Backup history is not deletion authority
Before Free Up, the current phone item, receiver, device, destination generation, manifest record, expected stored file, and size must still agree. Contradictory or inaccessible state blocks deletion, while full byte verification is available separately for a fresh archive audit.
Verified transfer state
Failed or interrupted transfers are never deletion-eligible, and finalized backup media is outside the receiver's normal cleanup gateway.
Physical interruption and recovery
Forced receiver interruptions showed that incomplete transfers failed safely but initially restarted from zero. Resumable partial state was then added and retested at multiple interruption points; later requests continued from retained progress and the final file matched the phone SHA-256.
A separate physical Wi-Fi interruption exposed a liveness bug: Android rediscovered the receiver while the previous TCP request remained established and held the single receive gate. The receiver was changed to bound no-byte network state, preserve valid resumable progress, release the gate reliably, and allow a later authenticated continuation without restarting the receiver or re-pairing the device.
Stage-level performance measurement
Instrumentation separated network receive/write, hashing, durable flush, atomic finalization, and manifest persistence. Receive/write dominated the measured transfer path; hash verification and finalization were comparatively small, so optimization effort stayed on the transfer stage rather than weakening integrity checks.
A TLS keep-alive experiment was slower on the matched test matrix and was reverted. The retained buffered-write change reduced the measured receive/write stage by 11.7% and medium-plus-large end-to-end time by 5.6%; whole-batch variance prevented a broader speedup claim.
Safety boundaries
| Condition | Behavior |
|---|---|
| Expected Windows copy missing or wrong size | Deletion blocked |
| Phone metadata changed | Deletion blocked until current state is reconciled |
| Receiver/device/destination identity changed | Historical verification rejected for the active target |
| Interrupted upload | No final promotion; valid partial may remain resumable |
| Capacity falls below reserve | Run rejected or stopped before crossing the reserve |
| State is contradictory or inaccessible | Destructive path fails closed |
Physical validation
Generated test media was exercised through the real Android/Windows path while real media remained excluded. A retained audit independently recomputed source hashes and checked the Windows copies against manifest size/hash data with zero mismatches. The result is presented as validation of that test corpus, not as a general reliability benchmark.