Summary
Expands the weak-storage safety contract across library moves, manual/download imports, scanning, deletion capabilities, and recovery. Filesystems that cannot prove durable mutation semantics remain usable for safe read/scan and copy-retain workflows, while destructive cleanup requires explicit semantics plus verified cleanup authorization.
This also hardens durable move recovery across cross-filesystem timestamp differences and remote filesystem metadata caching, and replaces the cross-assembly dynamic metadata envelope that caused image fallback failures.
Changes
Added
- Explicit root storage capabilities for additive publication, durable mutation, durable retirement, and verified-copy retirement.
- Weak-storage source-cleanup policy with durable policy revisioning and the
AddWeakStorageVerifiedCleanupmigration. - Verified compatibility cleanup coordination for weak-storage imports and companion publications.
- Durable weak-storage scan candidates and API support for reviewing them.
- Filesystem volume resolution used to distinguish same-volume rename paths from verified cross-volume copy paths.
- Root/delete/move capability data used by the UI to explain safe fallback actions.
Changed
- Weak storage under
Autoremains read/scan capable but cannot gain destructive mutation authority from behavioral case probes alone. - NFS/CIFS Auto moves use verified copy-retain semantics even when cleanup policy is enabled.
- Explicit filesystem semantics plus compatible source/destination policy can authorize verified source cleanup.
- Move queue/recovery now preserves cleanup disposition, execution evidence, target scaffolding, and source-retention state across retries and restarts.
- Manual and download imports preserve effective publication mode, source disposition, failure context, and compatibility recovery ownership.
- Move source proof uses pinned physical generation plus stable cont...
Automated Canary build