Direct Multipart Upload With Recorded Object Identity

Context

Input files can exceed request and function limits.

Decision and Origin

Input bytes travel directly to signed storage parts; completion assembles the object before recording its size, version and available digest in the upload session. The origin recorded above supplies the authority for this choice; implementation evidence supplies the limits described here.

Alternative Comparison

Proxy file bytes through the API: API payload and execution limits would restrict supported files.

Accept caller-chosen storage locations: Uncontrolled locations would weaken workspace isolation and stable input references.

Consequences

The multipart design supports the declared maximum of 5 TiB.

Large-file digests can remain producer claims when storage supplies no digest.

A crash after storage completion but before the session write lacks a proven recovery path.