Sweep a log's spilled rows and hold every retained object to its commitment.
missing is deliberately not an error. A spill object is a cache of bytes the
signed log already commits to, and deleting one is a legitimate operation —
retention, a purged session, a wiped tmpdir. Making absence fail would either
force spill objects to live forever or make routine cleanup look like an
attack. What is NOT tolerated is an object that is present and different: that
is a modification of evidence and it lands in errors.
Sweep a log's spilled rows and hold every retained object to its commitment.
missingis deliberately not an error. A spill object is a cache of bytes the signed log already commits to, and deleting one is a legitimate operation — retention, a purged session, a wiped tmpdir. Making absence fail would either force spill objects to live forever or make routine cleanup look like an attack. What is NOT tolerated is an object that is present and different: that is a modification of evidence and it lands inerrors.