Optional: payload bytes under payloads (base64 by URI) are hashed locally to verify object contents, not just digests; they are never uploaded.