remove the filesystem and buffered upload ability on the holds. going forward the only supported storage is s3. adds extra mocks and tests around uploading

.env.example

···
 # HOLD_ADMIN_ENABLED=false
 
 # ==============================================================================
-# STORAGE - S3 CONFIGURATION
+# STORAGE - S3 CONFIGURATION (REQUIRED)
 # ==============================================================================
 
-# Storage driver type
-# Options: s3, filesystem
-# Default: s3
-STORAGE_DRIVER=s3
+# S3 is the only supported storage backend. Presigned URLs enable direct
+# client-to-S3 transfers, reducing hold bandwidth by ~99%.
 
-# S3 Access Credentials
+# S3 Access Credentials (REQUIRED)
 AWS_ACCESS_KEY_ID=your_access_key
 AWS_SECRET_ACCESS_KEY=your_secret_key
 
···
 #   - Minio: http://minio:9000
 # Leave empty for AWS S3
 # S3_ENDPOINT=https://gateway.storjshare.io
-
-# ==============================================================================
-# STORAGE - FILESYSTEM CONFIGURATION
-# ==============================================================================
-
-# Root directory for filesystem storage (when STORAGE_DRIVER=filesystem)
-# Default: /var/lib/atcr/hold
-# STORAGE_ROOT_DIR=/var/lib/atcr/hold
 
 # ==============================================================================
 # LOGGING (Shared by AppView and Hold)

.env.hold.example

···
 HOLD_PUBLIC_URL=http://127.0.0.1:8080
 
 # ==============================================================================
-# Storage Configuration
+# S3 Storage Configuration (REQUIRED)
 # ==============================================================================
 
-# Storage driver type (s3, filesystem)
-# Default: s3
-#
-# S3 Presigned URLs:
-#   When using S3 storage, presigned URLs are automatically enabled for direct
-#   client ↔ S3 transfers. This eliminates the hold service as a bandwidth
-#   bottleneck, reducing hold bandwidth by ~99% for push/pull operations.
-#   Falls back to proxy mode automatically for non-S3 drivers.
-STORAGE_DRIVER=filesystem
+# S3 is the only supported storage backend. Presigned URLs are used for direct
+# client ↔ S3 transfers, eliminating the hold service as a bandwidth bottleneck
+# and reducing hold bandwidth by ~99% for push/pull operations.
 
-# S3 Access Credentials
+# S3 Access Credentials (REQUIRED)
 AWS_ACCESS_KEY_ID=your_access_key
 AWS_SECRET_ACCESS_KEY=your_secret_key
 
···
 # Default: us-east-1
 AWS_REGION=us-east-1
 
-# S3 Bucket Name
+# S3 Bucket Name (REQUIRED)
 S3_BUCKET=atcr-blobs
 
 # S3 Endpoint (for S3-compatible services like Storj, Minio, UpCloud)
···
 #   - Minio: http://minio:9000
 # Leave empty for AWS S3
 # S3_ENDPOINT=https://gateway.storjshare.io
-
-# For filesystem driver:
-# STORAGE_DRIVER=filesystem
-# STORAGE_ROOT_DIR=/var/lib/atcr/hold
 
 # ==============================================================================
 # Server Configuration

CLAUDE.md

···
 # ./bin/atcr-appview serve config/config.yml
 
 # Run hold service (configure via env vars - see .env.hold.example)
+# For local development, use Minio as S3-compatible storage:
+# docker run -p 9000:9000 minio/minio server /data
 export HOLD_PUBLIC_URL=http://127.0.0.1:8080
-export STORAGE_DRIVER=filesystem
-export STORAGE_ROOT_DIR=/tmp/atcr-hold
+export AWS_ACCESS_KEY_ID=minioadmin
+export AWS_SECRET_ACCESS_KEY=minioadmin
+export S3_BUCKET=test
+export S3_ENDPOINT=http://localhost:9000
 export HOLD_OWNER=did:plc:your-did-here
 ./bin/atcr-hold
 # Hold starts immediately with embedded PDS
···
 2. **Hold Service** (`cmd/hold`) - Optional BYOS component
    - Lightweight HTTP server for presigned URLs
    - Embedded PDS with captain + crew records
-   - Supports S3, Storj, Minio, filesystem, etc.
+   - Supports S3-compatible storage (AWS S3, Storj, Minio, UpCloud, etc.)
    - Authorization based on captain record (public, allowAllCrew)
    - Self-describing via DID resolution
    - Configured entirely via environment variables
···
 5. Blob PUT → ProxyBlobStore calls hold's XRPC multipart upload endpoints:
    a. POST /xrpc/io.atcr.hold.initiateUpload (gets uploadID)
    b. POST /xrpc/io.atcr.hold.getPartUploadUrl (gets presigned URL for each part)
-   c. PUT to S3 presigned URL (or PUT /xrpc/io.atcr.hold.uploadPart for buffered mode)
+   c. PUT to S3 presigned URL (client uploads directly to S3)
    d. POST /xrpc/io.atcr.hold.completeUpload (finalizes upload)
 6. Manifest PUT → alice's PDS as io.atcr.manifest record (includes holdDid + holdEndpoint)
    → Manifest also uploaded to PDS blob storage (ATProto CID format)
···
 - Resolves hold DID → HTTP URL for XRPC requests (did:web resolution)
 - Gets service tokens from user's PDS (`com.atproto.server.getServiceAuth`)
 - Calls hold XRPC endpoints with service token authentication:
-  - Multipart upload: initiateUpload, getPartUploadUrl, uploadPart, completeUpload, abortUpload
+  - Multipart upload: initiateUpload, getPartUploadUrl, completeUpload, abortUpload
   - Blob read: com.atproto.sync.getBlob (returns presigned download URL)
 - Implements full `distribution.BlobStore` interface
-- Supports both presigned URL mode (S3 direct) and buffered mode (proxy via hold)
+- Uses presigned URLs for direct client-to-S3 transfers
 
 #### AppView Web UI (`pkg/appview/`)
 
···
 **Architecture:**
 - **Embedded PDS**: Each hold has a full ATProto PDS for storing captain + crew records
 - **DID**: Hold identified by did:web (e.g., `did:web:hold01.atcr.io`)
-- **Storage**: Reuses distribution's storage driver factory (S3, Storj, Minio, Azure, GCS, filesystem)
+- **Storage**: Requires S3-compatible storage (AWS S3, Storj, Minio, UpCloud, etc.)
 - **Authorization**: Based on captain + crew records in embedded PDS
 - **Blob operations**: Generates presigned URLs (15min expiry) or proxies uploads/downloads via XRPC
 
···
 All require blob:write permission via service token authentication:
 - `POST /xrpc/io.atcr.hold.initiateUpload` - Start multipart upload session
 - `POST /xrpc/io.atcr.hold.getPartUploadUrl` - Get presigned URL for uploading a part
-- `PUT /xrpc/io.atcr.hold.uploadPart` - Direct buffered part upload (alternative to presigned URLs)
 - `POST /xrpc/io.atcr.hold.completeUpload` - Finalize multipart upload and move to final location
 - `POST /xrpc/io.atcr.hold.abortUpload` - Cancel multipart upload and cleanup temp data
 
···
 
 **Configuration:** Environment variables (see `.env.hold.example`)
 - `HOLD_PUBLIC_URL` - Public URL of hold service (required, used for did:web generation)
-- `STORAGE_DRIVER` - Storage driver type (s3, filesystem)
-- `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` - S3 credentials
-- `S3_BUCKET`, `S3_ENDPOINT` - S3 configuration
+- `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` - S3 credentials (required)
+- `S3_BUCKET` - S3 bucket name (required)
+- `S3_ENDPOINT` - S3 endpoint URL (for non-AWS providers like Storj, Minio, UpCloud)
 - `HOLD_PUBLIC` - Allow public reads (default: false)
 - `HOLD_OWNER` - DID for captain record creation (optional)
 - `HOLD_ALLOW_ALL_CREW` - Allow any authenticated user to register as crew (default: false)
-- `HOLD_DATABASE_PATH` - Path for embedded PDS database (required)
-- `HOLD_DATABASE_KEY_PATH` - Path for PDS signing keys (optional, generated if missing)
+- `HOLD_DATABASE_DIR` - Directory for embedded PDS database (required)
+- `HOLD_KEY_PATH` - Path for PDS signing keys (optional, generated if missing)
 
 **Deployment:** Can run on Fly.io, Railway, Docker, Kubernetes, etc.
 
···
 
 See `.env.hold.example` for all available options. Key environment variables:
 - `HOLD_PUBLIC_URL` - Public URL of hold service (REQUIRED)
-- `STORAGE_DRIVER` - Storage backend (s3, filesystem)
-- `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` - S3 credentials
-- `S3_BUCKET`, `S3_ENDPOINT` - S3 configuration
+- `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY` - S3 credentials (REQUIRED)
+- `S3_BUCKET` - S3 bucket name (REQUIRED)
+- `S3_ENDPOINT` - S3 endpoint URL (for non-AWS providers)
 - `HOLD_PUBLIC` - Allow public reads (default: false)
 - `HOLD_OWNER` - DID for captain record creation (optional)
 - `HOLD_ALLOW_ALL_CREW` - Allow any authenticated user to register as crew (default: false)
···
 5. AppView automatically queries hold's PDS and routes blobs to user's storage
 6. No AppView changes needed - fully decentralized
 
-**Supporting a new storage backend**:
-1. Ensure driver is registered in `cmd/hold/main.go` imports
-2. Distribution supports: S3, Azure, GCS, Swift, filesystem, OSS
-3. For custom drivers: implement `storagedriver.StorageDriver` interface
-4. Add case to `buildStorageConfig()` in `cmd/hold/main.go`
-5. Update `.env.example` with new driver's env vars
+**Using S3-compatible storage**:
+ATCR requires S3-compatible storage. Supported providers:
+- AWS S3 - Set `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `S3_BUCKET`
+- Storj - Set `S3_ENDPOINT=https://gateway.storjshare.io`
+- Minio - Set `S3_ENDPOINT=http://localhost:9000`
+- UpCloud - Set `S3_ENDPOINT=https://[bucket-id].upcloudobjects.com`
+- Azure/GCS - Use their S3-compatible API endpoints
 
 **Working with the database**:
 - **Base schema** defined in `pkg/appview/db/schema.sql` - source of truth for fresh installations

cmd/hold/main.go

···
 	"atcr.io/pkg/logging"
 	"atcr.io/pkg/s3"
 
-	// Import storage drivers
+	// Import S3 storage driver
 	"github.com/distribution/distribution/v3/registry/storage/driver/factory"
-	_ "github.com/distribution/distribution/v3/registry/storage/driver/filesystem"
 	_ "github.com/distribution/distribution/v3/registry/storage/driver/s3-aws"
 
 	"github.com/go-chi/chi/v5"
···
 			os.Exit(1)
 		}
 
-		s3Service, err := s3.NewS3Service(cfg.Storage.Parameters(), cfg.Server.DisablePresignedURLs, cfg.Storage.Type())
+		s3Service, err := s3.NewS3Service(cfg.Storage.Parameters())
 		if err != nil {
 			slog.Error("Failed to create S3 service", "error", err)
 			os.Exit(1)
···
 		xrpcHandler = pds.NewXRPCHandler(holdPDS, *s3Service, driver, broadcaster, nil, quotaMgr)
 
 		// Create OCI XRPC handler (multipart upload endpoints)
-		ociHandler = oci.NewXRPCHandler(holdPDS, *s3Service, driver, cfg.Server.DisablePresignedURLs, cfg.Registration.EnableBlueskyPosts, nil, quotaMgr)
+		ociHandler = oci.NewXRPCHandler(holdPDS, *s3Service, driver, cfg.Registration.EnableBlueskyPosts, nil, quotaMgr)
 
 		// Initialize garbage collector
 		gcConfig := gc.LoadConfigFromEnv()

cmd/usage-report/main.go

···
 //
 //	go run ./cmd/usage-report --hold https://hold01.atcr.io
 //	go run ./cmd/usage-report --hold https://hold01.atcr.io --from-manifests
+//	go run ./cmd/usage-report --hold https://hold01.atcr.io --list-blobs
 package main
 
 import (
···
 
 var client = &http.Client{Timeout: 30 * time.Second}
 
+// BlobInfo represents a single blob with its metadata
+type BlobInfo struct {
+	Digest    string
+	Size      int64
+	MediaType string
+	UserDID   string
+	Handle    string
+}
+
 func main() {
 	holdURL := flag.String("hold", "https://hold01.atcr.io", "Hold service URL")
 	fromManifests := flag.Bool("from-manifests", false, "Calculate usage from user manifests instead of hold layer records (more accurate but slower)")
+	listBlobs := flag.Bool("list-blobs", false, "List all individual blobs sorted by size (largest first)")
 	flag.Parse()
 
 	// Normalize URL
···
 		os.Exit(1)
 	}
 	fmt.Printf("Hold DID: %s\n\n", holdDID)
+
+	// If --list-blobs flag is set, run blob listing mode
+	if *listBlobs {
+		listAllBlobs(baseURL, holdDID)
+		return
+	}
 
 	var userUsage map[string]*UserUsage
 
···
 		}
 		sort.Strings(repos)
 		fmt.Printf("%s,%s,%d,%d,%s,\"%s\"\n", u.Handle, u.DID, u.LayerCount, u.TotalSize, humanSize(u.TotalSize), strings.Join(repos, ";"))
+	}
+}
+
+// listAllBlobs fetches all blobs and lists them sorted by size (largest first)
+func listAllBlobs(baseURL, holdDID string) {
+	fmt.Println("=== Fetching all blob records ===")
+
+	layers, err := fetchAllLayerRecords(baseURL, holdDID)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Failed to fetch layer records: %v\n", err)
+		os.Exit(1)
+	}
+
+	fmt.Printf("Fetched %d layer records\n", len(layers))
+
+	// Deduplicate by digest, keeping track of first seen user
+	blobMap := make(map[string]*BlobInfo)
+	for _, layer := range layers {
+		if existing, exists := blobMap[layer.Digest]; exists {
+			// If we have a record with a user DID and existing doesn't, prefer this one
+			if existing.UserDID == "" && layer.UserDID != "" {
+				existing.UserDID = layer.UserDID
+			}
+			continue
+		}
+		blobMap[layer.Digest] = &BlobInfo{
+			Digest:    layer.Digest,
+			Size:      layer.Size,
+			MediaType: layer.MediaType,
+			UserDID:   layer.UserDID,
+		}
+	}
+
+	// Convert to slice
+	var blobs []*BlobInfo
+	for _, b := range blobMap {
+		blobs = append(blobs, b)
+	}
+
+	// Sort by size (largest first)
+	sort.Slice(blobs, func(i, j int) bool {
+		return blobs[i].Size > blobs[j].Size
+	})
+
+	fmt.Printf("Found %d unique blobs\n\n", len(blobs))
+
+	// Resolve DIDs to handles (batch for efficiency)
+	fmt.Println("Resolving DIDs to handles...")
+	didToHandle := make(map[string]string)
+	for _, b := range blobs {
+		if b.UserDID == "" {
+			continue
+		}
+		if _, exists := didToHandle[b.UserDID]; !exists {
+			handle, err := resolveDIDToHandle(b.UserDID)
+			if err != nil {
+				didToHandle[b.UserDID] = b.UserDID
+			} else {
+				didToHandle[b.UserDID] = handle
+			}
+		}
+		b.Handle = didToHandle[b.UserDID]
+	}
+
+	// Calculate total
+	var totalSize int64
+	for _, b := range blobs {
+		totalSize += b.Size
+	}
+
+	// Print report
+	fmt.Println("\n========================================")
+	fmt.Println("BLOB SIZE REPORT (sorted largest to smallest)")
+	fmt.Println("========================================")
+	fmt.Printf("\nTotal Unique Blobs: %d\n", len(blobs))
+	fmt.Printf("Total Storage: %s\n\n", humanSize(totalSize))
+
+	fmt.Println("BLOBS:")
+	fmt.Println("----------------------------------------")
+	for i, b := range blobs {
+		pct := float64(0)
+		if totalSize > 0 {
+			pct = float64(b.Size) / float64(totalSize) * 100
+		}
+		owner := b.Handle
+		if owner == "" {
+			owner = "(unknown)"
+		}
+		fmt.Printf("%4d. %s\n", i+1, humanSize(b.Size))
+		fmt.Printf("      Digest: %s\n", b.Digest)
+		fmt.Printf("      Owner: %s\n", owner)
+		if b.MediaType != "" {
+			fmt.Printf("      Type: %s\n", b.MediaType)
+		}
+		fmt.Printf("      Share: %.2f%%\n\n", pct)
+	}
+
+	// Output CSV format
+	fmt.Println("\n========================================")
+	fmt.Println("CSV FORMAT")
+	fmt.Println("========================================")
+	fmt.Println("rank,size_bytes,size_human,digest,owner,media_type,share_pct")
+	for i, b := range blobs {
+		pct := float64(0)
+		if totalSize > 0 {
+			pct = float64(b.Size) / float64(totalSize) * 100
+		}
+		owner := b.Handle
+		if owner == "" {
+			owner = ""
+		}
+		fmt.Printf("%d,%d,%s,%s,%s,%s,%.2f\n", i+1, b.Size, humanSize(b.Size), b.Digest, owner, b.MediaType, pct)
 	}
 }
 

deploy/.env.prod.template

···
 HOLD_BLUESKY_POSTS_ENABLED=true
 
 # ==============================================================================
-# S3/UpCloud Object Storage Configuration
+# S3/UpCloud Object Storage Configuration (REQUIRED)
 # ==============================================================================
 
-# Storage driver type
-# Options: s3, filesystem
-# Default: s3
-STORAGE_DRIVER=s3
+# S3 is the only supported storage backend. Presigned URLs are used for direct
+# client ↔ S3 transfers, eliminating the hold service as a bandwidth bottleneck.
 
 # S3 Access Credentials
 # Get these from UpCloud Object Storage console
···
 # ATProto relay endpoint for backfill sync API
 # Default: https://relay1.us-east.bsky.network
 ATCR_RELAY_ENDPOINT=https://relay1.us-east.bsky.network
-
-# ==============================================================================
-# Optional: Filesystem Storage (alternative to S3)
-# ==============================================================================
-
-# If using filesystem storage instead of S3:
-# 1. Uncomment these lines
-# 2. Comment out all S3 variables above
-# 3. Set STORAGE_DRIVER=filesystem
-
-# STORAGE_DRIVER=filesystem
-# STORAGE_ROOT_DIR=/var/lib/atcr/hold
 
 # ==============================================================================
 # CHECKLIST

deploy/README.md

···
 docker logs atcr-hold | grep -i presigned
 ```
 
-**Check S3 driver:**
+**Check S3 configuration:**
 ```bash
-docker exec atcr-hold env | grep STORAGE_DRIVER
-# Should be: s3 (not filesystem)
+docker exec atcr-hold env | grep S3_BUCKET
+# Should show your S3 bucket name
 ```
 
 **Verify direct S3 access:**

deploy/docker-compose.prod.yml

···
       HOLD_DATABASE_DIR: ${HOLD_DATABASE_DIR:-/var/lib/atcr-hold}
       # HOLD_KEY_PATH: ${HOLD_KEY_PATH}  # Optional, defaults to {HOLD_DATABASE_DIR}/signing.key
 
-      # Storage driver
-      STORAGE_DRIVER: ${STORAGE_DRIVER:-s3}
-
-      # S3/UpCloud Object Storage configuration
+      # S3/UpCloud Object Storage configuration (REQUIRED)
       AWS_ACCESS_KEY_ID: ${AWS_ACCESS_KEY_ID:-}
       AWS_SECRET_ACCESS_KEY: ${AWS_SECRET_ACCESS_KEY:-}
       AWS_REGION: ${AWS_REGION:-us-east-1}
···
       # Logging
       ATCR_LOG_LEVEL: ${ATCR_LOG_LEVEL:-debug}
       ATCR_LOG_FORMATTER: ${ATCR_LOG_FORMATTER:-text}
-
-      # Optional: Filesystem storage (comment out S3 vars above)
-      # STORAGE_DRIVER: filesystem
-      # STORAGE_ROOT_DIR: /var/lib/atcr/hold
     volumes:
       # PDS data (carstore SQLite + signing keys)
       - atcr-hold-data:/var/lib/atcr-hold

docker-compose.yml

···
       HOLD_OWNER: did:plc:pddp4xt5lgnv2qsegbzzs4xg
       HOLD_PUBLIC: false
       HOLD_ALLOW_ALL_CREW: true
-      # STORAGE_DRIVER: filesystem
-      # STORAGE_ROOT_DIR: /var/lib/atcr/hold
       TEST_MODE: true
-      # DISABLE_PRESIGNED_URLS: true
       # Logging
       ATCR_LOG_LEVEL: debug
       # Log shipping (uncomment to enable)
       ATCR_LOG_SHIPPER_BACKEND: victoria
       ATCR_LOG_SHIPPER_URL: http://172.28.0.10:9428
-      # Storage config comes from env_file (STORAGE_DRIVER, AWS_*, S3_*)
+      # S3 storage config comes from env_file (AWS_*, S3_*)
     # Limit local Docker logs - real logs go to Victoria Logs
     # Local logs just for live tailing (docker logs -f)
     logging:

docs/BYOS.md

···
 ATCR supports "Bring Your Own Storage" (BYOS) for blob storage. Users can:
 - Deploy their own hold service with embedded PDS
 - Control access via crew membership in the hold's PDS
-- Keep blob data in their own S3/Storj/Minio while manifests stay in their user PDS
+- Keep blob data in their own S3-compatible storage (AWS S3, Storj, Minio, UpCloud, etc.) while manifests stay in their user PDS
 
 ## Architecture
 
···
 Each hold is a full ATProto actor with:
 - **DID**: `did:web:hold.example.com` (hold's identity)
 - **Embedded PDS**: Stores captain + crew records (shared data)
-- **Storage backend**: S3, Storj, Minio, filesystem, etc.
+- **Storage backend**: S3-compatible (AWS S3, Storj, Minio, UpCloud, etc.)
 - **XRPC endpoints**: Standard ATProto + custom OCI multipart upload
 
 ### Records in Hold's PDS
···
 HOLD_PUBLIC_URL=https://hold.example.com
 HOLD_OWNER=did:plc:your-did-here
 
-# Storage backend
-STORAGE_DRIVER=s3
+# S3 storage backend (REQUIRED)
 AWS_ACCESS_KEY_ID=your_access_key
 AWS_SECRET_ACCESS_KEY=your_secret_key
 AWS_REGION=us-east-1
···
 ```
 
 ### Running Locally
+
+For local development, use Minio as an S3-compatible storage:
 
 ```bash
+# Start Minio (in separate terminal)
+docker run -p 9000:9000 -p 9001:9001 minio/minio server /data --console-address ":9001"
+
 # Build
 go build -o bin/atcr-hold ./cmd/hold
 
 # Run (with env vars or .env file)
 export HOLD_PUBLIC_URL=http://localhost:8080
 export HOLD_OWNER=did:plc:your-did-here
-export STORAGE_DRIVER=filesystem
-export STORAGE_ROOT_DIR=/tmp/atcr-hold
+export AWS_ACCESS_KEY_ID=minioadmin
+export AWS_SECRET_ACCESS_KEY=minioadmin
+export S3_BUCKET=test
+export S3_ENDPOINT=http://localhost:9000
 export HOLD_DATABASE_PATH=/tmp/atcr-hold/hold.db
 
 ./bin/atcr-hold
···
 
 [env]
   HOLD_PUBLIC_URL = "https://my-atcr-hold.fly.dev"
-  STORAGE_DRIVER = "s3"
   AWS_REGION = "us-east-1"
   S3_BUCKET = "my-blobs"
   HOLD_PUBLIC = "false"
···
   --rkey "{memberDID}"
 ```
 
-## Storage Drivers
+## Storage Backends
 
-Hold service supports all distribution storage drivers:
-- **S3** - AWS S3, Minio, Storj (via S3 gateway)
-- **Filesystem** - Local disk (for testing)
-- **Azure** - Azure Blob Storage
-- **GCS** - Google Cloud Storage
-- **Swift** - OpenStack Swift
+Hold service requires S3-compatible storage. Supported providers:
+- **AWS S3** - Amazon Simple Storage Service
+- **Storj** - Decentralized cloud storage (via S3 gateway)
+- **Minio** - High-performance object storage (great for local development)
+- **UpCloud** - European cloud provider
+- **Azure** - Azure Blob Storage (via S3-compatible API)
+- **GCS** - Google Cloud Storage (via S3-compatible API)
 
 ## Example: Team Hold
 
···
 export HOLD_PUBLIC_URL=https://team-hold.fly.dev
 export HOLD_OWNER=did:plc:admin
 export HOLD_PUBLIC=false  # Private
-export STORAGE_DRIVER=s3
 export AWS_ACCESS_KEY_ID=...
+export AWS_SECRET_ACCESS_KEY=...
 export S3_BUCKET=team-blobs
 
 fly deploy

docs/SBOM_SCANNING.md

···
 ```bash
 # .env.hold
 HOLD_PUBLIC_URL=https://hold01.atcr.io
-STORAGE_DRIVER=s3
 S3_BUCKET=my-hold-blobs
+AWS_ACCESS_KEY_ID=your-access-key
+AWS_SECRET_ACCESS_KEY=your-secret-key
 HOLD_OWNER=did:plc:xyz123
-HOLD_DATABASE_PATH=/var/lib/atcr/hold.db
+HOLD_DATABASE_DIR=/var/lib/atcr-hold
 
 # Enable SBOM scanning
 HOLD_SBOM_ENABLED=true
···
 # 1. Configure hold with SBOM enabled
 cat > .env.hold <<EOF
 HOLD_PUBLIC_URL=https://myhold.example.com
-STORAGE_DRIVER=s3
 S3_BUCKET=my-blobs
+AWS_ACCESS_KEY_ID=your-access-key
+AWS_SECRET_ACCESS_KEY=your-secret-key
 HOLD_OWNER=did:plc:myid
 
 # Enable SBOM scanning

docs/appview.md

···
 
 ### Development/Testing
 
-Local Docker Compose setup:
+Local Docker Compose setup with Minio for S3-compatible storage:
 
 ```bash
+# Start Minio (S3-compatible storage)
+docker run -p 9000:9000 -p 9001:9001 minio/minio server /data --console-address ":9001"
+
 # AppView config
 ATCR_HTTP_ADDR=:5000
 ATCR_DEFAULT_HOLD_DID=did:web:atcr-hold:8080
 ATCR_LOG_LEVEL=debug
 
 # Hold config (linked hold service)
-STORAGE_DRIVER=filesystem
-STORAGE_ROOT_DIR=/tmp/atcr-hold
+AWS_ACCESS_KEY_ID=minioadmin
+AWS_SECRET_ACCESS_KEY=minioadmin
+S3_BUCKET=test
+S3_ENDPOINT=http://minio:9000
 HOLD_PUBLIC=true
 HOLD_ALLOW_ALL_CREW=true
 ```

docs/hold.md

···
 
 ## Overview
 
-**Hold Service** is the storage backend component of ATCR. It enables BYOS (Bring Your Own Storage) - users can store their own container image layers in their own S3, Storj, Minio, or filesystem storage. Each hold runs as a full ATProto user with an embedded PDS, exposing both standard ATProto sync endpoints and custom XRPC endpoints for OCI multipart blob uploads.
+**Hold Service** is the storage backend component of ATCR. It enables BYOS (Bring Your Own Storage) - users can store their own container image layers in their own S3-compatible storage (AWS S3, Storj, Minio, UpCloud, etc.). Each hold runs as a full ATProto user with an embedded PDS, exposing both standard ATProto sync endpoints and custom XRPC endpoints for OCI multipart blob uploads.
 
 ### What Hold Service Does
 
 Hold Service is the storage layer that:
 
-- **Bring Your Own Storage (BYOS)** - Store your own container image layers in your own S3, Storj, Minio, or filesystem
+- **Bring Your Own Storage (BYOS)** - Store your own container image layers in your own S3-compatible storage (AWS S3, Storj, Minio, UpCloud, etc.)
 - **Embedded ATProto PDS** - Each hold is a full ATProto user with its own DID, repository, and identity
 - **Custom XRPC Endpoints** - OCI-compatible multipart upload endpoints (`io.atcr.hold.*`) for blob operations
 - **Presigned URL Generation** - Creates time-limited S3 URLs for direct client-to-storage transfers (~99% bandwidth reduction)
 - **Crew Management** - Controls access via captain and crew records stored in the hold's embedded PDS
 - **Standard ATProto Sync** - Exposes com.atproto.sync.* endpoints for repository synchronization and firehose
-- **Multi-Backend Support** - Works with S3, Storj, Minio, filesystem, Azure, GCS via distribution's driver system
+- **S3 Storage** - Works with any S3-compatible storage (AWS S3, Storj, Minio, UpCloud, Azure, GCS via S3 gateway)
 - **Bluesky Integration** - Optional: Posts container image push notifications from the hold's identity to Bluesky
 
 ### The ATCR Ecosystem
···
 - Maintain data sovereignty (keep blobs in specific geographic regions)
 
 **Prerequisites:**
-- S3-compatible storage (AWS S3, Storj, Minio, UpCloud, etc.) OR filesystem storage
+- S3-compatible storage (AWS S3, Storj, Minio, UpCloud, etc.)
 - (Optional) Domain name with SSL/TLS certificates for production
 - ATProto DID for hold owner (get from: `https://bsky.social/xrpc/com.atproto.identity.resolveHandle?handle=yourhandle.bsky.social`)
 
···
 # Required: Your ATProto DID (for captain record)
 HOLD_OWNER=did:plc:your-did-here
 
-# Required: Storage driver type
-STORAGE_DRIVER=s3
-
-# Required for S3: Credentials and bucket
+# Required: S3 credentials and bucket
 AWS_ACCESS_KEY_ID=your-access-key
 AWS_SECRET_ACCESS_KEY=your-secret-key
 S3_BUCKET=your-bucket-name
···
   - `true`: Public registry (anyone can pull, authenticated users can push if crew)
   - `false`: Private registry (authentication required for both push and pull)
 
-### Storage Configuration
-
-#### `STORAGE_DRIVER`
-- **Default:** `s3`
-- **Options:** `s3`, `filesystem`
-- **Description:** Storage backend type. S3 enables presigned URLs for direct client-to-storage transfers (~99% bandwidth reduction). Filesystem stores blobs locally (development/testing).
+### S3 Storage Configuration
 
-#### S3 Storage (when `STORAGE_DRIVER=s3`)
+S3 is the only supported storage backend. Presigned URLs enable direct client-to-storage transfers (~99% bandwidth reduction).
 
 ##### `AWS_ACCESS_KEY_ID` ⚠️ REQUIRED for S3
 - **Description:** S3 access key ID for authentication
···
 - **UpCloud:** `https://[bucket-id].upcloudobjects.com`
 - **Minio:** `http://minio:9000`
 - **Note:** Leave empty for AWS S3
-
-#### Filesystem Storage (when `STORAGE_DRIVER=filesystem`)
-
-##### `STORAGE_ROOT_DIR`
-- **Default:** `/var/lib/atcr/hold`
-- **Description:** Directory path where blobs will be stored on local filesystem
-- **Use case:** Development, testing, or single-server deployments
-- **Note:** Presigned URLs are not available with filesystem driver (hold proxies all blob transfers)
 
 ### Embedded PDS Configuration
 
···
 - **Default:** `false`
 - **Description:** Enable test mode (skips some validations). Do not use in production.
 
-#### `DISABLE_PRESIGNED_URLS`
-- **Default:** `false`
-- **Description:** Force proxy mode even with S3 configured (for testing). Disables presigned URL generation and routes all blob transfers through the hold service.
-- **Use case:** Testing, debugging, or environments where presigned URLs don't work
-
 ## XRPC Endpoints
 
 Hold Service exposes two types of XRPC endpoints:
···
 ### OCI Multipart Upload Endpoints (Custom)
 - `POST /xrpc/io.atcr.hold.initiateUpload` - Start multipart upload session
 - `POST /xrpc/io.atcr.hold.getPartUploadUrl` - Get presigned URL for uploading a part
-- `PUT /xrpc/io.atcr.hold.uploadPart` - Direct buffered part upload (alternative to presigned URLs)
 - `POST /xrpc/io.atcr.hold.completeUpload` - Finalize multipart upload
 - `POST /xrpc/io.atcr.hold.abortUpload` - Cancel multipart upload
 - `POST /xrpc/io.atcr.hold.notifyManifest` - Notify hold of manifest upload (creates layer records, Bluesky posts)
···
 HOLD_ALLOW_ALL_CREW=false   # Only you can push
 HOLD_DATABASE_DIR=/var/lib/atcr-hold
 
-# S3 storage
-STORAGE_DRIVER=s3
+# S3 storage (using Storj)
 AWS_ACCESS_KEY_ID=your-key
 AWS_SECRET_ACCESS_KEY=your-secret
 S3_BUCKET=alice-container-registry
-S3_ENDPOINT=https://gateway.storjshare.io  # Using Storj
+S3_ENDPOINT=https://gateway.storjshare.io
 ```
 
 ### Shared Hold (Team/Organization)
···
 HOLD_DATABASE_DIR=/var/lib/atcr-hold
 
 # S3 storage
-STORAGE_DRIVER=s3
 AWS_ACCESS_KEY_ID=your-key
 AWS_SECRET_ACCESS_KEY=your-secret
 S3_BUCKET=acme-registry-blobs
···
 HOLD_DATABASE_DIR=/var/lib/atcr-hold
 
 # S3 storage
-STORAGE_DRIVER=s3
 AWS_ACCESS_KEY_ID=your-key
 AWS_SECRET_ACCESS_KEY=your-secret
 S3_BUCKET=community-registry-blobs
 ```
 
-### Development/Testing
+### Development/Testing with Minio
 
-Local filesystem storage for testing:
+For local development, use Minio as an S3-compatible storage:
 
 ```bash
+# Start Minio
+docker run -p 9000:9000 -p 9001:9001 minio/minio server /data --console-address ":9001"
+
 # Hold config
 HOLD_PUBLIC_URL=http://127.0.0.1:8080
 HOLD_OWNER=did:plc:your-test-did
···
 HOLD_ALLOW_ALL_CREW=true
 HOLD_DATABASE_DIR=/tmp/atcr-hold
 
-# Filesystem storage
-STORAGE_DRIVER=filesystem
-STORAGE_ROOT_DIR=/tmp/atcr-hold-blobs
+# Minio S3 storage
+AWS_ACCESS_KEY_ID=minioadmin
+AWS_SECRET_ACCESS_KEY=minioadmin
+S3_BUCKET=test
+S3_ENDPOINT=http://localhost:9000
 ```
 
 ## Production Deployment
···
 
 - [ ] Set `HOLD_PUBLIC_URL` to your public HTTPS URL
 - [ ] Set `HOLD_OWNER` to your ATProto DID
-- [ ] Configure S3 storage (`STORAGE_DRIVER=s3`)
 - [ ] Set `AWS_ACCESS_KEY_ID`, `AWS_SECRET_ACCESS_KEY`, `S3_BUCKET`, `S3_ENDPOINT`
 - [ ] Set `HOLD_DATABASE_DIR` to persistent directory
 - [ ] Configure `HOLD_PUBLIC` and `HOLD_ALLOW_ALL_CREW` for desired access model

pkg/appview/storage/proxy_blob_store.go

···
 	return result.UploadID, nil
 }
 
-// PartUploadInfo contains structured information for uploading a part
+// PartUploadInfo contains the presigned URL for uploading a part
 type PartUploadInfo struct {
-	URL     string            `json:"url"`
-	Method  string            `json:"method,omitempty"`
-	Headers map[string]string `json:"headers,omitempty"`
+	URL string `json:"url"` // Presigned URL to PUT the part to
 }
 
 // getPartUploadInfo gets structured upload info for uploading a specific part via XRPC
···
 		return fmt.Errorf("failed to get part upload info: %w", err)
 	}
 
-	// Determine HTTP method (default to PUT)
-	method := uploadInfo.Method
-	if method == "" {
-		method = "PUT"
-	}
-
-	// Upload part (either to S3 presigned URL or back to XRPC with headers)
-	req, err := http.NewRequestWithContext(ctx, method, uploadInfo.URL, bytes.NewReader(w.buffer.Bytes()))
+	// Upload part to S3 presigned URL
+	req, err := http.NewRequestWithContext(ctx, "PUT", uploadInfo.URL, bytes.NewReader(w.buffer.Bytes()))
 	if err != nil {
 		return err
 	}
 	req.Header.Set("Content-Type", "application/octet-stream")
-
-	// Apply any additional headers from the response (for buffered mode)
-	for key, value := range uploadInfo.Headers {
-		req.Header.Set(key, value)
-	}
 
 	resp, err := w.store.httpClient.Do(req)
 	if err != nil {

pkg/appview/storage/proxy_blob_store_test.go

···
 package storage
 
 import (
+	"bytes"
 	"context"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
+	"io"
 	"net/http"
 	"net/http/httptest"
+	"strconv"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
 	"atcr.io/pkg/atproto"
 	"atcr.io/pkg/auth"
+	"github.com/distribution/distribution/v3"
 	"github.com/opencontainers/go-digest"
 )
 
···
 	// Verify S3 received NO Authorization header
 	if s3ReceivedAuthHeader != "" {
 		t.Errorf("S3 should not receive Authorization header for presigned URLs, got: %s", s3ReceivedAuthHeader)
+	}
+}
+
+// ============================================================================
+// ProxyBlobWriter Tests
+// ============================================================================
+
+// mockHoldServer is a test helper that mocks the hold service XRPC endpoints
+type mockHoldServer struct {
+	*httptest.Server
+
+	// Track calls
+	mu            sync.Mutex
+	InitiateCalls []mockInitiateCall
+	PartURLCalls  []mockPartURLCall
+	CompleteCalls []mockCompleteCall
+	AbortCalls    []mockAbortCall
+
+	// Error injection
+	InitiateError error
+	PartURLError  error
+	CompleteError error
+	AbortError    error
+
+	// Response customization
+	UploadID string
+}
+
+type mockInitiateCall struct {
+	Digest string
+}
+
+type mockPartURLCall struct {
+	UploadID   string
+	PartNumber int
+}
+
+type mockCompleteCall struct {
+	UploadID string
+	Digest   string
+	Parts    []map[string]any
+}
+
+type mockAbortCall struct {
+	UploadID string
+}
+
+// mockS3Server mocks S3 presigned URL uploads
+type mockS3Server struct {
+	*httptest.Server
+
+	// Track uploads
+	mu    sync.Mutex
+	Parts map[int][]byte
+
+	// Error injection
+	UploadError error
+
+	// Response customization
+	ETagInHeader bool // true = ETag in header, false = in JSON body
+}
+
+// newMockHoldServer creates a mock hold service
+func newMockHoldServer(t *testing.T, s3URL string) *mockHoldServer {
+	m := &mockHoldServer{
+		UploadID: "test-upload-id-" + fmt.Sprintf("%d", time.Now().UnixNano()),
+	}
+
+	m.Server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		m.mu.Lock()
+		defer m.mu.Unlock()
+
+		w.Header().Set("Content-Type", "application/json")
+
+		switch {
+		case strings.Contains(r.URL.Path, atproto.HoldInitiateUpload):
+			if m.InitiateError != nil {
+				w.WriteHeader(http.StatusInternalServerError)
+				fmt.Fprintf(w, `{"error":"%s"}`, m.InitiateError.Error())
+				return
+			}
+
+			var body map[string]any
+			json.NewDecoder(r.Body).Decode(&body)
+			m.InitiateCalls = append(m.InitiateCalls, mockInitiateCall{
+				Digest: body["digest"].(string),
+			})
+
+			w.WriteHeader(http.StatusOK)
+			json.NewEncoder(w).Encode(map[string]string{
+				"uploadId": m.UploadID,
+			})
+
+		case strings.Contains(r.URL.Path, atproto.HoldGetPartUploadURL):
+			if m.PartURLError != nil {
+				w.WriteHeader(http.StatusInternalServerError)
+				fmt.Fprintf(w, `{"error":"%s"}`, m.PartURLError.Error())
+				return
+			}
+
+			var body map[string]any
+			json.NewDecoder(r.Body).Decode(&body)
+			m.PartURLCalls = append(m.PartURLCalls, mockPartURLCall{
+				UploadID:   body["uploadId"].(string),
+				PartNumber: int(body["partNumber"].(float64)),
+			})
+
+			// Return presigned URL pointing to mock S3
+			partNum := int(body["partNumber"].(float64))
+			w.WriteHeader(http.StatusOK)
+			json.NewEncoder(w).Encode(map[string]string{
+				"url": fmt.Sprintf("%s/upload?partNumber=%d", s3URL, partNum),
+			})
+
+		case strings.Contains(r.URL.Path, atproto.HoldCompleteUpload):
+			if m.CompleteError != nil {
+				w.WriteHeader(http.StatusInternalServerError)
+				fmt.Fprintf(w, `{"error":"%s"}`, m.CompleteError.Error())
+				return
+			}
+
+			var body map[string]any
+			json.NewDecoder(r.Body).Decode(&body)
+			parts, _ := body["parts"].([]any)
+			partsArr := make([]map[string]any, len(parts))
+			for i, p := range parts {
+				partsArr[i] = p.(map[string]any)
+			}
+			m.CompleteCalls = append(m.CompleteCalls, mockCompleteCall{
+				UploadID: body["uploadId"].(string),
+				Digest:   body["digest"].(string),
+				Parts:    partsArr,
+			})
+
+			w.WriteHeader(http.StatusOK)
+			json.NewEncoder(w).Encode(map[string]any{})
+
+		case strings.Contains(r.URL.Path, atproto.HoldAbortUpload):
+			if m.AbortError != nil {
+				w.WriteHeader(http.StatusInternalServerError)
+				fmt.Fprintf(w, `{"error":"%s"}`, m.AbortError.Error())
+				return
+			}
+
+			var body map[string]any
+			json.NewDecoder(r.Body).Decode(&body)
+			m.AbortCalls = append(m.AbortCalls, mockAbortCall{
+				UploadID: body["uploadId"].(string),
+			})
+
+			w.WriteHeader(http.StatusOK)
+			json.NewEncoder(w).Encode(map[string]any{})
+
+		default:
+			t.Errorf("Unexpected hold endpoint: %s", r.URL.Path)
+			w.WriteHeader(http.StatusNotFound)
+		}
+	}))
+
+	return m
+}
+
+// newMockS3Server creates a mock S3 server for presigned URL uploads
+func newMockS3Server(t *testing.T, etagInHeader bool) *mockS3Server {
+	m := &mockS3Server{
+		Parts:        make(map[int][]byte),
+		ETagInHeader: etagInHeader,
+	}
+
+	m.Server = httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		m.mu.Lock()
+		defer m.mu.Unlock()
+
+		if m.UploadError != nil {
+			w.WriteHeader(http.StatusInternalServerError)
+			w.Write([]byte(m.UploadError.Error()))
+			return
+		}
+
+		// Parse part number from URL
+		partNum, _ := strconv.Atoi(r.URL.Query().Get("partNumber"))
+
+		// Read body
+		body, _ := io.ReadAll(r.Body)
+		m.Parts[partNum] = body
+
+		// Generate ETag
+		etag := fmt.Sprintf(`"etag-part-%d"`, partNum)
+
+		if m.ETagInHeader {
+			w.Header().Set("ETag", etag)
+			w.WriteHeader(http.StatusOK)
+		} else {
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusOK)
+			json.NewEncoder(w).Encode(map[string]string{
+				"etag": etag,
+			})
+		}
+	}))
+
+	return m
+}
+
+// createTestProxyBlobStore creates a ProxyBlobStore for testing with mock servers
+func createTestProxyBlobStore(t *testing.T, holdURL string) *ProxyBlobStore {
+	ctx := &RegistryContext{
+		DID:          "did:plc:testuser",
+		HoldDID:      "did:web:hold.example.com",
+		PDSEndpoint:  "https://pds.example.com",
+		Repository:   "test-repo",
+		ServiceToken: "test-service-token",
+	}
+	store := NewProxyBlobStore(ctx)
+	store.holdURL = holdURL
+	return store
+}
+
+// generateTestData creates n bytes of predictable test data
+func generateTestData(n int) []byte {
+	data := make([]byte, n)
+	for i := 0; i < n; i++ {
+		data[i] = byte(i % 256)
+	}
+	return data
+}
+
+// TestCreate_Success tests that Create() successfully initiates multipart upload
+func TestCreate_Success(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+
+	// Verify writer is returned
+	if writer == nil {
+		t.Fatal("Expected non-nil writer")
+	}
+
+	// Verify initiate was called
+	holdServer.mu.Lock()
+	if len(holdServer.InitiateCalls) != 1 {
+		t.Errorf("Expected 1 initiate call, got %d", len(holdServer.InitiateCalls))
+	}
+	holdServer.mu.Unlock()
+
+	// Verify writer ID
+	if writer.ID() == "" {
+		t.Error("Expected non-empty writer ID")
+	}
+
+	// Verify writer is stored in global uploads
+	globalUploadsMu.RLock()
+	_, exists := globalUploads[writer.ID()]
+	globalUploadsMu.RUnlock()
+	if !exists {
+		t.Error("Writer should be stored in globalUploads")
+	}
+
+	// Cleanup
+	writer.Cancel(context.Background())
+}
+
+// TestCreate_HoldError tests that Create() returns error when hold service fails
+func TestCreate_HoldError(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	holdServer.InitiateError = fmt.Errorf("hold service unavailable")
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err == nil {
+		t.Fatal("Expected error from Create()")
+	}
+	if writer != nil {
+		t.Error("Expected nil writer when error occurs")
+	}
+
+	if !strings.Contains(err.Error(), "hold service unavailable") {
+		t.Errorf("Expected hold error message, got: %v", err)
+	}
+}
+
+// TestWrite_BasicBuffer tests that small writes are buffered
+func TestWrite_BasicBuffer(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+	defer writer.Cancel(context.Background())
+
+	// Write small data (1MB - well under 10MB threshold)
+	data := generateTestData(1 * 1024 * 1024)
+	n, err := writer.Write(data)
+	if err != nil {
+		t.Fatalf("Write() failed: %v", err)
+	}
+
+	if n != len(data) {
+		t.Errorf("Expected to write %d bytes, wrote %d", len(data), n)
+	}
+
+	// Verify size is tracked
+	if writer.Size() != int64(len(data)) {
+		t.Errorf("Expected size %d, got %d", len(data), writer.Size())
+	}
+
+	// Verify NO flush occurred (no part uploads to S3)
+	s3Server.mu.Lock()
+	partCount := len(s3Server.Parts)
+	s3Server.mu.Unlock()
+
+	if partCount != 0 {
+		t.Errorf("Expected 0 parts uploaded (data should be buffered), got %d", partCount)
+	}
+}
+
+// TestWrite_TriggerFlush tests that writing 10MB triggers flush
+func TestWrite_TriggerFlush(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+	defer writer.Cancel(context.Background())
+
+	// Write exactly 10MB (the threshold)
+	data := generateTestData(10 * 1024 * 1024)
+	_, err = writer.Write(data)
+	if err != nil {
+		t.Fatalf("Write() failed: %v", err)
+	}
+
+	// Verify flush occurred (1 part uploaded)
+	s3Server.mu.Lock()
+	partCount := len(s3Server.Parts)
+	uploadedData := s3Server.Parts[1]
+	s3Server.mu.Unlock()
+
+	if partCount != 1 {
+		t.Errorf("Expected 1 part uploaded after 10MB write, got %d", partCount)
+	}
+
+	if len(uploadedData) != 10*1024*1024 {
+		t.Errorf("Expected uploaded part to be 10MB, got %d", len(uploadedData))
+	}
+}
+
+// TestWrite_MultipleFlushes tests that writing 25MB triggers 2 flushes
+func TestWrite_MultipleFlushes(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+	defer writer.Cancel(context.Background())
+
+	// Write 25MB in chunks (simulating Docker layer upload)
+	totalSize := 25 * 1024 * 1024
+	chunkSize := 64 * 1024 // 64KB chunks
+	data := generateTestData(chunkSize)
+
+	for written := 0; written < totalSize; written += chunkSize {
+		_, err = writer.Write(data)
+		if err != nil {
+			t.Fatalf("Write() failed at byte %d: %v", written, err)
+		}
+	}
+
+	// Verify 2 flushes occurred (10MB + 10MB), 5MB remains in buffer
+	s3Server.mu.Lock()
+	partCount := len(s3Server.Parts)
+	s3Server.mu.Unlock()
+
+	if partCount != 2 {
+		t.Errorf("Expected 2 parts uploaded after 25MB write, got %d", partCount)
+	}
+
+	// Verify size tracking
+	if writer.Size() != int64(totalSize) {
+		t.Errorf("Expected size %d, got %d", totalSize, writer.Size())
+	}
+
+	// Verify part URL calls
+	holdServer.mu.Lock()
+	partURLCount := len(holdServer.PartURLCalls)
+	holdServer.mu.Unlock()
+
+	if partURLCount != 2 {
+		t.Errorf("Expected 2 part URL calls, got %d", partURLCount)
+	}
+}
+
+// TestWrite_ClosedWriter tests that Write() fails on closed writer
+func TestWrite_ClosedWriter(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+
+	// Close the writer
+	writer.Cancel(context.Background())
+
+	// Try to write
+	data := generateTestData(1024)
+	_, err = writer.Write(data)
+	if err == nil {
+		t.Fatal("Expected error writing to closed writer")
+	}
+
+	if !strings.Contains(err.Error(), "closed") {
+		t.Errorf("Expected 'closed' error, got: %v", err)
+	}
+}
+
+// TestFlushPart_Success tests successful part upload with ETag in header
+func TestFlushPart_Success(t *testing.T) {
+	s3Server := newMockS3Server(t, true) // ETag in header
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+	defer writer.Cancel(context.Background())
+
+	// Write enough to trigger flush
+	data := generateTestData(10 * 1024 * 1024)
+	_, err = writer.Write(data)
+	if err != nil {
+		t.Fatalf("Write() failed: %v", err)
+	}
+
+	// Get the internal writer to check parts
+	pbw := writer.(*ProxyBlobWriter)
+	if len(pbw.parts) != 1 {
+		t.Errorf("Expected 1 part recorded, got %d", len(pbw.parts))
+	}
+
+	if pbw.parts[0].PartNumber != 1 {
+		t.Errorf("Expected part number 1, got %d", pbw.parts[0].PartNumber)
+	}
+
+	if pbw.parts[0].ETag != `"etag-part-1"` {
+		t.Errorf("Expected ETag '\"etag-part-1\"', got %s", pbw.parts[0].ETag)
+	}
+}
+
+// TestFlushPart_ETagInJSON tests successful part upload with ETag in JSON body
+func TestFlushPart_ETagInJSON(t *testing.T) {
+	s3Server := newMockS3Server(t, false) // ETag in JSON body
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+	defer writer.Cancel(context.Background())
+
+	// Write enough to trigger flush
+	data := generateTestData(10 * 1024 * 1024)
+	_, err = writer.Write(data)
+	if err != nil {
+		t.Fatalf("Write() failed: %v", err)
+	}
+
+	// Verify part was recorded with ETag from JSON
+	pbw := writer.(*ProxyBlobWriter)
+	if len(pbw.parts) != 1 {
+		t.Errorf("Expected 1 part recorded, got %d", len(pbw.parts))
+	}
+
+	if pbw.parts[0].ETag != `"etag-part-1"` {
+		t.Errorf("Expected ETag '\"etag-part-1\"', got %s", pbw.parts[0].ETag)
+	}
+}
+
+// TestFlushPart_HoldError tests that flushPart returns error when hold fails
+func TestFlushPart_HoldError(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	holdServer.PartURLError = fmt.Errorf("hold service error")
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+	defer writer.Cancel(context.Background())
+
+	// Write enough to trigger flush
+	data := generateTestData(10 * 1024 * 1024)
+	_, err = writer.Write(data)
+
+	if err == nil {
+		t.Fatal("Expected error when hold service fails")
+	}
+
+	if !strings.Contains(err.Error(), "failed to get part upload info") {
+		t.Errorf("Expected part upload info error, got: %v", err)
+	}
+}
+
+// TestFlushPart_S3Error tests that flushPart returns error when S3 fails
+func TestFlushPart_S3Error(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	s3Server.UploadError = fmt.Errorf("S3 unavailable")
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+	defer writer.Cancel(context.Background())
+
+	// Write enough to trigger flush
+	data := generateTestData(10 * 1024 * 1024)
+	_, err = writer.Write(data)
+
+	if err == nil {
+		t.Fatal("Expected error when S3 fails")
+	}
+
+	if !strings.Contains(err.Error(), "part upload failed") {
+		t.Errorf("Expected part upload failed error, got: %v", err)
+	}
+}
+
+// TestFlushPart_NoETag tests that flushPart returns error when no ETag is returned
+func TestFlushPart_NoETag(t *testing.T) {
+	// Create a custom S3 server that returns no ETag
+	s3Server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		// Return 200 OK but no ETag anywhere
+		w.WriteHeader(http.StatusOK)
+		w.Write([]byte(`{}`))
+	}))
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+	defer writer.Cancel(context.Background())
+
+	// Write enough to trigger flush
+	data := generateTestData(10 * 1024 * 1024)
+	_, err = writer.Write(data)
+
+	if err == nil {
+		t.Fatal("Expected error when no ETag is returned")
+	}
+
+	if !strings.Contains(err.Error(), "no ETag") {
+		t.Errorf("Expected no ETag error, got: %v", err)
+	}
+}
+
+// TestReadFrom_SmallFile tests ReadFrom with data under flush threshold
+func TestReadFrom_SmallFile(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+	defer writer.Cancel(context.Background())
+
+	// Stream 1MB through ReadFrom
+	data := generateTestData(1 * 1024 * 1024)
+	reader := bytes.NewReader(data)
+
+	n, err := writer.ReadFrom(reader)
+	if err != nil {
+		t.Fatalf("ReadFrom() failed: %v", err)
+	}
+
+	if n != int64(len(data)) {
+		t.Errorf("Expected to read %d bytes, got %d", len(data), n)
+	}
+
+	// Verify no flush occurred
+	s3Server.mu.Lock()
+	partCount := len(s3Server.Parts)
+	s3Server.mu.Unlock()
+
+	if partCount != 0 {
+		t.Errorf("Expected 0 parts (data buffered), got %d", partCount)
+	}
+}
+
+// TestReadFrom_LargeFile tests ReadFrom with multiple flushes
+func TestReadFrom_LargeFile(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+	defer writer.Cancel(context.Background())
+
+	// Stream 25MB through ReadFrom
+	data := generateTestData(25 * 1024 * 1024)
+	reader := bytes.NewReader(data)
+
+	n, err := writer.ReadFrom(reader)
+	if err != nil {
+		t.Fatalf("ReadFrom() failed: %v", err)
+	}
+
+	if n != int64(len(data)) {
+		t.Errorf("Expected to read %d bytes, got %d", len(data), n)
+	}
+
+	// Verify 2 flushes occurred
+	s3Server.mu.Lock()
+	partCount := len(s3Server.Parts)
+	s3Server.mu.Unlock()
+
+	if partCount != 2 {
+		t.Errorf("Expected 2 parts (2x 10MB), got %d", partCount)
+	}
+}
+
+// TestReadFrom_ClosedWriter tests that ReadFrom fails on closed writer
+func TestReadFrom_ClosedWriter(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+
+	// Close the writer
+	writer.Cancel(context.Background())
+
+	// Try to ReadFrom
+	data := generateTestData(1024)
+	reader := bytes.NewReader(data)
+
+	_, err = writer.ReadFrom(reader)
+	if err == nil {
+		t.Fatal("Expected error reading to closed writer")
+	}
+
+	if !strings.Contains(err.Error(), "closed") {
+		t.Errorf("Expected 'closed' error, got: %v", err)
+	}
+}
+
+// TestCommit_Success tests successful commit
+func TestCommit_Success(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+
+	// Write some data
+	data := generateTestData(5 * 1024 * 1024)
+	_, err = writer.Write(data)
+	if err != nil {
+		t.Fatalf("Write() failed: %v", err)
+	}
+
+	// Commit
+	dgst := digest.FromBytes(data)
+	desc, err := writer.Commit(context.Background(), distribution.Descriptor{
+		Digest:    dgst,
+		Size:      int64(len(data)),
+		MediaType: "application/octet-stream",
+	})
+	if err != nil {
+		t.Fatalf("Commit() failed: %v", err)
+	}
+
+	// Verify descriptor
+	if desc.Digest != dgst {
+		t.Errorf("Expected digest %s, got %s", dgst, desc.Digest)
+	}
+
+	if desc.Size != int64(len(data)) {
+		t.Errorf("Expected size %d, got %d", len(data), desc.Size)
+	}
+
+	// Verify complete was called
+	holdServer.mu.Lock()
+	completeCount := len(holdServer.CompleteCalls)
+	holdServer.mu.Unlock()
+
+	if completeCount != 1 {
+		t.Errorf("Expected 1 complete call, got %d", completeCount)
+	}
+
+	// Verify writer removed from global uploads
+	globalUploadsMu.RLock()
+	_, exists := globalUploads[writer.ID()]
+	globalUploadsMu.RUnlock()
+	if exists {
+		t.Error("Writer should be removed from globalUploads after commit")
+	}
+}
+
+// TestCommit_WithRemainingBuffer tests commit with data in buffer
+func TestCommit_WithRemainingBuffer(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+
+	// Write 15MB in chunks (simulating realistic upload)
+	// This ensures: 1 flush at 10MB threshold + 5MB remaining in buffer
+	totalSize := 15 * 1024 * 1024
+	chunkSize := 64 * 1024 // 64KB chunks
+	chunk := generateTestData(chunkSize)
+
+	allData := make([]byte, 0, totalSize)
+	for written := 0; written < totalSize; written += chunkSize {
+		_, err = writer.Write(chunk)
+		if err != nil {
+			t.Fatalf("Write() failed: %v", err)
+		}
+		allData = append(allData, chunk...)
+	}
+
+	// At this point, 1 part should be uploaded (10MB), 5MB in buffer
+	s3Server.mu.Lock()
+	partsBeforeCommit := len(s3Server.Parts)
+	s3Server.mu.Unlock()
+
+	if partsBeforeCommit != 1 {
+		t.Errorf("Expected 1 part before commit, got %d", partsBeforeCommit)
+	}
+
+	// Commit
+	dgst := digest.FromBytes(allData)
+	_, err = writer.Commit(context.Background(), distribution.Descriptor{
+		Digest:    dgst,
+		Size:      int64(totalSize),
+		MediaType: "application/octet-stream",
+	})
+	if err != nil {
+		t.Fatalf("Commit() failed: %v", err)
+	}
+
+	// Verify final flush happened (now 2 parts)
+	s3Server.mu.Lock()
+	partsAfterCommit := len(s3Server.Parts)
+	s3Server.mu.Unlock()
+
+	if partsAfterCommit != 2 {
+		t.Errorf("Expected 2 parts after commit, got %d", partsAfterCommit)
+	}
+
+	// Verify complete was called with 2 parts
+	holdServer.mu.Lock()
+	if len(holdServer.CompleteCalls) != 1 {
+		t.Fatalf("Expected 1 complete call, got %d", len(holdServer.CompleteCalls))
+	}
+	completedParts := len(holdServer.CompleteCalls[0].Parts)
+	holdServer.mu.Unlock()
+
+	if completedParts != 2 {
+		t.Errorf("Expected complete to have 2 parts, got %d", completedParts)
+	}
+}
+
+// TestCommit_FlushError tests that commit handles flush error
+func TestCommit_FlushError(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+
+	// Write some data
+	data := generateTestData(5 * 1024 * 1024)
+	_, err = writer.Write(data)
+	if err != nil {
+		t.Fatalf("Write() failed: %v", err)
+	}
+
+	// Inject error for final flush
+	holdServer.mu.Lock()
+	holdServer.PartURLError = fmt.Errorf("flush error")
+	holdServer.mu.Unlock()
+
+	// Commit should fail
+	dgst := digest.FromBytes(data)
+	_, err = writer.Commit(context.Background(), distribution.Descriptor{
+		Digest: dgst,
+		Size:   int64(len(data)),
+	})
+
+	if err == nil {
+		t.Fatal("Expected error from Commit() when flush fails")
+	}
+
+	if !strings.Contains(err.Error(), "failed to flush final part") {
+		t.Errorf("Expected flush error, got: %v", err)
+	}
+
+	// Verify abort was called
+	holdServer.mu.Lock()
+	abortCount := len(holdServer.AbortCalls)
+	holdServer.mu.Unlock()
+
+	if abortCount != 1 {
+		t.Errorf("Expected 1 abort call after flush error, got %d", abortCount)
+	}
+}
+
+// TestCommit_CompleteError tests that commit handles complete error
+func TestCommit_CompleteError(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	holdServer.CompleteError = fmt.Errorf("complete failed")
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+
+	// Write some data
+	data := generateTestData(1 * 1024 * 1024)
+	_, err = writer.Write(data)
+	if err != nil {
+		t.Fatalf("Write() failed: %v", err)
+	}
+
+	// Commit should fail
+	dgst := digest.FromBytes(data)
+	_, err = writer.Commit(context.Background(), distribution.Descriptor{
+		Digest: dgst,
+		Size:   int64(len(data)),
+	})
+
+	if err == nil {
+		t.Fatal("Expected error from Commit() when complete fails")
+	}
+
+	if !strings.Contains(err.Error(), "failed to complete multipart upload") {
+		t.Errorf("Expected complete error, got: %v", err)
+	}
+}
+
+// TestCommit_ClosedWriter tests that Commit() fails on closed writer
+func TestCommit_ClosedWriter(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+
+	// Close the writer
+	writer.Cancel(context.Background())
+
+	// Try to commit
+	dgst := digest.FromString("test")
+	_, err = writer.Commit(context.Background(), distribution.Descriptor{
+		Digest: dgst,
+		Size:   4,
+	})
+
+	if err == nil {
+		t.Fatal("Expected error committing closed writer")
+	}
+
+	if !strings.Contains(err.Error(), "closed") {
+		t.Errorf("Expected 'closed' error, got: %v", err)
+	}
+}
+
+// TestCancel_Success tests successful cancel
+func TestCancel_Success(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+
+	writerID := writer.ID()
+
+	// Cancel
+	err = writer.Cancel(context.Background())
+	if err != nil {
+		t.Fatalf("Cancel() failed: %v", err)
+	}
+
+	// Verify abort was called
+	holdServer.mu.Lock()
+	abortCount := len(holdServer.AbortCalls)
+	holdServer.mu.Unlock()
+
+	if abortCount != 1 {
+		t.Errorf("Expected 1 abort call, got %d", abortCount)
+	}
+
+	// Verify removed from global uploads
+	globalUploadsMu.RLock()
+	_, exists := globalUploads[writerID]
+	globalUploadsMu.RUnlock()
+
+	if exists {
+		t.Error("Writer should be removed from globalUploads after cancel")
+	}
+}
+
+// TestCancel_AbortError tests that Cancel() still succeeds when abort fails
+func TestCancel_AbortError(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	holdServer.AbortError = fmt.Errorf("abort failed")
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+
+	writerID := writer.ID()
+
+	// Cancel should still return nil (graceful)
+	err = writer.Cancel(context.Background())
+	if err != nil {
+		t.Errorf("Cancel() should return nil even when abort fails, got: %v", err)
+	}
+
+	// Verify still removed from global uploads
+	globalUploadsMu.RLock()
+	_, exists := globalUploads[writerID]
+	globalUploadsMu.RUnlock()
+
+	if exists {
+		t.Error("Writer should be removed from globalUploads even when abort fails")
+	}
+}
+
+// TestCancel_AlreadyClosed tests that Cancel() is idempotent
+func TestCancel_AlreadyClosed(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+
+	// Cancel twice
+	err1 := writer.Cancel(context.Background())
+	err2 := writer.Cancel(context.Background())
+
+	if err1 != nil || err2 != nil {
+		t.Errorf("Cancel() should be idempotent, got err1=%v, err2=%v", err1, err2)
+	}
+}
+
+// TestResume_Success tests successful resume
+func TestResume_Success(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+	defer writer.Cancel(context.Background())
+
+	writerID := writer.ID()
+
+	// Write some data
+	data := generateTestData(1024)
+	_, err = writer.Write(data)
+	if err != nil {
+		t.Fatalf("Write() failed: %v", err)
+	}
+
+	// Resume should return the same writer
+	resumedWriter, err := store.Resume(context.Background(), writerID)
+	if err != nil {
+		t.Fatalf("Resume() failed: %v", err)
+	}
+
+	// Should be the same writer instance
+	if resumedWriter.ID() != writerID {
+		t.Errorf("Expected same writer ID, got %s", resumedWriter.ID())
+	}
+
+	// Size should be preserved
+	if resumedWriter.Size() != int64(len(data)) {
+		t.Errorf("Expected size %d, got %d", len(data), resumedWriter.Size())
+	}
+}
+
+// TestResume_NotFound tests that Resume() returns error for unknown ID
+func TestResume_NotFound(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	// Try to resume non-existent upload
+	_, err := store.Resume(context.Background(), "non-existent-upload-id")
+	if err == nil {
+		t.Fatal("Expected error for non-existent upload")
+	}
+
+	if err != distribution.ErrBlobUploadUnknown {
+		t.Errorf("Expected ErrBlobUploadUnknown, got: %v", err)
+	}
+}
+
+// TestFullUploadFlow_25MB tests the complete upload flow with a 25MB file
+func TestFullUploadFlow_25MB(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	// Create writer
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+
+	// Write 25MB in chunks (simulating Docker layer upload)
+	totalSize := 25 * 1024 * 1024
+	chunkSize := 64 * 1024 // 64KB chunks (realistic for Docker)
+	allData := generateTestData(totalSize)
+
+	for i := 0; i < totalSize; i += chunkSize {
+		end := i + chunkSize
+		if end > totalSize {
+			end = totalSize
+		}
+		_, err = writer.Write(allData[i:end])
+		if err != nil {
+			t.Fatalf("Write() failed at byte %d: %v", i, err)
+		}
+	}
+
+	// Verify 2 parts uploaded during write (10MB + 10MB)
+	s3Server.mu.Lock()
+	partsBeforeCommit := len(s3Server.Parts)
+	s3Server.mu.Unlock()
+	if partsBeforeCommit != 2 {
+		t.Errorf("Expected 2 parts before commit, got %d", partsBeforeCommit)
+	}
+
+	// Commit
+	dgst := digest.FromBytes(allData)
+	desc, err := writer.Commit(context.Background(), distribution.Descriptor{
+		Digest:    dgst,
+		Size:      int64(totalSize),
+		MediaType: "application/vnd.oci.image.layer.v1.tar+gzip",
+	})
+	if err != nil {
+		t.Fatalf("Commit() failed: %v", err)
+	}
+
+	// Verify 3 total parts (10MB + 10MB + 5MB final)
+	s3Server.mu.Lock()
+	partsAfterCommit := len(s3Server.Parts)
+	s3Server.mu.Unlock()
+	if partsAfterCommit != 3 {
+		t.Errorf("Expected 3 parts after commit, got %d", partsAfterCommit)
+	}
+
+	// Verify complete was called with correct parts
+	holdServer.mu.Lock()
+	if len(holdServer.CompleteCalls) != 1 {
+		t.Fatalf("Expected 1 complete call, got %d", len(holdServer.CompleteCalls))
+	}
+	completeCall := holdServer.CompleteCalls[0]
+	holdServer.mu.Unlock()
+
+	if len(completeCall.Parts) != 3 {
+		t.Errorf("Expected 3 parts in complete call, got %d", len(completeCall.Parts))
+	}
+
+	if completeCall.Digest != dgst.String() {
+		t.Errorf("Expected digest %s, got %s", dgst.String(), completeCall.Digest)
+	}
+
+	// Verify descriptor
+	if desc.Size != int64(totalSize) {
+		t.Errorf("Expected descriptor size %d, got %d", totalSize, desc.Size)
+	}
+
+	// Verify data integrity - check each part has correct size
+	s3Server.mu.Lock()
+	part1Size := len(s3Server.Parts[1])
+	part2Size := len(s3Server.Parts[2])
+	part3Size := len(s3Server.Parts[3])
+	s3Server.mu.Unlock()
+
+	expectedPart1 := 10 * 1024 * 1024
+	expectedPart2 := 10 * 1024 * 1024
+	expectedPart3 := 5 * 1024 * 1024
+
+	if part1Size != expectedPart1 {
+		t.Errorf("Part 1 expected %d bytes, got %d", expectedPart1, part1Size)
+	}
+	if part2Size != expectedPart2 {
+		t.Errorf("Part 2 expected %d bytes, got %d", expectedPart2, part2Size)
+	}
+	if part3Size != expectedPart3 {
+		t.Errorf("Part 3 expected %d bytes, got %d", expectedPart3, part3Size)
+	}
+}
+
+// TestProxyBlobWriter_ID tests the ID() method
+func TestProxyBlobWriter_ID(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+	defer writer.Cancel(context.Background())
+
+	id := writer.ID()
+	if id == "" {
+		t.Error("Expected non-empty ID")
+	}
+
+	if !strings.HasPrefix(id, "upload-") {
+		t.Errorf("Expected ID to start with 'upload-', got %s", id)
+	}
+}
+
+// TestProxyBlobWriter_StartedAt tests the StartedAt() method
+func TestProxyBlobWriter_StartedAt(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	before := time.Now()
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+	after := time.Now()
+	defer writer.Cancel(context.Background())
+
+	startedAt := writer.StartedAt()
+	if startedAt.Before(before) || startedAt.After(after) {
+		t.Errorf("StartedAt() should be between %v and %v, got %v", before, after, startedAt)
+	}
+}
+
+// TestProxyBlobWriter_Size tests the Size() method
+func TestProxyBlobWriter_Size(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+	defer writer.Cancel(context.Background())
+
+	// Initial size should be 0
+	if writer.Size() != 0 {
+		t.Errorf("Expected initial size 0, got %d", writer.Size())
+	}
+
+	// Write 1KB
+	data := generateTestData(1024)
+	writer.Write(data)
+
+	if writer.Size() != 1024 {
+		t.Errorf("Expected size 1024 after write, got %d", writer.Size())
+	}
+
+	// Write another 2KB
+	data2 := generateTestData(2048)
+	writer.Write(data2)
+
+	if writer.Size() != 3072 {
+		t.Errorf("Expected size 3072 after second write, got %d", writer.Size())
+	}
+}
+
+// TestProxyBlobWriter_Close tests the Close() method
+func TestProxyBlobWriter_Close(t *testing.T) {
+	s3Server := newMockS3Server(t, true)
+	defer s3Server.Close()
+
+	holdServer := newMockHoldServer(t, s3Server.URL)
+	defer holdServer.Close()
+
+	store := createTestProxyBlobStore(t, holdServer.URL)
+
+	writer, err := store.Create(context.Background())
+	if err != nil {
+		t.Fatalf("Create() failed: %v", err)
+	}
+	defer writer.Cancel(context.Background())
+
+	// Close should not error
+	err = writer.Close()
+	if err != nil {
+		t.Errorf("Close() should not return error, got: %v", err)
+	}
+
+	// Close should NOT mark writer as closed (allows resume)
+	// Write should still work after Close
+	data := generateTestData(1024)
+	_, err = writer.Write(data)
+	if err != nil {
+		t.Errorf("Write() should work after Close(), got: %v", err)
 	}
 }
 

pkg/hold/config.go

···
 	// TestMode uses localhost for OAuth redirects while storing real URL in hold record (from env: TEST_MODE)
 	TestMode bool `yaml:"test_mode"`
 
-	// DisablePresignedURLs forces proxy mode even with S3 configured (for testing) (from env: DISABLE_PRESIGNED_URLS)
-	DisablePresignedURLs bool `yaml:"disable_presigned_urls"`
-
 	// RelayEndpoint is the ATProto relay URL to request crawl from on startup (from env: HOLD_RELAY_ENDPOINT)
 	// If empty, no crawl request is made. Default: https://bsky.network
 	RelayEndpoint string `yaml:"relay_endpoint"`
···
 	}
 	cfg.Server.Public = os.Getenv("HOLD_PUBLIC") == "true"
 	cfg.Server.TestMode = os.Getenv("TEST_MODE") == "true"
-	cfg.Server.DisablePresignedURLs = os.Getenv("DISABLE_PRESIGNED_URLS") == "true"
 	cfg.Server.RelayEndpoint = os.Getenv("HOLD_RELAY_ENDPOINT")
 	cfg.Server.ReadTimeout = 5 * time.Minute  // Increased for large blob uploads
 	cfg.Server.WriteTimeout = 5 * time.Minute // Increased for large blob uploads
···
 		cfg.Database.KeyPath = filepath.Join(cfg.Database.Path, "signing.key")
 	}
 
-	// Storage configuration - build from env vars based on storage type
-	storageType := getEnvOrDefault("STORAGE_DRIVER", "s3")
+	// Storage configuration - S3 is required (filesystem support removed)
 	var err error
-	cfg.Storage, err = buildStorageConfig(storageType)
+	cfg.Storage, err = buildStorageConfig()
 	if err != nil {
 		return nil, fmt.Errorf("failed to build storage config: %w", err)
 	}
···
 		cfg.Registration.Region = meta.Region
 		slog.Info("Detected cloud metadata", "region", meta.Region)
 	} else {
-		// Fall back to S3 region
-		if storageType == "s3" {
-			cfg.Registration.Region = getEnvOrDefault("AWS_REGION", "us-east-1")
-			slog.Info("Using S3 region", "region", cfg.Registration.Region)
-		}
+		// Fall back to S3 region (S3 is always used)
+		cfg.Registration.Region = getEnvOrDefault("AWS_REGION", "us-east-1")
+		slog.Info("Using S3 region", "region", cfg.Registration.Region)
 	}
 
 	return cfg, nil
 }
 
-// buildStorageConfig creates storage configuration based on driver type
-func buildStorageConfig(driver string) (StorageConfig, error) {
+// buildStorageConfig creates S3 storage configuration from environment variables
+// S3 is the only supported storage backend
+func buildStorageConfig() (StorageConfig, error) {
 	params := make(map[string]any)
 
-	switch driver {
-	case "s3":
-		// S3/Storj/Minio configuration from standard AWS env vars
-		accessKey := os.Getenv("AWS_ACCESS_KEY_ID")
-		secretKey := os.Getenv("AWS_SECRET_ACCESS_KEY")
-		region := getEnvOrDefault("AWS_REGION", "us-east-1")
-		bucket := os.Getenv("S3_BUCKET")
-		endpoint := os.Getenv("S3_ENDPOINT") // For Storj/Minio
+	// S3/Storj/Minio configuration from standard AWS env vars
+	accessKey := os.Getenv("AWS_ACCESS_KEY_ID")
+	secretKey := os.Getenv("AWS_SECRET_ACCESS_KEY")
+	region := getEnvOrDefault("AWS_REGION", "us-east-1")
+	bucket := os.Getenv("S3_BUCKET")
+	endpoint := os.Getenv("S3_ENDPOINT") // For Storj/Minio
 
-		if bucket == "" {
-			return StorageConfig{}, fmt.Errorf("S3_BUCKET is required for S3 storage")
-		}
-
-		params["accesskey"] = accessKey
-		params["secretkey"] = secretKey
-		params["region"] = region
-		params["bucket"] = bucket
-		if endpoint != "" {
-			params["regionendpoint"] = endpoint
-		}
-
-	case "filesystem":
-		// Filesystem configuration
-		rootDir := getEnvOrDefault("STORAGE_ROOT_DIR", "/var/lib/atcr/hold")
-		params["rootdirectory"] = rootDir
+	if bucket == "" {
+		return StorageConfig{}, fmt.Errorf("S3_BUCKET is required - S3 is the only supported storage backend")
+	}
 
-	default:
-		return StorageConfig{}, fmt.Errorf("unsupported storage driver: %s", driver)
+	params["accesskey"] = accessKey
+	params["secretkey"] = secretKey
+	params["region"] = region
+	params["bucket"] = bucket
+	if endpoint != "" {
+		params["regionendpoint"] = endpoint
 	}
 
 	// Build distribution Storage config
 	storageCfg := configuration.Storage{}
-	storageCfg[driver] = configuration.Parameters(params)
+	storageCfg["s3"] = configuration.Parameters(params)
 
 	return StorageConfig{Storage: storageCfg}, nil
 }

pkg/hold/config_test.go

···
 
 func TestLoadConfigFromEnv_Success(t *testing.T) {
 	cleanup := setupEnv(t, map[string]string{
-		"HOLD_PUBLIC_URL":     "https://hold.example.com",
-		"HOLD_SERVER_ADDR":    ":9000",
-		"HOLD_PUBLIC":         "true",
-		"TEST_MODE":           "true",
-		"HOLD_OWNER":          "did:plc:owner123",
-		"HOLD_ALLOW_ALL_CREW": "true",
-		"STORAGE_DRIVER":      "filesystem",
-		"STORAGE_ROOT_DIR":    "/tmp/test-storage",
-		"HOLD_DATABASE_DIR":   "/tmp/test-db",
-		"HOLD_KEY_PATH":       "/tmp/test-key.pem",
+		"HOLD_PUBLIC_URL":       "https://hold.example.com",
+		"HOLD_SERVER_ADDR":      ":9000",
+		"HOLD_PUBLIC":           "true",
+		"TEST_MODE":             "true",
+		"HOLD_OWNER":            "did:plc:owner123",
+		"HOLD_ALLOW_ALL_CREW":   "true",
+		"S3_BUCKET":             "test-bucket",
+		"AWS_ACCESS_KEY_ID":     "test-key",
+		"AWS_SECRET_ACCESS_KEY": "test-secret",
+		"HOLD_DATABASE_DIR":     "/tmp/test-db",
+		"HOLD_KEY_PATH":         "/tmp/test-key.pem",
 	})
 	defer cleanup()
 
···
 func TestLoadConfigFromEnv_MissingPublicURL(t *testing.T) {
 	cleanup := setupEnv(t, map[string]string{
 		"HOLD_PUBLIC_URL": "", // Missing required field
-		"STORAGE_DRIVER":  "filesystem",
+		"S3_BUCKET":       "test-bucket",
 	})
 	defer cleanup()
 
···
 	}
 }
 
-func TestLoadConfigFromEnv_Defaults(t *testing.T) {
+func TestLoadConfigFromEnv_MissingS3Bucket(t *testing.T) {
 	cleanup := setupEnv(t, map[string]string{
 		"HOLD_PUBLIC_URL": "https://hold.example.com",
-		"STORAGE_DRIVER":  "filesystem",
+		"S3_BUCKET":       "", // Missing required field
+	})
+	defer cleanup()
+
+	_, err := LoadConfigFromEnv()
+	if err == nil {
+		t.Error("Expected error for missing S3_BUCKET")
+	}
+}
+
+func TestLoadConfigFromEnv_Defaults(t *testing.T) {
+	cleanup := setupEnv(t, map[string]string{
+		"HOLD_PUBLIC_URL":       "https://hold.example.com",
+		"S3_BUCKET":             "test-bucket",
+		"AWS_ACCESS_KEY_ID":     "test-key",
+		"AWS_SECRET_ACCESS_KEY": "test-secret",
 		// Don't set optional vars - test defaults
 		"HOLD_SERVER_ADDR":    "",
 		"HOLD_PUBLIC":         "",
···
 		"HOLD_OWNER":          "",
 		"HOLD_ALLOW_ALL_CREW": "",
 		"AWS_REGION":          "",
-		"STORAGE_ROOT_DIR":    "",
 		"HOLD_DATABASE_DIR":   "",
 	})
 	defer cleanup()
···
 	if cfg.Server.TestMode {
 		t.Error("Expected default TestMode=false")
 	}
-	if cfg.Server.DisablePresignedURLs {
-		t.Error("Expected default DisablePresignedURLs=false")
-	}
 	if cfg.Registration.OwnerDID != "" {
 		t.Error("Expected default OwnerDID to be empty")
 	}
···
 
 func TestLoadConfigFromEnv_KeyPathDefault(t *testing.T) {
 	cleanup := setupEnv(t, map[string]string{
-		"HOLD_PUBLIC_URL":   "https://hold.example.com",
-		"STORAGE_DRIVER":    "filesystem",
-		"HOLD_DATABASE_DIR": "/custom/db/path",
-		"HOLD_KEY_PATH":     "", // Should default to {Database.Path}/signing.key
+		"HOLD_PUBLIC_URL":       "https://hold.example.com",
+		"S3_BUCKET":             "test-bucket",
+		"AWS_ACCESS_KEY_ID":     "test-key",
+		"AWS_SECRET_ACCESS_KEY": "test-secret",
+		"HOLD_DATABASE_DIR":     "/custom/db/path",
+		"HOLD_KEY_PATH":         "", // Should default to {Database.Path}/signing.key
 	})
 	defer cleanup()
 
···
 	}
 }
 
-func TestLoadConfigFromEnv_DisablePresignedURLs(t *testing.T) {
-	cleanup := setupEnv(t, map[string]string{
-		"HOLD_PUBLIC_URL":        "https://hold.example.com",
-		"STORAGE_DRIVER":         "filesystem",
-		"DISABLE_PRESIGNED_URLS": "true",
-	})
-	defer cleanup()
-
-	cfg, err := LoadConfigFromEnv()
-	if err != nil {
-		t.Fatalf("Expected success, got error: %v", err)
-	}
-
-	if !cfg.Server.DisablePresignedURLs {
-		t.Error("Expected DisablePresignedURLs=true")
-	}
-}
-
 func TestBuildStorageConfig_S3_Complete(t *testing.T) {
 	cleanup := setupEnv(t, map[string]string{
 		"AWS_ACCESS_KEY_ID":     "test-access-key",
···
 	})
 	defer cleanup()
 
-	cfg, err := buildStorageConfig("s3")
+	cfg, err := buildStorageConfig()
 	if err != nil {
 		t.Fatalf("Expected success, got error: %v", err)
 	}
···
 	})
 	defer cleanup()
 
-	cfg, err := buildStorageConfig("s3")
+	cfg, err := buildStorageConfig()
 	if err != nil {
 		t.Fatalf("Expected success, got error: %v", err)
 	}
···
 	})
 	defer cleanup()
 
-	_, err := buildStorageConfig("s3")
+	_, err := buildStorageConfig()
 	if err == nil {
 		t.Error("Expected error for missing S3_BUCKET")
-	}
-}
-
-func TestBuildStorageConfig_Filesystem(t *testing.T) {
-	cleanup := setupEnv(t, map[string]string{
-		"STORAGE_ROOT_DIR": "/custom/storage/path",
-	})
-	defer cleanup()
-
-	cfg, err := buildStorageConfig("filesystem")
-	if err != nil {
-		t.Fatalf("Expected success, got error: %v", err)
-	}
-
-	fsParams, ok := cfg.Storage["filesystem"]
-	if !ok {
-		t.Fatal("Expected filesystem storage config")
-	}
-
-	params := map[string]any(fsParams)
-
-	if params["rootdirectory"] != "/custom/storage/path" {
-		t.Errorf("Expected rootdirectory=/custom/storage/path, got %v", params["rootdirectory"])
-	}
-}
-
-func TestBuildStorageConfig_Filesystem_Default(t *testing.T) {
-	cleanup := setupEnv(t, map[string]string{
-		"STORAGE_ROOT_DIR": "", // Test default
-	})
-	defer cleanup()
-
-	cfg, err := buildStorageConfig("filesystem")
-	if err != nil {
-		t.Fatalf("Expected success, got error: %v", err)
-	}
-
-	fsParams, ok := cfg.Storage["filesystem"]
-	if !ok {
-		t.Fatal("Expected filesystem storage config")
-	}
-
-	params := map[string]any(fsParams)
-
-	if params["rootdirectory"] != "/var/lib/atcr/hold" {
-		t.Errorf("Expected default rootdirectory=/var/lib/atcr/hold, got %v", params["rootdirectory"])
-	}
-}
-
-func TestBuildStorageConfig_UnsupportedDriver(t *testing.T) {
-	cleanup := setupEnv(t, map[string]string{})
-	defer cleanup()
-
-	_, err := buildStorageConfig("azure")
-	if err == nil {
-		t.Error("Expected error for unsupported driver")
 	}
 }
 

pkg/hold/oci/multipart.go

···
 
 import (
 	"context"
-	"crypto/sha256"
-	"encoding/hex"
 	"fmt"
 	"log/slog"
 	"sort"
···
 	"sync"
 	"time"
 
-	"atcr.io/pkg/atproto"
 	"atcr.io/pkg/s3"
 	awss3 "github.com/aws/aws-sdk-go/service/s3"
 	"github.com/google/uuid"
 )
 
-// MultipartMode indicates how multipart uploads are handled
-type MultipartMode int
-
-const (
-	// S3Native uses S3's native multipart API with presigned URLs
-	S3Native MultipartMode = iota
-	// Buffered buffers parts in memory and assembles them in the hold service
-	Buffered
-)
-
 // PartInfo represents an uploaded part with its ETag
 type PartInfo struct {
 	PartNumber int    `json:"part_number"`
 	ETag       string `json:"etag"`
 }
 
-// PartUploadInfo contains structured information for uploading a part
-// Used for both S3 presigned URLs and buffered mode with headers
+// PartUploadInfo contains the presigned URL for uploading a part
 type PartUploadInfo struct {
-	URL     string            `json:"url"`               // URL to PUT the part to
-	Method  string            `json:"method,omitempty"`  // HTTP method (usually "PUT")
-	Headers map[string]string `json:"headers,omitempty"` // Additional headers required for the request
+	URL string `json:"url"` // Presigned URL to PUT the part to
 }
 
 // MultipartSession tracks an in-progress multipart upload
 type MultipartSession struct {
-	UploadID     string                 // Unique upload ID
-	Digest       string                 // Target digest path
-	Mode         MultipartMode          // Upload mode (S3Native or Buffered)
-	S3UploadID   string                 // S3 upload ID (for S3Native mode)
-	Parts        map[int]*MultipartPart // Buffered parts (for Buffered mode)
-	CreatedAt    time.Time              // When upload started
-	LastActivity time.Time              // Last part upload
-	mu           sync.RWMutex           // Protects Parts map
+	UploadID     string    // Unique upload ID
+	Digest       string    // Target digest path
+	S3UploadID   string    // S3 upload ID
+	CreatedAt    time.Time // When upload started
+	LastActivity time.Time // Last part upload
 }
 
 // MultipartPart represents a single part in a multipart upload
 type MultipartPart struct {
 	PartNumber int       // Part number (1-indexed)
-	Data       []byte    // Part data (for Buffered mode)
-	ETag       string    // ETag from S3 or computed hash
+	ETag       string    // ETag from S3
 	Size       int64     // Part size in bytes
 	UploadedAt time.Time // When part was uploaded
 }
···
 }
 
 // CreateSession creates a new multipart upload session
-func (m *MultipartManager) CreateSession(digest string, mode MultipartMode, s3UploadID string) *MultipartSession {
+func (m *MultipartManager) CreateSession(digest string, s3UploadID string) *MultipartSession {
 	uploadID := uuid.New().String()
 
 	session := &MultipartSession{
 		UploadID:     uploadID,
 		Digest:       digest,
-		Mode:         mode,
 		S3UploadID:   s3UploadID,
-		Parts:        make(map[int]*MultipartPart),
 		CreatedAt:    time.Now(),
 		LastActivity: time.Now(),
 	}
···
 
 	slog.Debug("Created multipart session",
 		"uploadID", uploadID,
-		"digest", digest,
-		"mode", mode)
+		"digest", digest)
 	return session
 }
 
···
 	slog.Debug("Deleted multipart session", "uploadID", uploadID)
 }
 
-// StorePart stores a part in the session (for Buffered mode)
-func (s *MultipartSession) StorePart(partNumber int, data []byte) string {
-	s.mu.Lock()
-	defer s.mu.Unlock()
-
-	// Compute ETag as SHA256 hash of part data
-	hash := sha256.Sum256(data)
-	etag := hex.EncodeToString(hash[:])
-
-	part := &MultipartPart{
-		PartNumber: partNumber,
-		Data:       data,
-		ETag:       etag,
-		Size:       int64(len(data)),
-		UploadedAt: time.Now(),
+// StartMultipartUploadWithManager initiates a multipart upload using the manager
+// Returns the upload ID for tracking the session
+func (h *XRPCHandler) StartMultipartUploadWithManager(ctx context.Context, digest string) (string, error) {
+	if h.s3Service.Client == nil {
+		return "", fmt.Errorf("S3 not configured - S3 is required for blob storage")
 	}
 
-	s.Parts[partNumber] = part
-	s.LastActivity = time.Now()
-
-	slog.Debug("Stored part",
-		"uploadID", s.UploadID,
-		"part", partNumber,
-		"size", len(data),
-		"etag", etag)
-	return etag
-}
-
-// AssembleBufferedParts assembles all buffered parts into a single blob
-// Returns the complete data and total size
-func (s *MultipartSession) AssembleBufferedParts() ([]byte, int64, error) {
-	s.mu.RLock()
-	defer s.mu.RUnlock()
-
-	if s.Mode != Buffered {
-		return nil, 0, fmt.Errorf("session is not in buffered mode")
+	path := s3.BlobPath(digest)
+	s3Key := strings.TrimPrefix(path, "/")
+	if h.s3Service.PathPrefix != "" {
+		s3Key = h.s3Service.PathPrefix + "/" + s3Key
 	}
 
-	// Calculate total size
-	var totalSize int64
-	maxPart := 0
-	for partNum, part := range s.Parts {
-		totalSize += part.Size
-		if partNum > maxPart {
-			maxPart = partNum
-		}
+	result, err := h.s3Service.Client.CreateMultipartUploadWithContext(ctx, &awss3.CreateMultipartUploadInput{
+		Bucket: &h.s3Service.Bucket,
+		Key:    &s3Key,
+	})
+	if err != nil {
+		return "", fmt.Errorf("failed to start S3 multipart upload: %w", err)
 	}
 
-	// Check for missing parts
-	for i := 1; i <= maxPart; i++ {
-		if _, ok := s.Parts[i]; !ok {
-			return nil, 0, fmt.Errorf("missing part %d", i)
-		}
-	}
-
-	// Assemble parts in order
-	assembled := make([]byte, 0, totalSize)
-	for i := 1; i <= maxPart; i++ {
-		part := s.Parts[i]
-		assembled = append(assembled, part.Data...)
-	}
-
-	slog.Debug("Assembled buffered parts",
-		"uploadID", s.UploadID,
-		"parts", maxPart,
-		"totalSize", totalSize)
-	return assembled, totalSize, nil
-}
-
-// StartMultipartUploadWithManager initiates a multipart upload using the manager
-// Returns uploadID and mode
-func (h *XRPCHandler) StartMultipartUploadWithManager(ctx context.Context, digest string) (string, MultipartMode, error) {
-	// Check if presigned URLs are disabled for testing
-	if h.disablePresignedURLs {
-		slog.Debug("Presigned URLs disabled, using buffered mode", "reason", "DISABLE_PRESIGNED_URLS=true")
-		session := h.MultipartMgr.CreateSession(digest, Buffered, "")
-		slog.Debug("Started buffered multipart", "uploadID", session.UploadID)
-		return session.UploadID, Buffered, nil
-	}
-
-	// Try S3 native multipart first
-	if h.s3Service.Client != nil {
-		if h.s3Service.Client == nil {
-			return "", S3Native, fmt.Errorf("S3 not configured")
-		}
-		path := s3.BlobPath(digest)
-		s3Key := strings.TrimPrefix(path, "/")
-		if h.s3Service.PathPrefix != "" {
-			s3Key = h.s3Service.PathPrefix + "/" + s3Key
-		}
-
-		result, err := h.s3Service.Client.CreateMultipartUploadWithContext(ctx, &awss3.CreateMultipartUploadInput{
-			Bucket: &h.s3Service.Bucket,
-			Key:    &s3Key,
-		})
-		if err == nil {
-			s3UploadID := *result.UploadId
-			// S3 native multipart succeeded
-			session := h.MultipartMgr.CreateSession(digest, S3Native, s3UploadID)
-			slog.Debug("Started S3 native multipart",
-				"digest", digest,
-				"uploadID", session.UploadID,
-				"s3UploadID", s3UploadID)
-			return session.UploadID, S3Native, nil
-		}
-		slog.Warn("S3 native multipart failed, falling back to buffered mode", "error", err)
-	}
-
-	// Fallback to buffered mode
-	session := h.MultipartMgr.CreateSession(digest, Buffered, "")
-	slog.Debug("Started buffered multipart", "uploadID", session.UploadID)
-	return session.UploadID, Buffered, nil
+	s3UploadID := *result.UploadId
+	session := h.MultipartMgr.CreateSession(digest, s3UploadID)
+	slog.Debug("Started S3 multipart upload",
+		"digest", digest,
+		"uploadID", session.UploadID,
+		"s3UploadID", s3UploadID)
+	return session.UploadID, nil
 }
 
 // GetPartUploadURL generates a presigned URL for uploading a part
-// Only used for S3Native mode - Buffered mode is handled by blobstore adapter
 func (h *XRPCHandler) GetPartUploadURL(ctx context.Context, uploadID string, partNumber int) (*PartUploadInfo, error) {
 	session, err := h.MultipartMgr.GetSession(uploadID)
 	if err != nil {
 		return nil, err
 	}
 
-	// For S3Native mode: return presigned URL
-	if session.Mode == S3Native {
-		if h.s3Service.Client == nil {
-			return nil, fmt.Errorf("S3 not configured")
-		}
+	if h.s3Service.Client == nil {
+		return nil, fmt.Errorf("S3 not configured")
+	}
 
-		path := s3.BlobPath(session.Digest)
-		s3Key := strings.TrimPrefix(path, "/")
-		if h.s3Service.PathPrefix != "" {
-			s3Key = h.s3Service.PathPrefix + "/" + s3Key
-		}
-		pnum := int64(partNumber)
-		req, _ := h.s3Service.Client.UploadPartRequest(&awss3.UploadPartInput{
-			Bucket:     &h.s3Service.Bucket,
-			Key:        &s3Key,
-			UploadId:   &session.S3UploadID,
-			PartNumber: &pnum,
-		})
+	path := s3.BlobPath(session.Digest)
+	s3Key := strings.TrimPrefix(path, "/")
+	if h.s3Service.PathPrefix != "" {
+		s3Key = h.s3Service.PathPrefix + "/" + s3Key
+	}
+	pnum := int64(partNumber)
+	req := h.s3Service.Client.UploadPartPresignable(&awss3.UploadPartInput{
+		Bucket:     &h.s3Service.Bucket,
+		Key:        &s3Key,
+		UploadId:   &session.S3UploadID,
+		PartNumber: &pnum,
+	})
 
-		url, err := req.Presign(15 * time.Minute)
-		if err != nil {
-			return nil, err
-		}
+	url, err := req.Presign(15 * time.Minute)
+	if err != nil {
+		return nil, err
+	}
 
-		slog.Debug("Generated part presigned URL",
-			"digest", session.Digest,
-			"uploadID", uploadID,
-			"part", partNumber)
-
-		return &PartUploadInfo{
-			URL:    url,
-			Method: "PUT",
-		}, nil
-	}
+	slog.Debug("Generated part presigned URL",
+		"digest", session.Digest,
+		"uploadID", uploadID,
+		"part", partNumber)
 
-	// Buffered mode: return XRPC endpoint with headers
 	return &PartUploadInfo{
-		URL:    fmt.Sprintf("%s%s", h.pds.PublicURL, atproto.HoldUploadPart),
-		Method: "PUT",
-		Headers: map[string]string{
-			"X-Upload-Id":   uploadID,
-			"X-Part-Number": fmt.Sprintf("%d", partNumber),
-		},
+		URL: url,
 	}, nil
 }
 
···
 		return err
 	}
 
-	if session.Mode == S3Native {
-		if h.s3Service.Client == nil {
-			return fmt.Errorf("S3 not configured")
-		}
+	if h.s3Service.Client == nil {
+		return fmt.Errorf("S3 not configured")
+	}
 
-		// Sort parts by part number (S3 requires ascending order)
-		sort.Slice(parts, func(i, j int) bool {
-			return parts[i].PartNumber < parts[j].PartNumber
-		})
+	// Sort parts by part number (S3 requires ascending order)
+	sort.Slice(parts, func(i, j int) bool {
+		return parts[i].PartNumber < parts[j].PartNumber
+	})
 
-		// Convert to S3 CompletedPart format
-		// IMPORTANT: S3 requires ETags to be quoted in the CompleteMultipartUpload XML
-		s3Parts := make([]*awss3.CompletedPart, len(parts))
-		for i, p := range parts {
-			etag := normalizeETag(p.ETag)
-			pnum := int64(p.PartNumber)
-			s3Parts[i] = &awss3.CompletedPart{
-				PartNumber: &pnum,
-				ETag:       &etag,
-			}
+	// Convert to S3 CompletedPart format
+	// IMPORTANT: S3 requires ETags to be quoted in the CompleteMultipartUpload XML
+	s3Parts := make([]*awss3.CompletedPart, len(parts))
+	for i, p := range parts {
+		etag := normalizeETag(p.ETag)
+		pnum := int64(p.PartNumber)
+		s3Parts[i] = &awss3.CompletedPart{
+			PartNumber: &pnum,
+			ETag:       &etag,
 		}
-		sourcePath := s3.BlobPath(session.Digest)
-		s3Key := strings.TrimPrefix(sourcePath, "/")
-		if h.s3Service.PathPrefix != "" {
-			s3Key = h.s3Service.PathPrefix + "/" + s3Key
-		}
-
-		_, err = h.s3Service.Client.CompleteMultipartUploadWithContext(ctx, &awss3.CompleteMultipartUploadInput{
-			Bucket:   &h.s3Service.Bucket,
-			Key:      &s3Key,
-			UploadId: &session.S3UploadID,
-			MultipartUpload: &awss3.CompletedMultipartUpload{
-				Parts: s3Parts,
-			},
-		})
-		if err != nil {
-			return fmt.Errorf("failed to complete multipart upload: digest=%s, uploadID=%s, err=%v", session.Digest, uploadID, err)
-		}
-		slog.Info("Completed S3 native multipart at temp location",
-			"digest", session.Digest,
-			"uploadID", session.UploadID,
-			"parts", len(s3Parts))
-
-		// Verify the blob exists at temp location before moving
-		destPath := s3.BlobPath(finalDigest)
-		slog.Debug("About to move blob",
-			"source", sourcePath,
-			"dest", destPath)
-
-		if _, err := h.driver.Stat(ctx, sourcePath); err != nil {
-			slog.Error("Source blob not found after multipart complete",
-				"path", sourcePath,
-				"error", err)
-			return fmt.Errorf("source blob not found after multipart complete: %w", err)
-		}
-		slog.Debug("Source blob verified", "path", sourcePath)
-
-		// Move from temp to final digest location using driver
-		// Driver handles path management correctly (including S3 prefix)
-		if err := h.driver.Move(ctx, sourcePath, destPath); err != nil {
-			slog.Error("Failed to move blob",
-				"source", sourcePath,
-				"dest", destPath,
-				"error", err)
-			return fmt.Errorf("failed to move blob to final location: %w", err)
-		}
-
-		slog.Info("Moved blob to final location",
-			"from", session.Digest,
-			"to", finalDigest,
-			"sourcePath", sourcePath,
-			"destPath", destPath)
-		return nil
 	}
-
-	// Buffered mode: assemble parts and write directly to final location
-	data, size, err := session.AssembleBufferedParts()
-	if err != nil {
-		return fmt.Errorf("failed to assemble parts: %w", err)
+	sourcePath := s3.BlobPath(session.Digest)
+	s3Key := strings.TrimPrefix(sourcePath, "/")
+	if h.s3Service.PathPrefix != "" {
+		s3Key = h.s3Service.PathPrefix + "/" + s3Key
 	}
 
-	// Write assembled blob to final digest location (not temp)
-	path := s3.BlobPath(finalDigest)
-	writer, err := h.driver.Writer(ctx, path, false)
+	_, err = h.s3Service.Client.CompleteMultipartUploadWithContext(ctx, &awss3.CompleteMultipartUploadInput{
+		Bucket:   &h.s3Service.Bucket,
+		Key:      &s3Key,
+		UploadId: &session.S3UploadID,
+		MultipartUpload: &awss3.CompletedMultipartUpload{
+			Parts: s3Parts,
+		},
+	})
 	if err != nil {
-		return fmt.Errorf("failed to create writer: %w", err)
+		return fmt.Errorf("failed to complete multipart upload: digest=%s, uploadID=%s, err=%v", session.Digest, uploadID, err)
 	}
+	slog.Info("Completed S3 native multipart at temp location",
+		"digest", session.Digest,
+		"uploadID", session.UploadID,
+		"parts", len(s3Parts))
 
-	written, err := writer.Write(data)
-	if err != nil {
-		writer.Cancel(ctx)
-		return fmt.Errorf("failed to write blob: %w", err)
+	// Verify the blob exists at temp location before moving
+	destPath := s3.BlobPath(finalDigest)
+	slog.Debug("About to move blob",
+		"source", sourcePath,
+		"dest", destPath)
+
+	if _, err := h.driver.Stat(ctx, sourcePath); err != nil {
+		slog.Error("Source blob not found after multipart complete",
+			"path", sourcePath,
+			"error", err)
+		return fmt.Errorf("source blob not found after multipart complete: %w", err)
 	}
+	slog.Debug("Source blob verified", "path", sourcePath)
 
-	if err := writer.Commit(ctx); err != nil {
-		return fmt.Errorf("failed to commit blob: %w", err)
+	// Move from temp to final digest location using driver
+	// Driver handles path management correctly (including S3 prefix)
+	if err := h.driver.Move(ctx, sourcePath, destPath); err != nil {
+		slog.Error("Failed to move blob",
+			"source", sourcePath,
+			"dest", destPath,
+			"error", err)
+		return fmt.Errorf("failed to move blob to final location: %w", err)
 	}
 
-	slog.Info("Completed buffered multipart",
-		"uploadID", session.UploadID,
-		"finalDigest", finalDigest,
-		"size", size,
-		"written", written)
+	slog.Info("Moved blob to final location",
+		"from", session.Digest,
+		"to", finalDigest,
+		"sourcePath", sourcePath,
+		"destPath", destPath)
 	return nil
 }
 
···
 		return err
 	}
 
-	if session.Mode == S3Native {
-		if h.s3Service.Client == nil {
-			return fmt.Errorf("S3 not configured")
-		}
-		path := s3.BlobPath(session.Digest)
-		s3Key := strings.TrimPrefix(path, "/")
-		if h.s3Service.PathPrefix != "" {
-			s3Key = h.s3Service.PathPrefix + "/" + s3Key
-		}
-
-		_, err := h.s3Service.Client.AbortMultipartUploadWithContext(ctx, &awss3.AbortMultipartUploadInput{
-			Bucket:   &h.s3Service.Bucket,
-			Key:      &s3Key,
-			UploadId: &session.S3UploadID,
-		})
-		// Abort S3 multipart upload
-		if err != nil {
-			return fmt.Errorf("failed  to abort multipart upload: digest=%s, uploadID=%s, err=%v", session.Digest, uploadID, err)
-		}
-		slog.Debug("Aborted S3 native multipart",
-			"digest", session.Digest,
-			"uploadID", session.UploadID)
-		return nil
+	if h.s3Service.Client == nil {
+		return fmt.Errorf("S3 not configured")
 	}
 
-	// Buffered mode: just delete the session (parts are in memory)
-	slog.Debug("Aborted buffered multipart", "uploadID", session.UploadID)
-	return nil
-}
+	path := s3.BlobPath(session.Digest)
+	s3Key := strings.TrimPrefix(path, "/")
+	if h.s3Service.PathPrefix != "" {
+		s3Key = h.s3Service.PathPrefix + "/" + s3Key
+	}
 
-// HandleBufferedPartUpload handles uploading a part in buffered mode
-func (h *XRPCHandler) HandleBufferedPartUpload(ctx context.Context, uploadID string, partNumber int, data []byte) (string, error) {
-	session, err := h.MultipartMgr.GetSession(uploadID)
+	_, err = h.s3Service.Client.AbortMultipartUploadWithContext(ctx, &awss3.AbortMultipartUploadInput{
+		Bucket:   &h.s3Service.Bucket,
+		Key:      &s3Key,
+		UploadId: &session.S3UploadID,
+	})
 	if err != nil {
-		return "", err
+		return fmt.Errorf("failed to abort multipart upload: digest=%s, uploadID=%s, err=%v", session.Digest, uploadID, err)
 	}
-
-	if session.Mode != Buffered {
-		return "", fmt.Errorf("session is not in buffered mode")
-	}
-
-	etag := session.StorePart(partNumber, data)
-	return etag, nil
+	slog.Debug("Aborted S3 multipart",
+		"digest", session.Digest,
+		"uploadID", session.UploadID)
+	return nil
 }
 
 // normalizeETag ensures an ETag has quotes (required by S3 CompleteMultipartUpload)

pkg/hold/oci/multipart_test.go

···
 		sessions: make(map[string]*MultipartSession),
 	}
 
-	session := mgr.CreateSession("sha256:test123", Buffered, "")
+	session := mgr.CreateSession("sha256:test123", "aws-upload-id")
 
 	if session.UploadID == "" {
 		t.Error("Expected non-empty uploadID")
···
 	if session.Digest != "sha256:test123" {
 		t.Errorf("Expected digest=sha256:test123, got %s", session.Digest)
 	}
-	if session.Mode != Buffered {
-		t.Errorf("Expected mode=Buffered, got %v", session.Mode)
-	}
-	if session.Parts == nil {
-		t.Error("Expected Parts map to be initialized")
+	if session.S3UploadID != "aws-upload-id" {
+		t.Errorf("Expected S3UploadID=aws-upload-id, got %s", session.S3UploadID)
 	}
 	if session.CreatedAt.IsZero() {
 		t.Error("Expected CreatedAt to be set")
 	}
 }
 
-func TestCreateSession_S3Native(t *testing.T) {
-	mgr := &MultipartManager{
-		sessions: make(map[string]*MultipartSession),
-	}
-
-	s3UploadID := "aws-multipart-id-123"
-	session := mgr.CreateSession("sha256:test123", S3Native, s3UploadID)
-
-	if session.Mode != S3Native {
-		t.Errorf("Expected mode=S3Native, got %v", session.Mode)
-	}
-	if session.S3UploadID != s3UploadID {
-		t.Errorf("Expected S3UploadID=%s, got %s", s3UploadID, session.S3UploadID)
-	}
-}
-
 func TestGetSession_Success(t *testing.T) {
 	mgr := &MultipartManager{
 		sessions: make(map[string]*MultipartSession),
 	}
 
-	created := mgr.CreateSession("sha256:test123", Buffered, "")
+	created := mgr.CreateSession("sha256:test123", "aws-upload-id")
 
 	retrieved, err := mgr.GetSession(created.UploadID)
 	if err != nil {
···
 		sessions: make(map[string]*MultipartSession),
 	}
 
-	session := mgr.CreateSession("sha256:test123", Buffered, "")
+	session := mgr.CreateSession("sha256:test123", "aws-upload-id")
 	uploadID := session.UploadID
 
 	// Verify it exists
···
 	}
 }
 
-func TestStorePart(t *testing.T) {
-	session := &MultipartSession{
-		UploadID: "test-upload",
-		Digest:   "sha256:test",
-		Mode:     Buffered,
-		Parts:    make(map[int]*MultipartPart),
-	}
-
-	data := []byte("test part data")
-	etag := session.StorePart(1, data)
-
-	if etag == "" {
-		t.Error("Expected non-empty etag")
-	}
-
-	part, exists := session.Parts[1]
-	if !exists {
-		t.Fatal("Part 1 should exist")
-	}
-
-	if part.PartNumber != 1 {
-		t.Errorf("Expected partNumber=1, got %d", part.PartNumber)
-	}
-	if string(part.Data) != string(data) {
-		t.Errorf("Expected data=%s, got %s", string(data), string(part.Data))
-	}
-	if part.ETag != etag {
-		t.Errorf("Expected etag=%s, got %s", etag, part.ETag)
-	}
-	if part.Size != int64(len(data)) {
-		t.Errorf("Expected size=%d, got %d", len(data), part.Size)
-	}
-}
-
-func TestAssembleBufferedParts_Success(t *testing.T) {
-	session := &MultipartSession{
-		UploadID: "test-upload",
-		Digest:   "sha256:test",
-		Mode:     Buffered,
-		Parts:    make(map[int]*MultipartPart),
-	}
-
-	// Add parts in non-sequential order to test sorting
-	session.StorePart(2, []byte("second part"))
-	session.StorePart(1, []byte("first part"))
-	session.StorePart(3, []byte("third part"))
-
-	data, size, err := session.AssembleBufferedParts()
-	if err != nil {
-		t.Fatalf("Expected success, got error: %v", err)
-	}
-
-	expected := "first partsecond partthird part"
-	if string(data) != expected {
-		t.Errorf("Expected data=%s, got %s", expected, string(data))
-	}
-
-	if size != int64(len(expected)) {
-		t.Errorf("Expected size=%d, got %d", len(expected), size)
-	}
-}
-
-func TestAssembleBufferedParts_MissingPart(t *testing.T) {
-	session := &MultipartSession{
-		UploadID: "test-upload",
-		Digest:   "sha256:test",
-		Mode:     Buffered,
-		Parts:    make(map[int]*MultipartPart),
-	}
-
-	// Add parts 1 and 3, but not 2
-	session.StorePart(1, []byte("first part"))
-	session.StorePart(3, []byte("third part"))
-
-	_, _, err := session.AssembleBufferedParts()
-	if err == nil {
-		t.Error("Expected error for missing part 2")
-	}
-}
-
-func TestAssembleBufferedParts_WrongMode(t *testing.T) {
-	session := &MultipartSession{
-		UploadID: "test-upload",
-		Digest:   "sha256:test",
-		Mode:     S3Native,
-		Parts:    make(map[int]*MultipartPart),
-	}
-
-	_, _, err := session.AssembleBufferedParts()
-	if err == nil {
-		t.Error("Expected error for S3Native mode")
-	}
-}
-
 func TestCleanupExpiredSessions(t *testing.T) {
 	mgr := &MultipartManager{
 		sessions: make(map[string]*MultipartSession),
···
 	oldSession := &MultipartSession{
 		UploadID:     "old-session",
 		Digest:       "sha256:old",
-		Mode:         Buffered,
-		Parts:        make(map[int]*MultipartPart),
+		S3UploadID:   "aws-old-upload",
 		CreatedAt:    time.Now().Add(-25 * time.Hour),
 		LastActivity: time.Now().Add(-25 * time.Hour),
 	}
 	mgr.sessions[oldSession.UploadID] = oldSession
 
 	// Create a recent session
-	recentSession := mgr.CreateSession("sha256:recent", Buffered, "")
+	recentSession := mgr.CreateSession("sha256:recent", "aws-recent-upload")
 
 	// Run cleanup
 	mgr.cleanupExpiredSessions()

pkg/hold/oci/xrpc.go

···
 
 import (
 	"fmt"
-	"io"
 	"log/slog"
 	"net/http"
-	"strconv"
 	"strings"
 
 	"atcr.io/pkg/atproto"
···
 
 // XRPCHandler handles OCI-specific XRPC endpoints for multipart uploads
 type XRPCHandler struct {
-	driver               storagedriver.StorageDriver
-	disablePresignedURLs bool
-	s3Service            s3.S3Service
-	MultipartMgr         *MultipartManager // Exported for access in route handlers
-	pds                  *pds.HoldPDS
-	httpClient           pds.HTTPClient
-	enableBlueskyPosts   bool
-	quotaMgr             *quota.Manager // Quota manager for tier-based limits
+	driver             storagedriver.StorageDriver
+	s3Service          s3.S3Service
+	MultipartMgr       *MultipartManager // Exported for access in route handlers
+	pds                *pds.HoldPDS
+	httpClient         pds.HTTPClient
+	enableBlueskyPosts bool
+	quotaMgr           *quota.Manager // Quota manager for tier-based limits
 }
 
 // NewXRPCHandler creates a new OCI XRPC handler
-func NewXRPCHandler(holdPDS *pds.HoldPDS, s3Service s3.S3Service, driver storagedriver.StorageDriver, disablePresignedURLs bool, enableBlueskyPosts bool, httpClient pds.HTTPClient, quotaMgr *quota.Manager) *XRPCHandler {
+func NewXRPCHandler(holdPDS *pds.HoldPDS, s3Service s3.S3Service, driver storagedriver.StorageDriver, enableBlueskyPosts bool, httpClient pds.HTTPClient, quotaMgr *quota.Manager) *XRPCHandler {
 	return &XRPCHandler{
-		driver:               driver,
-		disablePresignedURLs: disablePresignedURLs,
-		MultipartMgr:         NewMultipartManager(),
-		s3Service:            s3Service,
-		pds:                  holdPDS,
-		httpClient:           httpClient,
-		enableBlueskyPosts:   enableBlueskyPosts,
-		quotaMgr:             quotaMgr,
+		driver:             driver,
+		MultipartMgr:       NewMultipartManager(),
+		s3Service:          s3Service,
+		pds:                holdPDS,
+		httpClient:         httpClient,
+		enableBlueskyPosts: enableBlueskyPosts,
+		quotaMgr:           quotaMgr,
 	}
 }
 
···
 
 		r.Post(atproto.HoldInitiateUpload, h.HandleInitiateUpload)
 		r.Post(atproto.HoldGetPartUploadURL, h.HandleGetPartUploadURL)
-		r.Put(atproto.HoldUploadPart, h.HandleUploadPart)
 		r.Post(atproto.HoldCompleteUpload, h.HandleCompleteUpload)
 		r.Post(atproto.HoldAbortUpload, h.HandleAbortUpload)
 		r.Post(atproto.HoldNotifyManifest, h.HandleNotifyManifest)
···
 		return
 	}
 
-	uploadID, _, err := h.StartMultipartUploadWithManager(r.Context(), req.Digest)
+	uploadID, err := h.StartMultipartUploadWithManager(r.Context(), req.Digest)
 	if err != nil {
 		render.Status(r, http.StatusInternalServerError)
 		render.JSON(w, r, map[string]string{"error": fmt.Sprintf("failed to initiate upload: %v", err)})
···
 	}
 
 	render.JSON(w, r, uploadInfo)
-}
-
-// HandleUploadPart handles direct buffered part uploads
-// Moved from pds/xrpc.go - this is OCI-specific multipart upload logic
-func (h *XRPCHandler) HandleUploadPart(w http.ResponseWriter, r *http.Request) {
-	uploadID := r.Header.Get("X-Upload-Id")
-	partNumberStr := r.Header.Get("X-Part-Number")
-
-	if uploadID == "" || partNumberStr == "" {
-		render.Status(r, http.StatusBadRequest)
-		render.JSON(w, r, map[string]string{"error": "X-Upload-Id and X-Part-Number headers are required"})
-		return
-	}
-
-	partNumber, err := strconv.Atoi(partNumberStr)
-	if err != nil {
-		render.Status(r, http.StatusBadRequest)
-		render.JSON(w, r, map[string]string{"error": fmt.Sprintf("invalid part number: %v", err)})
-		return
-	}
-
-	data, err := io.ReadAll(r.Body)
-	if err != nil {
-		render.Status(r, http.StatusInternalServerError)
-		render.JSON(w, r, map[string]string{"error": fmt.Sprintf("failed to read part data: %v", err)})
-		return
-	}
-
-	etag, err := h.HandleBufferedPartUpload(r.Context(), uploadID, partNumber, data)
-	if err != nil {
-		render.Status(r, http.StatusInternalServerError)
-		render.JSON(w, r, map[string]string{"error": fmt.Sprintf("failed to upload part: %v", err)})
-		return
-	}
-
-	render.JSON(w, r, map[string]any{
-		"etag": etag,
-	})
 }
 
 // HandleCompleteUpload finalizes a multipart upload

pkg/hold/oci/xrpc_test.go

···
 	"net/http/httptest"
 	"os"
 	"path/filepath"
-	"strconv"
+	"sync"
 	"testing"
+	"time"
 
 	"atcr.io/pkg/atproto"
 	"atcr.io/pkg/auth/oauth"
 	"atcr.io/pkg/hold/pds"
 	"atcr.io/pkg/s3"
+	storagedriver "github.com/distribution/distribution/v3/registry/storage/driver"
 	"github.com/distribution/distribution/v3/registry/storage/driver/factory"
-	_ "github.com/distribution/distribution/v3/registry/storage/driver/filesystem"
+	_ "github.com/distribution/distribution/v3/registry/storage/driver/s3-aws"
 )
 
 // Shared test resources for OCI package
···
 	}, nil
 }
 
-// setupTestOCIHandler creates a test OCI XRPC handler with filesystem driver
-func setupTestOCIHandler(t *testing.T) (*XRPCHandler, context.Context) {
+// mockStorageDriver implements storagedriver.StorageDriver for testing
+type mockStorageDriver struct {
+	mu    sync.RWMutex
+	blobs map[string][]byte
+
+	// Error injection for testing error handling
+	StatError error
+	MoveError error
+}
+
+func newMockStorageDriver() *mockStorageDriver {
+	return &mockStorageDriver{
+		blobs: make(map[string][]byte),
+	}
+}
+
+func (m *mockStorageDriver) Name() string { return "mock" }
+
+func (m *mockStorageDriver) GetContent(ctx context.Context, path string) ([]byte, error) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+	if data, ok := m.blobs[path]; ok {
+		return data, nil
+	}
+	return nil, storagedriver.PathNotFoundError{Path: path}
+}
+
+func (m *mockStorageDriver) PutContent(ctx context.Context, path string, content []byte) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	m.blobs[path] = content
+	return nil
+}
+
+func (m *mockStorageDriver) Reader(ctx context.Context, path string, offset int64) (io.ReadCloser, error) {
+	data, err := m.GetContent(ctx, path)
+	if err != nil {
+		return nil, err
+	}
+	return io.NopCloser(bytes.NewReader(data[offset:])), nil
+}
+
+func (m *mockStorageDriver) Writer(ctx context.Context, path string, append bool) (storagedriver.FileWriter, error) {
+	return &mockFileWriter{driver: m, path: path}, nil
+}
+
+func (m *mockStorageDriver) Stat(ctx context.Context, path string) (storagedriver.FileInfo, error) {
+	m.mu.RLock()
+	defer m.mu.RUnlock()
+
+	// Check for injected error
+	if m.StatError != nil {
+		return nil, m.StatError
+	}
+
+	if data, ok := m.blobs[path]; ok {
+		return &mockFileInfo{path: path, size: int64(len(data))}, nil
+	}
+	return nil, storagedriver.PathNotFoundError{Path: path}
+}
+
+func (m *mockStorageDriver) List(ctx context.Context, path string) ([]string, error) {
+	return nil, nil
+}
+
+func (m *mockStorageDriver) Move(ctx context.Context, sourcePath string, destPath string) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	// Check for injected error
+	if m.MoveError != nil {
+		return m.MoveError
+	}
+
+	if data, ok := m.blobs[sourcePath]; ok {
+		m.blobs[destPath] = data
+		delete(m.blobs, sourcePath)
+		return nil
+	}
+	return storagedriver.PathNotFoundError{Path: sourcePath}
+}
+
+func (m *mockStorageDriver) Delete(ctx context.Context, path string) error {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+	delete(m.blobs, path)
+	return nil
+}
+
+func (m *mockStorageDriver) RedirectURL(r *http.Request, path string) (string, error) {
+	return "", storagedriver.ErrUnsupportedMethod{}
+}
+
+func (m *mockStorageDriver) Walk(ctx context.Context, path string, f storagedriver.WalkFn, options ...func(*storagedriver.WalkOptions)) error {
+	return nil
+}
+
+// mockFileWriter implements storagedriver.FileWriter
+type mockFileWriter struct {
+	driver *mockStorageDriver
+	path   string
+	buf    bytes.Buffer
+}
+
+func (w *mockFileWriter) Write(p []byte) (int, error) {
+	return w.buf.Write(p)
+}
+
+func (w *mockFileWriter) Size() int64 {
+	return int64(w.buf.Len())
+}
+
+func (w *mockFileWriter) Close() error {
+	return nil
+}
+
+func (w *mockFileWriter) Cancel(ctx context.Context) error {
+	return nil
+}
+
+func (w *mockFileWriter) Commit(ctx context.Context) error {
+	w.driver.mu.Lock()
+	defer w.driver.mu.Unlock()
+	w.driver.blobs[w.path] = w.buf.Bytes()
+	return nil
+}
+
+// mockFileInfo implements storagedriver.FileInfo
+type mockFileInfo struct {
+	path string
+	size int64
+}
+
+func (f *mockFileInfo) Path() string       { return f.path }
+func (f *mockFileInfo) Size() int64        { return f.size }
+func (f *mockFileInfo) ModTime() time.Time { return time.Time{} }
+func (f *mockFileInfo) IsDir() bool        { return false }
+
+// setupTestOCIHandlerWithMockS3 creates a test OCI XRPC handler with mock S3
+// This does NOT require real S3 credentials - uses MockS3Client
+// Returns the handler, mock S3 client, and mock storage driver for test manipulation
+func setupTestOCIHandlerWithMockS3(t *testing.T) (*XRPCHandler, *s3.MockS3Client, *mockStorageDriver) {
 	t.Helper()
 
-	// Create temp directory for test storage
+	// Create temp directory for PDS database
+	tmpDir := t.TempDir()
+	ctx := t.Context()
+
+	// Create mock S3 client
+	mockS3Client := s3.NewMockS3Client("http://mock-s3.test")
+
+	// Create S3 service with mock client
+	s3Service := s3.S3Service{
+		Client:     mockS3Client,
+		Bucket:     "test-bucket",
+		PathPrefix: "test-prefix",
+	}
+
+	// Create mock storage driver
+	mockDriver := newMockStorageDriver()
+
+	// Create minimal PDS for DID/auth
+	dbPath := ":memory:"
+	keyPath := filepath.Join(tmpDir, "signing-key")
+	holdDID := "did:web:hold.example.com"
+	publicURL := "https://hold.example.com"
+
+	// Copy shared signing key instead of generating a new one
+	if err := os.WriteFile(keyPath, sharedTestKey, 0600); err != nil {
+		t.Fatalf("Failed to copy shared signing key: %v", err)
+	}
+
+	holdPDS, err := pds.NewHoldPDS(ctx, holdDID, publicURL, dbPath, keyPath, false)
+	if err != nil {
+		t.Fatalf("Failed to create PDS: %v", err)
+	}
+
+	// Bootstrap PDS, suppressing stdout to avoid log spam
+	ownerDID := "did:plc:owner123"
+
+	// Redirect stdout to suppress bootstrap logging
+	oldStdout := os.Stdout
+	r, w, _ := os.Pipe()
+	os.Stdout = w
+
+	err = holdPDS.Bootstrap(ctx, nil, ownerDID, true, false, "", "")
+
+	// Restore stdout
+	w.Close()
+	os.Stdout = oldStdout
+	io.ReadAll(r) // Drain the pipe
+
+	if err != nil {
+		t.Fatalf("Failed to bootstrap PDS: %v", err)
+	}
+
+	// Create mock HTTP client
+	mockClient := &mockPDSClient{}
+
+	// Create OCI handler with mock S3
+	handler := NewXRPCHandler(holdPDS, s3Service, mockDriver, false, mockClient, nil)
+
+	return handler, mockS3Client, mockDriver
+}
+
+// setupTestOCIHandlerWithS3 creates a test OCI XRPC handler with S3 driver
+// This requires real S3 credentials or a mock S3 server (like MinIO)
+// Returns nil if S3 is not configured
+func setupTestOCIHandlerWithS3(t *testing.T) (*XRPCHandler, bool) {
+	t.Helper()
+
+	// Check if S3 credentials are available
+	bucket := os.Getenv("S3_BUCKET")
+	if bucket == "" {
+		return nil, false // S3 not configured, skip S3-dependent tests
+	}
+
+	// Create temp directory for PDS database
 	tmpDir := t.TempDir()
 	storageDir := filepath.Join(tmpDir, "blobs")
 
 	// Create context
-	ctx := context.Background()
+	ctx := t.Context()
 
-	// Create filesystem storage driver
-	params := map[string]any{
-		"rootdirectory": storageDir,
+	// Create S3 storage driver
+	s3Params := map[string]any{
+		"bucket":    bucket,
+		"region":    os.Getenv("AWS_REGION"),
+		"accesskey": os.Getenv("AWS_ACCESS_KEY_ID"),
+		"secretkey": os.Getenv("AWS_SECRET_ACCESS_KEY"),
 	}
-	driver, err := factory.Create(ctx, "filesystem", params)
+	if endpoint := os.Getenv("S3_ENDPOINT"); endpoint != "" {
+		s3Params["regionendpoint"] = endpoint
+	}
+	if s3Params["region"] == nil || s3Params["region"] == "" {
+		s3Params["region"] = "us-east-1"
+	}
+	s3Params["rootdirectory"] = storageDir
+
+	driver, err := factory.Create(ctx, "s3", s3Params)
+	if err != nil {
+		t.Logf("Failed to create S3 storage driver: %v", err)
+		return nil, false
+	}
+
+	// Create S3 service
+	s3Service, err := s3.NewS3Service(s3Params)
 	if err != nil {
-		t.Fatalf("Failed to create storage driver: %v", err)
+		t.Logf("Failed to create S3 service: %v", err)
+		return nil, false
 	}
 
 	// Create minimal PDS for DID/auth
-	// Use in-memory database for speed
 	dbPath := ":memory:"
 	keyPath := filepath.Join(tmpDir, "signing-key")
 	holdDID := "did:web:hold.example.com"
···
 	// Create mock HTTP client
 	mockClient := &mockPDSClient{}
 
-	// Create OCI handler with buffered mode (no S3)
-	mockS3 := s3.S3Service{}
-	handler := NewXRPCHandler(holdPDS, mockS3, driver, true, false, mockClient, nil)
+	// Create OCI handler with S3
+	handler := NewXRPCHandler(holdPDS, *s3Service, driver, false, mockClient, nil)
 
-	return handler, ctx
+	return handler, true
 }
 
 // Helper function to create JSON request
···
 	}
 }
 
-// Tests for HandleInitiateUpload
+// Tests for HandleInitiateUpload - Mock S3 (no credentials required)
 
-func TestHandleInitiateUpload_Success(t *testing.T) {
-	handler, _ := setupTestOCIHandler(t)
+func TestHandleInitiateUpload_MockS3_Success(t *testing.T) {
+	handler, mockS3Client, _ := setupTestOCIHandlerWithMockS3(t)
 
 	req := makeJSONRequest("POST", atproto.HoldInitiateUpload, map[string]string{
 		"digest": "sha256:abc123",
···
 	if !ok || uploadID == "" {
 		t.Error("Expected uploadId in response")
 	}
+
+	// Verify mock S3 was called
+	if len(mockS3Client.CreateMultipartCalls) != 1 {
+		t.Errorf("Expected 1 CreateMultipartUpload call, got %d", len(mockS3Client.CreateMultipartCalls))
+	}
 }
 
-func TestHandleInitiateUpload_MissingDigest(t *testing.T) {
-	handler, _ := setupTestOCIHandler(t)
+func TestHandleInitiateUpload_MockS3_MissingDigest(t *testing.T) {
+	handler, _, _ := setupTestOCIHandlerWithMockS3(t)
 
 	req := makeJSONRequest("POST", atproto.HoldInitiateUpload, map[string]string{})
 	addMockAuth(req)
···
 	}
 }
 
-// NOTE: Authorization tests are handled separately via chi router middleware tests.
-// When calling handlers directly (not through router), middleware doesn't execute.
-// See TestRequireBlobWriteAccess_* tests for middleware auth validation.
+// Tests for full Mock S3 upload flow (no credentials required)
 
-// Tests for HandleGetPartUploadUrl
+func TestFullMockS3UploadFlow(t *testing.T) {
+	handler, mockS3Client, _ := setupTestOCIHandlerWithMockS3(t)
 
-func TestHandleGetPartUploadUrl_Buffered(t *testing.T) {
-	handler, _ := setupTestOCIHandler(t)
-
-	// First, initiate an upload
+	// 1. Initiate upload
 	initReq := makeJSONRequest("POST", atproto.HoldInitiateUpload, map[string]string{
-		"digest": "sha256:abc123",
+		"digest": "uploads/temp-test-flow",
 	})
 	addMockAuth(initReq)
 	initW := httptest.NewRecorder()
 	handler.HandleInitiateUpload(initW, initReq)
 
+	if initW.Code != http.StatusOK {
+		t.Fatalf("Expected status 200, got %d: %s", initW.Code, initW.Body.String())
+	}
+
 	var initResp map[string]any
 	decodeJSONResponse(t, initW, &initResp)
 	uploadID := initResp["uploadId"].(string)
 
-	// Now get part upload URL
-	req := makeJSONRequest("POST", atproto.HoldGetPartUploadURL, map[string]any{
+	// 2. Get part upload URL
+	partReq := makeJSONRequest("POST", atproto.HoldGetPartUploadURL, map[string]any{
 		"uploadId":   uploadID,
 		"partNumber": 1,
 	})
+	addMockAuth(partReq)
+	partW := httptest.NewRecorder()
+	handler.HandleGetPartUploadURL(partW, partReq)
+
+	if partW.Code != http.StatusOK {
+		t.Fatalf("Expected status 200, got %d: %s", partW.Code, partW.Body.String())
+	}
+
+	var partResp PartUploadInfo
+	decodeJSONResponse(t, partW, &partResp)
+
+	// Should return presigned URL from mock
+	if partResp.URL == "" {
+		t.Error("Expected presigned URL")
+	}
+
+	// URL should point to mock server
+	if partResp.URL == "" || partResp.URL[0:4] != "http" {
+		t.Errorf("Expected valid URL, got %s", partResp.URL)
+	}
+
+	// 3. Abort the upload
+	abortReq := makeJSONRequest("POST", atproto.HoldAbortUpload, map[string]string{
+		"uploadId": uploadID,
+	})
+	addMockAuth(abortReq)
+	abortW := httptest.NewRecorder()
+	handler.HandleAbortUpload(abortW, abortReq)
+
+	if abortW.Code != http.StatusOK {
+		t.Errorf("Expected status 200, got %d: %s", abortW.Code, abortW.Body.String())
+	}
+
+	// Verify S3 operations were called
+	if len(mockS3Client.CreateMultipartCalls) != 1 {
+		t.Errorf("Expected 1 CreateMultipart call, got %d", len(mockS3Client.CreateMultipartCalls))
+	}
+	if len(mockS3Client.UploadPartCalls) != 1 {
+		t.Errorf("Expected 1 UploadPart call, got %d", len(mockS3Client.UploadPartCalls))
+	}
+	if len(mockS3Client.AbortCalls) != 1 {
+		t.Errorf("Expected 1 Abort call, got %d", len(mockS3Client.AbortCalls))
+	}
+}
+
+func TestHandleGetPartUploadUrl_MockS3_InvalidSession(t *testing.T) {
+	handler, _, _ := setupTestOCIHandlerWithMockS3(t)
+
+	req := makeJSONRequest("POST", atproto.HoldGetPartUploadURL, map[string]any{
+		"uploadId":   "invalid-upload-id",
+		"partNumber": 1,
+	})
 	addMockAuth(req)
 
 	w := httptest.NewRecorder()
 	handler.HandleGetPartUploadURL(w, req)
 
+	if w.Code != http.StatusInternalServerError {
+		t.Errorf("Expected status 500, got %d", w.Code)
+	}
+}
+
+func TestHandleAbortUpload_MockS3_InvalidSession(t *testing.T) {
+	handler, _, _ := setupTestOCIHandlerWithMockS3(t)
+
+	req := makeJSONRequest("POST", atproto.HoldAbortUpload, map[string]string{
+		"uploadId": "invalid-upload-id",
+	})
+	addMockAuth(req)
+
+	w := httptest.NewRecorder()
+	handler.HandleAbortUpload(w, req)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Errorf("Expected status 500, got %d", w.Code)
+	}
+}
+
+// Tests for HandleInitiateUpload - requires real S3
+
+func TestHandleInitiateUpload_WithS3_Success(t *testing.T) {
+	handler, hasS3 := setupTestOCIHandlerWithS3(t)
+	if !hasS3 {
+		t.Skip("S3 not configured, skipping test")
+	}
+
+	req := makeJSONRequest("POST", atproto.HoldInitiateUpload, map[string]string{
+		"digest": "sha256:abc123",
+	})
+	addMockAuth(req)
+
+	w := httptest.NewRecorder()
+	handler.HandleInitiateUpload(w, req)
+
 	if w.Code != http.StatusOK {
 		t.Errorf("Expected status 200, got %d: %s", w.Code, w.Body.String())
 	}
 
-	var resp PartUploadInfo
+	var resp map[string]any
 	decodeJSONResponse(t, w, &resp)
 
-	// Buffered mode should return XRPC endpoint
-	if resp.Method != "PUT" {
-		t.Errorf("Expected method PUT, got %s", resp.Method)
+	uploadID, ok := resp["uploadId"].(string)
+	if !ok || uploadID == "" {
+		t.Error("Expected uploadId in response")
 	}
-	if resp.Headers == nil || resp.Headers["X-Upload-Id"] != uploadID {
-		t.Error("Expected X-Upload-Id header in buffered mode")
+}
+
+func TestHandleInitiateUpload_MissingDigest(t *testing.T) {
+	handler, hasS3 := setupTestOCIHandlerWithS3(t)
+	if !hasS3 {
+		t.Skip("S3 not configured, skipping test")
+	}
+
+	req := makeJSONRequest("POST", atproto.HoldInitiateUpload, map[string]string{})
+	addMockAuth(req)
+
+	w := httptest.NewRecorder()
+	handler.HandleInitiateUpload(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("Expected status 400, got %d", w.Code)
 	}
 }
 
+// Tests for HandleGetPartUploadUrl - requires S3
+
 func TestHandleGetPartUploadUrl_InvalidSession(t *testing.T) {
-	handler, _ := setupTestOCIHandler(t)
+	handler, hasS3 := setupTestOCIHandlerWithS3(t)
+	if !hasS3 {
+		t.Skip("S3 not configured, skipping test")
+	}
 
 	req := makeJSONRequest("POST", atproto.HoldGetPartUploadURL, map[string]any{
 		"uploadId":   "invalid-upload-id",
···
 }
 
 func TestHandleGetPartUploadUrl_MissingParams(t *testing.T) {
-	handler, _ := setupTestOCIHandler(t)
+	handler, hasS3 := setupTestOCIHandlerWithS3(t)
+	if !hasS3 {
+		t.Skip("S3 not configured, skipping test")
+	}
 
 	tests := []struct {
 		name string
···
 	}
 }
 
-// Tests for HandleUploadPart
+// Tests for HandleCompleteUpload
+
+func TestHandleCompleteUpload_MissingParts(t *testing.T) {
+	handler, hasS3 := setupTestOCIHandlerWithS3(t)
+	if !hasS3 {
+		t.Skip("S3 not configured, skipping test")
+	}
+
+	req := makeJSONRequest("POST", atproto.HoldCompleteUpload, map[string]any{
+		"uploadId": "test-id",
+		"digest":   "sha256:test",
+		"parts":    []any{},
+	})
+	addMockAuth(req)
+
+	w := httptest.NewRecorder()
+	handler.HandleCompleteUpload(w, req)
+
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("Expected status 400, got %d", w.Code)
+	}
+}
+
+func TestHandleCompleteUpload_InvalidSession(t *testing.T) {
+	handler, hasS3 := setupTestOCIHandlerWithS3(t)
+	if !hasS3 {
+		t.Skip("S3 not configured, skipping test")
+	}
+
+	req := makeJSONRequest("POST", atproto.HoldCompleteUpload, map[string]any{
+		"uploadId": "invalid-upload-id",
+		"digest":   "sha256:test",
+		"parts": []any{
+			map[string]any{"partNumber": 1, "etag": "abc"},
+		},
+	})
+	addMockAuth(req)
+
+	w := httptest.NewRecorder()
+	handler.HandleCompleteUpload(w, req)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Errorf("Expected status 500, got %d", w.Code)
+	}
+}
+
+// Tests for HandleAbortUpload
+
+func TestHandleAbortUpload_InvalidSession(t *testing.T) {
+	handler, hasS3 := setupTestOCIHandlerWithS3(t)
+	if !hasS3 {
+		t.Skip("S3 not configured, skipping test")
+	}
+
+	req := makeJSONRequest("POST", atproto.HoldAbortUpload, map[string]string{
+		"uploadId": "invalid-upload-id",
+	})
+	addMockAuth(req)
+
+	w := httptest.NewRecorder()
+	handler.HandleAbortUpload(w, req)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Errorf("Expected status 500, got %d", w.Code)
+	}
+}
 
-func TestHandleUploadPart_Success(t *testing.T) {
-	handler, _ := setupTestOCIHandler(t)
+// Tests for full S3 upload flow
 
-	// Initiate upload
+func TestFullS3UploadFlow(t *testing.T) {
+	handler, hasS3 := setupTestOCIHandlerWithS3(t)
+	if !hasS3 {
+		t.Skip("S3 not configured, skipping test")
+	}
+
+	// 1. Initiate upload
 	initReq := makeJSONRequest("POST", atproto.HoldInitiateUpload, map[string]string{
-		"digest": "sha256:abc123",
+		"digest": "uploads/temp-test-flow",
 	})
 	addMockAuth(initReq)
 	initW := httptest.NewRecorder()
 	handler.HandleInitiateUpload(initW, initReq)
 
+	if initW.Code != http.StatusOK {
+		t.Fatalf("Expected status 200, got %d: %s", initW.Code, initW.Body.String())
+	}
+
 	var initResp map[string]any
 	decodeJSONResponse(t, initW, &initResp)
 	uploadID := initResp["uploadId"].(string)
 
-	// Upload a part
-	partData := []byte("test part data")
-	req := httptest.NewRequest("PUT", atproto.HoldUploadPart, bytes.NewReader(partData))
-	req.Header.Set("X-Upload-Id", uploadID)
-	req.Header.Set("X-Part-Number", "1")
-	addMockAuth(req)
+	// 2. Get part upload URL
+	partReq := makeJSONRequest("POST", atproto.HoldGetPartUploadURL, map[string]any{
+		"uploadId":   uploadID,
+		"partNumber": 1,
+	})
+	addMockAuth(partReq)
+	partW := httptest.NewRecorder()
+	handler.HandleGetPartUploadURL(partW, partReq)
 
-	w := httptest.NewRecorder()
-	handler.HandleUploadPart(w, req)
+	if partW.Code != http.StatusOK {
+		t.Fatalf("Expected status 200, got %d: %s", partW.Code, partW.Body.String())
+	}
+
+	var partResp PartUploadInfo
+	decodeJSONResponse(t, partW, &partResp)
 
-	if w.Code != http.StatusOK {
-		t.Errorf("Expected status 200, got %d: %s", w.Code, w.Body.String())
+	// Should return presigned URL
+	if partResp.URL == "" {
+		t.Error("Expected presigned URL")
 	}
 
-	var resp map[string]any
-	decodeJSONResponse(t, w, &resp)
+	// 3. Abort the upload (we're not actually uploading to S3 in tests)
+	abortReq := makeJSONRequest("POST", atproto.HoldAbortUpload, map[string]string{
+		"uploadId": uploadID,
+	})
+	addMockAuth(abortReq)
+	abortW := httptest.NewRecorder()
+	handler.HandleAbortUpload(abortW, abortReq)
 
-	etag, ok := resp["etag"].(string)
-	if !ok || etag == "" {
-		t.Error("Expected etag in response")
+	if abortW.Code != http.StatusOK {
+		t.Errorf("Expected status 200, got %d: %s", abortW.Code, abortW.Body.String())
 	}
 }
 
-func TestHandleUploadPart_MissingHeaders(t *testing.T) {
-	handler, _ := setupTestOCIHandler(t)
+// Tests for HandleCompleteUpload with Mock S3
+
+func TestHandleCompleteUpload_MockS3_Success(t *testing.T) {
+	handler, mockS3Client, mockDriver := setupTestOCIHandlerWithMockS3(t)
+
+	// 1. Initiate upload with temp path
+	tempDigest := "uploads/temp-test-complete"
+	initReq := makeJSONRequest("POST", atproto.HoldInitiateUpload, map[string]string{
+		"digest": tempDigest,
+	})
+	addMockAuth(initReq)
+	initW := httptest.NewRecorder()
+	handler.HandleInitiateUpload(initW, initReq)
+
+	if initW.Code != http.StatusOK {
+		t.Fatalf("Expected status 200 for initiate, got %d: %s", initW.Code, initW.Body.String())
+	}
+
+	var initResp map[string]any
+	decodeJSONResponse(t, initW, &initResp)
+	uploadID := initResp["uploadId"].(string)
+
+	// 2. Get part upload URL (so session has S3 upload info)
+	partReq := makeJSONRequest("POST", atproto.HoldGetPartUploadURL, map[string]any{
+		"uploadId":   uploadID,
+		"partNumber": 1,
+	})
+	addMockAuth(partReq)
+	partW := httptest.NewRecorder()
+	handler.HandleGetPartUploadURL(partW, partReq)
+
+	if partW.Code != http.StatusOK {
+		t.Fatalf("Expected status 200 for part URL, got %d: %s", partW.Code, partW.Body.String())
+	}
+
+	// 3. Pre-populate mock storage driver with temp blob (simulates S3 upload completing)
+	// Path format: /docker/registry/v2/uploads/temp-{id}/data
+	tempBlobPath := fmt.Sprintf("/docker/registry/v2/%s/data", tempDigest)
+	mockDriver.PutContent(t.Context(), tempBlobPath, []byte("test blob content"))
+
+	// 4. Complete upload with parts
+	finalDigest := "sha256:abc123def456"
+	completeReq := makeJSONRequest("POST", atproto.HoldCompleteUpload, map[string]any{
+		"uploadId": uploadID,
+		"digest":   finalDigest,
+		"parts": []any{
+			map[string]any{"part_number": 1, "etag": "abc123"},
+		},
+	})
+	addMockAuth(completeReq)
+	completeW := httptest.NewRecorder()
+	handler.HandleCompleteUpload(completeW, completeReq)
+
+	if completeW.Code != http.StatusOK {
+		t.Fatalf("Expected status 200, got %d: %s", completeW.Code, completeW.Body.String())
+	}
+
+	var completeResp map[string]any
+	decodeJSONResponse(t, completeW, &completeResp)
+
+	if completeResp["status"] != "completed" {
+		t.Errorf("Expected status=completed, got %v", completeResp["status"])
+	}
+	if completeResp["digest"] != finalDigest {
+		t.Errorf("Expected digest=%s, got %v", finalDigest, completeResp["digest"])
+	}
+
+	// 5. Verify S3 operations were called
+	if len(mockS3Client.CompleteCalls) != 1 {
+		t.Errorf("Expected 1 Complete call, got %d", len(mockS3Client.CompleteCalls))
+	}
+
+	// 6. Verify blob was moved to final location
+	// Final path format: /docker/registry/v2/blobs/sha256/ab/abc123def456/data
+	finalBlobPath := "/docker/registry/v2/blobs/sha256/ab/abc123def456/data"
+	_, err := mockDriver.Stat(t.Context(), finalBlobPath)
+	if err != nil {
+		t.Errorf("Expected blob at final location %s, got error: %v", finalBlobPath, err)
+	}
+}
+
+func TestHandleCompleteUpload_MockS3_InvalidSession(t *testing.T) {
+	handler, _, _ := setupTestOCIHandlerWithMockS3(t)
+
+	req := makeJSONRequest("POST", atproto.HoldCompleteUpload, map[string]any{
+		"uploadId": "non-existent-upload-id",
+		"digest":   "sha256:test",
+		"parts": []any{
+			map[string]any{"part_number": 1, "etag": "abc123"},
+		},
+	})
+	addMockAuth(req)
+
+	w := httptest.NewRecorder()
+	handler.HandleCompleteUpload(w, req)
+
+	if w.Code != http.StatusInternalServerError {
+		t.Errorf("Expected status 500, got %d: %s", w.Code, w.Body.String())
+	}
+}
+
+func TestHandleCompleteUpload_MockS3_MissingParams(t *testing.T) {
+	handler, _, _ := setupTestOCIHandlerWithMockS3(t)
 
 	tests := []struct {
-		name          string
-		uploadID      string
-		partNumber    string
-		expectedCode  int
-		expectedError string
+		name string
+		body map[string]any
 	}{
-		{"missing both headers", "", "", 400, "X-Upload-Id and X-Part-Number headers are required"},
-		{"missing upload ID", "", "1", 400, "X-Upload-Id and X-Part-Number headers are required"},
-		{"missing part number", "test-id", "", 400, "X-Upload-Id and X-Part-Number headers are required"},
+		{"missing uploadId", map[string]any{"digest": "sha256:test", "parts": []any{map[string]any{"part_number": 1, "etag": "abc"}}}},
+		{"missing digest", map[string]any{"uploadId": "test-id", "parts": []any{map[string]any{"part_number": 1, "etag": "abc"}}}},
+		{"missing parts", map[string]any{"uploadId": "test-id", "digest": "sha256:test"}},
+		{"empty parts", map[string]any{"uploadId": "test-id", "digest": "sha256:test", "parts": []any{}}},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			req := httptest.NewRequest("PUT", atproto.HoldUploadPart, bytes.NewReader([]byte("data")))
-			if tt.uploadID != "" {
-				req.Header.Set("X-Upload-Id", tt.uploadID)
-			}
-			if tt.partNumber != "" {
-				req.Header.Set("X-Part-Number", tt.partNumber)
-			}
+			req := makeJSONRequest("POST", atproto.HoldCompleteUpload, tt.body)
 			addMockAuth(req)
 
 			w := httptest.NewRecorder()
-			handler.HandleUploadPart(w, req)
+			handler.HandleCompleteUpload(w, req)
 
-			if w.Code != tt.expectedCode {
-				t.Errorf("Expected status %d, got %d", tt.expectedCode, w.Code)
+			if w.Code != http.StatusBadRequest {
+				t.Errorf("Expected status 400, got %d: %s", w.Code, w.Body.String())
 			}
 		})
 	}
 }
 
-func TestHandleUploadPart_InvalidPartNumber(t *testing.T) {
-	handler, _ := setupTestOCIHandler(t)
+func TestHandleCompleteUpload_MockS3_ETagNormalization(t *testing.T) {
+	handler, mockS3Client, mockDriver := setupTestOCIHandlerWithMockS3(t)
+
+	// Setup upload session
+	tempDigest := "uploads/temp-etag-test"
+	initReq := makeJSONRequest("POST", atproto.HoldInitiateUpload, map[string]string{
+		"digest": tempDigest,
+	})
+	addMockAuth(initReq)
+	initW := httptest.NewRecorder()
+	handler.HandleInitiateUpload(initW, initReq)
 
-	req := httptest.NewRequest("PUT", atproto.HoldUploadPart, bytes.NewReader([]byte("data")))
-	req.Header.Set("X-Upload-Id", "test-id")
-	req.Header.Set("X-Part-Number", "not-a-number")
-	addMockAuth(req)
+	var initResp map[string]any
+	decodeJSONResponse(t, initW, &initResp)
+	uploadID := initResp["uploadId"].(string)
 
-	w := httptest.NewRecorder()
-	handler.HandleUploadPart(w, req)
+	// Pre-populate mock driver
+	tempBlobPath := fmt.Sprintf("/docker/registry/v2/%s/data", tempDigest)
+	mockDriver.PutContent(t.Context(), tempBlobPath, []byte("test"))
 
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("Expected status 400, got %d", w.Code)
+	// Complete with unquoted ETags
+	completeReq := makeJSONRequest("POST", atproto.HoldCompleteUpload, map[string]any{
+		"uploadId": uploadID,
+		"digest":   "sha256:etagtest123",
+		"parts": []any{
+			map[string]any{"part_number": 1, "etag": "unquoted-etag"},      // No quotes
+			map[string]any{"part_number": 2, "etag": "\"already-quoted\""}, // Already quoted
+		},
+	})
+	addMockAuth(completeReq)
+	completeW := httptest.NewRecorder()
+	handler.HandleCompleteUpload(completeW, completeReq)
+
+	// Should succeed - handler normalizes ETags
+	if completeW.Code != http.StatusOK {
+		t.Errorf("Expected status 200, got %d: %s", completeW.Code, completeW.Body.String())
+	}
+
+	// Verify Complete was called with 2 parts
+	if len(mockS3Client.CompleteCalls) != 1 {
+		t.Fatalf("Expected 1 Complete call, got %d", len(mockS3Client.CompleteCalls))
+	}
+	if mockS3Client.CompleteCalls[0].Parts != 2 {
+		t.Errorf("Expected 2 parts in Complete call, got %d", mockS3Client.CompleteCalls[0].Parts)
 	}
 }
 
-// Tests for HandleCompleteUpload
+func TestHandleCompleteUpload_MockS3_S3Error(t *testing.T) {
+	handler, mockS3Client, mockDriver := setupTestOCIHandlerWithMockS3(t)
 
-func TestHandleCompleteUpload_BufferedMode(t *testing.T) {
-	handler, _ := setupTestOCIHandler(t)
+	// Setup upload session
+	tempDigest := "uploads/temp-s3-error"
+	initReq := makeJSONRequest("POST", atproto.HoldInitiateUpload, map[string]string{
+		"digest": tempDigest,
+	})
+	addMockAuth(initReq)
+	initW := httptest.NewRecorder()
+	handler.HandleInitiateUpload(initW, initReq)
+
+	var initResp map[string]any
+	decodeJSONResponse(t, initW, &initResp)
+	uploadID := initResp["uploadId"].(string)
+
+	// Pre-populate mock driver
+	tempBlobPath := fmt.Sprintf("/docker/registry/v2/%s/data", tempDigest)
+	mockDriver.PutContent(t.Context(), tempBlobPath, []byte("test"))
+
+	// Inject S3 error
+	mockS3Client.CompleteError = fmt.Errorf("simulated S3 CompleteMultipartUpload failure")
+
+	// Complete upload should fail
+	completeReq := makeJSONRequest("POST", atproto.HoldCompleteUpload, map[string]any{
+		"uploadId": uploadID,
+		"digest":   "sha256:s3error123",
+		"parts": []any{
+			map[string]any{"part_number": 1, "etag": "abc"},
+		},
+	})
+	addMockAuth(completeReq)
+	completeW := httptest.NewRecorder()
+	handler.HandleCompleteUpload(completeW, completeReq)
+
+	if completeW.Code != http.StatusInternalServerError {
+		t.Errorf("Expected status 500, got %d: %s", completeW.Code, completeW.Body.String())
+	}
+
+	// Verify error message mentions the failure
+	if !bytes.Contains(completeW.Body.Bytes(), []byte("failed to complete upload")) {
+		t.Errorf("Expected error message about failed complete, got: %s", completeW.Body.String())
+	}
+}
+
+func TestHandleCompleteUpload_MockS3_StatError(t *testing.T) {
+	handler, _, mockDriver := setupTestOCIHandlerWithMockS3(t)
 
-	// Initiate upload
+	// Setup upload session
+	tempDigest := "uploads/temp-stat-error"
 	initReq := makeJSONRequest("POST", atproto.HoldInitiateUpload, map[string]string{
-		"digest": "sha256:abc123",
+		"digest": tempDigest,
 	})
 	addMockAuth(initReq)
 	initW := httptest.NewRecorder()
···
 	decodeJSONResponse(t, initW, &initResp)
 	uploadID := initResp["uploadId"].(string)
 
-	// Upload parts
-	parts := []struct {
-		number int
-		data   string
-	}{
-		{1, "part one data"},
-		{2, "part two data"},
+	// Pre-populate mock driver (so S3 complete succeeds)
+	tempBlobPath := fmt.Sprintf("/docker/registry/v2/%s/data", tempDigest)
+	mockDriver.PutContent(t.Context(), tempBlobPath, []byte("test"))
+
+	// Inject Stat error (simulates blob not found after S3 complete)
+	mockDriver.StatError = fmt.Errorf("simulated stat failure")
+
+	// Complete upload should fail
+	completeReq := makeJSONRequest("POST", atproto.HoldCompleteUpload, map[string]any{
+		"uploadId": uploadID,
+		"digest":   "sha256:staterror123",
+		"parts": []any{
+			map[string]any{"part_number": 1, "etag": "abc"},
+		},
+	})
+	addMockAuth(completeReq)
+	completeW := httptest.NewRecorder()
+	handler.HandleCompleteUpload(completeW, completeReq)
+
+	if completeW.Code != http.StatusInternalServerError {
+		t.Errorf("Expected status 500, got %d: %s", completeW.Code, completeW.Body.String())
 	}
+}
 
-	var partInfos []map[string]any
-	for _, p := range parts {
-		req := httptest.NewRequest("PUT", atproto.HoldUploadPart, bytes.NewReader([]byte(p.data)))
-		req.Header.Set("X-Upload-Id", uploadID)
-		req.Header.Set("X-Part-Number", strconv.Itoa(p.number))
-		addMockAuth(req)
+func TestHandleCompleteUpload_MockS3_MoveError(t *testing.T) {
+	handler, _, mockDriver := setupTestOCIHandlerWithMockS3(t)
 
-		w := httptest.NewRecorder()
-		handler.HandleUploadPart(w, req)
+	// Setup upload session
+	tempDigest := "uploads/temp-move-error"
+	initReq := makeJSONRequest("POST", atproto.HoldInitiateUpload, map[string]string{
+		"digest": tempDigest,
+	})
+	addMockAuth(initReq)
+	initW := httptest.NewRecorder()
+	handler.HandleInitiateUpload(initW, initReq)
+
+	var initResp map[string]any
+	decodeJSONResponse(t, initW, &initResp)
+	uploadID := initResp["uploadId"].(string)
 
-		var resp map[string]any
-		decodeJSONResponse(t, w, &resp)
+	// Pre-populate mock driver
+	tempBlobPath := fmt.Sprintf("/docker/registry/v2/%s/data", tempDigest)
+	mockDriver.PutContent(t.Context(), tempBlobPath, []byte("test"))
 
-		partInfos = append(partInfos, map[string]any{
-			"partNumber": p.number,
-			"etag":       resp["etag"],
-		})
-	}
+	// Inject Move error
+	mockDriver.MoveError = fmt.Errorf("simulated move failure")
 
-	// Complete upload
+	// Complete upload should fail
 	completeReq := makeJSONRequest("POST", atproto.HoldCompleteUpload, map[string]any{
 		"uploadId": uploadID,
-		"digest":   "sha256:finaldigest123",
-		"parts":    partInfos,
+		"digest":   "sha256:moveerror123",
+		"parts": []any{
+			map[string]any{"part_number": 1, "etag": "abc"},
+		},
 	})
 	addMockAuth(completeReq)
+	completeW := httptest.NewRecorder()
+	handler.HandleCompleteUpload(completeW, completeReq)
 
-	w := httptest.NewRecorder()
-	handler.HandleCompleteUpload(w, completeReq)
+	if completeW.Code != http.StatusInternalServerError {
+		t.Errorf("Expected status 500, got %d: %s", completeW.Code, completeW.Body.String())
+	}
 
-	if w.Code != http.StatusOK {
-		t.Errorf("Expected status 200, got %d: %s", w.Code, w.Body.String())
+	// Verify error message mentions move failure
+	if !bytes.Contains(completeW.Body.Bytes(), []byte("failed to complete upload")) {
+		t.Errorf("Expected error message about failed complete, got: %s", completeW.Body.String())
 	}
+}
 
-	var resp map[string]any
-	decodeJSONResponse(t, w, &resp)
+func TestHandleCompleteUpload_MockS3_UnsortedParts(t *testing.T) {
+	handler, mockS3Client, mockDriver := setupTestOCIHandlerWithMockS3(t)
 
-	if resp["status"] != "completed" {
-		t.Errorf("Expected status=completed, got %v", resp["status"])
+	// Setup upload session
+	tempDigest := "uploads/temp-unsorted"
+	initReq := makeJSONRequest("POST", atproto.HoldInitiateUpload, map[string]string{
+		"digest": tempDigest,
+	})
+	addMockAuth(initReq)
+	initW := httptest.NewRecorder()
+	handler.HandleInitiateUpload(initW, initReq)
+
+	var initResp map[string]any
+	decodeJSONResponse(t, initW, &initResp)
+	uploadID := initResp["uploadId"].(string)
+
+	// Pre-populate mock driver
+	tempBlobPath := fmt.Sprintf("/docker/registry/v2/%s/data", tempDigest)
+	mockDriver.PutContent(t.Context(), tempBlobPath, []byte("test"))
+
+	// Complete with unsorted parts (3, 1, 2) - handler should sort them
+	completeReq := makeJSONRequest("POST", atproto.HoldCompleteUpload, map[string]any{
+		"uploadId": uploadID,
+		"digest":   "sha256:unsorted123",
+		"parts": []any{
+			map[string]any{"part_number": 3, "etag": "etag3"},
+			map[string]any{"part_number": 1, "etag": "etag1"},
+			map[string]any{"part_number": 2, "etag": "etag2"},
+		},
+	})
+	addMockAuth(completeReq)
+	completeW := httptest.NewRecorder()
+	handler.HandleCompleteUpload(completeW, completeReq)
+
+	if completeW.Code != http.StatusOK {
+		t.Errorf("Expected status 200, got %d: %s", completeW.Code, completeW.Body.String())
 	}
-	if resp["digest"] != "sha256:finaldigest123" {
-		t.Errorf("Expected digest=sha256:finaldigest123, got %v", resp["digest"])
+
+	// Verify Complete was called with 3 parts
+	if len(mockS3Client.CompleteCalls) != 1 {
+		t.Fatalf("Expected 1 Complete call, got %d", len(mockS3Client.CompleteCalls))
+	}
+	if mockS3Client.CompleteCalls[0].Parts != 3 {
+		t.Errorf("Expected 3 parts, got %d", mockS3Client.CompleteCalls[0].Parts)
 	}
 }
 
-func TestHandleCompleteUpload_MissingParts(t *testing.T) {
-	handler, _ := setupTestOCIHandler(t)
+// Tests for HandleInitiateUpload edge cases
+
+func TestHandleInitiateUpload_MockS3_S3Error(t *testing.T) {
+	handler, mockS3Client, _ := setupTestOCIHandlerWithMockS3(t)
+
+	// Inject S3 error
+	mockS3Client.CreateMultipartError = fmt.Errorf("simulated S3 CreateMultipartUpload failure")
 
-	req := makeJSONRequest("POST", atproto.HoldCompleteUpload, map[string]any{
-		"uploadId": "test-id",
-		"digest":   "sha256:test",
-		"parts":    []any{},
+	req := makeJSONRequest("POST", atproto.HoldInitiateUpload, map[string]string{
+		"digest": "sha256:test123",
 	})
 	addMockAuth(req)
 
 	w := httptest.NewRecorder()
-	handler.HandleCompleteUpload(w, req)
+	handler.HandleInitiateUpload(w, req)
 
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("Expected status 400, got %d", w.Code)
+	if w.Code != http.StatusInternalServerError {
+		t.Errorf("Expected status 500, got %d: %s", w.Code, w.Body.String())
+	}
+
+	// Verify error message
+	if !bytes.Contains(w.Body.Bytes(), []byte("failed to initiate upload")) {
+		t.Errorf("Expected error about failed initiate, got: %s", w.Body.String())
 	}
 }
 
-func TestHandleCompleteUpload_InvalidSession(t *testing.T) {
-	handler, _ := setupTestOCIHandler(t)
+func TestHandleInitiateUpload_MockS3_WhitespaceDigest(t *testing.T) {
+	handler, _, _ := setupTestOCIHandlerWithMockS3(t)
 
-	req := makeJSONRequest("POST", atproto.HoldCompleteUpload, map[string]any{
-		"uploadId": "invalid-upload-id",
-		"digest":   "sha256:test",
-		"parts": []any{
-			map[string]any{"partNumber": 1, "etag": "abc"},
-		},
+	req := makeJSONRequest("POST", atproto.HoldInitiateUpload, map[string]string{
+		"digest": "   ", // Whitespace only
 	})
 	addMockAuth(req)
 
 	w := httptest.NewRecorder()
-	handler.HandleCompleteUpload(w, req)
+	handler.HandleInitiateUpload(w, req)
 
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("Expected status 500, got %d", w.Code)
+	// Current implementation doesn't validate whitespace, so this may succeed
+	// or fail based on S3 key validation. This test documents the behavior.
+	// If you want to enforce validation, update the handler and change this assertion.
+	if w.Code == http.StatusOK {
+		t.Log("Handler accepts whitespace digest (S3 may reject it)")
 	}
 }
 
-// Tests for HandleAbortUpload
+// Tests for HandleGetPartUploadURL edge cases
+
+func TestHandleGetPartUploadUrl_MockS3_MissingParams(t *testing.T) {
+	handler, _, _ := setupTestOCIHandlerWithMockS3(t)
+
+	tests := []struct {
+		name string
+		body map[string]any
+	}{
+		{"missing uploadId", map[string]any{"partNumber": 1}},
+		{"missing partNumber", map[string]any{"uploadId": "test-id"}},
+		{"partNumber is zero", map[string]any{"uploadId": "test-id", "partNumber": 0}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			req := makeJSONRequest("POST", atproto.HoldGetPartUploadURL, tt.body)
+			addMockAuth(req)
+
+			w := httptest.NewRecorder()
+			handler.HandleGetPartUploadURL(w, req)
+
+			if w.Code != http.StatusBadRequest {
+				t.Errorf("Expected status 400, got %d: %s", w.Code, w.Body.String())
+			}
+		})
+	}
+}
 
-func TestHandleAbortUpload_Success(t *testing.T) {
-	handler, _ := setupTestOCIHandler(t)
+func TestHandleGetPartUploadUrl_MockS3_ValidSession(t *testing.T) {
+	handler, mockS3Client, _ := setupTestOCIHandlerWithMockS3(t)
 
-	// Initiate upload
+	// First initiate an upload
 	initReq := makeJSONRequest("POST", atproto.HoldInitiateUpload, map[string]string{
-		"digest": "sha256:abc123",
+		"digest": "sha256:parttest123",
 	})
 	addMockAuth(initReq)
 	initW := httptest.NewRecorder()
···
 	decodeJSONResponse(t, initW, &initResp)
 	uploadID := initResp["uploadId"].(string)
 
-	// Abort upload
-	req := makeJSONRequest("POST", atproto.HoldAbortUpload, map[string]string{
-		"uploadId": uploadID,
+	// Now get part upload URL
+	partReq := makeJSONRequest("POST", atproto.HoldGetPartUploadURL, map[string]any{
+		"uploadId":   uploadID,
+		"partNumber": 5, // Arbitrary part number
 	})
+	addMockAuth(partReq)
+
+	partW := httptest.NewRecorder()
+	handler.HandleGetPartUploadURL(partW, partReq)
+
+	if partW.Code != http.StatusOK {
+		t.Errorf("Expected status 200, got %d: %s", partW.Code, partW.Body.String())
+	}
+
+	var partResp PartUploadInfo
+	decodeJSONResponse(t, partW, &partResp)
+
+	// Verify URL is returned
+	if partResp.URL == "" {
+		t.Error("Expected non-empty presigned URL")
+	}
+
+	// Verify mock S3 was called with correct part number
+	if len(mockS3Client.UploadPartCalls) != 1 {
+		t.Fatalf("Expected 1 UploadPart call, got %d", len(mockS3Client.UploadPartCalls))
+	}
+	if mockS3Client.UploadPartCalls[0].PartNumber != 5 {
+		t.Errorf("Expected partNumber=5, got %d", mockS3Client.UploadPartCalls[0].PartNumber)
+	}
+}
+
+// Tests for HandleAbortUpload edge cases
+
+func TestHandleAbortUpload_MockS3_MissingUploadId(t *testing.T) {
+	handler, _, _ := setupTestOCIHandlerWithMockS3(t)
+
+	req := makeJSONRequest("POST", atproto.HoldAbortUpload, map[string]string{})
 	addMockAuth(req)
 
 	w := httptest.NewRecorder()
 	handler.HandleAbortUpload(w, req)
 
-	if w.Code != http.StatusOK {
-		t.Errorf("Expected status 200, got %d: %s", w.Code, w.Body.String())
+	if w.Code != http.StatusBadRequest {
+		t.Errorf("Expected status 400, got %d: %s", w.Code, w.Body.String())
 	}
+}
+
+func TestHandleAbortUpload_MockS3_S3Error(t *testing.T) {
+	handler, mockS3Client, _ := setupTestOCIHandlerWithMockS3(t)
 
-	var resp map[string]any
-	decodeJSONResponse(t, w, &resp)
+	// First initiate an upload
+	initReq := makeJSONRequest("POST", atproto.HoldInitiateUpload, map[string]string{
+		"digest": "sha256:aborttest123",
+	})
+	addMockAuth(initReq)
+	initW := httptest.NewRecorder()
+	handler.HandleInitiateUpload(initW, initReq)
+
+	var initResp map[string]any
+	decodeJSONResponse(t, initW, &initResp)
+	uploadID := initResp["uploadId"].(string)
 
+	// Inject S3 abort error
+	mockS3Client.AbortError = fmt.Errorf("simulated S3 AbortMultipartUpload failure")
+
+	// Abort should fail
+	abortReq := makeJSONRequest("POST", atproto.HoldAbortUpload, map[string]string{
+		"uploadId": uploadID,
+	})
+	addMockAuth(abortReq)
+
+	abortW := httptest.NewRecorder()
+	handler.HandleAbortUpload(abortW, abortReq)
+
+	if abortW.Code != http.StatusInternalServerError {
+		t.Errorf("Expected status 500, got %d: %s", abortW.Code, abortW.Body.String())
+	}
+
+	// Verify error message
+	if !bytes.Contains(abortW.Body.Bytes(), []byte("failed to abort upload")) {
+		t.Errorf("Expected error about failed abort, got: %s", abortW.Body.String())
+	}
+}
+
+func TestHandleAbortUpload_MockS3_ValidSession(t *testing.T) {
+	handler, mockS3Client, _ := setupTestOCIHandlerWithMockS3(t)
+
+	// First initiate an upload
+	initReq := makeJSONRequest("POST", atproto.HoldInitiateUpload, map[string]string{
+		"digest": "sha256:abortvalid123",
+	})
+	addMockAuth(initReq)
+	initW := httptest.NewRecorder()
+	handler.HandleInitiateUpload(initW, initReq)
+
+	var initResp map[string]any
+	decodeJSONResponse(t, initW, &initResp)
+	uploadID := initResp["uploadId"].(string)
+
+	// Abort should succeed
+	abortReq := makeJSONRequest("POST", atproto.HoldAbortUpload, map[string]string{
+		"uploadId": uploadID,
+	})
+	addMockAuth(abortReq)
+
+	abortW := httptest.NewRecorder()
+	handler.HandleAbortUpload(abortW, abortReq)
+
+	if abortW.Code != http.StatusOK {
+		t.Errorf("Expected status 200, got %d: %s", abortW.Code, abortW.Body.String())
+	}
+
+	// Verify response
+	var resp map[string]any
+	decodeJSONResponse(t, abortW, &resp)
 	if resp["status"] != "aborted" {
 		t.Errorf("Expected status=aborted, got %v", resp["status"])
 	}
-}
 
-func TestHandleAbortUpload_InvalidSession(t *testing.T) {
-	handler, _ := setupTestOCIHandler(t)
+	// Verify S3 was called
+	if len(mockS3Client.AbortCalls) != 1 {
+		t.Errorf("Expected 1 Abort call, got %d", len(mockS3Client.AbortCalls))
+	}
 
-	req := makeJSONRequest("POST", atproto.HoldAbortUpload, map[string]string{
-		"uploadId": "invalid-upload-id",
+	// Session should be deleted - trying to abort again should fail
+	abortReq2 := makeJSONRequest("POST", atproto.HoldAbortUpload, map[string]string{
+		"uploadId": uploadID,
 	})
-	addMockAuth(req)
+	addMockAuth(abortReq2)
 
-	w := httptest.NewRecorder()
-	handler.HandleAbortUpload(w, req)
+	abortW2 := httptest.NewRecorder()
+	handler.HandleAbortUpload(abortW2, abortReq2)
 
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("Expected status 500, got %d", w.Code)
+	if abortW2.Code != http.StatusInternalServerError {
+		t.Errorf("Expected status 500 for deleted session, got %d", abortW2.Code)
 	}
 }

pkg/hold/pds/xrpc.go

···
 		switch operation {
 		case http.MethodGet:
 			// Note: Don't use ResponseContentType - not supported by all S3-compatible services
-			req, _ = h.s3Service.Client.GetObjectRequest(&awss3.GetObjectInput{
+			req = h.s3Service.Client.GetObjectPresignable(&awss3.GetObjectInput{
 				Bucket: &h.s3Service.Bucket,
 				Key:    &s3Key,
 			})
 
 		case http.MethodHead:
-			req, _ = h.s3Service.Client.HeadObjectRequest(&awss3.HeadObjectInput{
+			req = h.s3Service.Client.HeadObjectPresignable(&awss3.HeadObjectInput{
 				Bucket: &h.s3Service.Bucket,
 				Key:    &s3Key,
 			})
 
 		case http.MethodPut:
-			req, _ = h.s3Service.Client.PutObjectRequest(&awss3.PutObjectInput{
+			req = h.s3Service.Client.PutObjectPresignable(&awss3.PutObjectInput{
 				Bucket:      &h.s3Service.Bucket,
 				Key:         &s3Key,
 				ContentType: &contentType,

pkg/hold/pds/xrpc_test.go

···
 	}
 }
 
+// setupTestXRPCHandlerWithMockS3 creates handler with MockS3Client for testing presigned URLs
+func setupTestXRPCHandlerWithMockS3(t *testing.T) (*XRPCHandler, *s3.MockS3Client, context.Context) {
+	t.Helper()
+
+	ctx := context.Background()
+	tmpDir := t.TempDir()
+
+	// Use in-memory database for speed
+	dbPath := ":memory:"
+	keyPath := filepath.Join(tmpDir, "signing-key")
+
+	// Copy shared signing key instead of generating a new one
+	if err := os.WriteFile(keyPath, sharedTestKey, 0600); err != nil {
+		t.Fatalf("Failed to copy shared signing key: %v", err)
+	}
+
+	pds, err := NewHoldPDS(ctx, "did:web:hold.example.com", "https://hold.example.com", dbPath, keyPath, false)
+	if err != nil {
+		t.Fatalf("Failed to create test PDS: %v", err)
+	}
+
+	// Bootstrap with a test owner, suppressing stdout to avoid log spam
+	ownerDID := "did:plc:testowner123"
+
+	// Redirect stdout to suppress bootstrap logging
+	oldStdout := os.Stdout
+	r, w, _ := os.Pipe()
+	os.Stdout = w
+
+	err = pds.Bootstrap(ctx, nil, ownerDID, true, false, "", "")
+
+	// Restore stdout
+	w.Close()
+	os.Stdout = oldStdout
+	io.ReadAll(r) // Drain the pipe
+
+	if err != nil {
+		t.Fatalf("Failed to bootstrap PDS: %v", err)
+	}
+
+	// Create MockS3Client for testing presigned URLs
+	mockS3Client := s3.NewMockS3Client("https://mock-s3.example.com")
+	s3Service := s3.S3Service{
+		Client:     mockS3Client,
+		Bucket:     "test-bucket",
+		PathPrefix: "test-prefix",
+	}
+
+	// Create filesystem storage driver for tests
+	storageDir := filepath.Join(tmpDir, "storage")
+	params := map[string]any{
+		"rootdirectory": storageDir,
+	}
+	driver, err := factory.Create(ctx, "filesystem", params)
+	if err != nil {
+		t.Fatalf("Failed to create storage driver: %v", err)
+	}
+
+	// Create mock PDS client for DPoP validation
+	mockClient := &mockPDSClient{}
+
+	// Create XRPC handler with mock S3 client and real filesystem driver
+	handler := NewXRPCHandler(pds, s3Service, driver, nil, mockClient, nil)
+
+	return handler, mockS3Client, ctx
+}
+
 // setupTestXRPCHandlerWithBlobs creates handler with mock s3 service and real filesystem driver
 func setupTestXRPCHandlerWithBlobs(t *testing.T) (*XRPCHandler, *mockS3Service, context.Context) {
 	t.Helper()
···
 	t.Skip("Skipping blob store error test - using real filesystem driver now")
 }
 
-// Tests for HandleGetBlob
+// Tests for HandleGetBlob with Mock S3 (presigned URLs)
+
+// TestHandleGetBlob_MockS3_SHA256Digest tests getBlob with OCI sha256 digest format using MockS3Client
+// This verifies that presigned S3 URLs are correctly generated
+func TestHandleGetBlob_MockS3_SHA256Digest(t *testing.T) {
+	handler, mockS3Client, _ := setupTestXRPCHandlerWithMockS3(t)
+
+	holdDID := "did:web:hold.example.com"
+	digest := "sha256:abc123def456" // OCI digest format
+
+	req := makeXRPCGetRequest(atproto.SyncGetBlob, map[string]string{
+		"did": holdDID,
+		"cid": digest,
+	})
+	w := httptest.NewRecorder()
+
+	handler.HandleGetBlob(w, req)
+
+	// Should return 200 OK with JSON response
+	if w.Code != http.StatusOK {
+		t.Errorf("Expected status 200 OK, got %d", w.Code)
+	}
+
+	// Parse JSON response
+	var response map[string]string
+	if err := json.Unmarshal(w.Body.Bytes(), &response); err != nil {
+		t.Fatalf("Failed to parse JSON response: %v", err)
+	}
+
+	// Verify URL field points to mock S3
+	if response["url"] == "" {
+		t.Error("Expected url field in response")
+	}
+
+	// URL should be from mock S3 server
+	if !strings.Contains(response["url"], "mock-s3.example.com") {
+		t.Errorf("Expected mock S3 URL, got: %s", response["url"])
+	}
+
+	// Verify GetObjectPresignable was called
+	if len(mockS3Client.GetObjectCalls) != 1 {
+		t.Errorf("Expected 1 GetObject call, got %d", len(mockS3Client.GetObjectCalls))
+	}
+}
+
+// TestHandleGetBlob_MockS3_HeadMethod tests HEAD request support with MockS3Client
+func TestHandleGetBlob_MockS3_HeadMethod(t *testing.T) {
+	handler, mockS3Client, _ := setupTestXRPCHandlerWithMockS3(t)
+
+	holdDID := "did:web:hold.example.com"
+	digest := "sha256:abc123def456" // OCI digest format
+
+	// Use HEAD instead of GET with method query param
+	req := makeXRPCGetRequest(atproto.SyncGetBlob, map[string]string{
+		"did":    holdDID,
+		"cid":    digest,
+		"method": "HEAD",
+	})
+	w := httptest.NewRecorder()
+
+	handler.HandleGetBlob(w, req)
+
+	// Should return 200 OK with JSON response
+	if w.Code != http.StatusOK {
+		t.Errorf("Expected status 200 OK, got %d", w.Code)
+	}
+
+	// Parse JSON response
+	var response map[string]string
+	if err := json.Unmarshal(w.Body.Bytes(), &response); err != nil {
+		t.Fatalf("Failed to parse JSON response: %v", err)
+	}
+
+	// Verify URL field points to mock S3
+	if response["url"] == "" {
+		t.Error("Expected url field in response")
+	}
+
+	// URL should be from mock S3 server
+	if !strings.Contains(response["url"], "mock-s3.example.com") {
+		t.Errorf("Expected mock S3 URL, got: %s", response["url"])
+	}
+
+	// Verify HeadObjectPresignable was called
+	if len(mockS3Client.HeadObjectCalls) != 1 {
+		t.Errorf("Expected 1 HeadObject call, got %d", len(mockS3Client.HeadObjectCalls))
+	}
+}
+
+// TestHandleGetBlob_MockS3_PutMethod tests PUT request support with MockS3Client
+func TestHandleGetBlob_MockS3_PutMethod(t *testing.T) {
+	handler, mockS3Client, _ := setupTestXRPCHandlerWithMockS3(t)
+
+	holdDID := "did:web:hold.example.com"
+	digest := "sha256:abc123def456" // OCI digest format
+
+	req := makeXRPCGetRequest(atproto.SyncGetBlob, map[string]string{
+		"did":    holdDID,
+		"cid":    digest,
+		"method": "PUT",
+	})
+	w := httptest.NewRecorder()
+
+	handler.HandleGetBlob(w, req)
+
+	// Should return 200 OK with JSON response
+	if w.Code != http.StatusOK {
+		t.Errorf("Expected status 200 OK, got %d", w.Code)
+	}
+
+	// Parse JSON response
+	var response map[string]string
+	if err := json.Unmarshal(w.Body.Bytes(), &response); err != nil {
+		t.Fatalf("Failed to parse JSON response: %v", err)
+	}
+
+	// Verify URL field points to mock S3
+	if response["url"] == "" {
+		t.Error("Expected url field in response")
+	}
+
+	// URL should be from mock S3 server
+	if !strings.Contains(response["url"], "mock-s3.example.com") {
+		t.Errorf("Expected mock S3 URL, got: %s", response["url"])
+	}
+
+	// Verify PutObjectPresignable was called
+	if len(mockS3Client.PutObjectCalls) != 1 {
+		t.Errorf("Expected 1 PutObject call, got %d", len(mockS3Client.PutObjectCalls))
+	}
+}
+
+// Tests for HandleGetBlob (without S3 - fallback to XRPC proxy)
 
 // TestHandleGetBlob tests com.atproto.sync.getBlob with ATProto CID
 // ATProto blobs should return 307 redirect to presigned URL

pkg/s3/mock.go

···
+package s3
+
+import (
+	"fmt"
+	"sync"
+	"time"
+
+	"github.com/aws/aws-sdk-go/aws"
+	"github.com/aws/aws-sdk-go/aws/request"
+	"github.com/aws/aws-sdk-go/service/s3"
+	"github.com/google/uuid"
+)
+
+// mockPresignable implements Presignable for testing
+type mockPresignable struct {
+	url string
+}
+
+// Presign returns the pre-configured mock URL
+func (m *mockPresignable) Presign(expire time.Duration) (string, error) {
+	return m.url, nil
+}
+
+// MockS3Client implements S3Client for testing without real S3 credentials.
+// It generates fake presigned URLs that point to a test server.
+type MockS3Client struct {
+	// TestServerURL is the base URL for generating fake presigned URLs.
+	// Requests to these URLs should be handled by a test server (httptest.Server).
+	TestServerURL string
+
+	// UploadID is returned by CreateMultipartUploadWithContext.
+	// If empty, a UUID is generated.
+	UploadID string
+
+	// Track calls for verification in tests
+	mu                   sync.Mutex
+	CreateMultipartCalls []CreateMultipartCall
+	CompleteCalls        []CompleteCall
+	AbortCalls           []AbortCall
+	UploadPartCalls      []UploadPartCall
+	GetObjectCalls       []GetObjectCall
+	HeadObjectCalls      []HeadObjectCall
+	PutObjectCalls       []PutObjectCall
+
+	// Error injection for testing error handling
+	CreateMultipartError error
+	CompleteError        error
+	AbortError           error
+}
+
+// CreateMultipartCall records a CreateMultipartUploadWithContext call
+type CreateMultipartCall struct {
+	Bucket string
+	Key    string
+}
+
+// CompleteCall records a CompleteMultipartUploadWithContext call
+type CompleteCall struct {
+	Bucket   string
+	Key      string
+	UploadID string
+	Parts    int
+}
+
+// AbortCall records an AbortMultipartUploadWithContext call
+type AbortCall struct {
+	Bucket   string
+	Key      string
+	UploadID string
+}
+
+// UploadPartCall records an UploadPartRequest call
+type UploadPartCall struct {
+	Bucket     string
+	Key        string
+	UploadID   string
+	PartNumber int64
+}
+
+// GetObjectCall records a GetObjectRequest call
+type GetObjectCall struct {
+	Bucket string
+	Key    string
+}
+
+// HeadObjectCall records a HeadObjectRequest call
+type HeadObjectCall struct {
+	Bucket string
+	Key    string
+}
+
+// PutObjectCall records a PutObjectRequest call
+type PutObjectCall struct {
+	Bucket string
+	Key    string
+}
+
+// NewMockS3Client creates a new mock S3 client for testing
+func NewMockS3Client(testServerURL string) *MockS3Client {
+	return &MockS3Client{
+		TestServerURL:        testServerURL,
+		CreateMultipartCalls: []CreateMultipartCall{},
+		CompleteCalls:        []CompleteCall{},
+		AbortCalls:           []AbortCall{},
+		UploadPartCalls:      []UploadPartCall{},
+		GetObjectCalls:       []GetObjectCall{},
+		HeadObjectCalls:      []HeadObjectCall{},
+		PutObjectCalls:       []PutObjectCall{},
+	}
+}
+
+// CreateMultipartUploadWithContext implements S3Client
+func (m *MockS3Client) CreateMultipartUploadWithContext(ctx aws.Context, input *s3.CreateMultipartUploadInput, opts ...request.Option) (*s3.CreateMultipartUploadOutput, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	m.CreateMultipartCalls = append(m.CreateMultipartCalls, CreateMultipartCall{
+		Bucket: aws.StringValue(input.Bucket),
+		Key:    aws.StringValue(input.Key),
+	})
+
+	if m.CreateMultipartError != nil {
+		return nil, m.CreateMultipartError
+	}
+
+	uploadID := m.UploadID
+	if uploadID == "" {
+		uploadID = "mock-upload-" + uuid.New().String()
+	}
+
+	return &s3.CreateMultipartUploadOutput{
+		UploadId: aws.String(uploadID),
+	}, nil
+}
+
+// CompleteMultipartUploadWithContext implements S3Client
+func (m *MockS3Client) CompleteMultipartUploadWithContext(ctx aws.Context, input *s3.CompleteMultipartUploadInput, opts ...request.Option) (*s3.CompleteMultipartUploadOutput, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	partsCount := 0
+	if input.MultipartUpload != nil {
+		partsCount = len(input.MultipartUpload.Parts)
+	}
+
+	m.CompleteCalls = append(m.CompleteCalls, CompleteCall{
+		Bucket:   aws.StringValue(input.Bucket),
+		Key:      aws.StringValue(input.Key),
+		UploadID: aws.StringValue(input.UploadId),
+		Parts:    partsCount,
+	})
+
+	if m.CompleteError != nil {
+		return nil, m.CompleteError
+	}
+
+	// Return a mock ETag
+	etag := "\"mock-etag-" + uuid.New().String() + "\""
+	return &s3.CompleteMultipartUploadOutput{
+		ETag: aws.String(etag),
+	}, nil
+}
+
+// AbortMultipartUploadWithContext implements S3Client
+func (m *MockS3Client) AbortMultipartUploadWithContext(ctx aws.Context, input *s3.AbortMultipartUploadInput, opts ...request.Option) (*s3.AbortMultipartUploadOutput, error) {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	m.AbortCalls = append(m.AbortCalls, AbortCall{
+		Bucket:   aws.StringValue(input.Bucket),
+		Key:      aws.StringValue(input.Key),
+		UploadID: aws.StringValue(input.UploadId),
+	})
+
+	if m.AbortError != nil {
+		return nil, m.AbortError
+	}
+
+	return &s3.AbortMultipartUploadOutput{}, nil
+}
+
+// UploadPartPresignable implements S3Client
+// Returns a mock Presignable that generates test server URLs
+func (m *MockS3Client) UploadPartPresignable(input *s3.UploadPartInput) Presignable {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	m.UploadPartCalls = append(m.UploadPartCalls, UploadPartCall{
+		Bucket:     aws.StringValue(input.Bucket),
+		Key:        aws.StringValue(input.Key),
+		UploadID:   aws.StringValue(input.UploadId),
+		PartNumber: aws.Int64Value(input.PartNumber),
+	})
+
+	// Create a mock presignable request
+	url := fmt.Sprintf("%s/upload/%s?partNumber=%d&uploadId=%s",
+		m.TestServerURL,
+		aws.StringValue(input.Key),
+		aws.Int64Value(input.PartNumber),
+		aws.StringValue(input.UploadId))
+
+	return &mockPresignable{url: url}
+}
+
+// GetObjectPresignable implements S3Client
+func (m *MockS3Client) GetObjectPresignable(input *s3.GetObjectInput) Presignable {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	m.GetObjectCalls = append(m.GetObjectCalls, GetObjectCall{
+		Bucket: aws.StringValue(input.Bucket),
+		Key:    aws.StringValue(input.Key),
+	})
+
+	url := fmt.Sprintf("%s/get/%s", m.TestServerURL, aws.StringValue(input.Key))
+	return &mockPresignable{url: url}
+}
+
+// HeadObjectPresignable implements S3Client
+func (m *MockS3Client) HeadObjectPresignable(input *s3.HeadObjectInput) Presignable {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	m.HeadObjectCalls = append(m.HeadObjectCalls, HeadObjectCall{
+		Bucket: aws.StringValue(input.Bucket),
+		Key:    aws.StringValue(input.Key),
+	})
+
+	url := fmt.Sprintf("%s/head/%s", m.TestServerURL, aws.StringValue(input.Key))
+	return &mockPresignable{url: url}
+}
+
+// PutObjectPresignable implements S3Client
+func (m *MockS3Client) PutObjectPresignable(input *s3.PutObjectInput) Presignable {
+	m.mu.Lock()
+	defer m.mu.Unlock()
+
+	m.PutObjectCalls = append(m.PutObjectCalls, PutObjectCall{
+		Bucket: aws.StringValue(input.Bucket),
+		Key:    aws.StringValue(input.Key),
+	})
+
+	url := fmt.Sprintf("%s/put/%s", m.TestServerURL, aws.StringValue(input.Key))
+	return &mockPresignable{url: url}
+}

pkg/s3/types.go

···
 // Package s3 provides S3 client initialization and presigned URL generation
-// for hold services. It supports S3, Storj, and Minio storage backends,
-// with fallback to buffered proxy mode when presigned URLs are unavailable.
+// for hold services. It supports S3, Storj, and Minio storage backends.
 package s3
 
 import (
 	"fmt"
 	"log/slog"
 	"strings"
+	"time"
 
 	"github.com/aws/aws-sdk-go/aws"
 	"github.com/aws/aws-sdk-go/aws/credentials"
+	"github.com/aws/aws-sdk-go/aws/request"
 	"github.com/aws/aws-sdk-go/aws/session"
 	"github.com/aws/aws-sdk-go/service/s3"
 )
 
-type S3Service struct {
-	Client     *s3.S3 // S3 client for presigned URLs (nil if not S3 storage)
-	Bucket     string // S3 bucket name
-	PathPrefix string // S3 path prefix (if any)
+// Presignable represents a request that can be presigned for direct client access.
+// This interface allows mocking the Presign() method in tests.
+type Presignable interface {
+	Presign(expire time.Duration) (string, error)
 }
 
-// NewS3Service initializes the S3 client for presigned URL generation
-// Returns nil error if S3 client is successfully initialized
-// Returns error if storage is not S3 or if initialization fails (service will fall back to proxy mode)
-func NewS3Service(params map[string]any, disablePresigned bool, storageType string) (*S3Service, error) {
-	// Check if presigned URLs are explicitly disabled
-	if disablePresigned {
-		slog.Warn("S3 presigned URLs DISABLED by config",
-			"reason", "DISABLE_PRESIGNED_URLS=true",
-			"uploadMode", "buffered")
-		return &S3Service{}, nil
-	}
+// S3Client defines the S3 operations used by the hold service.
+// This interface allows mocking S3 for tests without real credentials.
+// Use RealS3Client to wrap *s3.S3, or MockS3Client for testing.
+type S3Client interface {
+	// Multipart upload operations
+	CreateMultipartUploadWithContext(ctx aws.Context, input *s3.CreateMultipartUploadInput, opts ...request.Option) (*s3.CreateMultipartUploadOutput, error)
+	CompleteMultipartUploadWithContext(ctx aws.Context, input *s3.CompleteMultipartUploadInput, opts ...request.Option) (*s3.CompleteMultipartUploadOutput, error)
+	AbortMultipartUploadWithContext(ctx aws.Context, input *s3.AbortMultipartUploadInput, opts ...request.Option) (*s3.AbortMultipartUploadOutput, error)
 
-	// Check if storage driver is S3
-	if storageType != "s3" {
-		slog.Info("Presigned URLs disabled for non-S3 storage",
-			"storageDriver", storageType)
-		return &S3Service{}, nil
-	}
+	// Presigned URL operations - return Presignable interface for testability
+	// The second return value (_) is ignored by callers in practice
+	UploadPartPresignable(input *s3.UploadPartInput) Presignable
+	GetObjectPresignable(input *s3.GetObjectInput) Presignable
+	HeadObjectPresignable(input *s3.HeadObjectInput) Presignable
+	PutObjectPresignable(input *s3.PutObjectInput) Presignable
+}
+
+// RealS3Client wraps *s3.S3 to implement S3Client interface
+type RealS3Client struct {
+	client *s3.S3
+}
 
+// NewRealS3Client creates a new RealS3Client wrapper
+func NewRealS3Client(client *s3.S3) *RealS3Client {
+	return &RealS3Client{client: client}
+}
+
+// CreateMultipartUploadWithContext implements S3Client
+func (r *RealS3Client) CreateMultipartUploadWithContext(ctx aws.Context, input *s3.CreateMultipartUploadInput, opts ...request.Option) (*s3.CreateMultipartUploadOutput, error) {
+	return r.client.CreateMultipartUploadWithContext(ctx, input, opts...)
+}
+
+// CompleteMultipartUploadWithContext implements S3Client
+func (r *RealS3Client) CompleteMultipartUploadWithContext(ctx aws.Context, input *s3.CompleteMultipartUploadInput, opts ...request.Option) (*s3.CompleteMultipartUploadOutput, error) {
+	return r.client.CompleteMultipartUploadWithContext(ctx, input, opts...)
+}
+
+// AbortMultipartUploadWithContext implements S3Client
+func (r *RealS3Client) AbortMultipartUploadWithContext(ctx aws.Context, input *s3.AbortMultipartUploadInput, opts ...request.Option) (*s3.AbortMultipartUploadOutput, error) {
+	return r.client.AbortMultipartUploadWithContext(ctx, input, opts...)
+}
+
+// UploadPartPresignable implements S3Client
+func (r *RealS3Client) UploadPartPresignable(input *s3.UploadPartInput) Presignable {
+	req, _ := r.client.UploadPartRequest(input)
+	return req
+}
+
+// GetObjectPresignable implements S3Client
+func (r *RealS3Client) GetObjectPresignable(input *s3.GetObjectInput) Presignable {
+	req, _ := r.client.GetObjectRequest(input)
+	return req
+}
+
+// HeadObjectPresignable implements S3Client
+func (r *RealS3Client) HeadObjectPresignable(input *s3.HeadObjectInput) Presignable {
+	req, _ := r.client.HeadObjectRequest(input)
+	return req
+}
+
+// PutObjectPresignable implements S3Client
+func (r *RealS3Client) PutObjectPresignable(input *s3.PutObjectInput) Presignable {
+	req, _ := r.client.PutObjectRequest(input)
+	return req
+}
+
+// S3Service wraps an S3 client for presigned URL generation
+type S3Service struct {
+	Client     S3Client // S3 client for presigned URLs (interface for testability)
+	Bucket     string   // S3 bucket name
+	PathPrefix string   // S3 path prefix (if any)
+}
+
+// NewS3Service initializes the S3 client for presigned URL generation
+// S3 is required - this will return an error if not properly configured
+func NewS3Service(params map[string]any) (*S3Service, error) {
 	// Extract required S3 configuration
 	region, _ := params["region"].(string)
 	if region == "" {
···
 		"region", region,
 		"pathPrefix", s3PathPrefix)
 
-	// Create S3 client
+	// Create S3 client wrapped in RealS3Client for interface compatibility
 	return &S3Service{
-		Client:     s3.New(sess),
+		Client:     NewRealS3Client(s3.New(sess)),
 		Bucket:     bucket,
 		PathPrefix: s3PathPrefix,
 	}, nil

pkg/s3/types_test.go

···
 	"atcr.io/pkg/logging"
 )
 
-func TestNewS3Service_PresignedDisabled(t *testing.T) {
-	t.Cleanup(logging.SetupTestLogger())
-
-	params := map[string]any{
-		"bucket": "test-bucket",
-		"region": "us-west-2",
-	}
-
-	service, err := NewS3Service(params, true, "s3")
-	if err != nil {
-		t.Fatalf("Expected success when presigned disabled, got error: %v", err)
-	}
-
-	if service.Client != nil {
-		t.Error("Expected Client to be nil when presigned disabled")
-	}
-	if service.Bucket != "" {
-		t.Error("Expected empty Bucket when presigned disabled")
-	}
-}
-
-func TestNewS3Service_NonS3Storage(t *testing.T) {
-	t.Cleanup(logging.SetupTestLogger())
-
-	params := map[string]any{
-		"rootdirectory": "/tmp/test",
-	}
-
-	service, err := NewS3Service(params, false, "filesystem")
-	if err != nil {
-		t.Fatalf("Expected success for non-S3 storage, got error: %v", err)
-	}
-
-	if service.Client != nil {
-		t.Error("Expected Client to be nil for non-S3 storage")
-	}
-	if service.Bucket != "" {
-		t.Error("Expected empty Bucket for non-S3 storage")
-	}
-}
-
 func TestNewS3Service_MissingBucket(t *testing.T) {
 	t.Cleanup(logging.SetupTestLogger())
 
···
 		// Missing bucket
 	}
 
-	_, err := NewS3Service(params, false, "s3")
+	_, err := NewS3Service(params)
 	if err == nil {
 		t.Error("Expected error when bucket is missing")
 	}
···
 		"secretkey": "test-secret-key",
 	}
 
-	service, err := NewS3Service(params, false, "s3")
+	service, err := NewS3Service(params)
 	if err != nil {
 		t.Fatalf("Expected success, got error: %v", err)
 	}
···
 		"regionendpoint": "https://s3.storj.io",
 	}
 
-	service, err := NewS3Service(params, false, "s3")
+	service, err := NewS3Service(params)
 	if err != nil {
 		t.Fatalf("Expected success with custom endpoint, got error: %v", err)
 	}
···
 		// No region specified - should use default
 	}
 
-	service, err := NewS3Service(params, false, "s3")
+	service, err := NewS3Service(params)
 	if err != nil {
 		t.Fatalf("Expected success with default region, got error: %v", err)
 	}
···
 		"rootdirectory": "/my/prefix/path",
 	}
 
-	service, err := NewS3Service(params, false, "s3")
+	service, err := NewS3Service(params)
 	if err != nil {
 		t.Fatalf("Expected success, got error: %v", err)
 	}
···
 		// No credentials - should allow IAM role auth
 	}
 
-	service, err := NewS3Service(params, false, "s3")
+	service, err := NewS3Service(params)
 	if err != nil {
 		t.Fatalf("Expected success without credentials (IAM role), got error: %v", err)
 	}