[Zhi-Xiang-Guo]

Description

Removing a shared image from segment A previously deleted its dataset-level vector even when segment B still referenced it. A subsequent retrieval returned no image despite B's binding remaining intact.

Compute removed and added attachments separately. Before deleting removed vectors, query other bindings within the same tenant and dataset; preserve vectors owned by those bindings, including disabled segments and other documents. Leave retained vectors untouched and embed only newly added attachments. Existing upload files are not deleted.

Related Issues

Fixes #45236. #42642 concerns document deletion; #44402 dataset deletion; #44434 disabled-segment deletion; #41777 omitted attachment_ids. This patch covers explicit attachment edits.

Module(s) Affected

• api/services/knowledge/segments/indexing.py
• api/repositories/knowledge/segment_repository.py
• Segment adapter tests

Testing

10 behavior regressions cover Console/Service API adapters, same/cross-document sharing, enabled/disabled owners and retained-vector reuse. They all fail on baseline. A further repository scope test fails on baseline because the new query does not exist. All 11 pass with the fix; expanded related suite: 143 passed.

Actual source API + official plugin + real local CLIP + Qdrant: retrieval/images change 1→0 before, 1→1 after removing A, then 1→0 after removing final B. The upload record remains.

• Baseline: main@4c521a3c0a1f60607c8a7bcf90792f34adcf18d0; branch fix/shared-segment-attachment-index; commit 8c3efb6c9dfac48e2b204c234ff309ed9b45abe3.
• Actual deployment: isolated source API + Celery, PostgreSQL 15 and Redis 6; macOS arm64, Python 3.13.15.
• Local unit fixtures use real SQLite repositories and existing VectorProbe/model stubs; these are distinct from the real-service API validation.
• Ruff check/format, targeted Pyrefly and git diff --check passed. Import linter: 78 contracts kept, 0 broken. Response contract lint: 762 valid, 0 mismatch, 378 unknown (not a claim of full coverage).
• Relevant repository diff guards passed. Full monorepo test/lint was not run. Remote workflows currently report action_required; CI has not passed. Independent human code review is pending.

Checklist

• Targets main; applicable contribution and architecture guidance reviewed.
• Regression tests and real application before/after evidence prepared.
• Tenant/dataset-scoped query; no schema/API change; no transaction held during index I/O.
• Full monorepo checks / remote CI completed.
• Publication authorized by the author on 2026-11-01 after agent review.
• Independent human code review completed.

Additional Notes

AI-assisted implementation and validation. The query protects references present when the edit checks them; it is not a cross-store transaction or global lock. Concurrent edits, vector-provider failure mid-operation, and other deletion/indexing paths retain their existing coordination limitations. Existing missing vectors are not automatically repaired by this patch; an actual reindex or remove/re-add operation is needed.

Known separate provider limitation: Qdrant delete_by_ids can delete matching attachment IDs across datasets in a shared collection (discussed in #42642). This PR fixes same-dataset attachment edits and does not change provider deletion filters or claim cross-dataset deletion safety.