[servicememeai]

Scope (current dev only)

• Existing Server fix(storage): same-shard object staging and safe orphan preservation #15 atomic same-shard staging stays unchanged.
• Route C Commit/FS objects (read/write/exists/delete/copy/iteration/removal) through the already-present cf_v2_store_dir contract, matching C Blocks. Reject corrupt/unresolved routes instead of falling back to native paths; preserve native migration/export version-0 layout.
• Connect the existing Go v2StorageBackend in the real newBackend constructor, accept both config filename and directory, and refuse incompatible legacy multiple/S3 backends when the V2 managed root is present.
• Reserve new library cf_library_storage and RepoStorageId before the first commit, activate on successful creation, mark retired for cold GC. Preserve old cf_pin_default_local_storage only when no V2 root is configured; refuse new per-library class override in V2.
• Keep current Seafile repo UUIDs and object paths; no schema changes, metadata migration, volume moves, or automatic cleanup.

Minimal checks

• C native and managed filesystem fixture tests/local_storage/run.sh.
• Go existing V2 filesystem tests plus new real-entrypoint cf_v2_route_wiring_test.go via go test ./objstore; optional bind-mount EXDEV regression only in a disposable mount-capable environment.
• Code/source invariant review completed; no full compile, image build, DEV/PROD deploy or rollback requested.
• Docker dev already defaults to current Server/Hub dev and allowlists all modified native seams. Hub OAuth source isolation is a separate PR #32, not part of this storage change.

Release boundary

Merge only after cheap CI and targeted source review. User authorization is required separately for native build, image publication, DEV deployment or rollback. Runtime acceptance must use a fixed Server/Hub/Docker SHA tuple and verify old native-library reads, new managed-library C/Go bytes and real upload/download.