Concurrency and Durability Lens

For every changed lock, enumerate overlapping lock sets and construct the ABBA interleaving. Multiple-lock order must be documented and consistent.
Mark guard lifetimes and every .await, disk, and RPC call inside them. Estimate contention and timeout behavior under concurrent requests.
Object commits remain fenced if the distributed lock is lost after shard writes and before metadata rename.
For write/rename changes, trace write tmp -> sync tmp -> rename -> sync parent -> sync required ancestors; simulate a crash after each step and honor the configured durability gate.
Multi-disk fan-out counts every result. Quorum-minus-one cannot become success; heal remains best-effort per target where that is the established contract.
At every new cancellable await between mutation and cleanup/commit, drop the future and inspect leftover files, counters, permits, and replay state.
Multipart operations on the same upload ID are serialized where required; abort/complete/list races cannot delete parts before durable commit.
Post-commit cleanup is best-effort, retry-safe, and cannot fail an already committed write or delete the last surviving copy.
Persisted read-modify-write uses serialization/CAS. Queue replay is crash-safe and duplicate delivery has an idempotency contract.
Streaming reconstruction failures after partial output surface as errors, not successful EOF.