost is identical to RTSP and it adds ICE and keyframe-loss
 failure modes to the counting path. The saving was always on the browser side.
 
-## Task — Archive upload and date folders (REQ-178) `[TODO]`
+## Task — Archive upload and date folders (REQ-178) `[DONE]`
 
-1. Upload + date-folder API/UI → verify: mkdir returns 200/409/400, upload returns
-   200/409/400, new file listed in cycle, no `.part` residue; folder+upload work from the
-   Video Archive page.
+1. Upload + date-folder API/UI → verify: **[DONE]** mkdir 200 (new) / 409 (dup) / 400 (bad
+   format) / 400 (traversal `../evil`); upload 200 / 409 (dup) / 400 (bad ext) / 400 (missing
+   folder); 600MB file → 200; `GET .../library/2099-01-01` lists the uploaded file, file
+   visible from host WSL, zero `*.part` residue, test folder removed after verification;
+   `vite build` passes (66 modules). Browser click-test of copy buttons/upload dialog is NOT
+   automated — manual click-test pending.
 
-## Task — Copy-path buttons (REQ-179) `[TODO]`
+## Task — Copy-path buttons (REQ-179) `[DONE]`
 
-1. Copy-path buttons → verify: project payload carries `video_root_linux`/`video_root_windows`;
-   both buttons copy the correct paths to the clipboard.
+1. Copy-path buttons → verify: **[DONE]** project payload carries
+   `video_root_linux`=`/home/araaraenjoyer/dbs_project/reTraining/data/archive` and
+   `video_root_windows`=`\\wsl.localhost\Ubuntu\home\...\data\archive`. Browser click-test of
+   the buttons is NOT automated — manual click-test pending.
 
-## Task — Infra: rw archive mount + nginx body size (REQ-178) `[TODO]`
+## Task — Infra: rw archive mount + nginx body size (REQ-178) `[DONE]`
 
-1. rw mount + nginx body size → verify: compose archive mount is rw (no `RO`), nginx
-   accepts bodies >512m, `/api/health` 200 after rebuild.
+1. rw mount + nginx body size → verify: **[DONE]** compose archive mount `RW=true` (no `RO`);
+   nginx `client_max_body_size 20g` verified (600MB upload → 200); `/api/health` 200, `/docs`
+   200, frontend `http://localhost:9000` 200 after rebuild.
 
 ## Known open points