Customer Cells, custody, and privacy

Tenant run content, approvals, events, checkpoints, artifacts, and developer package records are authoritative in the assigned Customer Cell. Geyser Global and the Edge relay retain content-free routing, health, capability convergence, and signed discovery data only.

Managed, Mac Host, Linux Host, and enterprise Cells have different operational custody postures. A placement or runtime must carry current evidence for the requested privacy posture. Deletion proof covers primary rows, referenced artifacts, backup/export indexes, and adapter-native references; a request is not reported complete until its defined propagation boundary passes.