Uploader-bound staging and asset preparation

Context

Attachments need network transfer and validation before being referenced by a committed record.

Decision

Browsers upload to signed staging locations and record saves prepare permanent copies before opening persistence transactions, committing only verified ready references.

Alternatives Considered

Sending bytes through record persistence: Large request bodies and network transfer would lengthen the save path. Retaining external URLs as permanent attachments: The selected copy-at-save design brings served content under managed storage. Copying while record locks are held: File transfer would unnecessarily extend database transactions.

Consequences

The save rejects staging issued to a different person. Prepared content from a refused save becomes abandoned. Platform’s absent cleanup binding leaves detached and abandoned copies in storage.