Upload Session

The Lifecycle

Transitions Explained

Opening starts storage transfer before persisting the session. Completion assembles the object and checks available integrity evidence before saving success. Explicit abort removes parts first; an integrity refusal only changes the session state after assembly. A missing multipart transfer is recorded as expired on read or completion.

What Cannot Happen

Settled transfers cannot reopen, and completed sessions refuse abort. A replacement file starts a new session.

Concurrency and Timing

Part addresses last one hour and are issued in groups of at most 100. Database settlement is locked, but storage and row changes remain separate. A crash between assembly and bookkeeping has no established repair path.