We use private Vercel Blob with the Vercel Blob JavaScript SDK version 2.8.1. Our application immediately denies access when a recording is deleted or expires. We need a documented way to determine when its temporary and final objects, including incomplete multipart parts, have actually been removed and cannot be recreated by a previously authorized upload.

1. After a client token or signed URL expires, can a request started before expiry still finish? Is there a documented maximum lifetime or a server-side cancellation operation with a verifiable completion result?
2. Can we issue an upload capability that the Blob service enforces as single-object PUT only, prohibiting all multipart operations? The signed-token docs describe put as covering both single PUT and multipart POST.
3. How can an application list and abort all incomplete multipart uploads for a pathname or prefix, including uploads whose creation response was lost? If these are automatically reclaimed, what is the documented retention limit, and how can completion be verified?
4. Does ifMatch enforce its precondition atomically when a PUT or multipart completion commits, including a concurrent deletion? We understand that rejecting completion alone would not establish that all uploaded parts were reclaimed.
5. On Hobby, if Blob access is paused after exceeding included usage, are management deletion and multipart cleanup still available? If not, what is the no-upgrade recovery procedure?

Please point us to supported APIs and documented guarantees. A client-side abort, an expired token, or a 404 for an assembled object alone does not establish the physical cleanup boundary we need. We are not requesting a guarantee that provider security logs or backups are erased.