From a folder to the Library Diagram

Identity is the content

An item's id is its SHA-256, computed while the original streams
One original per household; derived files per vault, so the CDN policy can be per vault
A file already in the bucket is not uploaded again

The edge cannot lie

Each PUT is bound to the hash it claimed
/items checks the stored checksum before it writes a row
Vaults outside the edge's household are refused

Office and other files

Kept as their original only: nothing rendered, nothing read from inside
They reach the Library as files to download, through a five-minute link