Require identified admin evidence and locked reference checks before deleting bytes. Preserve immutable operational receipts, exclude them from retries, and expose the standard Review/Result table action with help.
Co-Authored-By: GPT-6 (Codex) <noreply@openai.com>
Do not retire a failed-upload locator merely because DELETE succeeds. Let adapters attest authoritative settlement; otherwise retain it with bounded retry scheduling. Reproduce a PUT completing after rollback and an independent sweep.
Refs QRun-IO/qqq#1289
Co-Authored-By: GPT-6 (Codex) <noreply@openai.com>
Retain cleanup locators after rollback compensation fails, keep failed batches from starving later work, and preserve pending requests across schema upgrades. Real PostgreSQL regressions and full verification pass; crash and provider acceptance remains tracked in QQQ #1289.
Co-Authored-By: Codex <noreply@openai.com>
Commit cleanup intent with attachment metadata removal before deleting storage bytes. Retry committed cleanup through the existing scheduler and verify PostgreSQL rollback, failed metadata deletion, lost callbacks and replay. Remaining upload and provider recovery acceptance stays tracked in QQQ #1289.
Co-Authored-By: Codex <noreply@openai.com>
james.maesandGPT-6