diff --git a/docs/redesign/phase-10/P10-04.md b/docs/redesign/phase-10/P10-04.md
index af9d869..db945e9 100644
--- a/docs/redesign/phase-10/P10-04.md
+++ b/docs/redesign/phase-10/P10-04.md
@@ -22,3 +22,9 @@ The three filters are disjoint: 89 distinct backend cases passed, zero failed/sk
 Frontend PASSED: five suites, 92 tests, zero failures/pending, native exit 0, 41.237 seconds. Exact selected paths: `career-history-view.test.tsx`, `application-assets.test.tsx`, `cover-letter-document.test.tsx`, `cv-document-controls.test.tsx`, `cv-import-review.test.tsx`; Jest `--runInBand --runTestsByPath`, local mocked contracts. [Native JSON](p10-04-evidence/frontend-document-workflows.json.gz), uncompressed SHA256 `b919a96d94218ff166de684f6b82d3ce6f34d47b51d52480721e8955df2df257`. Browser/real PDF fidelity and semantic AI quality are separate evidence. Backend and frontend counts remain separate.
 
 Migration rehearsal/rollback, MariaDB integration, sidecar, complete suites, security acceptance, hosted CI and human/device qualification remain NOT RUN here. Reuse unchanged accepted renderer evidence only within its source/fixture/environment boundaries. No migration or destructive cleanup is proposed. P10-05 remains open; production remains NO-GO.
+
+## Additional attachment qualification
+
+Fresh AttachmentConsistencyTests execution: 14 PASSED, zero failures/skips, native exit 0. Reused the existing Release assembly with --no-build/--no-restore after confirming no backend/test source difference between the Phase 10 and security branches. Relational temporary SQLite and synthetic files only. The named case Another_users_attachment_cannot_be_downloaded_renamed_or_deleted verifies three NotFound results and preserves the foreign file/row. Other selected cases cover upload/storage consistency. This is direct controller/local fixture evidence, not authenticated HTTP or deployed/MariaDB isolation acceptance. No application code changed.
+
+[Native TRX](p10-04-evidence/attachment-ownership-and-storage.trx.gz). These 14 cases are disjoint from the earlier 89 backend cases: selected backend coverage is now 103 distinct cases, with the 92 frontend tests kept separate. Complete suites and P10-05 remain open.
diff --git a/docs/redesign/phase-10/p10-04-evidence/attachment-ownership-and-storage.trx.gz b/docs/redesign/phase-10/p10-04-evidence/attachment-ownership-and-storage.trx.gz
new file mode 100644
index 0000000..56aad5c
Binary files /dev/null and b/docs/redesign/phase-10/p10-04-evidence/attachment-ownership-and-storage.trx.gz differ