Remove _random ID references and fix hosted file download ID

- Fix download button to use hosted_file_id instead of id (which resolved
  to event_file_id via _process_generic_props, hitting the wrong endpoint)
- Fix Dexie file table query in event_file_obj_tbl_wrapper to use _id
  fields (the indexed ones) instead of _id_random variants
- Remove _random fields from properties_to_save in event, event_session
- Drop _id_random fallbacks from launcher device ID resolution and
  background sync heartbeat
- Clean up dead comments and old FA anchor in post edit component
- Update TODO__Agents.md: BGH section removed, CMSC/Axonius shows added,
  download button fix marked complete

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

documentation/TODO__Agents.md

@@ -3,38 +3,22 @@
 > **Status:** Stable — ongoing development.
 
 
-## 🔴 BGH Conference — April 21 (Must Fix Before Event)
+## 🔴 CMSC Charlotte — May 27 (Presentation Management)
+**Drive down:** May 25 | **Setup:** May 26 morning | **Show:** May 27+
 
-- [x] **[Locations] Event Locations list does not auto-load** — added `+page.ts` to trigger
-  `load_ae_obj_li__event_location` on page load. Also fixed session query using stale
-  `event_location_id_random` index (should be `event_location_id`). (2026-04-19)
+- [ ] **[Electron/Launcher] Clean up presentation file launch scripts** — BGH show revealed
+  issues with the scripts used to open/launch presentation files through the Electron Launcher.
+  Audit and improve the launch/open flow (script reliability, error handling, file path resolution).
+  Must be tested and ready before May 26 setup day.
 
-- [x] **[Files] Warn/error on `.ppt`/`.doc` upload** — warning rows shown per-file in upload table;
-  non-trusted users are fully blocked (`file_list_status = 'blocked_legacy'`); trusted users see
-  warnings but can still upload. Covers `.ppt`, `.doc` (block) and other legacy exts (warn-only).
-  (2026-04-19)
+---
 
-- [x] **[Files] Hide internal-purpose files from Launcher by default** — renamed `hide_draft` prop
-  to `show_internal_purpose_files` in `launcher_file_cont.svelte`; logic flipped so `false` (the
-  default) hides files with `file_purpose == 'outline'`, `'draft'`, or `'admin'`. Store key renamed
-  from `hide_content__draft_files` (inverted, misleading) to `show_content__internal_files: false`
-  (show-on-opt-in, consistent with all other `show_content__*` flags). Updated across all 8 Launcher
-  templates that pass this prop. (2026-04-19, revised 2026-04-20)
+## 🔴 Axonius DC — June 9 (Badge Printing)
+**Setup/Registration:** June 8 | **Show:** June 9
 
-- [x] **[Launcher] Remove duplicate session API call on session select** — `menu_session_list.svelte`
-  was calling `load_ae_obj_id__event_session` directly AND then `goto()` triggered `+page.ts` which
-  also called it — two concurrent calls per session click. Removed the direct call entirely;
-  `+page.ts` is now the sole owner of session data loading. `goto()` promise assigned to
-  `ae_promises.slct__event_session_id` to drive the existing `{#await}` spinner. (2026-04-20)
-
-- [ ] **[Electron/Launcher] Deploy + test Aether Native Electron app on Mac laptops** — build,
-  deploy, and verify on onsite Mac laptops. Additional testing of cache/launch flow still needed
-  before April 21.
-
-- [x] **[Pres Mgmt] POC column shown in "Sessions at this Location"** — wired
-  `hide__session_poc={!pres_mgmt_loc.current.show__session_li_poc_field}` in
-  `ae_comp__event_location_obj_li.svelte`; also set `hide__session_location={true}` since
-  location is implicit in that context. (2026-04-19)
+- [ ] **[Badges] Epson C3500 fanfold badge layout** — Axonius is using Epson C3500 printers
+  with fanfold (continuous) badge stock. Create/configure a fanfold badge layout compatible
+  with the C3500 format. Must be ready before the June 8 setup/registration day.
 
 ---
 
@@ -268,28 +252,10 @@ Firefox unaffected. Production unaffected (public IPs only).
 
 
 ### [Files] Download button — wrong ID used in `handle_click()` (2026-04-22)
-`ae_comp__hosted_files_download_button.svelte` resolves `file_id` for the download call as
-`hosted_file_obj?.id || hosted_file_obj?.hosted_file_id || hosted_file_id`. When called from
-Manage Files with an `event_file_obj`, `hosted_file_obj.id` = `event_file_id` (set by
-`_process_generic_props` via the `_random` strip logic), so the chain stops at the wrong value.
-The download call goes to `/v3/action/hosted_file/{event_file_id}/download` instead of using the
-correct `hosted_file_id`. May work if the backend accepts event_file_id at that endpoint —
-needs live verification.
-
-**Status (2026-04-22):** Tested — downloads ARE working despite the wrong ID. The backend
-V3 action endpoint appears to silently accept `event_file_id` at the `hosted_file` download
-path (or maps between the two). Working by accident, not by design. Needs proper fix before
-it breaks — if the backend ever tightens that endpoint, all Manage Files downloads will 404.
-
-**Fix:** In `handle_click()` and both `$effect` blocks and the `content` snippet, replace:
-```ts
-const file_id = hosted_file_obj?.id || hosted_file_obj?.hosted_file_id || hosted_file_id;
-```
-with:
-```ts
-const file_id = hosted_file_obj?.hosted_file_id ?? hosted_file_id;
-```
-The direct-download `<a>` path is unaffected (already uses `event_file_id` → correct endpoint).
+- [x] **Fixed (2026-05-11):** All 5 spots in `ae_comp__hosted_files_download_button.svelte` updated
+  to use `hosted_file_obj?.hosted_file_id ?? hosted_file_id` instead of the old
+  `hosted_file_obj?.id || ...` chain that stopped at `event_file_id`. Needs live re-test to
+  confirm downloads still work correctly from Manage Files.
 
 ### [Files] `db_events.file.clear()` on upload clears all cached files (2026-04-22)
 In `ae_comp__event_files_upload.svelte` line 114, `db_events.file.clear()` wipes the entire