- set_retention and delete_own re-read the folder under its lock and use that row (an unfetched ORM
result never refreshes the object); a folder gone meanwhile is refused (409), and the route audits
the retention actually replaced
- a finishing download is stamped only while it is still in the folder (and keep) it was read with:
a move or a folder delete landing meanwhile sends the read round again, so no file is done with no
expiry
- the eviction pass counts the disk before each candidate and skips one asked for since it began
- docs: source builds get their own volume-copy snippet
- race tests assert the lock wait; one built on a committing delete never raced
peter
c9baf68b16