media-storage-lifecycle

Choose S3 cache for temporary transport to browsers or HTTP-only consumers, share for time-bounded user-facing deliverables with a named owner, and permanent only for canonical durable inventory with an owner-stable key. Default to the shortest-lived boundary that satisfies the next consumer.

Use Modal internal artifacts whenever another Modal container or a bounded retry needs the bytes, since they provide typed, validated handoff without a public S3 intermediate. Only materialize publicly at the first consumer that genuinely needs an HTTP URL.

No, a cache or share URL stored in Mongo is never durable merely because the string remains. Active work must validate the object, and reacquire, regenerate, or fail with a clear re-upload requirement when it is missing.

Commit the new authoritative reference first, then delete the previous exact managed object only when no other record shares it. If post-commit cleanup fails, keep the new reference valid, log the orphan, and let inventory reporting detect it.

No, when a provider like Ghost, YouTube, or Transistor accepts and owns the final bytes, upload directly and persist only the provider identity the product needs. Do not retain a duplicate S3 final without naming a separate consumer.