Prevent a duplicate retry from overwriting a product image: give every render attempt an immutable object-storage key, or the accepted image may be missing after the retry.

Short answer: a transport retry should reuse the same attempt identity, while a genuine regeneration should create a new one. Never let either operation write a shared name such as latest.png . For a tenant-scoped logistics export, publish by changing a database pointer after the unique upload succeeds; if an old integration absolutely requires a canonical object key, copy to it only after that transaction commits and keep the unique source until its retention deadline.

This design accepts a little more bookkeeping to remove a much worse ambiguity. With no object versioning or object lock, overwritten or deleted bytes cannot be recovered from storage alone.…