Storage Tiering Service · View 19 of 31 · 5 · Runtime
Decisions
- A new hold writes a scope row and increments the tenant's guard epoch in the same shard. Every movement that recorded the old epoch fails its commit, whatever it was moving. The mover does not need to know about holds at all (ADR-21).
- A hold that restricts takes effect immediately. Removing or narrowing a hold needs two named approvers, because that is the only action that lets the platform move something it must not move (ADR-30).
- A delete writes a tombstone. A commit against a tombstoned row fails, and the destination copy is cleaned up by the release gate, not by the mover.
Trade-off accepted
- An epoch bump for one custodian's hold also aborts that tenant's unrelated in-flight movements. They are retried in the next batch. Wasted copies are cheap; a per-object hold check inside every commit across nine billion rows is not.
Numbers
- Hold effective against new commits in under one second from arrival. Tombstones retained 35 days, which also bounds how long an orphan is quarantined before deletion.
