[PaleHazy]

Summary

This dependent draft adds the customer-owned S3/R2 delivery implementation to PR #28 and closes all six findings from the scoped hosted-storage security review:

• give zero-duration captures a durable cleanup-only terminal path, without an impossible delivery row or guild backpressure
• disable untracked per-SSRC source stems in hosted mode while preserving self-hosted stems
• bind grants, persisted operations, verify requests, and receipts to exact recording, artifact, segment, and object identities
• pin the exact provider host and object-key prefix before capture; use bucket-qualified S3 hosts and exact R2 account hosts
• require worker-observed provider HEAD evidence before local deletion
• bind detached expirations and required headers to the actual SigV4 date, expiry, credential scope, and signed-header list

Hosted mode remains fail closed. Self-hosted recording behavior is unchanged. This PR does not merge, deploy, or enable customer storage.

Verification

• cargo fmt --check
• cargo test --all-features --locked (59 passed)
• full 59-test suite with a disposable PostgreSQL 17 database and serialized tests
• cargo clippy --all-targets --all-features -- -D warnings
• cargo audit with the repository documented six-advisory allowlist (no unaccepted vulnerabilities; four maintenance warnings)
• Helm lint, immutable-digest render, empty-digest rejection, and Docker Compose config
• gitleaks full-history and working-tree scans
• tracked personal-data pattern gate
• git diff --check

Remaining integration proof

The public contract is aligned with the private storage adapter work. Live AWS S3 and Cloudflare R2 end-to-end tests remain required before storage is enabled. This draft intentionally targets PR #28 so review can happen without merging or deployment.