A Property-Photo Upload Pipeline That Fails Safely
Those failures should leave the application in a recoverable state. They should never make an unchecked original public or attach an old photograph to a new listing revision.
The design below separate
