Storage Quotas & the Shared-Copy Exemption — ADR-119, ADR-120, ADR-121

Three rulings from one adversarial review (2026-08-08) of a “Dual-Engine Monetization Strategy”. The review’s central finding was that the three proposed rules, adopted as written, compose into a bypass of themselves — and the fix turned out to also supply the honest justification the rules were missing.

These do not close ADR-087. Its residual is Q-034’s daily export allowance; storage is a different quantity entirely. What they close is a gap that was arguably worse: §6.2 already specified a per-account storage quota check and no value existed behind it anywhere in the corpus.

ADR-119 — The Storage Quota Bounds Stored Bytes, Is a Cost Bound, and Its Deletions Reuse an Existing State

Status: Accepted · Date: 2026-08-08 · Depends-on 060 (the labelled-placeholder path a deleted asset degrades to) · Depends-on 105 (the cost-bound classification that permits tier scaling) · interacts with 006, 022, 087

Context

§6.2 has always said a presigned URL “is issued only after checking the requester’s per-account storage quota”. No such quantity existed. A named gate with no number is the failure ADR-045 exists to catch, and it survived because the sentence reads like a statement of fact rather than a promise.

Unlike the two cost proposals this corpus rejected earlier the same day, the premise here is sound: §10.2 records R2 storage as a real line item, “distinct from egress, which is genuinely $0”. Storage costs money. The quota defends something.

Decision

Q-085 bounds stored bytes in R2, not uploaded bytes. The two diverge under re-upload and versioning, and the stored copy is the billed one. Recorded explicitly because “quota” reads as either and §6.2’s check predates any definition.
It is a cost bound and never an abuse bound (ADR-105). It therefore scales with entitlement tier — which ADR-105 permits for cost bounds and forbids for abuse ones — and nothing may cite it as a defence against a hostile account.
Stored bytes and R2 Class B operations are separate quantities. The proposal that produced this ADR justified the quota as protecting “storage and Class B operation costs”. Class B operations are reads: an account well inside its quota can generate more of them than one at the ceiling, and a byte ceiling bounds read volume not at all. No Class B bound is registered, and this ADR does not create one — it states the gap rather than implying it is covered, which is ADR-105’s “a bound doing one job must not be documented as doing two” applied before the conflation ships.
A deletion made to free quota degrades a §7.3 replay to labelled placeholder geometry — the same destination a revoked licence reaches under ADR-060, reused rather than duplicated. The label text differs (deleted by its owner, versus licence-revoked) because a player must be able to distinguish an action they took from one taken about them; the behaviour does not.

The failure clause 4 closes, which the quota itself created

A storage ceiling creates a deletion pressure this corpus did not previously have. Before it, a custom asset had no reason to disappear. After it, an account at Q-085 frees space by deleting one — and §7.3’s time-travel replay of a session that referenced those bytes now names something that no longer exists.

The corpus already had the right destination state and had reached it by two other routes (unavailable protected bundle, revoked licence). ADR-M-025 records the governing discipline for exactly this shape: a new cause of an existing state must reuse it rather than introduce another behaviour, because that is how a system acquires four ways to render “this asset is not here” that differ by accident.

Alternatives Considered and Why Rejected

Bound uploaded bytes instead of stored bytes. Rejected: it charges an account twice for correcting a mistake, and it is not the quantity R2 bills.
Forbid deletion of assets referenced by any historical event. Rejected: it makes the quota unusable — an account could never recover space — and it converts a FinOps control into a retention obligation nobody costed.
A distinct “deleted” render state. Rejected by clause 4’s reasoning; the label carries the difference, the mechanism does not.
Treating the quota as an abuse bound so it need not scale with tier. Rejected on ADR-105: an abuse bound that money can raise is a cost bound wearing the wrong label.

Consequences (including negative)

Q-085 is ⊙ and its value is a guess. 200 MB was chosen as a round number; a single 8K map or one high-poly .stl may consume the whole allowance, which would make the free tier “one asset” rather than “a small library”. The registry names the measurement that would settle it — the custom-asset size distribution — and until that exists no normative claim may rest on this figure.
Per-account stored-byte totals are retained data about a person, so ADR-079’s rights-holder question is due on the counter, and it must have an erasure path under ADR-078 like any other account-linked record.
Class B volume remains unbounded. Named as a gap, not solved.

Rights-holders (ADR-079)

The account holder, for the stored-bytes counter introduced here. Honouring a claim is deletion of the counter with the account; it holds no data beyond a total and its timestamps, and it must not accumulate a per-asset access history — that would be a different retention class answering a question nobody asked.

Enforcement

The presigned-URL issuance path already performs the check; this ADR gives it a value, so the enforcement point is unchanged and a test asserts issuance is refused above Q-085.
A test asserts a replay referencing a deleted asset renders the placeholder rather than failing, sharing the fixture with ADR-060’s revoked-licence case so the two cannot drift.
Not enforced and stated as such: nothing prevents a future sentence citing Q-085 as an abuse bound. That rests on review, as ADR-105’s own distinction does.

ADR-120 — The Marketplace Exemption Is a Shared-Copy Exemption, Not a Provenance One

Status: Accepted · Date: 2026-08-08 · Depends-on 097 (the entitlement surface through which ownership is known, and whose predicates this must not be merged into) · Depends-on 119 (the quota this exempts from) · interacts with 087

Context

The proposal was that any Marketplace-sourced asset be exempt from the personal quota, with the stated rationale that hitting the ceiling would push users toward buying official packs.

Two things were wrong with that, and they are separable. The rationale was a manipulation argument. The rule was bypassable to approximately zero cost.

The bypass, stated exactly

Follow the incentive with all three proposed rules in force:

A GM with 20 GB of custom maps hits the free ceiling.
Rather than subscribe, they publish those assets to the Marketplace at exactly $0.00 — which ADR-M-044 explicitly permits as the alternative to clearing the price floor, and which ADR-M-031 gates only on the downloader holding an authenticated account.
They acquire their own listing. The bytes are now Marketplace-sourced and exempt.

Same bytes, same platform storage cost, different quota treatment, at no cost to the user. The paid variant is barely worse: list at Q-M-005’s floor, self-purchase, and the platform’s commission is the only real outlay against a monthly subscription avoided indefinitely.

This is not a new attack. §8.1 already names self-purchase laundering as “the core creator-marketplace risk; mitigated, not eliminated”. Provenance-only exemption attaches a new payoff to a fraud already assessed as ineliminable — and the existing mitigations there (reserve, payout delay, velocity detection) are tuned to money movement and would observe nothing at all on a $0.00 listing.

Decision

An asset is exempt from Q-085 only where the purchaser is not the publisher, and only above Q-088 distinct owners. Both conditions, not either.
The justification is marginal cost and nothing else. A pack owned by thousands of GMs costs the platform one copy of storage; a custom upload costs one copy per owner. The exemption prices reality rather than subsidising a behaviour — and that argument is the reason clause 1 has the shape it does, because the marginal-cost case collapses at one owner, which is precisely the self-published case.
The “storage anxiety” rationale is rejected and is not recorded as a motivation. Any funnel effect is a consequence of pricing storage honestly, never the mechanism. §1.6’s M-F-03 in the Marketplace corpus is the worked example of what happens when commercial framing overrides an architectural claim, and this corpus’s house style (P9) settles it independently.
Exemption is a third predicate on the entitlement lookup and must not be merged into the other two. ADR-097 warns that authorisation-to-load and disclosure-authority “must not be merged into one lookup because both happen to be called ‘permission’”. Quota exemption is a billing predicate and makes three. If it requires publisher identity or a distinct-owner count, that is a _v2 view under ADR-097’s expand-only rule — a cross-context change owing a contract test in both repositories.

Alternatives Considered and Why Rejected

Exempt on provenance alone. Rejected by the bypass above. This is the version that will be re-proposed, because it is simpler and its failure is not visible until someone works the incentive through.
Exempt only paid purchases. Rejected as insufficient: at the price floor the round trip costs a fraction of one month’s subscription and is permanent.
Purchaser ≠ publisher alone, with no owner threshold. Rejected: two colluding accounts publishing for each other satisfy it trivially. Q-088 is the defence in depth, and it is Pending because setting it by guess denies the exemption to genuinely niche packs.
Detect self-purchase with the existing velocity machinery. Rejected: those controls watch money, and the cheapest form of this bypass moves none.

Consequences (including negative)

A legitimately niche pack is not exempt until it clears Q-088. Its early buyers pay quota for it, which is a real unfairness the threshold’s value has to weigh. Naming it is the honest position rather than pretending a threshold has no losers.
The exemption is recomputable rather than fixed at purchase: an asset can cross Q-088 and become exempt later, which means a user’s usable quota can change without them doing anything. The direction is favourable and it should be surfaced, not silent.
This ADR bounds a bypass; it does not eliminate self-purchase laundering, which remains §8.1’s residual on its own terms.

Enforcement

The quota calculator excludes an asset only when both conditions hold; a test asserts a self-published asset consumes quota for its publisher regardless of catalogue state.
A test asserts the exemption predicate is evaluated separately from the authorisation-to-load predicate rather than sharing a call site (ADR-097 clause 4).
Not enforceable here: whether two accounts are the same person. That is the residual and it belongs to the Marketplace’s fraud surface, not to this quota.

ADR-121 — Tiered Storage Unlocks (Conditional on a Recurring-Billing Surface)

Status: Conditional — in force only once a recurring-billing surface exists · Date: 2026-08-08 · Depends-on 119 (the quota these raise) · interacts with 087, 105

Context

The proposal raises Q-085 for paid tiers: Plus and Pro unlock larger allowances, so heavy users self-fund their storage. As a cost bound, tier scaling is exactly what ADR-105 permits, so the shape is sound.

The machinery is not there. ADR-M-027 defers subscriptions from Marketplace v1 in as many words — “a recurring-billing surface adds dunning, proration, entitlement expiry, and mid-period tier changes — four state machines” — and the Marketplace is merchant of record (§7.2 of that corpus), so a VTT storage subscription cannot be billed by anything that exists today.

This ADR is therefore Conditional rather than Accepted, on ADR-062’s precedent: the decision is recorded so it is not re-derived, and it asserts nothing about a mechanism that is not built. Reading it as Accepted will produce wrong work.

Decision

Q-086 (Plus) and Q-087 (Pro) raise Q-085 and are Pending, not ⊙ — values are proposed, but they are blocked on a commercial mechanism rather than on measurement, which is the same category ADR-087 uses for Q-034’s daily allowance.
This ADR comes into force when the recurring-billing surface exists, and not before. Until then the free ceiling is the only storage bound in effect.
Storage becomes a second cost driver inside a price point whose existing justification is AI inference and unlimited time travel. Recorded as a consequence rather than hidden: two drivers in one price is a thing ADR-105’s discipline warns about by analogy, and it makes the tier’s margin harder to attribute later.

Alternatives Considered and Why Rejected

Draft it as Accepted. Rejected: it would assert billing machinery ADR-M-027 explicitly defers, and an ADR that describes a system nobody built is the failure mode this corpus records most often.
Sell storage as a one-off rather than a subscription (a Campaign Pass shape, which the business overview already uses). Genuinely viable and not rejected on merit — it needs no recurring-billing surface at all, and it is the obvious path if subscriptions stay deferred. It is not adopted here only because the brief specified tiers; it should be reconsidered before this ADR is activated.
Wait and write nothing. Rejected: the analysis would be redone, and the Conditional status is what the corpus has for exactly this case.

Consequences (including negative)

A Conditional ADR is read as Accepted by someone skimming, which is why the status legend and docs/README.md’s Conditional list both carry it. That is the mitigation and it is a weak one; the count moving from two to three is itself worth noticing.
The free tier ships alone. Until this activates, an account that outgrows Q-085 has deletion or the Marketplace as its only routes — which makes Q-085’s unmeasured value more load-bearing than it would otherwise be, not less.

Enforcement

None today, by construction. The condition is the enforcement point: no tier lookup exists to test. When the billing surface lands, activation is a deliberate act that must register Q-086/Q-087 with values and add the tier check to §6.2’s issuance path.
A release-checklist item asks whether a recurring-billing surface has appeared; if it has, this ADR’s condition is met and its status must change rather than drift.