Verify retained originals before server delivery
Retained original download now uses a scoped Supabase SDK fetch with an abort signal and one 30-second deadline covering response headers and body consumption. Explicit bounded reads enforce byte/chunk limits before Blob creation; current owner/scope/withdrawal and retained digest/type are rechecked before internal readback. Default registration verification without a byte bound retains the existing Blob behavior. No endpoint exists on this branch.
Validation: 98 original fixtures pass, including 11 installed-SDK tests with synthetic HTTP. Three new deadline cases cover stalled headers, ignored abort and delayed headers followed by a stalled body. Full lint, scoped TypeScript, formatting and diff checks pass. Exact error assertion now rejects appended private causes. This is local synthetic evidence, not hosted authenticated storage or customer evidence.
Dependencies remain unapproved; refresh included commits after their releases. No merge/deployment/customer intake/signing/provider/financial operation. Distributed concurrency, storage/orphan controls, explicit legacy recovery and integrated authenticated write/read/recovery remain gates.