A closed loop that frees expensive storage the instant it is provably safe. No timers. No unverified deletes. No data you can't get back.
Every system that moves large data hits the same wall and reaches for the same broken proxy.
After N days. After last-access. Easy to automate, and wrong at exactly the moment being wrong is catastrophic.
The real question is who still requires this, and until when. Age has never been able to answer that.
It frees the source on "copy reported done," not on proof the bytes actually survived the trip.
You wire schedulers, movers and checksums together with scripts. No product ships the finished loop.
Every irreversible data loss started as a confident delete.We make confident mean proven.
Two ways to free a costly tier. Only one of them is safe to leave unattended.
One asset, many independent clocks held by different counterparties, resolved into a single safe decision.
The source is freed only once the destination is provably byte-identical. Fail-closed by construction.
Not a fixed number of days. The soonest moment every obligation clears or is provably transferable.
Idempotent and re-runnable from any partial state, across stores that each fail differently.
The engine is small and never relaxed. Three moving parts, one rule.
Model every obligation on an asset as an independent clock with its own counterparty and clearing condition.
Compute the soonest instant every binding clock is satisfied or provably transferable. Never sooner.
Prove a byte-identical copy landed across stores. Only then is the source freed. Any doubt: hold.
Time, ratio, acknowledgement and hold-based clocks, tracked independently per asset.
Decisions read the obligation holder's real state, never a local cache that can drift.
Resumable, rate-aware handoff across stores that each report success differently.
Every stage re-runs from an unknown, partially-broken state without double-acting.
Low-confidence placement is flagged and held, not confidently put in the wrong place.
Ambiguity always resolves to "do not delete." Safety is the construction, not a setting.
Moving the bytes is the easy part. Proving release stays safe, continuously, against systems that lie, is the rest. We built that proof. Copying it is the hard part.
The vocabulary changes per domain. The algorithm does not.
Never delete under a legal or regulatory hold. Prove the verified copy landed first, with an audit trail by construction.
Drain expensive online edit storage without ever cutting a clip an active production still references.
Land results in durable storage, provably, before the scratch purge deadline fires and the work is gone.
Reclaim the expensive transient tier the moment it is provably safe, not a fixed number of days later.
If a counterparty can punish premature deletion, it's an adapter. Three questions: who can punish release? when does each clock clear? what proves the handoff? The engine never changes.
That is the entire promise, and the entire product.