Fence managed file object effects

2026-08-03 04:21:52 +02:00
parent b993d8e31a
commit 6baf2a421b
10 changed files with 1162 additions and 25 deletions
@@ -156,6 +156,13 @@ then returns a 30-minute tenant/user-bound preview token. Confirmation reuploads
 the original archive and stores only the selected members. Password-protected
 ZIP passwords remain request-only and are never included in the preview token.

+Managed blob writes and applied orphan cleanup use Core's durable recovery
+ledger. Intent, request digests, recovery mode, and a distributed lease are
+committed before physical storage effects; the Files session commit verifies
+database and streamed object evidence, while rollback compensates only a newly
+reserved unreferenced key. New object keys are opaque and do not retain the
+uploaded filename. Uncertain or mismatched effects remain visible through Ops.
+
 Bulk rename and transfer APIs are owner-scoped: callers must provide the active
 user or group file space with `owner_type` and `owner_id`. The storage layer
 keeps a named legacy file-only helper for historical callers that lack owner