feat(blob)!: RFC-shaped remove/abort args; recognize BlobAccepted refusals

The blob-removal RFC drops the space from the client-leg arguments —
/blob/remove is {digest} and /blob/abort is {digest, cause}, with the
space as the invocation subject. Ingot already invoked with the space as
subject, so only the argument literals change.

Treat the node's BlobAccepted refusal on abort as final rather than a
fault: it means this space accepted the same content concurrently, so
the blob belongs to the reference index and is released via
/blob/remove when its last claim drops. The uploader logs it distinctly
instead of as an error; the multipart cleanup path already discards the
park row, which is obsolete either way.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

Author: frrist

docs/architecture.md

@@ -90,10 +90,11 @@ The design is shaped by how the Forge upload pipeline works and by a handful of
 - **The 256 MiB blob ceiling is a knob, not a wall.** Piri currently caps a blob at 256 MiB because
   it builds the commP Merkle tree in RAM; known improvements (streaming commP) lift this. Ingot
   treats it as a tunable maximum and splits larger objects.
-- **The delete primitives are built.** `blob/remove` is handled end-to-end (Sprue deregisters +
-  forwards; Piri releases the space's claim and defers physical deletion until the aggregate root
-  retires on-chain via the signed `schedulePieceDeletions` path), and `blob/unallocate` retires a
-  parked (never-accepted) blob — an upload ends in exactly one of accept or unallocate. The
+- **The delete primitives are built.** `/blob/remove` is handled end-to-end (Sprue forwards
+  `/blob/release` to the nodes and deregisters; Piri releases the space's claim and defers physical
+  deletion until the aggregate root retires on-chain via the signed `schedulePieceDeletions`
+  path), and `/blob/abort` — translated by Sprue into `/blob/reject` on the node — retires a
+  parked (never-accepted) blob — an upload ends in exactly one of accept or reject. The
   indexer still has no retraction. [§9](#9-the-system-contract-piri--sprue--indexer) enumerates
   the contract Ingot needs.
 
@@ -355,7 +356,7 @@ fixed constant (pdp-sim).
   discarded). This is the sub-`min` tail.
 
 **The delete primitives** are deliberately distinct:
-- **`unallocate(digest)`** retires a **parked** blob (PUT, never accepted): delete the MinIO bytes
+- **`abort(digest)`** retires a **parked** blob (PUT, never accepted): delete the MinIO bytes
   and the allocation record. No chain involvement.
 - **`remove(digest)`** releases a **space's claim** on an **accepted** blob. Because dedup is global,
   Piri deletes the bytes and retires the piece only when the per-`(digest, space)` claim count
@@ -428,7 +429,7 @@ CompleteMultipartUpload([parts])
         splice; blob_refs += version per digest; guarded root swap
 AbortMultipartUpload
      latch session open→aborting
-     parked blobs → unallocate;  already-accepted (deduped) blobs → remove (§6)
+     parked blobs → abort;  already-accepted (deduped) blobs → remove (§6)
 ```
 
 A completed multipart object is the ordered union of its parts' blobs plus a manifest of byte ranges;
@@ -439,13 +440,13 @@ later `GET`/`HEAD ?partNumber=N` can resolve part `N` to its byte span and repor
 ### 7.3 The session latch (the Abort/Complete race)
 
 `Complete` and `Abort` can arrive concurrently for one `uploadId`. Without coordination they collide
-on the parts — `Complete` triggering accept while `Abort` unallocates those same parts — leaving the
+on the parts — `Complete` triggering accept while `Abort` rejects those same parts — leaving the
 object half-built or half-deleted. A **single-winner latch** prevents it: an atomic state transition
 on the session row (`UPDATE … SET state=? WHERE state='open'`). Exactly one of
 `Complete`→`completing` or `Abort`→`aborting` wins; the loser observes the moved row and returns an
-error. Accept is triggered only after the session is latched `completing`, so accept and unallocate
+error. Accept is triggered only after the session is latched `completing`, so accept and reject
 never touch the same part concurrently. A deduped part is already accepted (not parked), so Abort
-removes it via the reference path rather than unallocating it.
+removes it via the reference path rather than rejecting it.
 
 ### 7.4 Read (`GetObject`)
 
@@ -471,7 +472,7 @@ updates are transactional with the commit.
 
 | Case | Handling |
 |---|---|
-| Crash after PUT, before accept | Bytes parked; `upload_intents` (parked) drives resume or `unallocate`. No `200` was sent. |
+| Crash after PUT, before accept | Bytes parked; `upload_intents` (parked) drives resume or `abort`. No `200` was sent. |
 | Crash after accept, before commit | Blob durable but unreferenced; `upload_intents` (accepted) drives commit-retry or `remove`. |
 | Guarded-root-swap mismatch | Reload root, re-splice; blobs already durable, never re-uploaded. |
 | Concurrent PUT, same key | Distinct versionIds; serialize only on the swap. |
@@ -525,8 +526,8 @@ negotiations).
 |------------------------------------------------------------------------------------------------|---------------------------------|--------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | `allocate` / `PUT` / `accept` blob lifecycle                                                   | Piri/Sprue                      | **exists**   | The storage primitive Ingot builds on.                                                                                                                                                                              |
 | Ingot-timed accept (PUT a part, defer the conclude until Complete)                             | Ingot + Sprue                   | **exists**   | `forgeclient.BlobAddParked`/`BlobConclude` split the flow at the conclude seam; UploadPart parks (durable, unaggregated), Complete concludes — Sprue's conclude handler already ran accept standalone. Ingot still does **not** issue `accept` (Piri requires the upload-service DID). |
-| `unallocate(digest)` — drop a parked blob                                                      | Piri + Sprue + libforge         | **exists**   | `/blob/unallocate` on Piri refuses accepted blobs (`BlobAccepted`), deletes the space's allocation, and drops the bytes at zero allocations. Sprue recovers the provider from the `cause` receipt chain (a parked blob has no registration). Abort/TTL/supersede unwind through it.  |
-| `remove(digest)` — per-space claim release; physical delete/piece-retire at zero global claims | Piri + Sprue + libforge         | **exists**   | `/blob/remove` on Piri deletes the space's allocation/acceptance/claim; at zero claims bytes delete immediately (unaggregated) or via the pending-removal sweep once the whole aggregate root is dead (FIL-623/624). Sprue forwards to primary + replicas (FIL-522). |
+| `abort(digest)` — drop a parked blob                                                           | Piri + Sprue + libforge         | **exists**   | `/blob/abort` on Sprue translates to `/blob/reject` on Piri, which refuses blobs the invoking space has accepted (`BlobAccepted`), deletes the space's allocation, and drops the bytes once no space holds an allocation or acceptance. Sprue recovers the provider from the `cause` receipt chain (a parked blob has no registration). Abort/TTL/supersede unwind through it.  |
+| `remove(digest)` — per-space claim release; physical delete/piece-retire at zero global claims | Piri + Sprue + libforge         | **exists**   | `/blob/remove` on Sprue forwards `/blob/release` to Piri, which deletes the space's allocation/acceptance/claim; at zero claims bytes delete immediately (unaggregated) or via the pending-removal sweep once the whole aggregate root is dead (FIL-623/624). Sprue forwards to primary + replicas (FIL-522). |
 | Configurable, adaptive size policy (`min`/`max`); batch guard for the `extraData` cap          | Piri                            | **partial**  | `MinAggregateSize` is hardcoded 128 MiB; lower to ~8 MiB and make configurable. The `addPieces` batch is no longer contract-capped (FWSS v1.3.0 removed the `extraData` cap); size it to the FVM `PiecesAdded` event-size + per-tx gas — a measured ceiling (default `BatchSize=10` is safely within it) (pdp-sim). No contract change. |
 | Compaction (Regime B) + complete the on-chain delete signature                                 | Piri                            | **partial**  | Whole-root delete is signed and wired (`schedulePieceDeletions` with `SignSchedulePieceRemovals` extraData); compaction (remove + re-hash survivors + re-add) is new.                                               |
 | De-dup at accept (don't re-aggregate a digest already a live piece)                            | Piri                            | **to-build** | Backstops one-piece-per-content once accept timing is Ingot-driven.                                                                                                                                                 |
@@ -539,7 +540,7 @@ negotiations).
 
 **Determinism / idempotency Ingot must preserve.** The `accept` invocation is built deterministically
 (stable CID, today via `WithNoNonce` over `{space, digest, size, put-task}`); re-driving accept must
-reuse the same put-task link. `remove`/`unallocate` must be idempotent. The forge-root advance must
+reuse the same put-task link. `remove`/`abort` must be idempotent. The forge-root advance must
 happen only after a successful guarded root swap — the catalog log currently advances it before the
 swap, so a mismatch can leave the forge root pointing at a bucket root that was never adopted.
 
@@ -592,7 +593,7 @@ The MVP this supersedes had six structural problems; each is resolved by a layer
 |-----------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
 | A per-bucket lock held across the whole write | Ingest and upload run off-lock; only the MST splice + guarded root swap is in the critical section. [§7.1](#71-write-single-shot-putobject)                                                                         |
 | The whole object buffered in memory           | Hash-while-writing to the local store; stream to Piri; nothing held whole in RAM. [§5](#5-the-data-layer), [§7.1](#71-write-single-shot-putobject)                                                                  |
-| No multipart, no abort                        | Parked part-blobs, accept-at-Complete, single-winner latch; abort = `unallocate` (parked) / `remove` (deduped). [§7.2](#72-multipart)–7.3, [§9](#9-the-system-contract-piri--sprue--indexer)                        |
+| No multipart, no abort                        | Parked part-blobs, accept-at-Complete, single-winner latch; abort = `/blob/abort` (parked) / `remove` (deduped). [§7.2](#72-multipart)–7.3, [§9](#9-the-system-contract-piri--sprue--indexer)                        |
 | Objects chunked into CARs to obtain a digest  | Object body = one blob (≤ `max`) or a coarse `≤ max` split; no fine chunking, no CAR. [§5](#5-the-data-layer), [§10](#10-deployment-topology--the-digest-before-upload-cost)                                        |
 | No delete of superseded data                  | Reference index + per-space `remove` + Piri's global claim gate + indexer delete; O(1) for ≥ `min` blobs. [§5](#5-the-data-layer), [§6](#6-the-forgechain-layer), [§9](#9-the-system-contract-piri--sprue--indexer) |
 | Aggregation blocked partial deletes           | A small `min` makes most blobs their own piece (O(1) delete); compaction handles only the sub-`min` tail. [§6](#6-the-forgechain-layer)                                                                             |
@@ -801,20 +802,20 @@ reference index — and is out of scope for this iteration.
 The in-memory harness uses a no-op uploader and serves reads from the spool, so these forge-network
 paths are stubbed in-tree and verified against a real sprue+piri+indexer later:
 
-- **`remove(digest)` and `unallocate(digest)` are live.** `RemoveBlob` invokes `/blob/remove` on
-  sprue, which forwards to the storage nodes ([§9](#9-the-system-contract-piri--sprue--indexer)); delete finality means claim-release-now,
-  bytes-at-root-death. `UnallocateBlob` retires parked part-blobs on abort via `/blob/unallocate`
-  (provider recovered from the `cause` receipt chain); allocation-expiry GC (FIL-625) remains the
-  backstop when an abort never arrives.
+- **`remove(digest)` and `abort(digest)` are live.** `RemoveBlob` invokes `/blob/remove` on
+  sprue, which forwards `/blob/release` to the storage nodes ([§9](#9-the-system-contract-piri--sprue--indexer)); delete finality means claim-release-now,
+  bytes-at-root-death. `AbortBlob` retires parked part-blobs via `/blob/abort` — sprue translates
+  it into `/blob/reject` on the node (provider recovered from the `cause` receipt chain);
+  allocation-expiry GC (FIL-625) remains the backstop when an abort never arrives.
 - **The local-table `Locator` read tier is not wired.** Body-blob *locations* are recorded at accept,
   but the read path that consumes them ([§7.4](#74-read-getobject), [§8](#8-retrieval-addressing-when-bodies-need-a-sharded-dag-index)) is deferred — it is only exercised after spool
   eviction (also not built) and is best validated live.
 - **Multipart parts park at UploadPart, accept at Complete.** (Built: `parkBlobs`/`concludeBlobs`
   over the `blob_parks` table.) The in-process harness still spools parts
   at `UploadPart` and uploads+accepts them at `Complete`; the true forge *parking* (upload early,
-  accept-at-Complete) and `unallocate`-on-abort from [§7.2](#72-multipart)–[7.3](#73-the-session-latch-the-abortcomplete-race) are forge-mode refinements.
+  accept-at-Complete) and the `/blob/abort` unwind from [§7.2](#72-multipart)–[7.3](#73-the-session-latch-the-abortcomplete-race) are forge-mode refinements.
 - **Crash recovery for the spool is not built.** The `upload_intents` × `blob_refs` reconciliation
-  the failure-mode table in [§7.5](#75-concurrency-durability-and-failure-modes) describes (resume/`unallocate` parked, `remove` accepted-but-unreferenced)
+  the failure-mode table in [§7.5](#75-concurrency-durability-and-failure-modes) describes (resume/`abort` parked, `remove` accepted-but-unreferenced)
   is a later phase; a partial post-commit reference-index write currently relies on retry/idempotency.
 - **`UploadPartCopy` and indexer retraction on delete** are unimplemented
   (`ErrNotImplemented` / no-op). `ListParts` and `ListMultipartUploads` are implemented
@@ -824,7 +825,7 @@ paths are stubbed in-tree and verified against a real sprue+piri+indexer later:
   sessions and committed objects), and a background sweeper aborts open sessions older
   than `multipart_session_ttl` (default 7d) and reaps terminal session rows. A successful
   Complete retains its session in state `completed` so a duplicate Complete is idempotent
-  per S3. The network-side `unallocate`-on-abort remains a parking-flow concern (above).
+  per S3. The network-side `/blob/abort` unwind remains a parking-flow concern (above).
 
 ### Known correctness boundary
 

forgeclient/blobabort.go

@@ -14,7 +14,7 @@ import (
 
 // BlobAbort invokes /blob/abort against the upload service (sprue),
 // abandoning the space's in-flight upload of a parked (never-accepted)
-// blob. cause is the /space/blob/add task link (ParkedBlob.AddTask) — sprue
+// blob. cause is the /blob/add task link (ParkedBlob.AddTask) — sprue
 // walks its receipt chain to locate the storage node holding the parked
 // bytes (which have no registration or acceptance to look up by) and
 // forwards a /blob/reject there. Idempotent on the node; a blob that has
@@ -28,7 +28,9 @@ func (c *Client) BlobAbort(ctx context.Context, digest multihash.Multihash, spac
 	inv, err := blobcmds.Abort.Invoke(
 		c.signer,
 		space,
-		&blobcmds.AbortArguments{Space: space, Digest: digest, Cause: cause},
+		// The space is the invocation subject; it is not repeated in the
+		// arguments.
+		&blobcmds.AbortArguments{Digest: digest, Cause: cause},
 		invocation.WithAudience(c.serviceID),
 		invocation.WithProofs(proofLinks...),
 	)

forgeclient/blobadd.go

@@ -88,7 +88,7 @@ type AddedBlob struct {
 type ParkedBlob struct {
 	Digest multihash.Multihash
 	Size   uint64
-	// AddTask is the /space/blob/add task link — the receipt-chain root the
+	// AddTask is the /blob/add task link — the receipt-chain root the
 	// upload service uses to locate the provider for abort.
 	AddTask cid.Cid
 	// AcceptTask is the /blob/accept task link BlobConclude polls.

forgeclient/blobremove.go

@@ -24,7 +24,9 @@ func (c *Client) BlobRemove(ctx context.Context, digest multihash.Multihash, spa
 	inv, err := blobcmds.Remove.Invoke(
 		c.signer,
 		space,
-		&blobcmds.RemoveArguments{Space: space, Digest: digest},
+		// The space is the invocation subject; it is not repeated in the
+		// arguments.
+		&blobcmds.RemoveArguments{Digest: digest},
 		invocation.WithAudience(c.serviceID),
 		invocation.WithProofs(proofLinks...),
 	)

go.mod

@@ -8,7 +8,7 @@ require (
 	github.com/aws/aws-sdk-go-v2/credentials v1.19.15
 	github.com/aws/aws-sdk-go-v2/service/s3 v1.99.1
 	github.com/fil-forge/indexing-service v1.13.5-0.20260619142411-efe3f5fab717
-	github.com/fil-forge/libforge v0.0.0-20260717174550-aac837a730c2
+	github.com/fil-forge/libforge v0.0.0-20260723212548-3e5e6ba95711
 	github.com/fil-forge/smelt v0.0.0-20260717195554-271831781c1d
 	github.com/fil-forge/ucantone v0.0.0-20260706102443-79141c5cc52e
 	github.com/fxamacker/cbor/v2 v2.9.2

go.sum

@@ -248,8 +248,8 @@ github.com/fil-forge/go-ucanto v0.0.0-20260507172450-5cb5d073f8ab h1:2J2cDThqTKP
 github.com/fil-forge/go-ucanto v0.0.0-20260507172450-5cb5d073f8ab/go.mod h1:lZF3UXZ2hGLKYmXdquG50JqI9pRlUrV6lubGtgOYfwc=
 github.com/fil-forge/indexing-service v1.13.5-0.20260619142411-efe3f5fab717 h1:Wke8qgaDgy7DGaIS28VpHip+YHSdQP1hGNEZTrXXzb4=
 github.com/fil-forge/indexing-service v1.13.5-0.20260619142411-efe3f5fab717/go.mod h1:wFcakLohOqpMRkJzWRdGFGHRFpGB+PpEMCm9wkt2cqU=
-github.com/fil-forge/libforge v0.0.0-20260717174550-aac837a730c2 h1:mwb14/aanwFBGdQJ/0WCkNX/AzUXF/iRKMVjhXtYd6Q=
-github.com/fil-forge/libforge v0.0.0-20260717174550-aac837a730c2/go.mod h1:0kXihIQ4L2uZ00nR5XrZ/Y8Db7Ht/qQNuiWslwMJ95M=
+github.com/fil-forge/libforge v0.0.0-20260723212548-3e5e6ba95711 h1:xO5gwfL3W2wqaLvwFUDj4MuWX9wHK9TGV8F3jFe/mZM=
+github.com/fil-forge/libforge v0.0.0-20260723212548-3e5e6ba95711/go.mod h1:0kXihIQ4L2uZ00nR5XrZ/Y8Db7Ht/qQNuiWslwMJ95M=
 github.com/fil-forge/smelt v0.0.0-20260717195554-271831781c1d h1:hRW4J1J1qZVKl+IBMIPwyHkjztoE37wAlBGjjJLkGgk=
 github.com/fil-forge/smelt v0.0.0-20260717195554-271831781c1d/go.mod h1:3UpZd5C7w59IDICASaYqIF6Uu/0uZkp7tj9Ivg0ZmRU=
 github.com/fil-forge/ucantone v0.0.0-20260706102443-79141c5cc52e h1:di/SseJVEO6bznSH/UEnAE2nSwwp/gqgnPLgE9/x2Zg=