Function reclaim_orphaned_attachments 

pub async fn reclaim_orphaned_attachments<M, S>(
    manifest: &M,
    store: &S,
    older_than_epoch_ms: u64,
) -> Result<AttachmentReclamationReport, AttachmentStoreError>
where
    M: AttachmentManifest + ?Sized,
    S: AttachmentStore + ?Sized,

Reclaim attachment bytes left orphaned by a crash between put and the next durable commit — the host-invocable counterpart to StoreMaintenance::gc_unreachable for attachment payloads.

The sweep asks the write-ahead manifest for every intent aged past older_than_epoch_ms that was recorded but never committed (AttachmentManifest::list_uncommitted), deletes each one’s bytes via AttachmentStore::delete, then forgets the manifest row (AttachmentManifest::forget).

Sharing safety

This is the safe delete path. Because the manifest is keyed by content id, an uncommitted intent proves no durable session state references that content: shared/committed content carries a set committed_at and is excluded from list_uncommitted. Deleting an aged uncommitted intent’s bytes is therefore safe under cross-session sharing by construction.

Policy is the host’s (ADR-0014)

This is a lever, not a scheduler: the host chooses older_than_epoch_ms (typically now - grace_period, where the grace period exceeds any live turn’s duration so an in-flight put is never swept) and when to run it. It does no background work of its own.