A v2 external API client downloading a workspace file whose blob is missing or whose storage backend is unavailable still gets a 500. Significant-Gravitas/AutoGPT#14881 (merged 2026-09-30) made the internal workspace download route answer 404 for a missing blob and 502 for a storage failure, but `backend/api/external/v2/files.py` (on the Significant-Gravitas/AutoGPT#12206 branch) reads storage directly through `get_workspace_storage` rather than through the helper the internal route now uses, at three sites (`files.py:225`, `:239`, `:254` at root head `c286ad24a1`), so the mapping never runs for v2.
**Fix:** route the v2 file read paths through the same download helper the internal route uses, so both surfaces answer the same statuses for the same failures; add a v2 test for each of the two cases (missing blob → 404, storage error → 502).
Predates the 2026-10-02 dev merge-up of the v2 chain; found while merging it. Not a blocker for Significant-Gravitas/AutoGPT#12206.
## Validation evidence (host-local) — blocked on platform image
**Verdict:** `blocked` — reported `backend/api/external/v2/files.py` (v2 external API file downloads) is **not present** in published `significantgravitas/autogpt:latest` (platform single-container). Only `external/v1/` ships in this image.
**Image**
- `significantgravitas/autogpt:latest` (= `sha-bf6e0c33d0f615983082ed7a5343dbbfc25adaab` / oci_revision `bf6e0c33d0f615983082ed7a5343dbbfc25adaab` / Hub `v0.8.2`)
- Index digest: `sha256:8322941548c6d43f7b343dff16c5a184cdc6928df8ad6c5fbae856bd380e1618`
- Pull: 2026-10-02T18:26:56 America/Chicago — `ok_up_to_date`
- Run: `sweep-20261002T1821`
**What we checked**
- Image FS probe: no `api/external/v2/` tree and no `files.py` under external API; tree is `external/{fastapi_app.py,middleware.py,v1/…}` only.
- GitHub: Significant-Gravitas/AutoGPT#12206 (`feat(backend/api): External API v2`) is still **OPEN** / unmerged (`pwuts/open-2923-v2-external-api` → `dev`). Issue body cites that branch at `c286ad24a1`.
- Internal workspace download helper from #14881 is present on this image (`features/workspace/routes.py` → `create_file_download_response` / `get_workspace_storage`), but the v2 client path that would bypass it is not in `:latest`, so the reported 500-vs-404/502 mismatch cannot be exercised here.
**Limitations**
- Scope is the Docker Hub platform `latest` image only. Did not check out or run the open #12206 branch.
**Suggestion**
Re-validate against `:latest` once External API v2 from #12206 is released into the published image (or label this as v2-PR-branch-only until then). No product fix attempted.
Host evidence: `BACKFILL_ROOT/evidence/15151/sweep-20261002T1821/`.