Publish a nominated immutable artifact

Explicitly capture one nominated guest file into immutable private retained storage. Accepts at most 32768 bytes of application/json and a 60000 millisecond control-plane deadline. The computer must already be running: one source file GET uses no_wake=1 and may touch guest activity. No automatic capture, shell, directory scan, Range assembly or retry on another host. Exact transferred bytes must match expected_size and expected_sha256; no prefix success. A live path may change or follow symlinks; digest matching is not an atomic snapshot or proof of who created a file. Optional execution_id must currently resolve on the same computer and recorded scope; its caller_selected association does not prove creation. Retrying creates another version; no listing or idempotency key. created_at is final publication time; expiry starts at reservation and never renews on reads. All routes require member and refuse suspended accounts. Artifacts and retained output share one store quota: at most 128 MiB and 256 objects per computer, 512 MiB and 2000 objects per account, and 2 captures in progress per account. An artifact is charged at expected_size from reservation; a retained-output capture at twice max_bytes_per_stream, plus the diagnostic for background output. Deleted objects stay charged until physical cleanup. Past any limit, or when the platform store is full, the answer is 429 result_capacity with Retry-After: 60. No query parameters or caller metadata. A verified execution association may add a passive result link to its existing activity. Responses are no-store with a relative Location. Daemon guest transfer can outlive control-plane cancellation.

Requires the member role or higher.