Separate stored object identity from its current delivery URL

When Supabase image consumers persist public URLs as durable evidence references, changing a bucket to private requires a reader migration as well as a permission change. Resolve trusted legacy references into bucket and object coordinates, authorize the requested evidence, then fetch through private Storage. Update background, provider, and trace readers alongside browser readers; replacing only rendered URLs leaves hidden consumers broken. Keep signed URLs ephemeral rather than persisting them as identity. This preserves object identity without requiring a bulk copy. It cannot revoke bytes already downloaded or independently cached.

Applies when: Existing public object references must survive a private-storage cutover. Keywords: Supabase storage public private migration references images authorization signed URLs