diff --git a/CHANGELOG.md b/CHANGELOG.md
index e84f41f8..b27ed2ad 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -35,6 +35,12 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Changed
 
+
+- Attachment-list status refresh now removes the per-row database lookup,
+  uses a configurable bounded worker pool with abortable downstream timeouts,
+  preserves stale status after isolated failures, excludes internal conversion
+  identifiers from responses, and reports attempted, changed, failed, and
+  deferred refresh counters.
 - 프로젝트 이름 입력 필드에 입력 예시(placeholder)를 추가하여 사용자 편의성을 개선했습니다.
 - 데이터 테이블의 반복되는 액션 버튼에 컨텍스트 정보(작업명)를 포함한 명시적인 ARIA 레이블을 추가하고, 유효성 검사 에러를 폼 필드에 연결하여 접근성을 개선했습니다.
 - `createGanttBarElement`, `renderGantt`, `buildWeekdayTimeline`에서 반복적으로 호출되던 `compareDateStrings`를 직접적인 문자열 비교 연산(`>=`, `<=`)으로 교체하여 O(N*D) 복잡도의 캐시 스레싱과 정규식 검사를 방지했습니다.
diff --git a/package-lock.json b/package-lock.json
index 079e2031..859ec2a6 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -9,7 +9,7 @@
       "version": "1.0.0",
       "dependencies": {
         "@hono/node-server": "^2.0.12",
-        "hono": "^4.12.32"
+        "hono": "^4.13.0"
       },
       "devDependencies": {
         "@playwright/test": "1.61.1",
@@ -382,9 +382,9 @@
       }
     },
     "node_modules/hono": {
-      "version": "4.12.32",
-      "resolved": "https://registry.npmjs.org/hono/-/hono-4.12.32.tgz",
-      "integrity": "sha512-XcuyW9qE2kJn07PkecMOBd5Vq/hMy7mmGw+idz1yblbg9N17ijJODrvPkn7/dwL3Kulj8LcRJ69DLOWf91dRUg==",
+      "version": "4.13.0",
+      "resolved": "https://registry.npmjs.org/hono/-/hono-4.13.0.tgz",
+      "integrity": "sha512-jhunvfHWxd7J5EFfSgH4xsYJzSe/lfqbUCxiyyeaQasUsXeEHXtzVid+7EOGByc5JnFa23SSFL3Y2RV/z1T+eQ==",
       "license": "MIT",
       "engines": {
         "node": ">=16.9.0"
diff --git a/package.json b/package.json
index 7790e678..31109a39 100644
--- a/package.json
+++ b/package.json
@@ -10,20 +10,21 @@
   },
   "scripts": {
     "check:python-docstrings": "node scripts/ci/static_coverage_evidence.mjs docstrings",
-    "coverage": "c8 --all --include=app.js --include=cloud-sync.js --include=scripts/ci/static_coverage_evidence.mjs --include=server/app.mjs --include=server/auth.mjs --reporter=json --reporter=json-summary npm run test:coverage",
+    "coverage": "npm run test:coverage",
     "server": "node server/server.mjs",
-    "test:api": "node tests/api/auth-secret.test.mjs && node tests/api/smoke.mjs && node tests/api/ratelimit.test.mjs",
-    "test:unit": "node tests/unit/analytics.test.mjs && node tests/unit/cpm.test.mjs && node tests/unit/baseline-compare.test.mjs && node tests/unit/workload.test.mjs && node tests/unit/cost-evm.test.mjs && node tests/unit/msproject.test.mjs && node tests/unit/auth-password.test.mjs && node tests/unit/editor-unsaved.test.mjs && node tests/unit/static-coverage-evidence.test.mjs && node tests/unit/dep-types.test.mjs && node tests/unit/weekly-report.test.mjs && node tests/unit/clearfolio.test.mjs && node tests/unit/sprint-stats.test.mjs && node tests/unit/burndown.test.mjs && node tests/unit/pm-analysis.test.mjs && node tests/unit/cloud-sync-security.test.mjs",
-    "test:coverage": "node tests/unit/msproject.test.mjs && node tests/unit/auth-password.test.mjs && node tests/unit/editor-unsaved.test.mjs && node tests/unit/static-coverage-evidence.test.mjs && npm run test:api",
+    "test:api": "node tests/api/auth-secret.test.mjs && node tests/api/smoke.mjs && node tests/api/ratelimit.test.mjs && node tests/api/attachment-status.test.mjs",
+    "test:unit": "node tests/unit/analytics.test.mjs && node tests/unit/cpm.test.mjs && node tests/unit/baseline-compare.test.mjs && node tests/unit/workload.test.mjs && node tests/unit/cost-evm.test.mjs && node tests/unit/msproject.test.mjs && node tests/unit/auth-password.test.mjs && node tests/unit/editor-unsaved.test.mjs && node tests/unit/static-coverage-evidence.test.mjs && node tests/unit/dep-types.test.mjs && node tests/unit/weekly-report.test.mjs && node tests/unit/clearfolio.test.mjs && node tests/unit/sprint-stats.test.mjs && node tests/unit/burndown.test.mjs && node tests/unit/pm-analysis.test.mjs && node tests/unit/cloud-sync-security.test.mjs && node tests/unit/attachment-status.test.mjs && node tests/unit/clearfolio-status-signal.test.mjs && node tests/unit/coverage-script-contract.test.mjs",
+    "test:coverage": "c8 --all --include=app.js --include=cloud-sync.js --include=scripts/ci/static_coverage_evidence.mjs --include=server/attachment_status.mjs --include=server/app.mjs --include=server/auth.mjs --include=server/clearfolio.mjs --reporter=json --reporter=json-summary npm run test:coverage:cases",
+    "test:coverage:cases": "node tests/unit/coverage-script-contract.test.mjs && node tests/unit/attachment-status.test.mjs && node tests/unit/clearfolio-status-signal.test.mjs && node tests/unit/msproject.test.mjs && node tests/unit/auth-password.test.mjs && node tests/unit/editor-unsaved.test.mjs && node tests/unit/static-coverage-evidence.test.mjs && npm run test:api",
     "test:e2e": "playwright test",
     "test:e2e:headed": "playwright test --headed",
-    "test:e2e:cloud": "playwright test tests/e2e/cloud.spec.js",
+    "test:e2e:cloud": "playwright install chromium && playwright test tests/e2e/cloud.spec.js",
     "test:fuzz": "playwright install chromium && playwright test tests/e2e/csv_formula_fuzz.spec.js",
     "fuzz": "node --test tests/fuzz/*.mjs"
   },
   "dependencies": {
     "@hono/node-server": "^2.0.12",
-    "hono": "^4.12.32"
+    "hono": "^4.13.0"
   },
   "devDependencies": {
     "@playwright/test": "1.61.1",
diff --git a/server/app.mjs b/server/app.mjs
index 13d95e5d..22fbe4be 100644
--- a/server/app.mjs
+++ b/server/app.mjs
@@ -8,6 +8,7 @@ import { db, rowid } from './db.mjs';
 import { hashPassword, verifyPassword, signToken, verifyToken, generateApiToken, hashApiToken } from './auth.mjs';
 import { PLANS, planOf, orgUsage, wouldExceed, createCheckout } from './billing.mjs';
 import { clearfolioMock, mockArtifact, submitJob, jobStatus, artifactUrl } from './clearfolio.mjs';
+import { normalizeAttachmentStatusBudgetMs, normalizeAttachmentStatusConcurrency, normalizeAttachmentStatusTimeoutMs, refreshAttachmentStatuses } from './attachment_status.mjs';
 import { chat as orchestratorChat } from './orchestrator.mjs';
 import { computeEvm } from '../analytics.js'; // pure math, shared with the client
 
@@ -73,7 +74,20 @@ function projectAccess(userId, projectId) {
 }
 
 // --- observability: in-process counters + structured request log.
-const metrics = { startedAt: new Date().toISOString(), requests: 0, s2xx: 0, s4xx: 0, s5xx: 0, signups: 0, projectsCreated: 0, webhookDeliveries: 0 };
+const metrics = {
+  startedAt: new Date().toISOString(),
+  requests: 0,
+  s2xx: 0,
+  s4xx: 0,
+  s5xx: 0,
+  signups: 0,
+  projectsCreated: 0,
+  webhookDeliveries: 0,
+  attachmentStatusRefreshAttempted: 0,
+  attachmentStatusRefreshChanged: 0,
+  attachmentStatusRefreshFailed: 0,
+  attachmentStatusRefreshDeferred: 0,
+};
 
 // Outbound webhooks: POST signed JSON to each active hook subscribed to `event`.
 // Fire-and-forget with a timeout, one retry on failure, and a recorded outcome
@@ -993,6 +1007,31 @@ app.post('/api/projects/:id/ai/brief', requireAuth, async (c) => {
 // 갱신), 서명 아티팩트 열람(302), 삭제. 테넌트 = 조직, 브라우저에는 Clearfolio
 // 자격이 절대 노출되지 않음.
 const ATTACH_MAX_BYTES = 10 * 1024 * 1024;
+
+const ATTACH_STATUS_CONCURRENCY = normalizeAttachmentStatusConcurrency(
+  process.env.SCOPEWEAVE_ATTACHMENT_STATUS_CONCURRENCY,
+);
+const ATTACH_STATUS_TIMEOUT_MS = normalizeAttachmentStatusTimeoutMs(
+  process.env.SCOPEWEAVE_ATTACHMENT_STATUS_TIMEOUT_MS,
+);
+const ATTACH_STATUS_BUDGET_MS = normalizeAttachmentStatusBudgetMs(
+  process.env.SCOPEWEAVE_ATTACHMENT_STATUS_BUDGET_MS,
+);
+const ATTACHMENT_LIST_COLUMNS = `a.id, a.task_id AS taskId, a.name, a.mime, a.size,
+  a.job_id AS jobId, a.status, a.created_at AS createdAt, u.email AS uploadedBy`;
+const ATTACHMENT_LIST_FROM =
+  'FROM attachments a LEFT JOIN users u ON u.id = a.created_by';
+const listAttachmentsStatement = db.prepare(
+  `SELECT ${ATTACHMENT_LIST_COLUMNS} ${ATTACHMENT_LIST_FROM}
+   WHERE a.project_id = ? ORDER BY a.id DESC`,
+);
+const listTaskAttachmentsStatement = db.prepare(
+  `SELECT ${ATTACHMENT_LIST_COLUMNS} ${ATTACHMENT_LIST_FROM}
+   WHERE a.project_id = ? AND a.task_id = ? ORDER BY a.id DESC`,
+);
+const updateAttachmentStatusStatement = db.prepare(
+  'UPDATE attachments SET status = ? WHERE id = ?',
+);
 app.post('/api/projects/:id/attachments', requireAuth, async (c) => {
   const uid = c.get('user').sub;
   const p = projectAccess(uid, c.req.param('id'));
@@ -1022,28 +1061,24 @@ app.get('/api/projects/:id/attachments', requireAuth, async (c) => {
   const uid = c.get('user').sub;
   const p = projectAccess(uid, c.req.param('id'));
   if (!p) return c.json({ error: 'not found' }, 404);
+
   const taskId = c.req.query('taskId');
-  const rows = (taskId
-    ? db.prepare(`SELECT a.id, a.task_id AS taskId, a.name, a.mime, a.size, a.status, a.created_at AS createdAt, u.email AS uploadedBy
-        FROM attachments a LEFT JOIN users u ON u.id = a.created_by
-        WHERE a.project_id = ? AND a.task_id = ? ORDER BY a.id DESC`).all(p.id, taskId)
-    : db.prepare(`SELECT a.id, a.task_id AS taskId, a.name, a.mime, a.size, a.status, a.created_at AS createdAt, u.email AS uploadedBy
-        FROM attachments a LEFT JOIN users u ON u.id = a.created_by
-        WHERE a.project_id = ? ORDER BY a.id DESC`).all(p.id));
-  // PENDING 잡 상태 갱신(최선 노력)
-  for (const r of rows) {
-    if (r.status === 'PENDING' || r.status === 'RUNNING') {
-      try {
-        const jid = db.prepare('SELECT job_id FROM attachments WHERE id = ?').get(r.id).job_id;
-        const st = await jobStatus(p.org_id, uid, jid);
-        if (st !== r.status) {
-          db.prepare('UPDATE attachments SET status = ? WHERE id = ?').run(st, r.id);
-          r.status = st;
-        }
-      } catch { /* keep stale status */ }
-    }
-  }
-  return c.json({ attachments: rows });
+  const rows = taskId
+    ? listTaskAttachmentsStatement.all(p.id, taskId)
+    : listAttachmentsStatement.all(p.id);
+  await refreshAttachmentStatuses(rows, {
+    orgId: p.org_id,
+    userId: uid,
+    jobStatus,
+    updateStatus: (status, attachmentId) =>
+      updateAttachmentStatusStatement.run(status, attachmentId),
+    concurrency: ATTACH_STATUS_CONCURRENCY,
+    timeoutMs: ATTACH_STATUS_TIMEOUT_MS,
+    budgetMs: ATTACH_STATUS_BUDGET_MS,
+    metrics,
+  });
+  const attachments = rows.map(({ jobId: _internalJobId, ...publicRow }) => publicRow);
+  return c.json({ attachments });
 });
 
 // 열람: 서명 아티팩트 URL로 302. 새 탭 열기용으로 ?token=도 허용(ics/stream 패턴).
diff --git a/server/attachment_status.mjs b/server/attachment_status.mjs
new file mode 100644
index 00000000..e92767c8
--- /dev/null
+++ b/server/attachment_status.mjs
@@ -0,0 +1,275 @@
+/** Default maximum concurrent Clearfolio status lookups. */
+export const ATTACHMENT_STATUS_DEFAULT_CONCURRENCY = 8;
+
+/** Conservative hard ceiling for operator-configured lookup concurrency. */
+export const ATTACHMENT_STATUS_MAX_CONCURRENCY = 32;
+
+/** Default downstream status lookup timeout in milliseconds. */
+export const ATTACHMENT_STATUS_DEFAULT_TIMEOUT_MS = 3_000;
+
+/** Hard ceiling for a downstream status lookup timeout in milliseconds. */
+export const ATTACHMENT_STATUS_MAX_TIMEOUT_MS = 30_000;
+
+/** Default wall-clock budget for one attachment-list refresh pass. */
+export const ATTACHMENT_STATUS_DEFAULT_BUDGET_MS = 5_000;
+
+/** Hard ceiling for one attachment-list refresh pass. */
+export const ATTACHMENT_STATUS_MAX_BUDGET_MS = 60_000;
+
+/** Status values accepted from the Clearfolio conversion contract. */
+const ATTACHMENT_STATUS_VALUES = new Set(['PENDING', 'RUNNING', 'SUCCEEDED', 'FAILED']);
+
+/** Timeout error name used only for sanitized failure categorization. */
+const ATTACHMENT_STATUS_TIMEOUT_ERROR = 'AttachmentStatusTimeoutError';
+
+/**
+ * Normalize a positive integer while applying a conservative upper bound.
+ *
+ * @param {unknown} value - Untrusted environment or caller value.
+ * @param {number} fallback - Value used for missing or invalid input.
+ * @param {number} maximum - Largest accepted value.
+ * @returns {number} A safe positive integer no greater than `maximum`.
+ */
+function normalizeBoundedInteger(value, fallback, maximum) {
+  const parsed = Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < 1) return fallback;
+  return Math.min(parsed, maximum);
+}
+
+/**
+ * Normalize the configured attachment-status worker count.
+ *
+ * @param {unknown} value - Environment or caller supplied value.
+ * @returns {number} An integer between 1 and 32, defaulting to 8.
+ */
+export function normalizeAttachmentStatusConcurrency(value) {
+  return normalizeBoundedInteger(
+    value,
+    ATTACHMENT_STATUS_DEFAULT_CONCURRENCY,
+    ATTACHMENT_STATUS_MAX_CONCURRENCY,
+  );
+}
+
+/**
+ * Normalize the configured Clearfolio status timeout.
+ *
+ * @param {unknown} value - Environment or caller supplied value.
+ * @returns {number} A positive timeout no greater than 30 seconds.
+ */
+export function normalizeAttachmentStatusTimeoutMs(value) {
+  return normalizeBoundedInteger(
+    value,
+    ATTACHMENT_STATUS_DEFAULT_TIMEOUT_MS,
+    ATTACHMENT_STATUS_MAX_TIMEOUT_MS,
+  );
+}
+
+/**
+ * Normalize the request-wide attachment refresh budget.
+ *
+ * @param {unknown} value - Environment or caller supplied value.
+ * @returns {number} A positive budget no greater than 60 seconds.
+ */
+export function normalizeAttachmentStatusBudgetMs(value) {
+  return normalizeBoundedInteger(
+    value,
+    ATTACHMENT_STATUS_DEFAULT_BUDGET_MS,
+    ATTACHMENT_STATUS_MAX_BUDGET_MS,
+  );
+}
+
+/**
+ * Read a clock dependency and reject unusable values before deadline math.
+ *
+ * @param {() => number} clock - Clock returning epoch-like milliseconds.
+ * @returns {number} A finite millisecond value.
+ * @throws {TypeError} If the clock returns a non-finite value.
+ */
+function readClock(clock) {
+  const value = clock();
+  if (!Number.isFinite(value)) throw new TypeError('clock must return a finite number');
+  return value;
+}
+
+/**
+ * Add one refresh result to process-level operational counters.
+ *
+ * @param {object|undefined} metrics - Mutable process metric registry.
+ * @param {{attempted:number,changed:number,failed:number,deferred:number}} counts - Refresh result.
+ * @returns {void}
+ */
+function addRefreshMetrics(metrics, counts) {
+  if (!metrics) return;
+  const fields = {
+    attachmentStatusRefreshAttempted: 'attempted',
+    attachmentStatusRefreshChanged: 'changed',
+    attachmentStatusRefreshFailed: 'failed',
+    attachmentStatusRefreshDeferred: 'deferred',
+  };
+  for (const [metric, count] of Object.entries(fields)) {
+    metrics[metric] = (Number(metrics[metric]) || 0) + counts[count];
+  }
+}
+
+/**
+ * Publish a sanitized refresh-failure category without risking the request.
+ *
+ * The callback never receives a Clearfolio job identifier, URL, response body,
+ * or raw downstream error. A failing diagnostic sink is isolated because
+ * observability must not break attachment listing.
+ *
+ * @param {((event:{category:string}) => unknown)|undefined} onError - Optional diagnostic sink.
+ * @param {string} category - Fixed safe failure category.
+ * @returns {void}
+ */
+function reportRefreshFailure(onError, category) {
+  if (!onError) return;
+  try {
+    onError({ category });
+  } catch {
+    // Diagnostics are best effort and must never fail the list response.
+  }
+}
+
+/**
+ * Await one downstream lookup with an AbortSignal and a hard caller-side timeout.
+ *
+ * The explicit race means a non-compliant downstream adapter cannot hold a list
+ * response open forever even if it ignores the supplied AbortSignal.
+ *
+ * @param {() => Promise<string>} lookup - Deferred downstream lookup.
+ * @param {AbortController} controller - Controller whose signal is passed downstream.
+ * @param {number} timeoutMs - Hard timeout in milliseconds.
+ * @returns {Promise<string>} The downstream status.
+ */
+async function withTimeout(lookup, controller, timeoutMs) {
+  let timer;
+  const timeout = new Promise((_, reject) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      const error = new Error('attachment status lookup timed out');
+      error.name = ATTACHMENT_STATUS_TIMEOUT_ERROR;
+      reject(error);
+    }, timeoutMs);
+  });
+  try {
+    return await Promise.race([lookup(), timeout]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+
+/**
+ * Refresh pending attachment statuses through a bounded worker pool.
+ *
+ * Rows are updated in place so the caller can serialize the refreshed public
+ * representation. A shared wall-clock deadline bounds the whole refresh pass;
+ * workers clamp each lookup timeout to the remaining request budget and mark
+ * unstarted rows as deferred after the deadline. Missing job identifiers and
+ * downstream, validation, or persistence failures preserve stale status and
+ * never fail the attachment-list response.
+ *
+ * @param {Array<object>} rows - Attachment rows containing `id`, `status`, and `jobId`.
+ * @param {object} options - Downstream functions, tenant identifiers, limits, and metrics.
+ * @param {number|string} options.orgId - ScopeWeave organization identifier.
+ * @param {number|string} options.userId - Requesting user identifier.
+ * @param {(orgId: unknown, userId: unknown, jobId: string, options: {signal: AbortSignal}) => Promise<string>} options.jobStatus - Downstream lookup.
+ * @param {(status: string, attachmentId: unknown) => unknown|Promise<unknown>} options.updateStatus - Changed-only persistence callback.
+ * @param {unknown} [options.concurrency] - Maximum concurrent lookups.
+ * @param {unknown} [options.timeoutMs] - Per-lookup timeout in milliseconds.
+ * @param {unknown} [options.budgetMs] - Request-wide refresh budget in milliseconds.
+ * @param {object} [options.metrics] - Mutable process metrics object.
+ * @param {(event:{category:string}) => unknown} [options.onError] - Sanitized diagnostic callback.
+ * @param {() => number} [options.now] - Injectable finite millisecond clock for deterministic tests.
+ * @returns {Promise<{attempted:number,changed:number,failed:number,deferred:number}>} Structured counters.
+ */
+export async function refreshAttachmentStatuses(rows, options) {
+  if (!Array.isArray(rows)) throw new TypeError('rows must be an array');
+  if (typeof options?.jobStatus !== 'function') throw new TypeError('jobStatus must be a function');
+  if (typeof options?.updateStatus !== 'function') throw new TypeError('updateStatus must be a function');
+  if (options.onError !== undefined && typeof options.onError !== 'function') {
+    throw new TypeError('onError must be a function');
+  }
+  if (options.now !== undefined && typeof options.now !== 'function') {
+    throw new TypeError('now must be a function');
+  }
+
+  const counts = { attempted: 0, changed: 0, failed: 0, deferred: 0 };
+  const pending = rows.filter((row) => row?.status === 'PENDING' || row?.status === 'RUNNING');
+  const concurrency = normalizeAttachmentStatusConcurrency(options.concurrency);
+  const timeoutMs = normalizeAttachmentStatusTimeoutMs(options.timeoutMs);
+  const budgetMs = normalizeAttachmentStatusBudgetMs(options.budgetMs);
+  const clock = options.now || Date.now;
+  const deadline = readClock(clock) + budgetMs;
+  let cursor = 0;
+
+  /**
+   * Process pending rows until the shared cursor is exhausted.
+   *
+   * JavaScript advances the cursor synchronously before each await, so workers
+   * claim distinct rows without locks and context switching stays bounded by the
+   * configured worker count.
+   *
+   * @returns {Promise<void>} Resolves after this worker has no remaining row.
+   */
+  async function worker() {
+    for (;;) {
+      const index = cursor;
+      cursor += 1;
+      if (index >= pending.length) return;
+      const row = pending[index];
+      const remainingBudgetMs = deadline - readClock(clock);
+      if (remainingBudgetMs <= 0) {
+        counts.deferred += 1;
+        continue;
+      }
+
+      const jobId = typeof row.jobId === 'string' ? row.jobId.trim() : '';
+      if (!jobId) {
+        counts.deferred += 1;
+        continue;
+      }
+
+      counts.attempted += 1;
+      const controller = new AbortController();
+      let failureCategory = 'downstream_lookup';
+      try {
+        const effectiveTimeoutMs = Math.max(
+          1,
+          Math.min(timeoutMs, Math.ceil(remainingBudgetMs)),
+        );
+        const nextStatus = await withTimeout(
+          () => options.jobStatus(
+            options.orgId,
+            options.userId,
+            jobId,
+            { signal: controller.signal },
+          ),
+          controller,
+          effectiveTimeoutMs,
+        );
+        failureCategory = 'invalid_status';
+        if (!ATTACHMENT_STATUS_VALUES.has(nextStatus)) {
+          throw new Error('invalid downstream status');
+        }
+        if (nextStatus !== row.status) {
+          failureCategory = 'status_persistence';
+          await options.updateStatus(nextStatus, row.id);
+          row.status = nextStatus;
+          counts.changed += 1;
+        }
+      } catch (error) {
+        counts.failed += 1;
+        const category = error?.name === ATTACHMENT_STATUS_TIMEOUT_ERROR
+          ? 'timeout'
+          : failureCategory;
+        reportRefreshFailure(options.onError, category);
+      }
+    }
+  }
+
+  const workerCount = Math.min(concurrency, pending.length);
+  await Promise.all(Array.from({ length: workerCount }, () => worker()));
+  addRefreshMetrics(options.metrics, counts);
+  return counts;
+}
diff --git a/server/clearfolio.mjs b/server/clearfolio.mjs
index ae5cd8f3..e5db9f08 100644
--- a/server/clearfolio.mjs
+++ b/server/clearfolio.mjs
@@ -7,16 +7,34 @@ const CF_URL = (process.env.CLEARFOLIO_URL || '').replace(/\/$/, '');
 const CF_SECRET = process.env.CLEARFOLIO_HMAC_SECRET || '';
 const PERMISSIONS = 'job:create,job:read,viewer:read,artifact-link:create';
 
+/** Whether the process uses the in-memory Clearfolio development adapter. */
 export const clearfolioMock = !CF_URL;
 
-// Clearfolio TenantAccessService.signClaims와 동일한 규격:
-// payload = tenantId \n subjectId \n permissions \n issuedAt(epoch초),
-// HMAC-SHA256 → base64url(무패딩).
+/**
+ * Sign tenant claims using the Clearfolio HMAC interoperability contract.
+ *
+ * The payload is the newline-delimited tenant ID, subject ID, permissions, and
+ * issued-at epoch value. The signature is unpadded base64url HMAC-SHA256.
+ *
+ * @param {string} tenantId - Clearfolio tenant identifier.
+ * @param {string} subjectId - Clearfolio subject identifier.
+ * @param {string} permissions - Comma-separated permission contract.
+ * @param {string|number} issuedAt - Epoch-second issue time.
+ * @param {string} secret - Shared HMAC secret.
+ * @returns {string} Unpadded base64url signature.
+ */
 export function signClaims(tenantId, subjectId, permissions, issuedAt, secret) {
   const payload = [tenantId, subjectId, permissions, issuedAt].join('\n');
   return createHmac('sha256', secret).update(payload).digest('base64url');
 }
 
+/**
+ * Build tenant-scoped Clearfolio request headers without exposing credentials.
+ *
+ * @param {string|number} orgId - ScopeWeave organization identifier.
+ * @param {string|number} userId - Requesting ScopeWeave user identifier.
+ * @returns {Record<string,string>} Tenant, subject, permission, and optional HMAC headers.
+ */
 function tenantHeaders(orgId, userId) {
   const tenantId = `sw-org-${orgId}`;
   const subjectId = `sw-user-${userId}`;
@@ -28,7 +46,13 @@ function tenantHeaders(orgId, userId) {
   if (CF_SECRET) {
     const issuedAt = String(Math.floor(Date.now() / 1000));
     headers['X-Clearfolio-Claims-Issued-At'] = issuedAt;
-    headers['X-Clearfolio-Claims-Signature'] = signClaims(tenantId, subjectId, PERMISSIONS, issuedAt, CF_SECRET);
+    headers['X-Clearfolio-Claims-Signature'] = signClaims(
+      tenantId,
+      subjectId,
+      PERMISSIONS,
+      issuedAt,
+      CF_SECRET,
+    );
   }
   return headers;
 }
@@ -36,8 +60,24 @@ function tenantHeaders(orgId, userId) {
 // ---- mock store (dev/test 전용; 재시작 시 소실) ----
 const mockDocs = new Map(); // jobId -> { name, mime, bytes }
 let mockSeq = 0;
+
+/**
+ * Read one in-memory mock artifact.
+ *
+ * @param {string} jobId - Mock conversion job identifier.
+ * @returns {{name:string,mime:string,bytes:Buffer}|null} Stored artifact or null.
+ */
 export const mockArtifact = (jobId) => mockDocs.get(jobId) || null;
 
+/**
+ * Submit a document conversion job through Clearfolio or the local mock.
+ *
+ * @param {string|number} orgId - ScopeWeave organization identifier.
+ * @param {string|number} userId - Requesting ScopeWeave user identifier.
+ * @param {{name:string,mime:string,bytes:Buffer|Uint8Array}} document - Conversion payload.
+ * @returns {Promise<{jobId:string,status:string}>} Downstream job identity and initial status.
+ * @throws {Error} If Clearfolio rejects the request or omits a job identifier.
+ */
 export async function submitJob(orgId, userId, { name, mime, bytes }) {
   if (clearfolioMock) {
     const jobId = `mockcf-${++mockSeq}`;
@@ -52,20 +92,49 @@ export async function submitJob(orgId, userId, { name, mime, bytes }) {
     body: form,
   });
   const data = await res.json().catch(() => ({}));
-  if (!res.ok || !data.jobId) throw new Error(data.message || `clearfolio submit failed (${res.status})`);
+  if (!res.ok || !data.jobId) {
+    throw new Error(data.message || `clearfolio submit failed (${res.status})`);
+  }
   return { jobId: data.jobId, status: data.status || 'PENDING' };
 }
 
-export async function jobStatus(orgId, userId, jobId) {
+/**
+ * Read a Clearfolio conversion status with optional caller cancellation.
+ *
+ * Non-success HTTP responses throw instead of being converted to `FAILED`.
+ * This allows the bounded refresh engine to preserve the previously persisted
+ * status when Clearfolio itself is temporarily unavailable or rejects a request.
+ *
+ * @param {string|number} orgId - ScopeWeave organization identifier.
+ * @param {string|number} userId - Requesting user identifier.
+ * @param {string} jobId - Clearfolio conversion job identifier.
+ * @param {{signal?:AbortSignal}} [options] - Optional request cancellation signal.
+ * @returns {Promise<string>} Downstream conversion status.
+ * @throws {Error} If Clearfolio returns a non-success HTTP status.
+ */
+export async function jobStatus(orgId, userId, jobId, { signal } = {}) {
   if (clearfolioMock) return mockDocs.has(jobId) ? 'SUCCEEDED' : 'FAILED';
   const res = await fetch(`${CF_URL}/api/v1/convert/jobs/${encodeURIComponent(jobId)}`, {
     headers: tenantHeaders(orgId, userId),
+    signal,
   });
   const data = await res.json().catch(() => ({}));
+  if (!res.ok) throw new Error(`clearfolio status failed (${res.status})`);
   return data.status || 'FAILED';
 }
 
-// SUCCEEDED 잡의 서명 아티팩트 URL 발급 → 뷰어/직접 열람용 절대 URL 반환.
+/**
+ * Issue a viewable artifact URL for a completed Clearfolio job.
+ *
+ * The hosted path prefers Clearfolio's external PDF.js viewer when an
+ * `artifactToken` is available and falls back to the signed artifact URL.
+ *
+ * @param {string|number} orgId - ScopeWeave organization identifier.
+ * @param {string|number} userId - Requesting ScopeWeave user identifier.
+ * @param {string} jobId - Completed conversion job identifier.
+ * @returns {Promise<string>} Relative mock path or absolute hosted artifact URL.
+ * @throws {Error} If Clearfolio cannot issue an artifact link.
+ */
 export async function artifactUrl(orgId, userId, jobId) {
   if (clearfolioMock) return `/api/mock-clearfolio/${encodeURIComponent(jobId)}`;
   const res = await fetch(`${CF_URL}/api/v1/viewer/${encodeURIComponent(jobId)}/artifact-links`, {
@@ -74,13 +143,19 @@ export async function artifactUrl(orgId, userId, jobId) {
   });
   const data = await res.json().catch(() => ({}));
   const link = data.artifactUrl || data.url || data.signedUrl;
-  if (!res.ok || !link) throw new Error(data.message || `clearfolio artifact-link failed (${res.status})`);
+  if (!res.ok || !link) {
+    throw new Error(data.message || `clearfolio artifact-link failed (${res.status})`);
+  }
   // PDF.js 뷰어 페이지 우선(clearfolio external artifactToken 모드): 토큰을
   // 추출해 /viewer/{docId}?artifactToken=… 으로 보낸다. 실패 시 원시 아티팩트.
   try {
-    const u = new URL(link, CF_URL);
-    const tok = u.searchParams.get('artifactToken');
-    if (tok) return `${CF_URL}/viewer/${encodeURIComponent(jobId)}?artifactToken=${encodeURIComponent(tok)}`;
-  } catch { /* fall through to raw link */ }
+    const url = new URL(link, CF_URL);
+    const token = url.searchParams.get('artifactToken');
+    if (token) {
+      return `${CF_URL}/viewer/${encodeURIComponent(jobId)}?artifactToken=${encodeURIComponent(token)}`;
+    }
+  } catch {
+    // Fall through to the signed raw artifact link.
+  }
   return link.startsWith('http') ? link : `${CF_URL}${link}`;
 }
diff --git a/tests/api/attachment-status.test.mjs b/tests/api/attachment-status.test.mjs
new file mode 100644
index 00000000..1b840fcb
--- /dev/null
+++ b/tests/api/attachment-status.test.mjs
@@ -0,0 +1,118 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+process.env.SCOPEWEAVE_DB = ':memory:';
+process.env.SCOPEWEAVE_JWT_SECRET = '0123456789abcdef0123456789abcdef';
+process.env.SCOPEWEAVE_ATTACHMENT_STATUS_CONCURRENCY = '2';
+process.env.SCOPEWEAVE_ATTACHMENT_STATUS_TIMEOUT_MS = '500';
+process.env.SCOPEWEAVE_ATTACHMENT_STATUS_BUDGET_MS = '1000';
+process.env.CLEARFOLIO_URL = '';
+
+const { app } = await import('../../server/app.mjs');
+const { db } = await import('../../server/db.mjs');
+const jsonRequest = (path, options = {}) => app.request(path, {
+  ...options,
+  headers: { 'content-type': 'application/json', ...(options.headers || {}) },
+});
+
+async function upload(projectId, token, taskId) {
+  const form = new FormData();
+  form.append(
+    'file',
+    new Blob([`content-${taskId}`], { type: 'text/plain' }),
+    `${taskId}.txt`,
+  );
+  form.set('taskId', taskId);
+  const response = await app.request(`/api/projects/${projectId}/attachments`, {
+    method: 'POST',
+    headers: { authorization: `Bearer ${token}` },
+    body: form,
+  });
+  assert.equal(response.status, 200);
+  return response.json();
+}
+
+test('attachment listing refreshes without internal identifier leakage', async () => {
+  let response = await jsonRequest('/api/auth/signup', {
+    method: 'POST',
+    body: JSON.stringify({
+      email: 'attachments@scopeweave.test',
+      password: 'password123',
+      name: 'Attachments',
+    }),
+  });
+  assert.equal(response.status, 200);
+  const token = (await response.json()).token;
+  const auth = { authorization: `Bearer ${token}` };
+
+  response = await jsonRequest('/api/me', { headers: auth });
+  const userId = (await response.json()).user.id;
+  response = await jsonRequest('/api/projects', {
+    method: 'POST',
+    headers: auth,
+    body: JSON.stringify({ name: 'Attachment Status Project' }),
+  });
+  assert.equal(response.status, 200);
+  const projectId = (await response.json()).id;
+
+  const first = await upload(projectId, token, 'task-a');
+  const second = await upload(projectId, token, 'task-b');
+  db.prepare("UPDATE attachments SET status = 'PENDING' WHERE id IN (?, ?)")
+    .run(first.id, second.id);
+  db.prepare(
+    'INSERT INTO attachments(project_id,task_id,name,mime,size,job_id,status,created_by) VALUES(?,?,?,?,?,?,?,?)',
+  ).run(
+    projectId,
+    'task-missing',
+    'missing.txt',
+    'text/plain',
+    1,
+    '',
+    'PENDING',
+    userId,
+  );
+
+  response = await jsonRequest(
+    `/api/projects/${projectId}/attachments?taskId=task-a`,
+    { headers: auth },
+  );
+  assert.equal(response.status, 200);
+  let attachments = (await response.json()).attachments;
+  assert.equal(attachments.length, 1);
+  assert.equal(attachments[0].taskId, 'task-a');
+  assert.equal(attachments[0].status, 'SUCCEEDED');
+  assert.equal(Object.hasOwn(attachments[0], 'jobId'), false);
+
+  response = await jsonRequest(`/api/projects/${projectId}/attachments`, {
+    headers: auth,
+  });
+  assert.equal(response.status, 200);
+  attachments = (await response.json()).attachments;
+  assert.equal(attachments.length, 3);
+  assert.equal(
+    attachments.every((row) => !Object.hasOwn(row, 'jobId')),
+    true,
+  );
+  assert.equal(
+    attachments.find((row) => row.taskId === 'task-b').status,
+    'SUCCEEDED',
+  );
+  assert.equal(
+    attachments.find((row) => row.taskId === 'task-missing').status,
+    'PENDING',
+  );
+
+  response = await jsonRequest('/api/metrics');
+  const metrics = await response.json();
+  assert.equal(metrics.attachmentStatusRefreshAttempted, 2);
+  assert.equal(metrics.attachmentStatusRefreshChanged, 2);
+  assert.equal(metrics.attachmentStatusRefreshFailed, 0);
+  assert.equal(metrics.attachmentStatusRefreshDeferred, 1);
+
+  response = await jsonRequest('/api/metrics?format=prometheus');
+  const prometheus = await response.text();
+  assert.match(prometheus, /scopeweave_attachment_status_refresh_attempted 2/);
+  assert.match(prometheus, /scopeweave_attachment_status_refresh_changed 2/);
+  assert.match(prometheus, /scopeweave_attachment_status_refresh_failed 0/);
+  assert.match(prometheus, /scopeweave_attachment_status_refresh_deferred 1/);
+});
diff --git a/tests/unit/attachment-status.test.mjs b/tests/unit/attachment-status.test.mjs
new file mode 100644
index 00000000..7c299cda
--- /dev/null
+++ b/tests/unit/attachment-status.test.mjs
@@ -0,0 +1,267 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+import {
+  ATTACHMENT_STATUS_DEFAULT_BUDGET_MS,
+  ATTACHMENT_STATUS_DEFAULT_CONCURRENCY,
+  ATTACHMENT_STATUS_DEFAULT_TIMEOUT_MS,
+  ATTACHMENT_STATUS_MAX_BUDGET_MS,
+  ATTACHMENT_STATUS_MAX_CONCURRENCY,
+  ATTACHMENT_STATUS_MAX_TIMEOUT_MS,
+  normalizeAttachmentStatusBudgetMs,
+  normalizeAttachmentStatusConcurrency,
+  normalizeAttachmentStatusTimeoutMs,
+  refreshAttachmentStatuses,
+} from '../../server/attachment_status.mjs';
+
+test('attachment status configuration is bounded and fail-safe', () => {
+  assert.equal(
+    normalizeAttachmentStatusConcurrency(undefined),
+    ATTACHMENT_STATUS_DEFAULT_CONCURRENCY,
+  );
+  assert.equal(normalizeAttachmentStatusConcurrency('4'), 4);
+  assert.equal(
+    normalizeAttachmentStatusConcurrency(0),
+    ATTACHMENT_STATUS_DEFAULT_CONCURRENCY,
+  );
+  assert.equal(
+    normalizeAttachmentStatusConcurrency(1.5),
+    ATTACHMENT_STATUS_DEFAULT_CONCURRENCY,
+  );
+  assert.equal(
+    normalizeAttachmentStatusConcurrency(999),
+    ATTACHMENT_STATUS_MAX_CONCURRENCY,
+  );
+
+  assert.equal(
+    normalizeAttachmentStatusTimeoutMs(undefined),
+    ATTACHMENT_STATUS_DEFAULT_TIMEOUT_MS,
+  );
+  assert.equal(normalizeAttachmentStatusTimeoutMs('25'), 25);
+  assert.equal(
+    normalizeAttachmentStatusTimeoutMs(-1),
+    ATTACHMENT_STATUS_DEFAULT_TIMEOUT_MS,
+  );
+  assert.equal(
+    normalizeAttachmentStatusTimeoutMs(50_000),
+    ATTACHMENT_STATUS_MAX_TIMEOUT_MS,
+  );
+
+  assert.equal(
+    normalizeAttachmentStatusBudgetMs(undefined),
+    ATTACHMENT_STATUS_DEFAULT_BUDGET_MS,
+  );
+  assert.equal(normalizeAttachmentStatusBudgetMs('2500'), 2_500);
+  assert.equal(
+    normalizeAttachmentStatusBudgetMs(0),
+    ATTACHMENT_STATUS_DEFAULT_BUDGET_MS,
+  );
+  assert.equal(
+    normalizeAttachmentStatusBudgetMs(100_000),
+    ATTACHMENT_STATUS_MAX_BUDGET_MS,
+  );
+});
+
+test('refresh validates its dependency, diagnostic, and clock contracts', async () => {
+  const dependencies = {
+    jobStatus: async () => 'PENDING',
+    updateStatus() {},
+  };
+  await assert.rejects(
+    () => refreshAttachmentStatuses(null, {}),
+    /rows must be an array/,
+  );
+  await assert.rejects(
+    () => refreshAttachmentStatuses([], undefined),
+    /jobStatus must be a function/,
+  );
+  await assert.rejects(
+    () => refreshAttachmentStatuses([], { updateStatus() {} }),
+    /jobStatus must be a function/,
+  );
+  await assert.rejects(
+    () => refreshAttachmentStatuses([], { jobStatus() {} }),
+    /updateStatus must be a function/,
+  );
+  await assert.rejects(
+    () => refreshAttachmentStatuses([], { ...dependencies, onError: 'log' }),
+    /onError must be a function/,
+  );
+  await assert.rejects(
+    () => refreshAttachmentStatuses([], { ...dependencies, now: 1 }),
+    /now must be a function/,
+  );
+  await assert.rejects(
+    () => refreshAttachmentStatuses([], { ...dependencies, now: () => Number.NaN }),
+    /clock must return a finite number/,
+  );
+});
+
+test('empty and settled rows perform no downstream work', async () => {
+  const dependencies = {
+    jobStatus: async () => { throw new Error('must not run'); },
+    updateStatus: () => { throw new Error('must not run'); },
+  };
+  assert.deepEqual(await refreshAttachmentStatuses([], dependencies), {
+    attempted: 0,
+    changed: 0,
+    failed: 0,
+    deferred: 0,
+  });
+
+  const metrics = {};
+  assert.deepEqual(
+    await refreshAttachmentStatuses(
+      [null, { id: 1, status: 'SUCCEEDED', jobId: 'job-1' }],
+      { ...dependencies, metrics },
+    ),
+    { attempted: 0, changed: 0, failed: 0, deferred: 0 },
+  );
+  assert.deepEqual(metrics, {
+    attachmentStatusRefreshAttempted: 0,
+    attachmentStatusRefreshChanged: 0,
+    attachmentStatusRefreshFailed: 0,
+    attachmentStatusRefreshDeferred: 0,
+  });
+});
+
+test('100 pending rows reach but never exceed configured concurrency', async () => {
+  const rows = Array.from({ length: 100 }, (_, index) => ({
+    id: index + 1,
+    jobId: `job-${index + 1}`,
+    status: index % 3 === 0 ? 'RUNNING' : 'PENDING',
+  }));
+  let active = 0;
+  let peak = 0;
+  let started = 0;
+  let releaseInitialWorkers;
+  const initialWorkerGate = new Promise((resolve) => {
+    releaseInitialWorkers = resolve;
+  });
+  const updates = [];
+  const metrics = {
+    attachmentStatusRefreshAttempted: 10,
+    attachmentStatusRefreshChanged: 20,
+    attachmentStatusRefreshFailed: 30,
+    attachmentStatusRefreshDeferred: 40,
+  };
+
+  const counts = await refreshAttachmentStatuses(rows, {
+    orgId: 7,
+    userId: 9,
+    concurrency: 8,
+    timeoutMs: 1_000,
+    budgetMs: 10_000,
+    metrics,
+    jobStatus: async (orgId, userId, jobId, { signal }) => {
+      assert.equal(orgId, 7);
+      assert.equal(userId, 9);
+      assert.equal(signal.aborted, false);
+      active += 1;
+      started += 1;
+      peak = Math.max(peak, active);
+      if (started === 8) releaseInitialWorkers();
+      await initialWorkerGate;
+      active -= 1;
+      const rowNumber = Number(jobId.split('-')[1]);
+      return rowNumber % 2 === 0 ? 'SUCCEEDED' : rows[rowNumber - 1].status;
+    },
+    updateStatus: async (status, attachmentId) => {
+      updates.push([status, attachmentId]);
+    },
+  });
+
+  assert.equal(peak, 8, `peak concurrency ${peak} did not match configured limit`);
+  assert.deepEqual(counts, { attempted: 100, changed: 50, failed: 0, deferred: 0 });
+  assert.equal(updates.length, 50);
+  assert.deepEqual(metrics, {
+    attachmentStatusRefreshAttempted: 110,
+    attachmentStatusRefreshChanged: 70,
+    attachmentStatusRefreshFailed: 30,
+    attachmentStatusRefreshDeferred: 40,
+  });
+});
+
+test('request-wide deadline defers work that has not started', async () => {
+  const rows = [
+    { id: 1, jobId: 'job-1', status: 'PENDING' },
+    { id: 2, jobId: 'job-2', status: 'PENDING' },
+    { id: 3, jobId: 'job-3', status: 'PENDING' },
+  ];
+  const clockValues = [0, 0, 20, 30];
+  const counts = await refreshAttachmentStatuses(rows, {
+    concurrency: 1,
+    timeoutMs: 1_000,
+    budgetMs: 15,
+    now: () => clockValues.shift() ?? 30,
+    jobStatus: async () => 'PENDING',
+    updateStatus: () => { throw new Error('unchanged status must not be written'); },
+  });
+
+  assert.deepEqual(counts, { attempted: 1, changed: 0, failed: 0, deferred: 2 });
+  assert.deepEqual(rows.map((row) => row.status), ['PENDING', 'PENDING', 'PENDING']);
+});
+
+test('invalid identifiers and categorized failures preserve stale state', async () => {
+  const rows = [
+    { id: 1, jobId: null, status: 'PENDING' },
+    { id: 2, jobId: '', status: 'RUNNING' },
+    { id: 3, jobId: '   ', status: 'PENDING' },
+    { id: 4, jobId: 'throws', status: 'PENDING' },
+    { id: 5, jobId: 'invalid-status', status: 'PENDING' },
+    { id: 6, jobId: 'write-fails', status: 'PENDING' },
+    { id: 7, jobId: 'times-out', status: 'PENDING' },
+  ];
+  let aborted = false;
+  const categories = [];
+  const counts = await refreshAttachmentStatuses(rows, {
+    concurrency: 3,
+    timeoutMs: 5,
+    budgetMs: 1_000,
+    onError: ({ category }) => categories.push(category),
+    jobStatus: async (_orgId, _userId, jobId, { signal }) => {
+      if (jobId === 'throws') throw new Error('downstream failure with sensitive detail');
+      if (jobId === 'invalid-status') return 'UNKNOWN';
+      if (jobId === 'write-fails') return 'SUCCEEDED';
+      return new Promise(() => {
+        signal.addEventListener('abort', () => { aborted = true; }, { once: true });
+      });
+    },
+    updateStatus: (_status, attachmentId) => {
+      if (attachmentId === 6) throw new Error('write failure');
+    },
+  });
+
+  assert.equal(aborted, true);
+  assert.deepEqual(counts, { attempted: 4, changed: 0, failed: 4, deferred: 3 });
+  assert.deepEqual(
+    categories.sort(),
+    ['downstream_lookup', 'invalid_status', 'status_persistence', 'timeout'].sort(),
+  );
+  assert.equal(categories.some((category) => category.includes('sensitive')), false);
+  assert.equal(rows[5].status, 'PENDING');
+  assert.equal(rows[6].status, 'PENDING');
+});
+
+test('diagnostic sink failures and omitted diagnostics stay isolated', async () => {
+  const row = [{ id: 1, jobId: 'job-1', status: 'PENDING' }];
+  const dependencies = {
+    timeoutMs: 100,
+    budgetMs: 1_000,
+    jobStatus: async () => { throw new Error('downstream failure'); },
+    updateStatus() {},
+  };
+
+  assert.deepEqual(await refreshAttachmentStatuses(row, dependencies), {
+    attempted: 1,
+    changed: 0,
+    failed: 1,
+    deferred: 0,
+  });
+  assert.deepEqual(
+    await refreshAttachmentStatuses(row, {
+      ...dependencies,
+      onError: () => { throw new Error('logger unavailable'); },
+    }),
+    { attempted: 1, changed: 0, failed: 1, deferred: 0 },
+  );
+});
diff --git a/tests/unit/clearfolio-status-signal.test.mjs b/tests/unit/clearfolio-status-signal.test.mjs
new file mode 100644
index 00000000..ef5f94ac
--- /dev/null
+++ b/tests/unit/clearfolio-status-signal.test.mjs
@@ -0,0 +1,51 @@
+import test from 'node:test';
+import assert from 'node:assert/strict';
+
+test('Clearfolio jobStatus enforces endpoint, signal, and HTTP status contracts', async () => {
+  process.env.CLEARFOLIO_URL = 'https://clearfolio.example';
+  const originalFetch = globalThis.fetch;
+  let observedUrl;
+  let observedSignal;
+  let downstreamResponse = {
+    ok: true,
+    status: 200,
+    json: async () => ({ status: 'RUNNING' }),
+  };
+  globalThis.fetch = async (url, options) => {
+    observedUrl = String(url);
+    observedSignal = options.signal;
+    return downstreamResponse;
+  };
+
+  try {
+    const { jobStatus } = await import('../../server/clearfolio.mjs?status-signal-test=1');
+    const controller = new AbortController();
+    const status = await jobStatus(1, 2, 'job-1', { signal: controller.signal });
+    assert.equal(status, 'RUNNING');
+    assert.equal(
+      observedUrl,
+      'https://clearfolio.example/api/v1/convert/jobs/job-1',
+    );
+    assert.equal(observedSignal, controller.signal);
+
+    downstreamResponse = {
+      ok: false,
+      status: 503,
+      json: async () => ({ message: 'sensitive downstream text' }),
+    };
+    await assert.rejects(
+      () => jobStatus(1, 2, 'job-1'),
+      /clearfolio status failed \(503\)/,
+    );
+
+    downstreamResponse = {
+      ok: true,
+      status: 200,
+      json: async () => ({}),
+    };
+    assert.equal(await jobStatus(1, 2, 'job-1'), 'FAILED');
+  } finally {
+    globalThis.fetch = originalFetch;
+    delete process.env.CLEARFOLIO_URL;
+  }
+});
diff --git a/tests/unit/coverage-script-contract.test.mjs b/tests/unit/coverage-script-contract.test.mjs
new file mode 100644
index 00000000..a053e9f2
--- /dev/null
+++ b/tests/unit/coverage-script-contract.test.mjs
@@ -0,0 +1,43 @@
+// This contract prevents a subtle CI regression: the central review gate may
+// invoke `test:coverage` directly, so that script itself must create Istanbul
+// JSON rather than merely execute tests without instrumentation.
+import assert from 'node:assert/strict';
+import { readFileSync } from 'node:fs';
+
+const packageJson = JSON.parse(
+  readFileSync(new URL('../../package.json', import.meta.url), 'utf8'),
+);
+const scripts = packageJson.scripts;
+
+assert.equal(
+  scripts.coverage,
+  'npm run test:coverage',
+  'the public coverage command delegates to the canonical coverage producer',
+);
+assert.match(
+  scripts['test:coverage'],
+  /\bc8\b.*--reporter=json.*npm run test:coverage:cases/,
+  'test:coverage creates Istanbul JSON before executing coverage cases',
+);
+assert.match(
+  scripts['test:coverage'],
+  /--include=server\/attachment_status\.mjs/,
+  'the bounded refresh module is instrumented',
+);
+assert.match(
+  scripts['test:coverage'],
+  /--include=server\/clearfolio\.mjs/,
+  'the abortable Clearfolio adapter is instrumented',
+);
+assert.match(
+  scripts['test:coverage:cases'],
+  /tests\/unit\/clearfolio-status-signal\.test\.mjs/,
+  'the Clearfolio signal and HTTP failure regression executes under c8',
+);
+assert.doesNotMatch(
+  scripts['test:coverage:cases'],
+  /npm run (?:coverage|test:coverage)(?:\s|$)/,
+  'coverage cases never recursively invoke a coverage wrapper',
+);
+
+console.log('✓ coverage script contract tests passed');