@@ -107,6 +107,13 @@
 //! as the source of truth for whether the upload logically exists.
 //! This marker is consumed upon cancellation or the first submission of a final chunk, making
 //! finalization one-shot.
+//!
+//! Time-based expiration of a resumable upload counts from its commit. Until then, the long-term
+//! blob carries a placeholder deadline of at least seven days, which outlives the marker, so the
+//! blob cannot expire before the upload completes. At commit, the blob is extended if the
+//! requested deadline is later, and only then is the tombstone committed with that deadline.
+//! A blob whose placeholder exceeds the requested deadline stays unreachable once the tombstone
+//! expires and is reclaimed when its own deadline passes.
 
 use std::num::NonZeroU64;
 use std::sync::Arc;
@@ -146,6 +153,11 @@ const BACKEND_SIZE_THRESHOLD: usize = 1024 * 1024; // 1 MiB
 /// Fixed lifetime of an ongoing upload marker.
 const RESUMABLE_UPLOAD_TTL: Duration = Duration::from_hours(5 * 24);
 
+/// Minimum lifetime of a resumable upload's long-term blob before it is committed.
+///
+/// Longer than [`RESUMABLE_UPLOAD_TTL`], so the blob outlives any session that can still commit.
+const RESUMABLE_BLOB_MIN_TTL: Duration = Duration::from_hours(7 * 24);
+
 /// Amount of time for which a `Change` generated by a `complete_multipart` operation is kept in the `Assembling`
 /// state before becoming eligible for cleanup by the `ChangeLog` recovery process.
 /// This allows the client to retry the `complete_multipart` operation upon any failures for at least this long,
@@ -304,6 +316,39 @@ impl TieredStorage {
         Ok(())
     }
 
+    /// Resolves the deadline of a completed resumable upload, counted from its commit.
+    ///
+    /// Extends the long-term blob if `now + expires_in` is later than its placeholder deadline,
+    /// and returns the deadline the redirect tombstone must carry. Returns `None` without a
+    /// time-based policy.
+    ///
+    /// Fails if the long-term backend does not confirm the deadline, so the caller never commits a
+    /// tombstone that could outlive its blob.
+    async fn commit_upload_expiry(
+        &self,
+        revision: &ObjectId,
+        expires_in: Option<Duration>,
+    ) -> Result<Option<Timestamp>> {
+        let Some(expires_in) = expires_in else {
+            return Ok(None);
+        };
+
+        let now = Timestamp::now();
+        let target = ExpiryTarget::At(now.saturating_add(expires_in));
+        match self
+            .inner
+            .long_term
+            .set_expiry(revision, target.into(), now)
+            .await?
+        {
+            SetExpiryResponse::Satisfied(deadline) => Ok(Some(deadline)),
+            SetExpiryResponse::NotFound | SetExpiryResponse::Rejected => Err(Error::new(
+                ErrorKind::BackendFailure,
+                "long-term backend did not confirm the expiry of a completed resumable upload",
+            )),
+        }
+    }
+
     /// Returns the name of the backend corresponding to the given routing choice.
     fn backend_type(&self, choice: &BackendChoice) -> &'static str {
         match choice {
@@ -445,7 +490,10 @@ type LongTermBackendToken = BackendToken;
 struct TieredResumableToken {
     inner: LongTermBackendToken,
     revision: String,
-    time_expires: Option<Timestamp>,
+    /// Duration of a time-based expiration policy, applied from the commit time.
+    ///
+    /// `None` for manual expiration.
+    expires_in: Option<Duration>,
 }
 
 impl TieredResumableToken {
@@ -492,10 +540,17 @@ impl Backend for TieredStorage {
         }
 
         let revision = new_long_term_revision(id);
+        // The commit sets the real deadline, so the blob must not expire before then.
+        let blob_metadata = Metadata {
+            time_expires: metadata
+                .time_expires
+                .map(|expiry| expiry.max(Timestamp::now().saturating_add(RESUMABLE_BLOB_MIN_TTL))),
+            ..metadata.clone()
+        };
         let Some(inner) = self
             .inner
             .long_term
-            .create_upload_session(&revision, metadata, upload_length)
+            .create_upload_session(&revision, &blob_metadata, upload_length)
             .await?
         else {
             return Ok(None);
@@ -527,7 +582,7 @@ impl Backend for TieredStorage {
         let token = TieredResumableToken {
             revision: revision.key,
             inner,
-            time_expires: metadata.time_expires,
+            expires_in: metadata.expiration_policy.expires_in(),
         };
         Ok(Some(serde_json::to_string(&token).context(
             ErrorKind::Internal,
@@ -550,7 +605,7 @@ impl Backend for TieredStorage {
             backend_type = self.backend_type(&BackendChoice::LongTerm),
         );
         let tiered = TieredResumableToken::decode(&session.backend_token)?;
-        let time_expires = tiered.time_expires;
+        let expires_in = tiered.expires_in;
         let inner_session = tiered.into_inner_session(session);
         let id = &session.object_id;
         let revision = &inner_session.object_id;
@@ -635,6 +690,10 @@ impl Backend for TieredStorage {
         }
         guard.advance(ChangePhase::Written);
 
+        // The blob must cover the final deadline before the tombstone makes it reachable. On
+        // failure, the guard reclaims the unreferenced blob.
+        let time_expires = self.commit_upload_expiry(revision, expires_in).await?;
+
         let written = self
             .inner
             .high_volume
@@ -1439,8 +1498,8 @@ mod tests {
         Ok(())
     }
 
-    #[tokio::test]
-    async fn resumable_bigtable_and_gcs() -> anyhow::Result<()> {
+    /// Builds tiered storage over the Bigtable and GCS emulators.
+    async fn make_bigtable_and_gcs_storage() -> anyhow::Result<TieredStorage> {
         let streams = ChangeStreamFactory::default();
         let lt = GcsBackend::new(
             GcsConfig {
@@ -1465,7 +1524,16 @@ mod tests {
             &streams,
         )
         .await?;
-        let storage = TieredStorage::new(Box::new(hv), Box::new(lt), Box::new(NoopChangeLog));
+        Ok(TieredStorage::new(
+            Box::new(hv),
+            Box::new(lt),
+            Box::new(NoopChangeLog),
+        ))
+    }
+
+    #[tokio::test]
+    async fn resumable_bigtable_and_gcs() -> anyhow::Result<()> {
+        let storage = make_bigtable_and_gcs_storage().await?;
         let id = make_id(&format!("tiered-resumable-{}", uuid::Uuid::now_v7()));
         let payload = vec![b'a'; BACKEND_SIZE_THRESHOLD + 1];
         let token =
@@ -1620,6 +1688,143 @@ mod tests {
         assert!(!hv.contains(&id));
     }
 
+    /// TTL metadata as resolved by a session created at `created`.
+    fn ttl_metadata(created: Timestamp, ttl: Duration) -> Metadata {
+        Metadata {
+            expiration_policy: ExpirationPolicy::TimeToLive(ttl),
+            time_created: Some(created),
+            time_expires: Some(created + ttl),
+            ..Default::default()
+        }
+    }
+
+    /// Uploads `payload` in a single final chunk and returns the upload's revision.
+    async fn upload_resumable(
+        storage: &TieredStorage,
+        id: &ObjectId,
+        metadata: &Metadata,
+        payload: &[u8],
+    ) -> Result<ObjectId> {
+        let token = resumable_token(storage, id, metadata, payload.len() as u64).await;
+        let progress = storage
+            .put_chunk(
+                &token,
+                0,
+                payload.len() as u64,
+                stream::single(payload.to_vec()),
+            )
+            .await?;
+        assert_eq!(progress, UploadProgress::Complete);
+        Ok(upload_revision(&token))
+    }
+
+    #[tokio::test]
+    async fn resumable_expiry_counts_from_commit() {
+        let (storage, hv, lt, _) = make_tiered_storage();
+        let id = make_id("resumable-expiry");
+        let payload = vec![b'a'; BACKEND_SIZE_THRESHOLD + 1];
+        // The session was created long enough ago that its own TTL deadline has passed.
+        let metadata = ttl_metadata(
+            Timestamp::now() - Duration::from_hours(3),
+            Duration::from_hours(1),
+        );
+
+        let before = Timestamp::now();
+        let revision = upload_resumable(&storage, &id, &metadata, &payload)
+            .await
+            .unwrap();
+        let after = Timestamp::now();
+
+        let deadline = hv.get(&id).expect_tombstone().time_expires.unwrap();
+        assert!(deadline >= before + Duration::from_hours(1));
+        assert!(deadline <= after + Duration::from_hours(1));
+        // The placeholder already covers the deadline, so the blob keeps it.
+        let blob_expiry = lt.get(&revision).expect_object().0.time_expires.unwrap();
+        assert!(blob_expiry >= before + RESUMABLE_BLOB_MIN_TTL);
+
+        let (metadata, _, body) = storage
+            .get_object(&id, Timestamp::now(), None)
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(metadata.time_expires, Some(deadline));
+        assert_eq!(stream::read_to_vec(body).await.unwrap(), payload);
+    }
+
+    #[tokio::test]
+    async fn resumable_expiry_extends_blob_beyond_placeholder() {
+        let (storage, hv, lt, _) = make_tiered_storage();
+        let id = make_id("resumable-expiry-long");
+        let payload = vec![b'a'; BACKEND_SIZE_THRESHOLD + 1];
+        let ttl = RESUMABLE_BLOB_MIN_TTL + Duration::from_hours(24);
+        let metadata = ttl_metadata(Timestamp::now() - Duration::from_secs(5), ttl);
+
+        let revision = upload_resumable(&storage, &id, &metadata, &payload)
+            .await
+            .unwrap();
+
+        let deadline = hv.get(&id).expect_tombstone().time_expires.unwrap();
+        assert!(deadline > metadata.time_expires.unwrap());
+        assert_eq!(
+            lt.get(&revision).expect_object().0.time_expires,
+            Some(deadline)
+        );
+    }
+
+    #[tokio::test]
+    async fn resumable_expiry_counts_from_commit_bigtable_and_gcs() -> anyhow::Result<()> {
+        let storage = make_bigtable_and_gcs_storage().await?;
+        let id = make_id(&format!("tiered-resumable-expiry-{}", uuid::Uuid::now_v7()));
+        let payload = vec![b'a'; BACKEND_SIZE_THRESHOLD + 1];
+        let metadata = ttl_metadata(
+            Timestamp::now() - Duration::from_hours(3),
+            Duration::from_hours(1),
+        );
+
+        let before = Timestamp::now();
+        let revision = upload_resumable(&storage, &id, &metadata, &payload).await?;
+        let after = Timestamp::now();
+
+        let metadata = storage
+            .get_metadata(&id, Timestamp::now())
+            .await?
+            .expect("committed upload is readable");
+        let deadline = metadata.time_expires.unwrap();
+        assert!(deadline >= before + Duration::from_hours(1));
+        assert!(deadline <= after + Duration::from_hours(1));
+        assert_eq!(
+            metadata.expiration_policy,
+            ExpirationPolicy::TimeToLive(Duration::from_hours(1))
+        );
+
+        let blob = storage
+            .inner
+            .long_term
+            .get_metadata(&revision, Timestamp::now())
+            .await?
+            .unwrap();
+        assert!(blob.time_expires.unwrap() >= before + RESUMABLE_BLOB_MIN_TTL);
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn resumable_commit_requires_confirmed_expiry() {
+        let (storage, hv, _, events) = tiered_with_expiry_hooks(false, true);
+        let id = make_id("resumable-expiry-rejected");
+        let payload = vec![b'a'; BACKEND_SIZE_THRESHOLD + 1];
+        let metadata = ttl_metadata(Timestamp::now(), Duration::from_hours(1));
+
+        let error = upload_resumable(&storage, &id, &metadata, &payload)
+            .await
+            .unwrap_err();
+        assert_eq!(error.kind(), ErrorKind::BackendFailure);
+        assert_eq!(events.lock().unwrap().as_slice(), &["lt"]);
+        assert!(
+            !hv.inner.contains(&id),
+            "no tombstone without a confirmed deadline"
+        );
+    }
+
     #[derive(Clone, Debug)]
     struct ExpiryHook {
         label: &'static str,